Geek Answers Handbook

Creating a third-party API on a Plone site using OAuth2?

We could create a third-party API to access the data of the Plone CMS site. One possible way to distribute user privileges on third-party systems is OAuth2, used by Twitter, Tumblr, and Facebook. Thus, a third party receives user privileges after the user clicks "Allow" in the dialog box to access one data.

  • Are there any existing solutions in which Plone acts as an OAuth2 host (not sure about the terminology)

  • What other options could be for this use case

I'm in no hurry, this is planning for 2014 :)

+4
source share
1 answer

As far as I know, pmr2.oauth is the only package (disclosure: I also wrote this) that provide OAuth provider support for Plone (that is, it allows Plone to act as an “OAuth host”, including scope support, to let users know what they allow, for example, Twitter, etc.). There is another package that I briefly looked at by the name wsgioauth, but this is a fairly general package, and it is for wsgi, so I created my own package (and it looks like wsgioauth has not been supported for 3 years).

Currently, it only supports OAuth 1.0; the reason is that at the time of development there were no good OAuth 2.0 libraries, especially for providers. More recently, support for RFC 6749 (the actual OAuth 2.0 standard) has begun to infiltrate through oauthlib, which is the library that performs the signing of requests on pmr2.oauth. However, I hope that I have written it in such a way that it is modular enough to enable OAuth 2.0 support, or at least the kernel is easy enough to change to include support for this. I would be more than happy if the Plone community takes it and improves it (or even forks it, or someone who knows in this area), since I have no plans to enable OAuth 2.0 support.

+1
source

More articles:


All Articles