Just another WordPress weblog

I’m just testing Wordpress 2.6 with the PamelaWare plugin now - stay tuned for results…

After some initial worries, it looks like Wordpress 2.5 and PamelaWare 0.9x are compatible.

The only thing that breaks, is that the Wordpress login page designers just *had* to change the color of the login page to be dark text on a light background, compared to the earlier versions where the text was white and the background was dark.

You have to edit admin.pw.php to fix this, as I didn’t want to include the entire .css file every time the login page was loaded — look for a function called pw_loginform_link, and replace the html portion with this:

<hr />
<a href="<?php echo PW_SECUREPLUGINURL . '/' . PW_PLUGIN; ?>/login/infocard-login.php"
        alt="<?php pw_utils::screenPrint('Infocard Login'); ?>"
        style="border: 0; color: #000">
       <?php pw_utils::screenPrint('Login or Register using an Information Card'); ?>
       <br/>
       <img src="<?php echo PW_IMGURL; ?>/infocard_60x42.png"
              style="padding:10px; border: 0" />
 </a>
 &nbsp;
<a alt="<?php echo __('What is this?'); ?>"
        style="border-bottom: none; color: #fff"
        href="http://pamelaproject.com/">
         <?php echo __('(what is this?)'); ?>
</a>

Well, it’s taken me 4 months longer than it should have… but:

The new version of PamelaWare is out!    If you are a new user, check out the Installation Guide for download and setup links.  If you are upgrading, check out the Upgrade Guide for everything you’ll need…

The goal after this version is to release frequently.  I think  I can do this now

Some of the MANY features of PW-wp v0.9:

• We integrate into existing wordpress login pages — this allows co-existence with other authentication plugins.
• We no longer do our own token processing — we rely on the experts at the phpInfoCard project to take care of things like C14N (canonicalization) and other important protocol functions, as well as parse claims and validate signatures.
• We allow administrators to choose their trust models for personal and managed cards separately - for each type of card they can trust everybody, nobody, or ask for email validation to keep it honest.

This is a list of all the things I can’t wait to get done with PamelaWare. I’ve organized these items into three categories - critical, important, and merely nice. If you disagree with my prioritization, please comment here.

Critical

• Obfuscate the certificate passphase so that it isn’t visible in the gui.
• Get the plugin working with WordPress 2.1 (done!  thanks to Pat Felsted)
• Provision, store & use both username/password data and information card data (this is critical for anyone who has an already existing user base)
• Add admin ability to view & (most importantly) prune the contents of the infocard_audit table.
• Figure out why the plugin can’t handle the Firefox plugins when no token is returned (somehow the POST looks different from IE, not sure why yet).

Important

• Alter debug functions to show an “under maintenance” static page to users while either printing debug information only to a secure IP address, or printing the information to a file.
• Add Admin ability to write and publish a privacy statement.
• Add Admin ability to choose the time validity window.
• Add Admin ability to turn debugging on and off from the console.

Nice

• Make the CSS pretty
• Make login fit with WordPress template
• Figure out how to preemptively know when the server isn’t time-synched.

In the beta1 version of PamelaWare for WordPress, the following features were added/modified from Kim Cameron’s original code:

• Code was turned into an official WordPress plugin, able to be activated from the plugin management menu.
• Database alterations are now part of plugin activation.
• Debug print statements have been replaced with a call to a ‘printDebug’ function — currently this function just prints to screen, but this could now be altered in a single place to write to a file, or to check the incoming IP address before writing.
• An error handler was created.
• User messages were altered to follow the standard WP look & feel.
• Localization has been taken into consideration - all printed statements have been written with the _e() function, and large html chunks such as error messages and user messages are grouped by language code.
• The infocard-post.php file was chunked up into separate task-related functions - hopefully this will aid collaboration, as each chunk can be separately examined and improved.
• User-facing messages have been split up into 3 files, roughly approximating a model-view-control method. One file contains a bare html template - this template calls out to a class file for dynamic functionality. Design is done through CSS, stored in a separate file.

General Notes:

• My apologies in advance for the horrible CSS, hopefully someone a little more artistic can spruce up the pages later
• Beta1 now works with WordPress v2.1 - this site is an example.
• This version has not fixed the code such that users can simultaneously possess a username/password combination and an Information Card. Right now, the best way to use this plugin is still as Cards only. This will be fixed soon.
• See the to-do list for all the other things I can’t wait to add to this version

Check out the following links to find out how to install PW-wp:

Prerequisites

Installation Instructions

Troubleshooting

Click on the image for a better view.

Click on the screen for a larger view.

Click on the image for a better view.