patka / cognitor Goto Github PK

1.0 0.0 0.0 660 KB

An OpenId based Single Sign On (SSO) service for web applications

License: Apache License 2.0

Java 99.62% CSS 0.38%

cognitor's Introduction

Cognitor

Cognitor is an OpenID based Single Sign On Service (SSO) for web applications. If you have multiple applications or one portal that consists of multiple decoupled web applications that share the same user base, Cognitor can manage those users and allows the user to login once for all applications.

Because Cognitor uses OpenID it is not limited to the domain boundaries like cookies would be.

The goal is to have a small, stateless, extensible and configurable application that can be integrated into an existing environment by customizing the persistence.

For more information go to the wiki: http://github.com/patka/cognitor/wiki

cognitor's People

Contributors

Stargazers

cognitor's Issues

Support german Umlauts in email addresses

As a user I want to be able to use email addresses at domain names that have german Umlauts since they are allowed in domain names.

The current implementation of the email validator does not work with this.

Remember Me

As a user I want to be able to configure that the system is recognizing me again when I return with the same browser, so I do not need to login again.

Attribute exchange

As a user I want to see in every application that is connected to Cognitor what my current account in use is. So, the applications should be able to exchange my email address, so that I can see the email address I used to login in all systems.

Anti phishing measurements

As a user I want my information to be secure. The application should not provide the of data phishing.
This should help with this: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html

2 stage authentication

As a user I want to be sure, that no one is misusing my account. Therefore I want to be asked for my credentials again, in case I was logged in with a remember me functionality before doing some serious actions.

This means, Cognitor needs to provide an extension, so a relying party can ask request the information how the user was authenticated and request a stronger authentication mechanism. This might also be useful if a third party login is ever considered.

Web tests

As a company I want the main features of the application to be checked by automated web tests (Selenium).

The main features so far are:

Registration
Login

Change Password

As a user I want to be able to change my password with a comfortable web gui.

Password Hashes

As a company I want to store all passwords only as hashes in the database to increase the security for my users in the application gets comprimised by evil forces.

The password hashing mechanism should be configurable to support different sorts of hashing to support existing data.

Update to Spring Framework 3.2.1-RELEASE

Some classes seem to have changed. At least the server is not starting out of the box with the new version.

Monitoring

As a company I want information about the health status of my application. The application should provide basic monitoring data.

To be decided, what exactly is needed.

Last Login Date

As a user I want to see when I did my last login, so I can see if my account was compromised.

Stateless Application

As an administrator and as a business I want the application to be stateless. This allows horizontal scaling and, if multiple instances are running behind a load balance, an easy and fast deployment of new versions while maintaining the service.

Email verification

As a company I want the data in my system to be valid and most accurate. The user should be able to verify its email address with an double opt in process. This means, that after the registration an email is sent to activate the account and verify the email address is working.

Maybe, this feature should be configurable, so that a double opt in is not a neccessarity in order to activate the account.

A successful forget password process should also count as an email verification.

Hooks for data change events

As I company I want to be able to be informed about updates the user makes to his data, in order to keep it in sync with other applications that rely e.g. on the email address of the user. There should be a possibility to implement some hooks to connect the application to an enterprise service bus for instance.