Feature of the week: authentication

With our latest Release 2.0.11 we migrated BibSonomy's authentication to Spring Security. In this post we want to give you some details and background information.

Remember Me

Before the last release you always got a cookie from BibSonomy after a successful login. This cookie contained your (hashed) password and user name and allowed you to stay logged in for one year. This was clearly security-relevant because when you forgot to log out on a shared computer, one could use your BibSonomy account and could even copy that cookie. Then, one could use it for an unlimited time (until you changed your password, actually) or run a password attack to obtain your plain-text password.

This cookie is now optional - you can use BibSonomy without getting this cookie (cf. this post). Furthermore, the cookie is now encrypted and contains a non-modifiable expiration date of one year. This means that password cracking is now much more complicated and the cookie always expires after one year. You can find more information in the Spring Security manual.

On the sign in page you can now decide whether you want this cookie set or not by (de)activating the stay logged in checkbox:

We recommend to not activate the checkbox when you are using a shared computer (e.g., in an internet cafe). Furthermore, you should always log out when you use such computers.

Note that by using the quick-login that you find in the top right corner of BibSonomy's pages (cf. the next screenshot) you always get the remember me cookie set.

OpenID

Though BibSonomy supports OpenID authentication for quite a while, the underlying implementation was rather buggy. Now, we are building upon Spring Security's implementation which has been tested in many production environments. Furthermore, we simplified the registration process for OpenID. Actually, if you sign in the first time with your OpenID you have to fill out one form and that's it. If your OpenID provider supports attribute exchange according to http://schema.openid.net/, some parts of the form are already filled by the user details you gave your OpenID provider.

LDAP & Co.

For the PUMA project (cf. this post) that is based upon BibSonomy technology we are using Spring Security's LDAP implementation to integrate PUMA into the University Library's user management.

For other setups we are now prepared - we can easily integrate X.509 or CAS authentication since Spring Security supports them out of the box. Other mechanisms can be added in a standardized way by implementing the corresponding interfaces.

Release 2.0.11

As announced, we released BibSonomy version 2.0.11 today. We also updated our publicly available libraries at our Maven repository. The new release contains various small bugfixes and internal restructurings which should make it run smoother and more efficiently; apart from that, we've included some new features:

• Spring Security: BibSonomy now implements Springs access-control framework for the user authentication process. For you as BibSonomy user there are several smaller changes that come along with the new framework:
  
  • The remember-me cookie (the cookie that keeps you logged in) is now optional. You can choose to stay logged in with a checkbox on the login-page. Note that using the login on the BibSonomy start page you will not get the cookie.
    
  • The registration process for OpenId is now significantly easier.
  • The registration link in the upper right corner has been removed. To register simply click sign in to get to the login page to find a registration link.
  • The passwort-reminder has changed: After requesting a new password you will receive one that only allows you to change your password. Afterwards you'll have to use the regular sign in.
    
• The BibSonomy URL now accepts a new parameter resourcetype. E. g. http://www.bibsonomy.org/json/?resourcetype=publication will retrieve publication posts. The other option is of cause resourcetype=bookmark.
  
• When posting a publication that you are the author of, you can add the tag myown to it. As from now you can also use the checkbox "I am an author" in the editing dialogue edit publication - which adds the tag myown to the post. Note that this also causes those posts to appear on your CV page.
  
• The publication details page shows a DOI link, if a DOI is available.
  
• Two new scrapers are offered: The PNASScraper for Proceedings of the National Academy of Sciences of the United States of America and the ScienceMagScraper for the Science Magazine.
• The photo you can upload on the settings page is now only scaled to 200 pixels for the longest side, if the longest side is larger than 200 pixels.
  

The next release (2.0.12) is scheduled for February 23h. If you have any feedback or comments regarding our new release, we would be happy to hear from you!


Best,
Stephan

What happened with the next release?

... you might ask. Well, we postponed it to mid of January (actually, January 19th 2011). Basically, there are two reasons for that: we have construction works going on at our institute that caused some trouble and we migrated BibSonomy's authentication to Spring Security - an authentication and access-control framework.

This migration to Spring Security will be noticed by you - our users. The most obvious change will be the new "remember me" cookie that allows you to stay logged in for a longer time than the session timeout (which is 30 minutes of inactivity).
When the new version of BibSonomy is released, your old cookie is no longer valid and you need to login again. Hopefully, this causes not too much trouble. In any case - with this post we want to inform you about this change such that you are prepared. Of course, the password reminder functionality will be available such that you can reset your password in case you forgot it.

Some more background information about this change: Currently, you always got such a cookie when logging into BibSonomy. Beginning with the next release, you can choose whether you want to stay logged in after using BibSonomy or not:

Although we always recommend to logout on computers which are not your own, not enabling the "remember me" functionality ensures that a forgotten logout not necessarily allows other users of the computer to access your account. After a timeout of 30 minutes of inactivity your session is closed and you need to login again.

Besides the new cookies, Spring Security brings improved compatibility with OpenID providers, support for other authentication schemes (e.g., for the PUMA project we need LDAP authentication), and in general a cleaner and more widely tested authentication implementation.

There will be some other changes included in the next release that we will present with the accompanying blog post.

Since Christmas is coming, I am happy that I can announce that some features from our wishlist (see my last blog post) are now going to be implemented: an OpenSocial API and a TeXlipse plugin for BibSonomy. Finally, the new document upload is almost finished. It allows you to upload the documents (yes documents - not just one) for your publication while editing the post. I have tried this on our development system today and really liked it. I hope you will enjoy it, too.

Last but not least, we want to thank our users for using BibSonomy and our funders for giving us the opportunity to develop such an amazing system.

The whole BibSonomy team wishes you a merry Christmas and a happy new year.

Happy tagging!