#wordpress 2018-01-15

2018-01-15 UTC
[cleverdevil] joined the channel
#
GWG I need to harden the Indieauth implementation in both plugins that implement it
[tantek], [jeremycherfas] and [pfefferle] joined the channel
#
[pfefferle] good morning
#
Loqi guten morgen
jeremycherfas, [kevinmarks], [tantek] and [pfefferle] joined the channel
#
GWG [pfefferle]: WordPress specific question. How can I improve the matching of URLs to WordPress users?
#
[pfefferle] what do you mean?
#
[pfefferle] so that multiple users can login to one wordpress with different indieauth urlsß
#
[pfefferle] ?
#
GWG [pfefferle]: In both the Micropub and the Indieauth code, to match URL to WP username, it does a user query on the user_url property to match it to the 'me' property.
#
GWG If it matches, it creates the post as that user
#
[pfefferle] that is the current code
#
GWG Yes
#
GWG I want to improve that
#
GWG https://indieauth.spec.indieweb.org/#user-profile-url
#
GWG The spec says I could use /author/?????
#
[pfefferle] yes, but you do not want to use the profile page to loginin to the site you have the author page…
#
[pfefferle] that is kind of an infinate loop
#
[pfefferle] and if you use a profile page of a different site, it is working again
#
aaronparecki.com edited /Wordpress_IndieAuth_Plugin (+2143) "add brainstorming section for different use cases" (view diff)
aaronpk joined the channel
#
[pfefferle] using notiz.blog/author/matthias-pfefferle to login to notiz.blog does not make sense
#
[pfefferle] ah sorry, you mean a mechanism to match a profile link to a username automattically?
#
GWG Yes
#
aaronpk isn't there a URL field in the wordpress user table?
#
[pfefferle] oh, that is no good idea
#
[pfefferle] I can generate any author page in my site, so this is very risky
#
[pfefferle] notiz.blog/author/dshanske should not be able to login as dshanske on your blog
#
[pfefferle] only if you whitelisted the page
#
[pfefferle] aaronpk, sure and that is currently used
#
[pfefferle] aaronpk as far as I understand GWG he wants a mechanism to automatch URLs to users without configuration!?
#
aaronpk i'm confused, isn't that all stored in the wordpress database?
#
GWG [pfefferle]: Yes, but not only other sites
#
[pfefferle] ???
#
GWG I don't have an account on notiz.blog
#
aaronpk also am I understanding correctly that the URL example.com/author/alice can map to a wordpress username of bethany?
#
[pfefferle] now I am also confused
#
[pfefferle] can you make an example with URLs GWG
#
[pfefferle] ???
#
GWG Okay.
#
GWG notiz.blog/author/pfefferle would work, but notiz.blog/author/dshanske wouldn't because your site has no dshanske user
#
GWG Whereas david.shanske.com/author/dshanske would work, because I have such a page
#
[pfefferle] but as I said, why would I like to login to my site with a URL on the same site?
#
GWG aaronpk: The permalink can be changed, but it can be picked up in the backend
#
[pfefferle] in the end I have to type in my password
#
aaronpk this is why https://indieweb.org/Wordpress_IndieAuth_Plugin#Logging_in_to_a_single-user_Wordpress_via_RelMeAuth
#
aaronpk so that you don't need to type a password
#
GWG Will agree with aaronpk that I thought that was why people used the Indieauth plugin on their sites
#
GWG I don't want it for that, but that's what people use it for
#
aaronpk that's what i've heard from everyone who installs it
#
[pfefferle] but this only makes sense, if you use indieauth.com
#
aaronpk no
#
aaronpk it makes sense for RelMeAuth
#
[pfefferle] sure
#
aaronpk which happens to be implemented by indieauth.com but could be other services as well
#
[pfefferle] sure, but we are not discussing RelMeAuth do we?
#
[pfefferle] and for IndieAuth it makes no sense
#
aaronpk agreed it makes no sense for indieauth, which is why the second use case I listed is phrased totally differently https://indieweb.org/Wordpress_IndieAuth_Plugin#Logging_in_to_a_multi-user_Wordpress_site_via_IndieAuth
#
[pfefferle] sorry, havent read the Wiki
#
GWG [pfefferle]: How someone's Indieauth server authenticates people is up to that server
#
aaronpk that second use case would let you log in to notiz.blog using the identity https://pfefferle.org/
#
[pfefferle] GWG if I go to notiz.blog and use notiz.blog/author/pfefferle to login, the site checks the authentication server and finds that it’s notiz.blog, so I will be redirected to notiz.blog to authenticate… that makes no sense…
#
[pfefferle] aaronpk that is how I implemented it currently
#
aaronpk GWG: can you write up what you're trying to do as a use case on that page?
#
[pfefferle] GWG as aaronpk mentioned, it is OK for rel-me-auth, but we should handle this different from IndieAuth
#
aaronpk in the same format as the others?
#
GWG I will, but later when I can focus on it
#
GWG aaronpk: You didn't cover multiple users logging into an multi-user site where all of their URLs are under that site. But I'll try to document that
#
[pfefferle] we can always trigger a rel-me-auth/indieauth.com login if it is the same domain, as the blog-domain
#
aaronpk GWG: please do, I am not clear what your goal is with that one
#
GWG Supporting WordPress in all its permutations
#
aaronpk I am not clear on how you expect it to work
#
GWG aaronpk: Authors have pages on WordPress...
#
aaronpk that's not a complete answer
#
[pfefferle] GWG but that is what I said
#
[pfefferle] if I go to notiz.blog and use notiz.blog/author/pfefferle to login, the site checks the authentication server and finds that it’s notiz.blog, so I will be redirected to notiz.blog to authenticate… that makes no sense…
#
aaronpk fill out the use case like I did the others, describing the whole flow like you expect it to work
#
GWG Will do
#
aaronpk e.g. do they actually authenticate via RelMeAuth?
#
[pfefferle] with indieauth.com
#
[pfefferle] so yes
#
[pfefferle] and no 😉
#
GWG But in this case, so far 100% yes
#
GWG As long as relmeauth is a possibility for the indieauth server, it makes sense
#
[pfefferle] no, if the site uses IndieAuth, then no
#
aaronpk cause that would require that someone puts their URL like notiz.blog/author/pfefferle in their twitter profile, which not everyone does
#
sknebel but notiz.blog/author/pfefferle could also have an external authentication server, e.g. another WP instance of yours?
#
GWG Can of worms opened
#
GWG But we'll figure it out
#
[pfefferle] sknebel true, that’s why it do not always use rel-me.-auth
#
aaronpk we may need more than one session at IWC Baltimore to sort through this
#
[pfefferle] 😞
#
aaronpk GWG: you're arriving Friday right? maybe we can get together friday before the meetup to work through some of this
#
GWG aaronpk: I'm arriving at 9:30PM Friday night
#
aaronpk aw darn
#
GWG If I get to Penn Station NY early, I might try to get an earlier train.
#
GWG aaronpk: Sorry.
#
GWG I think the train has wifi
snarfed joined the channel
#
snarfed morning GWG! re https://github.com/snarfed/wordpress-micropub/issues/99 ...odd, i don't actually see headers get replaced with the current code. e.g. it currently happily outputs multiple Link headers right now
#
Loqi [dshanske] #99 Multiple HTTP Headers are Being Overwritten
#
snarfed your PR looks fine, i'm just curious
#
[pfefferle] me neither
#
[pfefferle] but it is only for the same rel
#
[pfefferle] that means, if you have multiple authentication provider for example
#
[pfefferle] I had the issue when using multiple “hub” header for websub
#
[pfefferle] perhaps GWG found out, while working on the IndieAuth plugin…
#
snarfed ah ok
#
GWG snarfed: When I checked with the old code, the token endpoint showed up as it went in last, but that overwrote the authentication endpoint
#
GWG We never noticed because the code looks at the html headers if the http headers aren't there
#
GWG This would have been discovered if there was a unit test for it
#
GWG By the way, I wrote one in Indieauth to test this
#
GWG That's how I noticed it
#
GWG I turned off Micropub
#
GWG snarfed: It is a nice small PR though.
#
GWG I'll be copying the discovery tests I wrote(based on the ones I wrote for webmentions) over to Micropub after I finish with them in Indieauth
#
GWG I'm sorry for causing trouble, either way. I keep trying to make things better
[kevinmarks], snarfed and gRegorLove joined the channel; snarfed left the channel
#
david.shanske.com edited /Wordpress_IndieAuth_Plugin (+408) "/* Logging in to a single-user Wordpress via RelMeAuth */" (view diff)
[kevinmarks] joined the channel
#
david.shanske.com edited /Wordpress_IndieAuth_Plugin (+1711) (view diff)
#
GWG aaronpk: Does that help?
#
aaronpk we may need to talk this through in person
#
aaronpk I see a few things getting mixed up here
#
aaronpk the section you added has: "Users may not have their own websites" followed by "The users want to use their own website identity"
#
aaronpk and you've put some stuff about posting via micropub (authorization) under the "authenticating" header, so I am confused about what you're actually going for
#
GWG I think I keep confusing those terms
#
GWG I'll look at it again
#
GWG That was during lunch
raretrack and [kevinmarks] joined the channel
#
GWG aaronpk, rereading what you wrote. I think we're both confused. Working on clarifying as much as possible
[miklb] joined the channel