[Mailman-Developers] Dropping Persona

[Simon Hanna]

On 01/29/2016 08:59 PM, f at florianfuchs.com wrote:
> 
> 
> On 2016-01-29 16:00, Barry Warsaw wrote:
>> From a UX perspective, I do want to allow people to log into their accounts
>> using any of their registered and validated email addresses.  People very
>> often forget just which address is subscribed to which mailing list, so it
>> really shouldn't matter which one they use to get into their account.
> 
> We should check out which external app allows for multiple emails to be set. Or which ones allows
> for easy customization to do so at least.
> 
>> Further, I have a strong personal preference for "no user names", or
>> alternatively, using email addresses as their "user name".  I think user names
>> are essentially contrived extra information for which there's no need, when
>> clearly your identity is your email address.  I liked this about Persona.
> 
> I agree, especially since even though we now have HyperKitty, there will probably always be many
> folks whose interface of choice for Mailman is email, and who will not use the interface very often.
> Remembering usernames for sites you last visited 20 months ago is awful.

I just found another solution: django-allauth
http://www.intenct.nl/projects/django-allauth/
http://django-allauth.readthedocs.org/en/latest/overview.html
https://github.com/pennersr/django-allauth

It's a relatively large project. It has 2000+ stars and about 800 forks on github. The other two I
introduced can't get these values when adding them together.

About their functionalit quoting from their docs:
* Signup of both local and social accounts
* Connecting more than one social account to a local account
* Disconnecting a social account – requires setting a password if only the local account remains
* Optional instant-signup for social accounts – no questions asked
* E-mail address management (multiple e-mail addresses, setting a primary)
* Password forgotten flow
* E-mail address verification flow

They are basically supporting every OAuth provider out there

They have more signals than the other two projects I introduced. Some of them are:
* when a user signs up
* when a user adds an email
* when the user removes an email

I didn't look at the code yet but I think they are only using emails and not usernames.

I will try to integrate it in the next couple of weeks and see if we should create a sepparate app
for that or do the work in both projects