Support remember me on Gapps

XMLWordPrintable

    • Type: Suggestion
    • Resolution: Fixed
    • Component/s: None
    • None

      OpenID has remember me support:

      http://wiki.openid.net/Relying-Party-Best-Practices#StoreprimaryOpenIDinacookieandcheckimmediateatnextsession

      This is done using checkid_immediate indirect authentication requests:

      http://openid.net/specs/openid-authentication-2_0.html#anchor28

      Basically, this is how it would work:

      1. When a user logs into Studio via Google, their OpenID is set in a persistent cookie on Studio.
      2. When that user returns to Studio, either after closing their browser or after their Crowd token had expired, Studio checks for that cookie.
      3. If the cookie exists, the user is redirected to Google with the mode set to checkid_immediate. This tells Google not to supply the user with an authentication screen if they aren't logged in, rather, it will send them back to Studio with a unsuccessful response.
      4. If unsuccessful, Studio clears the persistent cookie, and the user is not logged in.

      The effect of the above is that if a user has clicked remember me on Google and has logged into Studio before on the browser, they will be automatically logged into Studio when they return after session expiry.

              Assignee:
              Unassigned
              Reporter:
              James Roper [Atlassian]
              Votes:
              9 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: