[ 
https://issues.apache.org/jira/browse/JSPWIKI-94?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134346#comment-18134346
 ] 

Arturo Bernal commented on JSPWIKI-94:
--------------------------------------

Checked in the current code (upstream master). There is no OpenID, OAuth, 
OpenID Connect or SAML code in the main module, the api module or the 
templates, and no property for them. What exists is container authentication: 
AuthenticationManager.isContainerAuthenticated and the security constraints of 
web.xml, so a wiki can already take its users from an identity provider that 
the servlet container handles. The comment on the password rules in 
jspwiki.properties mentions external setups such as Keycloak as a case that 
those rules do not cover. The ticket JSPWIKI-604 (CAS support), which a comment 
of 2009 pointed to as the way to support other systems, is closed as Won't Fix.

So the request, a login flow inside JSPWiki, is not implemented. The title and 
the description speak of OpenID 2.0 as it was in 2007, so a current proposal 
would probably have to say which protocol is meant.

Limits: I did not try to log in through a container with an external identity 
provider, so I cannot say how well that works with the user profiles of 
JSPWiki. Leaving the issue open for a decision on its scope.

> OpenID support
> --------------
>
>                 Key: JSPWIKI-94
>                 URL: https://issues.apache.org/jira/browse/JSPWIKI-94
>             Project: JSPWiki
>          Issue Type: New Feature
>          Components: Authentication & Authorization
>            Reporter: Janne Jalkanen
>            Priority: Minor
>             Fix For: STRIPES/JCR-3.1
>
>
> Now that OpenID2.0 is launched, we should look seriously into enabling that 
> as a way to manage your JSPWiki identity.
> http://openid.net/2007/12/05/openid-2_0-final-ly/
> I don't want to put any specific version on this item - it'll come when 
> someone is motivated enough to make it work ;-).  But it's a good idea to 
> keep here so that we don't forget about it.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)

Reply via email to