930619 - SecReview: mod_authn_persona

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Philippe M. Chiasson (:gozer)]

- Who is/are the point of contact(s) for this review?

Philippe M. Chiasson <[e-mail]>

- Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.)

An apache module that performs Persona logins

- Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:

It's all on github here : https://github.com/gozer-mozilla/mod_authn_persona

- Does this request block another bug? If so, please indicate the bug number

Nope.

- This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

Somewhat urgent, as it will allow us to roll this out on a lot of sites.

- To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list? If so, which goal?

Yes, the SSO goal

Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)

- Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

Not directly, no.

- Are there any portions of the project that interact with 3rd party services?

Yes, the assertion verification part uses https://login.persona.org/verify

- Will your application/service collect user data? If so, please describe

Nope, except for logging the e-mail address of authenticated users, just like the LDAP authentication currently does.

Comment 1

[Guillaume Destuynder [:kang] [this account is no longer active]]

review is in progress

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

sec review meeting w/gozer planned thursday, 31, 11AM PDT.

Comment 3

[Guillaume Destuynder [:kang] [this account is no longer active]]

moved to 1PM PDT

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

moved to friday, 01, 10AM PDT - :gozer wasn't available today

Comment 5

[Guillaume Destuynder [:kang] [this account is no longer active]]

Sec review notes: https://etherpad.mozilla.org/modpers

Comment 6

[Philippe M. Chiasson (:gozer)]

As an aside to the sec review notes, I made a code branch for this security review, it's here:

https://github.com/gozer-mozilla/mod_authn_persona/tree/secreview-2013-11-01

And all security issues have been remediated on that branch.

Comment 7

[Guillaume Destuynder [:kang] [this account is no longer active]]

note: using SA as bug component as I couldn't find any proper component for the remediation bugs. Sorry for the automatic CC spam ;-)

Comment 8

[Guillaume Destuynder [:kang] [this account is no longer active]]

Additional links:
Project doc: https://mana.mozilla.org/wiki/display/SpecOps/Labs+Project+-+mod_auth_persona
Review etherpad: https://etherpad.mozilla.org/modpers

This review will be considered completed/solved when this bug (bug 930619) and it's dependencies are resolved.

Comment 9

[Guillaume Destuynder [:kang] [this account is no longer active]]

making resolved as review is done