Re: Webapp OpenID Login Filter

Jack - thanks for the excellent initiative. As the resident security  
guy for JSPWiki and a part-time member of the Identity Gang, I have  
been looking at OpenID for a while. It has some issues (notably a  
susceptibility to man-in-the middle attacks) but overall the benefits  
strongly outweigh the risks.

OpenID us very interesting for us. I will take a careful look at what  
you've done (likely in the next month or so); perhaps we can include  
this in JSPWiki 3.

Nice work. What version of OpenID does your library support, by the way?

Andrew

Sent from my iPhone

On Aug 25, 2007, at 2:24 PM, Jack <[email protected]> wrote:

> Hi,
>
> I have written an OpenID consumer filter for Java webapps, and the
> template/demo integration is currently JSPWiki. It's called Webapp
> OpenID Login Filter (WOLF), and you can try it out or download it  
> here:
> http://www.jackpot.uk.net/
>
> It is licensed under the GPL.
>
> There is a link on that page to try out a JSPWiki that is secured  
> using
> OpenID. Don't rely on that wiki as storage space - it's just a demo,  
> and
> is liable to get burned without notice. But if you have constructive
> additions to make, I'll try to preserve them across updates to the  
> site.
>
> Integrating WOLF with JSPWiki was not particularly intrusive,
> requiring changes only to web.xml and Login.jsp. There are one or two
> additional files, including the jar containing the code, a trivial  
> realm
> implementation, and the login form itself. It took a couple of hours,
> which included figuring out how JSPWiki login works (I'm a newbie).
> There are some instructions in the wiki.
>
> On the whole it seems to me to be working well, although there are one
> or two quirks. But please judge for yourself.
>
> The software is very much beta - nobody has tried it except me, as far
> as I'm aware. If you're interested in this stuff, but it isn't working
> for you, please let me know. The site is also beta - it's very new,  
> and
> is subject to change at zero notice.
>
> I plan to bundle other integrations - if you have suggestions as to
> which apps I might want to target, I'd like to know about them. I'd
> particularly like to bundle an integration with a Java blogging  
> package,
> but I haven't had much success with Pebble so far (after spending  
> about
> a day on it).
>
> Thanks,
> -- 
> Jack
> http://www.jackpot.uk.net
> _______________________________________________
> This is the Jspwiki-users mailing list, in which we discuss the  
> stable release (even-numbered, 2.4.x, 2.6.x), and user-issues. For  
> development discussion, please join jspwiki-dev.
> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
> http://www.jspwiki.org/JSPWikiMailingList