January 2006 - Development - lists.drupal.org

Token based web service authentication, some clairification
by Benson Wong 25 Jan '06

25 Jan '06

Hi, I think there was some confusion on what I ment with the web service token authentication. A few people have pointed me at single sign on stuff which isn't what I was talking about. Essentially, I wanted to create a way so that clients using the web service weren't always Anonymous users. They can authenticate against the local user database, and become whoever as long as the username and password is correct. When they authenticate (over the web service), they get sent back a session id. Any additional requests are done to /xmlrpc.php?token={session id} and drupal will log them in automatically as that user. I'll submit the patch to the drupal.org for review. -- blog: http://www.mostlygeek.com

1 0

Likelihood of authenticated web services in 4.7
by Benson Wong 25 Jan '06

25 Jan '06

Hi, Sounds like everybody is busy squashing bugs for 4.7's release. I was wondering about the likelihood of authenticated web services (token approach or whatever) being added into 4.7. The project I'm working on right now really needs it (building on 4.7) but if there's not a snowball's chance in hell of it being added I'll take a different approach in the interim. Thanks. Ben. -- blog: http://www.mostlygeek.com

1 0

Token-based web service authentication to core
by Boris Mann 25 Jan '06

25 Jan '06

All: See http://drupal.org/node/46145 I'm going to make sure that Ben is signed up to the dev list. He's on the board of the PHP User's Group here in Vancouver and is a pretty kick ass programmer. For now, making sure this gets the views it deserves. This opens the door to the type of interactions that, e.g. Flickr, does remotely, and lots of rich inter-site functionality. > I'm building a new website in Drupal and there are some > administrative web services that I would like to make available to > middleware together a legacy system. I did some research into > Drupal's XMLRPC system and figured that token based authentication > in the core would be useful. > > This is what I have sketched out on a napkin: > > Scenario: > Client wants to create some new data in the system. This is the > process: > > 1. Client requests a service token, sends username/password of a > Drupal user > 2. Drupal loads the $user matching the crudentials > - creates a random alphanumeric token to send back to the user > - serializes, and caches the $user object, key = md5(token + ip > address of client) > - sends the token back to the client > 3. Client makes an RPC call to say: module.createListing($token, > $arg1,$arg2,...) > 4. In createListing(...) > -- Checks the token, if valid does it's thing, otherwise, returns > an error message. > > I think it would take a fairly small amount of code to accomplish > the above. I haven't given a lot of thought about Drupal's external > authentication system though. I'm not too familiar with it, but > maybe somebody can fill me it. For this system I may write my own > version of user_authenticate() without the variable_get > ('user_register',1) in it so some malicous person doesn't create an > unlimited number of random users in the system. > > Any thoughts or previous work on this? > I would like it to be implemented in core, but it would probably be > just as easy to implement as a module. Since modules will depend on > the functionality, I want to avoid the logic of checking if the > module is enabled or not. > > I took a look at how the blogapi module accomplishes > authentication. It has $username,$password for each request, and > does a user_load(...), which is alright, but I would like have a > shared authentication for web services rather than rolling a custom > one for every module that needs it. > > Privileges and access can be combined into a xmlrpc_check_token > ($token,$privilege) function, e.g: > > xmlrpc_check_token($token,'access content') > > It wouldn't take me long to write the code for this. I wanted some > feedback from the community first before I dive into design/coding. Boris Mann Vancouver 778-896-2747 San Francisco 415-367-3595 SKYPE borismann http://www.bryght.com

6 6

Introduction and Webservice Token Discussion
by Benson Wong 25 Jan '06

25 Jan '06

Hi, Boris @ Bryght recommend that I join this list. So hello all. I'm a little green to the drupal development process so I'm going to jump right in. I was working on Web service authentication token functionality for Drupal 4.7 (or 4.8). I wrote the code today and kept the implementation minimal. I tied it into the session.inc functions in Drupal. Which made the most sense. refer: http://drupal.org/node/46145 for the ongoing discussion. I've attached the patch to this email. Quick summary: 1. Uses the global $user 2. Tokens are passed in the GET string as: xmlrpc.php?token={big long string} 3. The tokens are just PHP session Ids 4. No modification to any current code to use. Code can use user_access(..) as normal to check privileges 5. xmlrpc.php modified so if a valid token exists, it will swap the anonymous sessionid with the authenticated one. Unrelated, but I figured this was useful. Every anonymous xmlrpc request creates a new anonymous session in the sessions table. I added a couple lines of code to get rid of anonymous sessions in xmlrpc_server() right before it send back the response. The same can probably be done for cron.php. Thanks. Ben. -- blog: http://www.mostlygeek.com

1 0

core dev as a category
by ae2005 25 Jan '06

25 Jan '06

Karoly, interesting. I personally put much more stock in a module developed by one of the trusted names (such as yourself). However, I can see your point about lacking the time to maintain it, as well as not wanting to "certify" people. any way, some rating of quality/stability would definitely be useful. ae

1 0

module categories
by ae2005 24 Jan '06

24 Jan '06

categorizing modules -- this is a great project. another thought. modules by use. when you set up civicspace, it asks if you want to set up a site for 1) politics 2) artists etc. one category there would definitely 3) ecommerce and maybe 4) paid memberships. on another dimension, stability, we could have categories like 1) well documented 2) contributed by core developers on another dimension, ease of use 1) easy (only ftp necessary) 2) moderate (need to import mysql tables) 3) advanced since i'm developing an ecommerce site, i really think it'd be fabulous to have the list of ecommerce sites (which kieran pointed me to one day on civicspace, thank you kieran) along with evaluations of how well it's documented, how stable it is, and how easy to use. we should also indicate which modules conflict with each other. ae2005

3 2

Issue with multisite url creation for edit forms action parameter...
by Tao Starbow 24 Jan '06

24 Jan '06

I tried posting this first to the support list, but it might be a little too deep geek for that list. This is the only multisite issue I have been stumped by. The problem has to do with the url in the action parameter for the edit forms being created incorrectly (Note: only tested in 4.6). This problem only shows up for multisite, and only when I use apache & $base_url to make a multisite site look like a single site. For example the main CITRIS site is really located at citrissrv2.berkeley.edu/citris. It sits behind an apache server that does a proxy pass from www.citris-uc.org to citrissrv2.berkeley.edu/citris. Then I set the site's $base_url to www.citris-uc.org , and 90% of the time this works fine. However, when Drupal generates a edit forms, it prepends "/citris" to the url in the form's action parameter. So where it should have action="/node/123/edit", instead it generates action="/citris/node/123/edit". This does not happen when the $base_url is citrissrv2.berkeley.edu/citris and proxy pass is not used. To deal with this issue, I set up a symbolic link so that $durpal_dir/citris just points back to $drupal_dir. This is an easy fix that works most of the time. However, modules such as webform and project have forms that use secondary pages as subforms, and as the pages pass the data back-and-forth, I end up with urls like action="/citris/citris/citris/citris/citris/node/123/edit" and so on, until the url finally gets too long for the browser to handle, the url gets clipped & the user is set to an error page. I suspect I am going to be diving into core to address this one, but I still hope it might just be a configuration error on my part. I am grateful for any tip & leads. Tao Starbow Web Architect, CITRIS

1 0

Categorizing modules-demonstrating the value of the Drupal platform
by Kieran Lal 24 Jan '06

24 Jan '06

Hi, software platforms like Drupal are often evaluated by the additional components they have. Today Drupal's contributed modules are plentiful but the value of the modules is hard to discover because the modules are hard to understand. This can be fixed in 3 ways. First, we need to categorize modules so that they can be quickly discovered. Second, we need to evaluate modules to rate their quality. Third, we need to make it easier to understand contributed modules. CivicSpace Labs with a lot of personal contributions from Nedjo and Dries have extended the project module to allow modules to be categorized. This new categorization can be seen on the Drupal.org beta site: http://scratch.drupal.org/project/Modules We are looking for volunteers to help us discover what the logical categories for modules on the Drupal platform is. We are starting with the developer community who know the modules best. In the long run we are likely to conduct a card sort usability experiment to confirm that modules are well categorized for web site developers, and Drupal administrators. We know from recent surveys that installing new modules is one of the most common tasks and therefore represents one of the biggest usability improvements for Drupal. We are looking for volunteers to wade through the modules and attempt a first pass at categorization. There are 4 groups of modules we could evaluate with the total modules increasing in each category. The larger the group to categorize the more work. 1) Most downloaded modules about 40- http://drupal.org/node/46109 2) Modules with administration help documentation. http://drupal.org/ handbook/modules -about 80 3) Modules with project pages http://drupal.org/project/Modules- about 200? <-has the advantage of allowing us to categorize all the project modules 4) Modules checked into the CVS contributions directory http:// cvs.drupal.org/viewcvs/drupal/contributions/modules/- Several hundred? The goal is to get this categorization done for the upcoming Drupal.org upgrade. I'll moderate this thread to coordinate volunteers and help to come up with some top level categories. Please suggest some top level categories for module project pages. Cheers, Kieran

9 12

Image module
by Chris Cook 23 Jan '06

23 Jan '06

The image.module is not included in 4.7.0 beta 3. Is this because it is too buggy to yet include or that it will not be included in the final release? I don't see it listed on the modules page either. Cheers, Chris

2 3

Evil hack: admin/modules without memory restrictions
by Gerhard Killesreiter 23 Jan '06

23 Jan '06

Hi there! There are quite a few people who'd like to run a lot of Drupal modules and have problems on admin/modules when they hit the php memory limit. Moshe pointed out that this has changed/ will change with the install files, but I needed something quick and dirty now. Attached is a patch that will make Drupal 1) read the module files 2) looking for help, init, exit hooks 3) write these hooks to a file 4) include that file 5) delete the file for all modules found. The patch makes a few assumptions about how a module file looks like (namely coding conventions). A few contrib modules do not respect these or they do call some other functions from their help hooks. These are: adsense contextlinks cursor g2 smartypants textile xstatic (all taken from contrib HEAD). I am surprised that the list is so short. The patch isn't proposed to be included in Drupal, also people who don't know PHP should not use it. I will not support it. It is intended to be run in development setups where you might want to test a lot of modules. Cheers, Gerhard

14 36