Post login callbacks

[smancke]

It would be great to support a configurable callback after a successful login:

• As go function, which could be registered
• As http endpoint

The callback should be receive the following data:

• claim data
• the raw user data from the oauth provider
• The access token from the oauth provider

A callback should be able to return a modified claim data object.

[jgillich]

I think using a plugin architecture is a more universal and efficient approach here. In billstack, I'm currently calling stripe at a few places:

• At login, to extend the claims
• At signup, to create a customer along with the cc token
• When updating user information, to update the cc token

In addition to that, there are payment specific endpoints (e.g. to subscribe to a plan, or to add credits). By going the callback route, not only would you have payment specific data in loginsrv calls, you would also need a separate service that provides the and other payment endpoints. Simply going the route of a payment plugin would be both easier in design and also faster.

There could of course also be other use cases for plugin other than payments. For example, if you wanted a http endpoint, you could easily create a plugin for it.

Maybe I wrote all this for nothing because "go function" already implies a plugin architecture, who knows. 😄

[smancke]

@jgillich In fact I plan to have both:

1. a hook, where you can register a custom function to be called after the login
2. a simple default implementation for that hook, calling a http endpoint

[magikstm]

I may use these hooks for a "password sharing detection" plugin.

After 5 or 10 logins from different IPs within a set amount of time (maybe 24h) it would mark that account as "potentially shared" and return an html page notifying the user. I may need that eventually with htpasswd.

[smancke]

ok, cool, nice idea.
I will definitely implement this 'post login callback' feature, since I will need it by my self, also. But it will take 2-4 weeks, until I come to that.

[jgillich]

Just to clarify, the ability to register custom functions (1.) is going to be implemented using plugins? We probably meant the same and just used different terminology.