doc: Document security issues involving LWP::UserAgent

[git.ikiwiki.info.git] / doc / plugins / openid.mdwn

diff --git a/doc/plugins/openid.mdwn b/doc/plugins/openid.mdwn
index f3b3abfbb6cd8af0203d522ca13d07201a3d540b..a061cb43ffd51450a3216b4e57bd40b1f5e4be82 100644 (file)
--- a/doc/plugins/openid.mdwn
+++ b/doc/plugins/openid.mdwn
@@ -7,8 +7,11 @@ into the wiki.
 The plugin needs the [[!cpan Net::OpenID::Consumer]] perl module.
 Version 1.x is needed in order for OpenID v2 to work.
 
 The plugin needs the [[!cpan Net::OpenID::Consumer]] perl module.
 Version 1.x is needed in order for OpenID v2 to work.
 

-The [[!cpan LWPx::ParanoidAgent]] perl module is used if available, for
-added security. Finally, the [[!cpan Crypt::SSLeay]] perl module is needed
+The [[!cpan LWPx::ParanoidAgent]] Perl module is strongly recommended.
+The [[!cpan LWP]] module can also be used, but is susceptible to
+server-side request forgery.
+
+The [[!cpan Crypt::SSLeay]] Perl module is needed

 to support users entering "https" OpenID urls.
 
 This plugin is enabled by default, but can be turned off if you want to
 to support users entering "https" OpenID urls.
 
 This plugin is enabled by default, but can be turned off if you want to


@@ -17,7 +20,7 @@ only use some other form of authentication, such as [[passwordauth]].
 ## options
 
 These options do not normally need to be set, but can be useful in
 ## options
 
 These options do not normally need to be set, but can be useful in

-certian setups.
+certain setups.

 
 * `openid_realm` can be used to control the scope of the openid request.
   It defaults to the `cgiurl` (or `openid_cgiurl` if set); only allowing
 
 * `openid_realm` can be used to control the scope of the openid request.
   It defaults to the `cgiurl` (or `openid_cgiurl` if set); only allowing


@@ -30,3 +33,19 @@ certian setups.
   to be used when doing openid authentication. The `openid_cgiurl` must
   point to an ikiwiki [[CGI]], and it will need to match the `openid_realm`
   to work.
   to be used when doing openid authentication. The `openid_cgiurl` must
   point to an ikiwiki [[CGI]], and it will need to match the `openid_realm`
   to work.

+
+## troubleshooting
+
+See [[plugins/openid/troubleshooting]] for a number of issues that may
+need to be addressed when setting up ikiwiki to accept OpenID logins reliably.
+
+## delegation
+
+This plugin does not take care of doing the "server" part of the
+OpenID protocol, only the "client" part. In other words, it allows
+users to login to your site through OpenID, but is not in itself an
+OpenID provider.
+
+It is possible, however, to use your Ikiwiki site as a delegation
+point to another OpenID provider. For this, use the
+[[ikiwiki/directive/meta/]] directive with the `openid` parameter.