Google Apps Auth Plugin for AccountManager

[Kazuho Okui]

I've implemented simple Google Auth plugin for AccountManager. This patch allow you to authentication with your Google Apps account.

How to Use

1. Extract Account Manager egg file and apply patch

   $ cd {path_to_your_python_site_package_dir}
   $ mv TracAccountManager-0.2.1dev_r3857-py2.5.egg tmp.egg
   $ mkdir TracAccountManager-0.2.1dev_r3857-py2.5.egg
   $ cd TracAccountManager-0.2.1dev_r3857-py2.5.egg
   $ unzip ../tmp.egg
   $ patch -p1 < {google_apps_patch_file}
   

2. Set up your trac.ini

   [components]
   acct_mgr.google.GoogleAuthStore = enabled
   
   [account-manager]
   google_apps_domain={your_google_apps_domain}
   password_store=GoogleAuthStore
   

3. Login with your google apps domain
   • username: your google apps user name (without domain name)
   • password: your google apps password

TODO

This is just authentication module, but if you have Google Apps Premiere Edition, you can retrieve account information and set user name, email address, timezone, etc... to trac environment

[Kazuho Okui]

Patch of Google Auth for Account Manager Plugin

[Noah Kantrowitz]

This seems like a pretty niche case. Any reason to not make it its own plugin.

[Matt Good]

I'm not comfortable integrating this since it requires users to provide their Google password directly to a 3rd party site. If you're using this for an internal site, I'm sure they can trust you, but this is a practice I'd rather discourage in general.

I think it would be great to see an ​OAuth plugin which would give users a secure way to sign in with their ​Google credentials, or another OAuth provider. However, since with the single-sign-on model all account administration is handled by another site it doesn't really fit inside the AccountManager API, so it's probably still easier to keep it in a separate plugin.

[Matt Good]

Hrm, I guess the intent of OAuth is more to securely access a user's data stored in a Google application, though maybe it can be used as a signin method as well. If that's not the right API I'm pretty sure there is another one that does work to just authenticate you via Google.