External authentication

Table of Contents History Why do we need external authentication? How to do it? But..

History

The old Crowley bot didn't have to worry about authentication. It was integrated with the Blitzed services package and was directly storing nick_ids in the database that corresponded to services' own nick_ids.

Anything that wanted to authenticate itself against the old services could do so via a Blitzed web site that enabled a third party login. There was a quotes web site which took advantage of this.

Life is much harder for enoch. It doesn't have much integration with services beyond being able to tell if someone on IRC is identified to their nickname. We can probably cobble together some sort of authentication for external services anyway.

Why do we need external authentication?

Rating a lot of quotes will be much easier through a web site. To rate a quote on IRC you have to type something like !ratequote 12345 5. On a web site it'll be just one click.

How to do it?

Best idea so far is to add some sort of auth command to the bot to be read in private message. If you're currently authenticated to your nickname then the bot:

• Adds a row in some table with a random token and your nick_id
• Tells you the token on IRC (possibly in the form of a URL that you can just click on?)

You then go to the web site and put in the token, the web site then knows that you are authenticated to that nick_id and should let you rate stuff.

But..

• What sort of algorithm will be needed to create a secure token?
• Will the tokens need to be deleted by the web application after they have been successfully used?
• How long should web apps keep the user logged in?
• …