Hub Authentication (SSO across branches)

[trf000]

Single sign on for all branches. log in at hub, user is directed to either stay in hub or be redirected to their "home" branch, something they could set in My Page. Permissions set at the branch. Eliminates branch user tables.

I know... this is a toughie.

┆Issue is synchronized with this Asana task

[jlbooker]

I'm not going to mark this as a duplicate just yet.. but see #33. This "pluggable" authentication system would allow for something like what you describe. It would simply be one method of authentication. Local (per site), Shibboleth, Facebook, Google, OAuth, are all other possibilities.

[hrvbid]

Well, as far as I do understand branches, own branch users are an essential design and should be kept. That will not speak agaist any SSO solutions.

[jtickle]

hrvbid, don't worry. It is essential that branches have their own set of users. However, we will provide the option (probably through a REST API) of authenticating users against the hub. This way you won't have to have a separate deity account on each website. I also have desperate need for "website groups" where users can be shared amongst those groups.

The fact of the matter is that there are a million different ways of using authentication and legitimate uses for each one under different circumstances, and we need to extend our user system enough such that it can support these kinds of things easily. User auth(n|z) is a place where we really do need to please everybody.

[jlbooker]

Moving this to 1.8.3, as it relates to #33. Once the authentication system is pluggable, hub authentication can be added as one of the strategies for a branch to use.