Basic Auth

[obfuscurity]

Basic Auth

[antonlindstrom]

It would be really nice, in addition to Basic Auth and Google OpenID, add several providers such as twitter and github for authentication.

Thanks for the awesome project!

[obfuscurity]

@antonlindstrom Descartes is a multi-user service, but not multi-tenant. It assumes that the user is part of some trust domain (e.g. Google Apps domain, htpasswd file, etc). Without that anyone with a valid twitter account could theoretically login (without some sort of pseudo-domain support on the backend, which would effectively nullify the point of using a 3rd-party federated login).

[antonlindstrom]

@obfuscurity I agree that that would be a problem. My thought was to use some sort of access list to grant access to specific accounts while still supporting several providers.

[brntbeer]

giving this issue a bump 👊 for htpasswd. is that still a request? i agree with @obfuscurity that twitter may not make much sense since it's about organizational groupings.

edit: how would we save graphs or set any kind of session with an htpasswd file?

[obfuscurity]

Twitter, no. GitHub, yes. htpasswd, yes. We should be able to use HTTP_USER for the session user in Rack, no?

TBH I haven't given too much thought to it yet, and I haven't had my coffee this morning.

[antonlindstrom]

That sounds great, Github is what we all want to use! ☕

[brntbeer]

doubling down on ☕ for you. @antonlindstrom: i have github auth in #62 right now.

No idea about HTTP_USER. maybe?

[obfuscurity]

@brntbeer Are you trolling me, maybe? :wink2:

I'm starting to lean towards closing this issue altogether and just going with Google/GitHub. I only wanted to offer Basic Auth as an alternative for those people not using Google Apps. But it seems like these two answer 99.99% of the user base, with other omniauth strategies potentially filling in gaps later on.

[brntbeer]

haha no. I was just chiming in (read: adding noise) that i had no idea about HTTP_USER off the top of my head.

👍 for closing this...and accepting my pull request.

[obfuscurity]

@brntbeer which pull request?