6

I'm looking for a solution for user provisioning, authentication and single sign-on which will make it easy for me to manage accounts for all the staff at my company across all of the sites we work on.

My main goal is to have a single point at which I can add/remove users to grant/revoke access to all the sites our staff will need to work on. This is obviously a pretty useful thing on it's own, but it'll also mean that I can ask staff to change passwords regularly without it taking a day to go through every site, etc. All this is in addition to "normal" users which vary from site to site.

The shared tables approach won't work (and wouldn't use anyway), I don't fancy setting up an LDAP server just for this, none of the sites share a domain so Bakery won't work, the OpenID module allows any provider so I can't trust the profile details to automatically set roles, etc.

Is there an existing (production ready) solution that uses, e.g., OpenID but lets me restrict the provider/s to those I can trust? Should I just bite the bullet and start trying to hack at the OpenID module? Am I barking up the wrong tree?

  • For anyone who finds this now, more than 4 years later, I'd highly recommend evaluating Shibboleth, in spite of the quite high organisational and infrastructure overhead (J2EE, LDAP, etc., etc.) Highly recommended! – thsutton Oct 19 '15 at 0:21
2

You would have to use a few modules working together to make this happen.

Development Seed had an interesting demo using OpenID, PubSubHub and Feeds. They detail it at http://developmentseed.org/blog/2010/mar/02/simple-sign-openid

lordg's comment re: hubs is exactly what they did.

| improve this answer | |
  • I've looked at this work before and, if nothing else turns up, I'll probably wind up using it. I'll leave if a few days and if there're no other ideas posted I'll accept this answer. – thsutton Mar 17 '11 at 0:58
0

Have a look at multisite_login, it should help you get to what you are looking for. I haven't used it myself yet, but the description appears to fit quite well. You could contact that maintainer to get some customizations or become a co-maintainer of it.

| improve this answer | |
  • Most of our sites are stand alone not multi-sites and multisite_login seems shared all users between sites whereas I need only some to be shared. Thanks for the suggestion thought! – thsutton Mar 16 '11 at 8:21
  • Ok. I see. I am not sure a module like that exists. You are probably going to have to write a module that does what you want. There is a users service extension where you could have one site for keeping the user information, and build your macro controls there. Then each sub site simple acts similar to the OpenID functionality, by either redirecting, or doing an API call to the central users site. The central users site could have permissions for access to each sub site, like "access sub.domain.com" or "access url.another.com" and the api service call checks that for general permissions. – lordg Mar 16 '11 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.