{"action":"created","issue":{"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/issues/46","repository_url":"https://api.github.com/repos/geosolutions-it/unesco-ihp","labels_url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/issues/46/comments","events_url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/issues/46/events","html_url":"https://github.com/geosolutions-it/unesco-ihp/issues/46","id":256965229,"number":46,"title":"WP7 [B22] - Users - Login with Linkedin or facebook account","user":{"login":"afabiani","id":1278021,"avatar_url":"https://avatars1.githubusercontent.com/u/1278021?v=4","gravatar_id":"","url":"https://api.github.com/users/afabiani","html_url":"https://github.com/afabiani","followers_url":"https://api.github.com/users/afabiani/followers","following_url":"https://api.github.com/users/afabiani/following{/other_user}","gists_url":"https://api.github.com/users/afabiani/gists{/gist_id}","starred_url":"https://api.github.com/users/afabiani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afabiani/subscriptions","organizations_url":"https://api.github.com/users/afabiani/orgs","repos_url":"https://api.github.com/users/afabiani/repos","events_url":"https://api.github.com/users/afabiani/events{/privacy}","received_events_url":"https://api.github.com/users/afabiani/received_events","type":"User","site_admin":false},"labels":[{"id":685857084,"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/labels/in%20progress","name":"in progress","color":"ededed","default":false},{"id":683147102,"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/labels/Priority:%20Medium","name":"Priority: Medium","color":"fbca04","default":false},{"id":683101119,"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/labels/task","name":"task","color":"000000","default":false},{"id":683159692,"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/labels/unesco-ihp","name":"unesco-ihp","color":"1d76db","default":false}],"state":"open","locked":false,"assignee":{"login":"ricardogsilva","id":732010,"avatar_url":"https://avatars3.githubusercontent.com/u/732010?v=4","gravatar_id":"","url":"https://api.github.com/users/ricardogsilva","html_url":"https://github.com/ricardogsilva","followers_url":"https://api.github.com/users/ricardogsilva/followers","following_url":"https://api.github.com/users/ricardogsilva/following{/other_user}","gists_url":"https://api.github.com/users/ricardogsilva/gists{/gist_id}","starred_url":"https://api.github.com/users/ricardogsilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricardogsilva/subscriptions","organizations_url":"https://api.github.com/users/ricardogsilva/orgs","repos_url":"https://api.github.com/users/ricardogsilva/repos","events_url":"https://api.github.com/users/ricardogsilva/events{/privacy}","received_events_url":"https://api.github.com/users/ricardogsilva/received_events","type":"User","site_admin":false},"assignees":[{"login":"ricardogsilva","id":732010,"avatar_url":"https://avatars3.githubusercontent.com/u/732010?v=4","gravatar_id":"","url":"https://api.github.com/users/ricardogsilva","html_url":"https://github.com/ricardogsilva","followers_url":"https://api.github.com/users/ricardogsilva/followers","following_url":"https://api.github.com/users/ricardogsilva/following{/other_user}","gists_url":"https://api.github.com/users/ricardogsilva/gists{/gist_id}","starred_url":"https://api.github.com/users/ricardogsilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricardogsilva/subscriptions","organizations_url":"https://api.github.com/users/ricardogsilva/orgs","repos_url":"https://api.github.com/users/ricardogsilva/repos","events_url":"https://api.github.com/users/ricardogsilva/events{/privacy}","received_events_url":"https://api.github.com/users/ricardogsilva/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/milestones/2","html_url":"https://github.com/geosolutions-it/unesco-ihp/milestone/2","labels_url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/milestones/2/labels","id":2742996,"number":2,"title":"Phase-2","description":"","creator":{"login":"afabiani","id":1278021,"avatar_url":"https://avatars1.githubusercontent.com/u/1278021?v=4","gravatar_id":"","url":"https://api.github.com/users/afabiani","html_url":"https://github.com/afabiani","followers_url":"https://api.github.com/users/afabiani/followers","following_url":"https://api.github.com/users/afabiani/following{/other_user}","gists_url":"https://api.github.com/users/afabiani/gists{/gist_id}","starred_url":"https://api.github.com/users/afabiani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afabiani/subscriptions","organizations_url":"https://api.github.com/users/afabiani/orgs","repos_url":"https://api.github.com/users/afabiani/repos","events_url":"https://api.github.com/users/afabiani/events{/privacy}","received_events_url":"https://api.github.com/users/afabiani/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":18,"state":"open","created_at":"2017-09-04T12:27:31Z","updated_at":"2017-11-06T10:07:19Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2017-09-12T08:48:21Z","updated_at":"2017-11-17T11:40:50Z","closed_at":null,"author_association":"OWNER","body":"Ref: https://docs.google.com/spreadsheets/d/13ICjs8oJ0Vkw-Y1cSpZxJ93MQJCtASuBCsI20ECvCOM/edit#gid=623020856\n \nLink WINS to LinkedIn and Facebook so that users can directly upload their profile on WINS from LinkedIn and Facebook."},"comment":{"url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/issues/comments/345221874","html_url":"https://github.com/geosolutions-it/unesco-ihp/issues/46#issuecomment-345221874","issue_url":"https://api.github.com/repos/geosolutions-it/unesco-ihp/issues/46","id":345221874,"user":{"login":"ricardogsilva","id":732010,"avatar_url":"https://avatars3.githubusercontent.com/u/732010?v=4","gravatar_id":"","url":"https://api.github.com/users/ricardogsilva","html_url":"https://github.com/ricardogsilva","followers_url":"https://api.github.com/users/ricardogsilva/followers","following_url":"https://api.github.com/users/ricardogsilva/following{/other_user}","gists_url":"https://api.github.com/users/ricardogsilva/gists{/gist_id}","starred_url":"https://api.github.com/users/ricardogsilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricardogsilva/subscriptions","organizations_url":"https://api.github.com/users/ricardogsilva/orgs","repos_url":"https://api.github.com/users/ricardogsilva/repos","events_url":"https://api.github.com/users/ricardogsilva/events{/privacy}","received_events_url":"https://api.github.com/users/ricardogsilva/received_events","type":"User","site_admin":false},"created_at":"2017-11-17T11:40:50Z","updated_at":"2017-11-17T11:40:50Z","author_association":"NONE","body":"Thinking about different approaches to the current task, I see the following:\r\n\r\n#### 1) Move on with django-allauth, retire geonode-user-accounts and reimplement  missing functionality\r\n\r\nThis is the original proposal, as described in my previous comment above. As I had been already working on this, current state of implementation on my local branch is:\r\n\r\n- django-allauth is mostly integrated with geonode (still need to add some templates);\r\n- geonode-user-accounts is not being used anymore (still need to clean up geonode's settings file and remove unused templates);\r\n- can register new users with a local account;\r\n- can register new users with a linkedin account (using another provider, like facebook or google is likely just a few config steps away, as this is provided by django-allauth. linkedin is being used as a test);\r\n- can change the password of a local user;\r\n- can set/change a password for a user who originally registered by connecting with linkedin;\r\n- can manage (add/remove) social accounts of a user - this means a user can choose to connect with its linkedin account even if already registered on geonode. It means also that a user can connect more than one social account to its geonode user (currently only testing with linkedin). User can also disconnect a previously connected social account;\r\n- can manage (add/remove/verify) multiple e-mail addresses for a user - there is a primary e-mail address and there may be secondary addresses too;\r\n\r\nStill todo:\r\n\r\n- [easy] Deal with 'forgotten password' auth flow - this is supported by django-allauth so it should be a matter of adding the correct templates;\r\n- [easy] Make the social accounts integration optional by tweaking the login template and adding a geonode setting to control this;\r\n- [easy] Add back geonode-user-accounts functionality of inviting users to join geonode - this means installing and wiring up the [django-invitations](https://github.com/bee-keeper/django-invitations) app\r\n- [easy] Write some documentation on how to configure social accounts (mostly add geonode specific docs and redirect to django-allauth's docs for provider related stuff)\r\n- [medium] Retrieve linkedin information upon user registration and use it for filling up user's geonode profile. django-allauth seems to provide useful signals for this. Alternatively the socialaccount adapter can be extended;\r\n- [medium] Add back geonode-user-accounts functionality of moderating (approve/deny) a new user's registration - this will involve extending django-allauth\r\n\r\nPending work seems to be easy/medium to do, without any blockers foreseen. **It seems to me that with three days more of work this could be finished**. \r\n\r\n#### 2) Use a different package to provide Oauth integration\r\n\r\nThere are some additional packages for handling Oauth and social authentication with django (analysis presented down below). However, none of them seems better than django-allauth for the current task. None of them supports the features that geonode-user-account has either. So this proposal would quickly transform back into the first one once with the additional drawbacks:\r\n\r\n- Would need to restart work of integrating new Oauth package with geonode;\r\n- IMHO there is no better package for the task at hand currently available, so the new package would be less suitable\r\n\r\n\r\n#### 3) Temporarily remove features that were being supplied by geonode-user-accounts\r\n\r\nAs stated previously, django-allauth does not currently have a ready-made solution for:\r\n\r\n- inviting users to register with geonode;\r\n- moderating a new user's registration.\r\n\r\nA possible time-saver would be to drop these features for the time being, if they are not critical to the current project.\r\n\r\nIn terms of implementation effort, according to the description in 1) I'd only need to wrap up the remaining integration of dajngo-allauth and cleaning up after retiring geonode-user-accounts. This means **I'd probably be able to finish things up with one more day (maybe a day and a half) of work**.\r\n\r\nThis approach will make it difficult to contribute back the changes to main geonode, since there is on one hand a gain in functionality (unification of local and social auth) but on the other there are some features that cease to exist.\r\n\r\nWe might perhaps then split up another task for re-adding this functionality back to geonode?\r\n\r\n#### 4) Have different feature sets for local and remote auth\r\n\r\nThis would mean that a user who would register for a local account would have different restrictions in its registration process than one who would register with a social account. This seems to be worse for the geonode project, as it will lead to fragmentation of the codebase by splitting similar responsabilities among different parts of the application. \r\n\r\nIn addition to that, it will likely require some patching of geonode-user-accounts in order to work, as different auth packages might be incompatible with each other (that is the case with geonode-user-accounts and django-allauth, it might be similar with others). This is also kind of risky, as it may open up the door for undefined behaviour (and bugs) by having differently managed auth mechanisms.\r\n\r\n## Conclusion\r\n\r\nAll in all, it seems like proposals 1) and 3) are feasible, while the others are not. Personally I'd go with 1), as it seems like there are no blockers and the estimate points to a not too long implementation cycle.\r\n\r\nWhat do you think?\r\n\r\n\r\n---\r\n\r\n##### packages that provide Oauth2 client functionality:\r\nThis research refers to the packages present on the [django packages](https://djangopackages.org/grids/g/oauth/) website, which is usually accepted as the reference place to publish and look for django packages:\r\n\r\n- django-allauth (the one currently being proposed)\r\n  - active project with commercial support backing it\r\n  - largest number of upvotes on djangopackages\r\n  - support for large number of providers baked in\r\n  - aims to provide complete auth solution (local auth + social auth)\r\n  - provides default templates that are good guidance\r\n  - has extensibility hooks for implementing missing functionality, which\r\n    in geonode's case seems to be user invitations and staff approval of new\r\n    accounts\r\n\r\n- python social auth\r\n  - active project supporting different web frameworks, in addition to django\r\n  - similar scope as django-allauth, being a complete auth solution (local \r\n    auth + social auth)\r\n  - the docs seem to indicate that it is more complex and requires a bigger \r\n    effort to setup\r\n  - also does not handle user invites nor registration approval\r\n\r\n- django-all-access\r\n\r\n  - only provides remote auth, local auth still needs to be handled. This \r\n    means keeping geonode-user-accounts and also reimplementing user invites \r\n    and registration approval for socialauths anyway\r\n  - relies on customization of CBVs\r\n  - does not provide any default templates\r\n  - seems to require a bit more effort to set up\r\n\r\n- django-auth-adfs\r\n  - used for authenticating against Microsoft ADFS through Oauth2\r\n  - not useful for the task at hand\r\n\r\n- django-oneall\r\n  - works with the oneall platform, thus adding an extra middleman in the \r\n    process.\r\n  - seems like adding another platform to the mix is adding complexity and \r\n    not really necessary\r\n\r\n- django social auth\r\n  - deprecated in favor of python social auth\r\n\r\n- django-oauth-access \r\n  - seems deprecated (last commit to master in 2014, not on pypi, no test \r\n    coverage)\r\n\r\n- django oauth2 consumer\r\n  - not maintained, last commit in 2013\r\n\r\n"}}
{"actor":{"display_login":"ricardogsilva"}}