This page discusses the implementation of an OpenID service.

Requirements

An OpenID service is provided with:

a page to register for a new user account at Mozilla
a login page that can be used to authenticate the user
a page to manage your account, enable/disable services (Account Manager Project ?)
a page to add a new site to your list of authorized sites
a page to manage the list of authorized sites

XXX TBD - mconnor

Server APIs

The server implements OpenID 2.0

XXX lists all APIs here, and usage scenarios

The server is implemented using python-openid and server-core
Users are stored in LDAP
Site tokens are stored in MySQL
The server uses the same node assignment library than Sync to associate a user to a server
A new multi-value field is added in the LDAP User object: service-enabled
- to enable OpenID for the user, an OpenID value is added
- The Sync value is used to enable/disable Sync.
- The account-enabled field is kept for a global de-activation of a user
Node assignment can be done on the first OpenID activation if Sync is disabled or not used yet.

If a user tries to create a new account in Firefox Sync via the wizard but already has OpenID activated
- we tell the user that there's an existing account and redirect him to the regular user authentication screen.
- we add Sync in service-enabled in LDAP on the first sync
If a user deletes his Sync account
- we remove Sync from service-enabled but don't remove the LDAP user
If a user tries to create a new account in the OpenID UI, and already has Sync activated, we warn that an account exists for that e-mail and propose to the user to activate OpenID through the user account management panel