(no commit message)

[git.ikiwiki.info.git] / doc / todo / cas_authentication.mdwn

diff --git a/doc/todo/cas_authentication.mdwn b/doc/todo/cas_authentication.mdwn
index fbfb5f7b0355f2647adbef9070f1b0892d4296e2..ed8010518ba8d15e228d5f16b0310b72a2eb5cba 100644 (file)
--- a/doc/todo/cas_authentication.mdwn
+++ b/doc/todo/cas_authentication.mdwn
@@ -1,4 +1,4 @@
-[[!tag patch]]
+[[!tag patch wishlist]]

 
 ikiwiki should support [Central Authentication
 Service](http://www.ja-sig.org/products/cas/) authentication in order to use
 
 ikiwiki should support [Central Authentication
 Service](http://www.ja-sig.org/products/cas/) authentication in order to use


@@ -14,6 +14,26 @@ follows) ?
 
 --[[/users/bbb]]
 
 
 --[[/users/bbb]]
 

+> Inline here is ok; git-am by mail is ok; a git repo I can pull from also
+> ok.
+> 
+> This looks pretty acceptable as-is, but you need to put a copyright and
+> license statement at the top. I have a few questions that I'll insert
+> inline with the patch below. --[[Joey]]
+
+>> I have made some corrections to this patch (my cas plugin) in order to use
+>> IkiWiki 3.00 interface and take your comments into account. It should work
+>> fine now.
+>>
+>> You can pull it from my git repo at
+>> http://git.boulgour.com/bbb/ikiwiki.git/ and maybe add it to your main
+>> repo.
+>> 
+>> I will add GNU GPL copyright license statement as soon as I get some free
+>> time.
+>>
+>> --[[/users/bbb]]
+

 ------------------------------------------------------------------------------
     diff --git a/IkiWiki/Plugin/cas.pm b/IkiWiki/Plugin/cas.pm
     new file mode 100644
 ------------------------------------------------------------------------------
     diff --git a/IkiWiki/Plugin/cas.pm b/IkiWiki/Plugin/cas.pm
     new file mode 100644


@@ -29,26 +49,40 @@ follows) ?
     +use strict;
     +use IkiWiki 2.00;
     +use AuthCAS;                  # http://search.cpan.org/~osalaun/AuthCAS-1.3.1/
     +use strict;
     +use IkiWiki 2.00;
     +use AuthCAS;                  # http://search.cpan.org/~osalaun/AuthCAS-1.3.1/

+
+> In ikiwiki we generally deman-load perl modules only when they're used.
+> This avoids loading expensive modules when the CGI isn't doing
+> authentication. Can you do that with AuthCAS? Something like this before
+> the use of it: `eval q{use AuthCAS}; error $@ if $@`
+

     +
     +

-    +sub import { #{{{
+    +sub import {

     +    hook(type => "getopt", id => "cas", call => \&getopt);
     +    hook(type => "auth", id => "cas", call => \&auth);
     +    hook(type => "formbuilder_setup", id => "cas", call => \&formbuilder_setup);
     +    hook(type => "getopt", id => "cas", call => \&getopt);
     +    hook(type => "auth", id => "cas", call => \&auth);
     +    hook(type => "formbuilder_setup", id => "cas", call => \&formbuilder_setup);

-    +} # }}}
-    +
+    +}
+
+> Could you please use tabs for indentation of program flow?
+

     +# FIXME: We should check_config to ensure that :
     +# * cas_url and ca_file are present
     +# FIXME: We should check_config to ensure that :
     +# * cas_url and ca_file are present

+
+> Please fix that..
+

     +# * no other auth plugin are present (at least passwordauth and openid)
     +# * no other auth plugin are present (at least passwordauth and openid)

-    +
-    +sub getopt () { #{{{
+
+> Why would you want to make other auth plugins not work? Could a site not
+> legitimatly chose to use this and another auth method?
+
+    +sub getopt () {

     +    eval q{use Getopt::Long};
     +    error($@) if $@;
     +    Getopt::Long::Configure('pass_through');
     +    GetOptions("cas_url=s" => \$config{cas_url});
     +    GetOptions("ca_file=s" => \$config{ca_file});
     +    eval q{use Getopt::Long};
     +    error($@) if $@;
     +    Getopt::Long::Configure('pass_through');
     +    GetOptions("cas_url=s" => \$config{cas_url});
     +    GetOptions("ca_file=s" => \$config{ca_file});

-    +} #}}}
+    +}

     +
     +

-    +sub auth ($$) { #{{{
+    +sub auth ($$) {

     +    my $q=shift;
     +    my $session=shift;
     +
     +    my $q=shift;
     +    my $session=shift;
     +


@@ -77,11 +111,11 @@ follows) ?
     +            error("CAS failure: ".&AuthCAS::get_errors());
     +        }
     +    }
     +            error("CAS failure: ".&AuthCAS::get_errors());
     +        }
     +    }

-    +} #}}}
+    +}

     +
     +# I use formbuilder_setup and not formbuilder type in order to bypass the
     +# Logout processing done in IkiWiki::CGI::cgi_prefs()
     +
     +# I use formbuilder_setup and not formbuilder type in order to bypass the
     +# Logout processing done in IkiWiki::CGI::cgi_prefs()

-    +sub formbuilder_setup (@) { #{{{
+    +sub formbuilder_setup (@) {

     +    my %params=@_;
     +    
     +    my $form=$params{form};
     +    my %params=@_;
     +    
     +    my $form=$params{form};


@@ -130,13 +164,20 @@ follows) ?
     +into the wiki.
     +
     +The plugin needs the [[!cpan AuthCAS-1.3.1]] perl module.
     +into the wiki.
     +
     +The plugin needs the [[!cpan AuthCAS-1.3.1]] perl module.

+
+> Does it really need that specific version? I think you should lose the
+> version part.
+

     +
     +This plugin has two mandatory configuration option. You **must** set `--cas_url`
     +to the url of a server offering CAS 2.0 authentication. You must also set the
     +`--ca_file` to an absolute path to the file containing CA certificates used by
     +the server (generally, aka under Debian, fixing that value to
     +`/etc/ssl/certs/ca-certificates.crt` is sufficient).
     +
     +This plugin has two mandatory configuration option. You **must** set `--cas_url`
     +to the url of a server offering CAS 2.0 authentication. You must also set the
     +`--ca_file` to an absolute path to the file containing CA certificates used by
     +the server (generally, aka under Debian, fixing that value to
     +`/etc/ssl/certs/ca-certificates.crt` is sufficient).

-    +
+
+> It would be good to add commented-out examples of these to
+> ikiwiki.setup as well.
+

     +This plugin is not enabled by default. It can not be used with other
     +authentication plugin, such as [[passwordauth]] or [[openid]].
 
     +This plugin is not enabled by default. It can not be used with other
     +authentication plugin, such as [[passwordauth]] or [[openid]].