1. In the Fedora services
Patrick Uiterwijk
Presented by
Intern, Red Hat, Inc.
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
OpenID

2. Today's Topics
1. What isOpenID?
2. Howdoesitwork?
3. Extensionsweuse
4. Deploymentstatus

3. What is OpenID?

4. Federatedauthentication
URLisidentity
SayingWHOyouare,ratherthanWHATyouare
What is OpenID?

5. How does it work?

6. Provider
Theserverthatverifiedanidentity
RelyingParty(RP)
Thewebsitewheretheuseristryingtologin
Endpoint
TheURLoftheproviderwhichacceptsandhandlesOpenIDprotocolmessages
ClaimedIdentifier
TheidentityoftheuserverifiedbytheProvider
Some terminology

7. 1. TheuserbrowsestoanOpenIDRelyingParty website(e.g.ask.fedoraproject.org)
2. TheuserclicksontheLogInbutton
3. Theuserenterhis/heridentityURL(puiterwijk.id.fedoraproject.org)
4. Theconsumerredirectstheusertotheprovider(id.fedoraproject.org)
5. Theuserauthenticatestotheprovider
6. Theuserisredirectedbacktotheoriginalwebsite,beingauthenticated
Simple process

8. But.....
It's not that simple
(though this is all the user sees)

9. Howdoestheconsumerknowwheretoredirecttheuserforauthentication?
Howdoestheconsumerknowforsurethattheuserdidn'tjustbrowsetoitsreturnpage,sayingit's
authenticated?
Some issues

10. ConsumerdoesarequesttotheURLtheuserprovided
ReturnedHTMLcontainseitherofthefollowing:
HTMLtagsayingwheretheendpointis
HTMLtagsayingwheretofindthediscoveryinfo
HTTPheadersayingwheretofindthediscoveryinfo
Nowwearereadytoredirecttheuser,right?
Well,maybe..
Discovery

11. Stateful
Afterdiscovery,theRelyingPartyexchangesacryptographickeywiththeproviderwhichisusedforverifyingthe
claimatreturn.
Stateless
Thekeyisgeneratedbytheproviderandreturnedintheresponse.
Whateverhappens,theresponseisvalidatedbyrequestingacheckagainsttheprovider.
Two operational modes

12. Extensions we use

13. ProvidesomebasicinformationabouttheusertotheRelyingparty:
Nickname
Emailaddress
Timezone
Usedbylotsofrelyingpartiestopre-fillregistrationformsafterauthenticatingwithOpenID.
Simple Registration

14. Provideaccesstowhattypeofauthenticationwasusedtoverifytheuser:
Username/password
OTPtoken
Tamper-proofOTPtoken
Also,theRelyingPartycanrequireanyspecifictypetobeusedforauthenticationtobesuccessful,orhave
theauthenticationtimeout.
Provider Authentication

15. ProvidegroupmembershipinformationtotheRelyingParty
Relyingpartysendslistofgroupsitwouldliketoknowiftheuserisamemberof
Theserverreturnsalistofgroupstheuserisactuallyamemberof
NamedteamsbecausethespecwaswrittenbyLaunchpadteam
Teams

16. ProvideinformationtotheRelyingPartywhetherornottheuserhassignedaContributorLicenseAgreement
(oranyotherformoflicenseagreement)
DifferentURLbasesfordifferentOpenIDproviders
Extensionsdefinedbyus,Fedorateam
CLA

17. Deployment status

18. OpenID-providerwasrewrittenfromscratch
HadbeenpartoftheFedoraAccountSystemformanyyears,butwasnotfollowingthestandardscompletely,
sonotcompatiblewithsomeRelyingParties
Addedtheteams,CLAandPAPEextensions
Hasbeenliveforaboutayearnow,withoutmajorincidents
Current provider

19. FedoraHostedtraclogin
COPR
Tagger
Hyperkitty
Jenkins
Services migrated

20. Bodhi
Pkgdb
Elections
Wiki
Fedocal
Blockerbugs
.....
Services being migrated

21. OpenIDisbeingusedtocentralizeourauthentication
LesscustomcodebecauseFASbackendsarelesscommonthanOpenIDbackends
BusymovingallservicesovertousingOpenID
Lastbutnotleast:wesupportotherpeopleusinganyoftheextensions!
Summary

22. Questions?
ThisworkislicensedunderaCreativeCommonsAttribution-ShareAlike3.0UnportedLicense.
patrick@fedoraproject.org
Contact: