Security issues

The process we have in our mind for the FaceBook application not to require to log in to CamTools every time is an association between your FaceBook ID and your CamTools User Id. This is quite easy and can even happen on our seperate PHP server.

Once that is in place, this association needs to allow you to request Sakai data without having to log in. So on the one side, we have our PHP server which knows the users login to CamTools and which can construct a security token using a random number, the user id and a shared secret. We can then send a request to the Sakai server and attach the token. Using a new request filter we have written in tool-util (TrustedLoginFilter.java), Sakai can decode the token, check whether it is valid and create a session for that user id. Then you can perform your code which can basically do/return anything you would like to.

Another issue is how much information we want to expose using this approach. Again, this is completely up to the implementer, but we have chosen to keep it limited to titles. To see the actual content itself, you need to click the title which redirects you to CamTools and will require a login.

 

FaceBook – Sakai Integration !?

I got my next task here at CARET and I do think it is a particularly cool one. We need to have a look into a possible integration of Sakai within FaceBook. This project will require us to do a couple of things: think about what might be useful for users to display within FaceBook and where in FaceBook, think about security issues and have a look into the FaceBook API (http://developers.facebook.com/) …