On Wed, Aug 15, 2012 at 3:16 PM, Thomas Gries <mail(a)tgries.de> wrote: What is not possible exactly? -Jeremy

On Wed, Aug 15, 2012 at 12:16 PM, Thomas Gries <mail(a)tgries.de> wrote: I think it would be a huge help to have openid installed and available on labs mw instances by default. There is no problem with having the provider and consumer on the same server (I run it like that in my local dev environment). You may hit a problem if you're using one dns name / ip, and subfolders for each wiki instance.

I didn't say anything about the provider and consumer being on the same server. The wmflabs prototypes would be consumers that would be forced to use production Wikimedia as providers. - Ryan

I *didn't* say we should use the openid extension to make the provider. In fact, I don't think we should. Also, it's not like it's a simple change. We need to consider how we'll deal with identity. Some people don't have global accounts. Do we do identity on a per-wiki basis, or a global basis? If we do it on a global basis, where does the identity url live? - Ryan

On Wed, Aug 15, 2012 at 12:39 PM, Thomas Gries <mail(a)tgries.de> wrote: I'd love Wikimedia to be a provider, but I'd prefer we don't use the OpenID extension for this. We have other authn/authz needs. We can't do authentication and authorization piecemeal without going insane. OpenID as a consumer on the sites is a really difficult problem. I'm not even going to go into it in this thread. - Ryan

It's not a technical problem, per se. It's mainly a usability issue. When you allow login as a consumer, you now have two login links. One link is for logging in with your password credentials and another is with OpenID. This is confusing for people who don't know what OpenID is. Assuming everyone has some knowledge of OpenID (which is a stupid assumption, but let's play along), what do you display on the OpenID login page? Do we have logos that people can click to login to a provider? If so, which logos do we show? Why are we showing *those* providers and not others? How do you login with OpenID for providers not shown? A text box where they can enter the URL? Many OpenID URLs are long, ugly, and totally un-memberable, which means people will need to search for their provider URL when they want to login. Let's assume people are logging in with OpenID. Now there's a possibility of users getting locked out of their accounts because their provider went away. Yes, we can allow users to have passwords on the site too, but then we have two methods of authentication, which increases the risk of accounts getting owned. Additionally, now we have to worry about a provider getting owned and all accounts associated with that provider being owned as a result. OpenID as a consumer on the sites without fixing the usability issues is simply not going to happen. The security issues are a worry too, but less so than the usability issues. - Ryan

This thread is starting to sound a bit hostile. Can we back up and assume good faith? On Aug 15, 2012, at 2:56 PM, Thomas Gries <mail(a)tgries.de> wrote: --- Brandon Harris, Senior Designer, Wikimedia Foundation Support Free Knowledge: http://wikimediafoundation.org/wiki/Donate

I'm working on migrating OpenStack's MoinMoin wiki to MediaWiki. They use OpenID locked to launchpad's provider. I did the same with the OpenID MediaWiki extension there. I've also installed the extension in a number of other places. I'm quite familiar with it. There's a pretty major difference between installing the extension on simple sites and Wikimedia. I explained all the usability issues that would stop us from using it. Basically no one has solutions to some of the usability issues I've mentioned, which is why you'll notice very few large site have OpenID enabled as a consumer, and the ones that do don't prominently expose it. - Ryan

I was wrong, sorry: delete this, as it is not correct: These are totally *different* things. The Extension can offer both (!) https://bugzilla.wikimedia.org/show_bug.cgi?id=13631 Wikimedia should become an OpenID provider https://bugzilla.wikimedia.org/show_bug.cgi?id=9604 Support OpenID extension on all wikimedia projects