Search the web
Sign In
New User? Sign Up
ydn-auth · Yahoo! Authenticated Web Services
? Already a member? Sign in to Yahoo!

Yahoo! Groups Tips

Did you know...
Real people. Real stories. See how Yahoo! Groups impacts members worldwide.

Best of Y! Groups

   Check them out and nominate your group.
Having problems with message search? Fill out this form to ensure your group is one of the first to be migrated to the new message search system.

Messages

  Messages Help
Advanced
permission page continues to be shown, even after agreeing   Message List  
Reply | Forward Message #43 of 729 |
Re: [ydn-auth] Re: permission page continues to be shown, even after agreeing

That makes sense.

FWIW, SSO is a special case of sorts for BBAuth, so things were really designed around the needs of apps that need access to user data.  Since there seems to be a lot of interest in the SSO support, we'll look into tailoring that on our side.

Jeremy

Andrew Chen wrote:
Ding! That's basically what I was getting at. I'd like to be able to throw the user to Yahoo! login as often as I'd like, but they should only get the permission page the first time. Each subsequent time should result in just the Yahoo! login page and redirect back to me.
----- Original Message ---- From: rmitz <rmitz@...> To: ydn-auth@yahoogroups.com Sent: Tuesday, October 3, 2006 12:21:14 AM Subject: [ydn-auth] Re: permission page continues to be shown, even after agreeing --- In ydn-auth@yahoogroup s.com, "sashimikid" <jlevitt@... > wrote: 
--- In ydn-auth@yahoogroup s.com, "trythinking" <trythinking@ > wrote: 
But according to the verify page itself, it says that permission would last 2 weeks. What's the point of granting access for 2 weeks if they're going to be continuously shown that access page for that duration? Thanks. 
When the user successfully logins the first time, you (the developer) are provided a token that you can use to make authenticated web service calls on their behalf for two weeks. So, they don't have to see the access page again until the token expires in two weeks. 

I think some people are missing the point. The point is not for yahoo to control how long the user is logged in (though I think that would be fine too.) The point is that a user will want to log in from multiple different machines, perhaps different browsers, etc, and it's cumbersome for someone to have to approve their login each time. In addition, I believe that it's a cleaner interface that once someone has signed into yahoo, those credentials should be sufficient to gain them automated access to whatever service that has already been approved. Particularly if that service has asked to not have access to any of the user's yahoo data, that is, i.e. it is operating purely as a SSO system. Roman.
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/ydn-auth/
<*> Your email settings:
Individual Email | Traditional
<*> To change settings online go to:
http://groups.yahoo.com/group/ydn-auth/join
(Yahoo! ID required)
<*> To change settings via email:
mailto:ydn-auth-digest@yahoogroups.com mailto:ydn-auth-fullfeatured@yahoogroups.com
<*> To unsubscribe from this group, send an email to:
ydn-auth-unsubscribe@yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/

-- Jeremy Zawodny
jzawodn@...
Yahoo! Developer Network
http://developer.yahoo.com/


Tue Oct 3, 2006 5:59 pm

jzawodn
Offline Offline
Send Email Send Email

Forward
Message #43 of 729 |
Expand Messages Author Sort by Date

Hello- I'm trying to use BBAuth for SSO on my site. When using the sample PHP code provided, I am continuously asked for my permission each time I sign in to...
trythinking
Offline Send Email
Oct 2, 2006
1:43 pm

We're working on trying to find a better balance in this case. For the moment, we err on the safe side, assuming that if you're sending a user back to us,...
Jeremy Zawodny
jzawodn
Offline Send Email
Oct 2, 2006
2:00 pm

But according to the verify page itself, it says that permission would last 2 weeks. What's the point of granting access for 2 weeks if they're going to be...
trythinking
Offline Send Email
Oct 2, 2006
6:14 pm

... When the user successfully logins the first time, you (the developer) are provided a token that you can use to make authenticated web service calls on...
sashimikid
Offline Send Email
Oct 2, 2006
6:17 pm

To clarify -- you, the developer, can store a cookie in the user's browser and attach that to stored session data (in a db, perhaps) to maintain the user's...
Jason Levitt
sashimikid
Offline Send Email
Oct 2, 2006
6:34 pm

Jason has it exactly right. I've implemented such a solution, here: http://kentbrewster.com/ybbs Currently the cookies I'm generating go away after the user...
kent_brewster
Offline Send Email
Oct 2, 2006
11:14 pm

... I think some people are missing the point. The point is not for yahoo to control how long the user is logged in (though I think that would be fine too.)...
rmitz
Offline Send Email
Oct 3, 2006
4:02 pm

That doesn't work too well if I'm using Yahoo! as an SSO system. I'd like my users to sign in through Yahoo! as often as they'd like, which would result in...
Andrew Chen
trythinking
Offline Send Email
Oct 3, 2006
5:30 am

Actually, it works fine. In the bbauth Drupal module I wrote (soon to be released), the Drupal cookies take over after a valid Yahoo! bbauth login. So, the...
sashimikid
Offline Send Email
Oct 3, 2006
5:53 am

Hm. So I can handle timing out a user after X number of hours (where X < 2 weeks). If after X, I want the user to reauthenticate (via Yahoo, in this case),...
Andrew Chen
trythinking
Offline Send Email
Oct 3, 2006
6:19 am

One approach is to save your own cookie in the user's web browser and check that. Yahoo sent you a timestamp and other useful data that you can use to validate...
sashimikid
Offline Send Email
Oct 3, 2006
6:42 am

Ding! That's basically what I was getting at. I'd like to be able to throw the user to Yahoo! login as often as I'd like, but they should only get the...
Andrew Chen
trythinking
Offline Send Email
Oct 3, 2006
5:50 pm

That makes sense. FWIW, SSO is a special case of sorts for BBAuth, so things were really designed around the needs of apps that need access to user data....
Jeremy Zawodny
jzawodn
Offline Send Email
Oct 3, 2006
6:03 pm
Advanced

Copyright © 2009 Yahoo! Inc. All rights reserved.
Privacy Policy - Terms of Service - Guidelines - Help