Implement OpenID Logins

[dstufft]

PyPI allows logging in via OpenID, we need to either implement this or deprecate it and provide a migration path.

[domenkozar]

Should be fairly trivial with http://velruse.readthedocs.org/en/latest/

[ergo]

I suggest http://peterhudec.github.io/authomatic/ instead - it supports both py 2 and 3, and I've implemented both velruse and authomatic in my applications.

Authomatic supports bigger range of providers over velruse though.

I can provide example implementation if you guys are interested.

[apollo13]

The last release from velruse was in 2013 -- does not seem to be really reassuring. If there are no objections from @dstufft I'd give authomatic a try, unless there is a "defacto" solution for pyramid I do not know off…

[ergo]

I've used both velruse and authomatic - both work fine with pyramid - however authomatic supports py3 and way more providers as of today.

[ewdurbin]

Numbers from the past month:

While I think maintaining federated authentication is not a bad idea, it is clearly not used enough to warrant doing any backflips.

pypa/pypi-legacy currently uses Authomatic for both Google and OpenID and I'm a huge fan, it was straightforward to integrate and hasn't caused any fuss since being deployed.

[brainwane]

@dstufft Per your distutils-sig email shall we close this issue?

[rsyring]

FWIW, it seems like a few comments on the distutils-sig thread indicate the usage disparity is due to the perception that google integration doesn't work on pypi currently. That's also true for me. If better social auth (GitHub and Google being my two preferences) were available in the future, I'd likely use it more.

[ewdurbin]

We disabled new Google Login associations many moons ago.

Only users who had previously associated a Google Account are able to use the feature, new logins are intentionally disabled.

[ewdurbin]

No PyPI user found associated with that Google Account, Associating new accounts has been deprecated.

Is the "error" message that currently displays when attempting to login with an unassociated Google Account.

[dstufft]

Closing this, we're not going to support Federated auth at this time.