OpenId Roadmap
Steps required to turn Launchpad into a normal OpenId Consumer.
As a user
I want to authenticate using my preferred OpenId provider
so that I have fewer credentials to manage
Rationale
A number of users would like to use their preferred OpenId provider rather than the Canonical OpenId provider (CanonicalSSO).
- It is more convenient.
It is often more secure - if the OpenId provider is also the email service provider, only one party needs to be trusted.
- It improves perception of Launchpad being a system for all Open Source developers, rather than for projects targetted at Ubuntu.
This work has not been scheduled. Launchpad is currently in a 'good enough' state, having offloaded authentication to the CanonicalSSO, and the authentication system contains a lot of tech debt that needs to be cleaned up.
Stakeholders
Our users.
ISD, maintainers of the CanonicalSSO and ShipIt.
Constraints and Requirements
Must
Keep ShipIt operational
- Keep Launchpad Account creation easy for users happy to use the CanonicalSSO.
Nice to have
Must not
What MUST it not do?
Subfeatures
Tear out OpenId Provider code. Implement simple Developer/Test OpenId
- Provider.
The OpenId Provider we currently use for development and testsuite environments is needlessly complex, from when Launchpad was itself an OpenId Provider. We should tear out all of this code, implementing a minimal OpenId Provider. The login screen can just be a single form containing:
a drop down list of the email addresses in the EmailAddress table.
a text box to use an email address not in the EmailAddress table.
a text box to override the OpenId Identity to use.
- a login button.
- a fail to login button.
AccountPassword and numerous legacy OpenId tables. It allows us to refactor the Account/EmailAddress/Person/OpenIdIdentifier parts of the data model.
- Provider.
- Sever ShipIt/Launchpad links.
- Simplify the Account table.
- Drop the displayname column on the Account table. Consider dropping the
Account table entirely, linking OpenIdIdentifier directly to Person.
- Drop the displayname column on the Account table. Consider dropping the
Drop EmailAddress.account
Remove all Account and EmailAddress records not linked to a Person, reducing the number of Account records on the system by 90%. Drop the redundant EmailAddress.account link.
Switch to using OpenId Identity URLs.
Currently, we are storing just the token used to generate the OpenId Identity URL. We should store the full URL.
Spec and implement workflow for signing up to Launchpad using a 3rd party OpenId Provider. Spec and implement workflow for attaching a 3rd party OpenId Identity to an existing Launchpad Account. Implement, rollout etc.
Workflows
What are the workflows for this feature? Even a short list can help you and others understand the scope of the change. Provide mockups for each workflow.
You do not have to get the mockups and workflows right at this point. In fact, it is better to have several alternatives, delaying deciding on the final set of workflows until the last responsible moment.
Success
How will we know when we are done?
How will we measure how well we have done?
Thoughts?
Put everything else here. Better out than in.