3

I've created a plugin for an editor.

This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, redmine, etc).

In the plugin, I have two "objects": Credentials (to get the issues) and External applications.

Sometimes I can guess how to get the information only with the user supplied credentials (i.e.: github, or gitlab cloud service), sometimes I need extra information (a local gitlab, redmine, etc).

My question is.. How do I show this configuration to the user?

I was thinking about having a third object called "Location". The idea was the following: the user configures different locations (i.e: "work gitlab -> 100.1.1.23","home redmine -> 127.0.0.1), and assigns some credentials to them ("work gitlab" has the authentication tokens A,B and C while redmine has only the autentication token D, etc).

When the user creates a new project in the IDE, the plugin scans the project files (".git/config") to see if the project is related to any configured location.

If that's true, the plugin gets the issues automatically, otherwise it asks the user for the new data.

Another idea is do nothing...In any new project, the user would have to configure the credentials and the external application that will use them.

Is this approach correct? Does anyone have a better idea?

6
  • Are you storing users credentials for other services on your server? If so you have some serious security implications... – Andy Boura Aug 10 '14 at 7:36
  • @AndyBoura No. Its a plugin for a desktop IDE. – user3803528 Aug 10 '14 at 7:55
  • OK, not so bad but you still have to be careful... – Andy Boura Aug 10 '14 at 8:03
  • Thanks... I'm looking for a way to encrypt the data and use a passphrase (like Eclipse) – user3803528 Aug 10 '14 at 8:06
  • 1
    Seems to me like the better approach is to ask the user. Yes it's an extra step, but how often do you need to configure for a new project? We don't exactly want the plugin to be guessing at the correct credentials to connect to. What if the user have 2 accounts of the same application they need to access? – nightning Oct 7 '14 at 16:32
1

I can see some serious problems with this approach.

First is that it sounds as though you're trying to use a single set of parameters for access to all possible services. I don't think that can possibly work, as different services require different credentials for authentication. Plus, not every service has a username and password - some use federated authentication (e.g. Microsoft Id, Facebook login, Google Id) where you'll never see anything more than an access token.

Second, your application is likely to end up in violation of the terms and conditions for one of the services you're using. For example, if you application is accessing Github.com, scraping the users username and password is a no-no - you're supposed to get the user to provide you with an API key that allows access.

As an alternative, you'll need to allow each supported service to manage credentials in a completely independent manner.

1
  • I already have resolved that problem. For example, in Redmine I bring the posibility to use the user&pasword pair or a token, with Github & Gitlab I use the access tokens only. I have a particular class to autenthicate with each service, one for github, another for gitlab, etc... I'm using a JSON in order to store the credetials information, so I don't have a particular schema. – user3803528 Aug 9 '14 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.