elgg community auth/login?

By adc


i was wondering whether or not anyone was working on a plugin which would enable community.elgg.org users to register and log into other elgg powered sites using their community.elgg.org credentials?

admin would have the option to disable normal registration process, so elgg community members could have more immediate access. this would better help plugin developers who offer technical support, as well as helping prospective plugin users experience those plugins for themselves from their users point of view.


  • The idea itself is nice. But this kind of authentication would require exposing an API method at the community site for any other site to use.

    I don't think the Elgg core developers want to do such a thing.

  • adc

    ah yes, but it seems it is perfectly alright for google, facebook, twitter and linkin users to name but a few to register and log into elgg sites using their existing credentials.

  • I'm not saying it's impossible but there are some challenges that need to be taken into consideration:

    • There are surely many security implications
    • Requests from all the other sites would increase community server load
    • Maintaining the API would take a lot of time

    The companies you mentioned are very large commercial organizations who have hired full time professionals to develop and maintain their APIs. Also they have very powerful server clusters all over the world.

    Whereas Elgg is a relatively small non-profit project.

    I'm simply saying that it is not easy to host such a service. I'm not so sure if it would be worth the effort from core developer's point of view.

    I might however be wrong. These are just my own thoughts.

  • adc

    if the core developers were worried about server load then they would not host this feature packed and well supported community. nor would they allow this to be an open source project, nor yet make latest releases be available through webhosts' clients' control panels. (all of which bring new users and new community members). maintaining the api doesnt take much once it is set up and security is not really an issue when you use authentication keys, tokens and automation. the benefits are obvious and are simply extensions of what is already provided.

  • AFAIK there are things with higher priority to be done on community page, but for your idea not to get lost post is as an issue on Github. Probably here is ok: https://github.com/Elgg/community_customizations/issues

  • I've looked at writing an OpenID server plugin based on earlier OpenID work (https://github.com/Elgg/openid_api and https://github.com/Elgg/openid_client). It's a low priority item for me.

  • adc

    i request that this should be placed higher priority because it would mean plugin developers would have a more streamlined, efficient and time saving method of accessing sites when needed.. i.e they (or the community as a whole) are requested to provide technical support for plugins and they (or anyone who thinks they might be able to provide a fix) need to see for themselves what is happening on another site, and may need admin permissions too, in an effort to debug, and fix any issue for the user of a plugin. personally experiencing an issue and direct intervention is worth a thousand words and saves a huge amount of time, including heading off possible confusion and misunderstanding on both sides. in addition, intereted parties could better experience plugins in use on the developers site before they choose whether or not to use them on their own site. screenshots are all well and good, but no substitue for the real thing.