{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/11778","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11778/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11778/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11778/events","html_url":"https://github.com/joomla/joomla-cms/pull/11778","id":172997515,"number":11778,"title":"Facebook Login integration for Joomla!","user":{"login":"nikosdion","id":256041,"avatar_url":"https://avatars.githubusercontent.com/u/256041?v=3","gravatar_id":"","url":"https://api.github.com/users/nikosdion","html_url":"https://github.com/nikosdion","followers_url":"https://api.github.com/users/nikosdion/followers","following_url":"https://api.github.com/users/nikosdion/following{/other_user}","gists_url":"https://api.github.com/users/nikosdion/gists{/gist_id}","starred_url":"https://api.github.com/users/nikosdion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikosdion/subscriptions","organizations_url":"https://api.github.com/users/nikosdion/orgs","repos_url":"https://api.github.com/users/nikosdion/repos","events_url":"https://api.github.com/users/nikosdion/events{/privacy}","received_events_url":"https://api.github.com/users/nikosdion/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/Language%20Change","name":"Language Change","color":"eb6420"},{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/New%20Feature","name":"New Feature","color":"e102d8"},{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/PR-staging","name":"PR-staging","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":47,"created_at":"2016-08-24T16:19:41Z","updated_at":"2016-08-28T15:54:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/joomla/joomla-cms/pulls/11778","html_url":"https://github.com/joomla/joomla-cms/pull/11778","diff_url":"https://github.com/joomla/joomla-cms/pull/11778.diff","patch_url":"https://github.com/joomla/joomla-cms/pull/11778.patch"},"body":"Pull Request for Issue # .\r\n\r\nPinging @brianteeman @wilsonge @mbabker @PhilETaylor @crystalenka @rdeutz @Radek-Suski @SigsiuTrinity – I know you guys use Facebook and Joomla so please give it a spin if you have some time.\r\n\r\n## Summary of Changes\r\n\r\nThis PR adds the Authentication – Facebook plugin and necessary related changes.\r\n\r\nThis feature lets visitors log into your site using their Facebook account as long as the email address on their Facebook account matches the email they have on your site, or they have linked their Facebook account to your site. If they do not have an account on your site already it will be created automatically for them (you can disable that feature if you want).\r\n\r\n**Facebook login is ONLY available in the front-end of your site**.\r\n\r\n## Why did I write this code?\r\n\r\n(Truth be told, because I need this feature and all the integrations I found on the JED where bloated, badly written or just plain outdated.)\r\n\r\nIt's 2016. Most people expect to be able to login to any site using their Facebook, Google, Twitter or GitHub account. They are put off when they have to deal with Joomla's registration process and tend to miss the account verification email (because lots of spam filters mark Joomla's account verification email as spam, according to my experience).\r\n\r\nThis PR not only implements login by Facebook, it also puts the foundation for any kind of social login or single sign on service integration. I believe this is an important step towards modernizing Joomla's aging authentication infrastructure.\r\n\r\nI only chose to implement Facebook login first –instead of GitHub, Twitter or whatever have you– because whether you like it or not Facebook is the most expansive social network on the planet right now. You can't beat the network effect. If this is approved I can try implementing more social logins (Google, Twitter and probably GitHub) as well.\r\n\r\n## Testing Instructions\r\n\r\nApply this PR. Follow the \"How to link Facebook Login to your Joomla! site\" section's instructions below to link Facebook to your Joomla! site. Go to the front-end of your site and make sure you can log in with Facebook.\r\n\r\n## Documentation Changes Required\r\n\r\nThe entire \"How to link Facebook Login to your Joomla! site\" is the documentation for this feature. The second paragraph of \"Summary of Changes\" can be used as an introductory text on that documentation page. Basically, you have to copy and paste. I did all the hard work for you ;)\r\n\r\n## Backwards compatibility\r\n\r\nThis PR impacts the way mod_login modules (front- and backend) and com_users (frontend) render their login pages.\r\n\r\nIf a template or site integrator has made overrides to these module and view templates they must update them to use this plugin. If they do not update them the plugin will not work but _the site itself will still work, with regular authentication_. Therefore, even though there's a minor b/c break it's not catastrophic and does NOT negatively affect existing extensions.\r\n\r\nIn other words, I made sure I didn't fsck up anybody's site.\r\n\r\nLikewise for extensions which implement their own login screen, be it obviously login modules (duh!) or components (like Akeeba Subscriptions – I _am_ creating more work for myself too, not just other developers). That's the first time since 2012 (when two factor authentication was introduced) that they need to do that. One update of your login screens every 4 years ain't that bad of a deal!\r\n\r\n## Translation impact\r\n\r\nThis PR introduces 15 new language strings, modifies 0 language strings and deletes 0 language strings.\r\n\r\nAverage translator time required: 10 minutes.\r\n\r\n## How to link Facebook Login to your Joomla! site\r\n\r\n### Setting things up on Facebook\r\n\r\nBefore you can use Facebook Login on your site you must create a Facebook App. Even though it sounds scary, a Facebook App is simply a way for you to get a set of access codes which let you identify your site on Facebook.\r\n\r\nStart by visiting [Facebook For Developer's site](https://developers.facebook.com/apps)\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/01.png)\r\n\r\nClick the *+ Add New App* button on the search bar. A popup opens.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/02.png)\r\n\r\nIn the popup enter the following information:\r\n\r\n* **Display name**: When the visitors to your site click on Login with Facebook they will be told that an app by that name requires permission to see their full name and email address. It's a good idea to put the name of your site here.\r\n* **Contact email**: This is the email Facebook will use to contact you whenever there is an important reason. This is NOT visible to the visitors of your site. Enter the email address of the person who will be managing this site.\r\n* **Category**: Choose the category that best matches your Facebook App. \"Apps for Pages\" seems to be the most fitting category for a Facebook App used for site login.\r\n\r\nNow press the blue *Create app ID* button at the bottom right of the popup dialog.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/03.png)\r\n\r\nIn the *Product Setup* page click on the *Get Started* button next to the Facebook Login option. You will see the Facebook Login feature's *Getting Started* page.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/04.png)\r\n\r\nScroll all the way to the bottom of the page.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/05.png)\r\n\r\nThis is the important part. Find the *Valid OAuth redirect URIs* option. You will need to enter a URL in the form `http://www.example.com/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw` replacing `http://www.example.com` with the real URL of your site.\r\n\r\nKeep in mind that Facebook is looking for an **exact match** of the URL being sent to it. Here are some gotchas regarding this requirement and how to deal with them:\r\n* If you have a site which is accessible through BOTH an `http://` and an `https://` URL you will need to enter both URL variations, with and without HTTPS. For example `http://www.example.com/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw` for the plain HTTP version of your site and `https://www.example.com/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw`\r\n* If your site is accessible through multiple domain / subdomain names you will need to enter the URLs for each and every domain / subdomain. For example, if your site is available through example.com (without www in front!), www.example.com (with www in front) and www.example.net (different domain name, note it's .net instead of .com!) you will need to enter THREE URLs there, `http://example.com/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw`, `http://www.example.com/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw` and `http://www.example.net/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw`. Of course if you have HTTP and HTTPS on each domain you will need to also add the HTTPS versions of these three URLs for a total of _six (6)_ URLs.\r\n* If your site is installed in a subdirectory you must use the full path to your site. For example, if your site is installed in http://www.example.com/joomla the URL you need to enter here is `http://www.example.com/joomla/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw`\r\n* You CAN set up localhost URLs here to test this feature on your local development site. For example, if your site is installed in http://localhost/joomla_test you need to enter here is `http://localhost/joomla_test/index.php?option=com_ajax&group=authentication&plugin=facebook&format=raw`\r\n* Your site MUST NOT convert these callback URLs to SEF URLs. The plugin itself is designed to never do that but some overzealous SEF / SEO plugins may end up doing that. If you get a message from Facebook about the callback URL not being allowed try disabling all SEO / SEF plugins on your site. If that helped please ask its developer to add an exception for com_ajax URLs (URLs to com_ajax must NEVER be translated to SEF format).\r\n\r\nClick on the blue *Save Changes* button to save the setup. Then click on the Settings link in the left hand sidebar.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/06.png)\r\n\r\nNote down the **App ID**. This is the **Facebook Application ID** you need to enter to the plugin on your site.\r\n\r\nWe need one more piece of information. Inside the *App Secret* area click on the *Show* button. Facebook will ask you to enter your password.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/08.png)\r\n\r\nAfter entering your password successfully you will see your **App Secret**. Note it down. This is the **Facebook Application Secret** you need to enter to the plugin on your site.\r\n\r\n**Tip**: You can always view the App ID and App Secret at any time by going to https://developers.facebook.com/apps and selecting your site's Facebook App.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/07.png)\r\n\r\nAs an _optional_ step, we recommend adding a logo to your Facebook App, typically the logo of your site. This will be shown to your site's visitors and it's useful to let them understand that the login request does come from your site. It must be 1024 x 1024 pixels square. Click inside the *App Icon* image to select a new file. Finally click on *Save Changes* to save the new logo.\r\n\r\n### Setting things up on Joomla\r\n\r\nLogin to your site's administrator backend and go to Extensions, Plugins. Find the plugin *Authentication – Facebook*.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/09.png)\r\n\r\nClick on the plugin's name to edit its configuration.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/10.png)\r\n\r\n* **Facebook Application ID** The App ID you noted down when setting up the application (see the previous section). This is required for the plugin to work.\r\n* **Facebook Application ID** The App Secret you noted down when setting up the application (see the previous section). This is required for the plugin to work.\r\n* **Create new user accounts?** When enabled, a new Joomla! user account will be created for user who do not already have a Joomla! user account with the same email as their Facebook account's email address. New user accounts will NOT be created if user registration is disabled in the Users component. If user registration is set to Self or Admin an account verification email will be sent out to the user or the administrators (respectively). However, no email will be sent and the account will be immediately activated *when the Facebook account is reported as \"verified\"*. A \"verified\" Facebook account means that the Facebook user has already verified their email address or phone number with Facebook. As such, there is no need to verify that person's email address again.\r\n\r\n### Using the plugin\r\n\r\nWhen the plugin is enabled, the Login module in the frontend of the site displays a Facebook Login button. Click on it.\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/11.png)\r\n\r\nThe first time you do that, you'll be asked to grant permissions to the Facebook App to read your full name and email. After accepting that you are magically logged in!\r\n\r\n![Facebook for Developers](https://dl.dropboxusercontent.com/u/5168399/fb_login_joomla/12.png)\r\n\r\nAny subsequent click on the Facebook Login button on that site will magically log you into your Joomla site – as long as you are logged into Facebook.\r\n\r\n## Special considerations (READ ME BEFORE COMMENTING)\r\n\r\nIf you have not read this section and ask me something I have covered here I will reply to you with \"RTFM\". I know it's rude, but so is not reading the fine manual someone spent hours of his life writing only to ask what's already in it, you know?\r\n\r\n### Backend login\r\n\r\nI decided against it. For starters, there are the security considerations below. However, the real show-stopper is the need for separate callback URLs in the front- and backend. In the frontend we can use com_ajax, exactly for the reason it's designed for.\r\n\r\nIn the backend we'd have to hardcode a feature in JApplicationSite to let certain callback URLs to be accessible without a user login. This could be easily abused by misguided developers to enable all sorts of callbacks in their components, all exposed from backend URLs. The security implications are chilling!\r\n\r\nThe other alternative is having the plugin initiate a backend login through a frontend URL. While technically possible, this is a violation of Joomla's security model of two separate and distinct applications. Even worse, this kind of code could set a precedent for unified front- and backend login or other frontend integrations which result in administrator backend access. This is EXTREMELY DANGEROUS and strongly advised AGAINST.\r\n\r\nFurthermore, even if we did implement that in a secure way (e.g. using single use, very limited expiration time tokens stored in cookies), we face another issue. Redirecting from the frontend to the backend may trigger another security feature installed on many sites, a secret URL parameter which must be present in the URL the first time a session accesses the administrator folder. Think about Admin Tools' Secret URL Parameter feature, jSecure etc. Note however that a .htaccess password protection for the administrator folder *is* compatible with redirections or even Facebook's callback system itself (it takes place through browser redirections which work fine with a .htaccess password).\r\n\r\n### Bypassing TFA\r\n\r\nBy its nature, Facebook Login bypasses Two Factor Authentication. You are essentially outsourcing authentication to a third party system (Facebook) and trust its security model.\r\n\r\nThis cannot be worked around unless Joomla! implements real Two Factor Authentication. Right now we have second factor authentication which means that the user needs to provide their username (public information), password (first authentication factor) and secret code (second authentication factor). Basically, the secret key is a second, mandatory, password.\r\n\r\nReal TFA is more like Google implements it. First you authenticate yourself with the minimum required information, e.g. a username and password, or a social login. At this point you have a _captive login_ i.e. you have a logged in user but they have no permissions to carry out any action. In fact, trying to carry any action will bring them back to the captive login page where they have to supply their second authentication factor (security code, hardware token, SMS, ...). As we had discussed in _20-freaking-11_ this would require a MAJOR b/c change in Joomla: JUser would need to report one of three states (guest, captive, logged in) instead of simply returning a boolean with `isGuest()`. We'd need to either remove `isGuest()` to prevent old code from assuming that a non-guest user is logged in (or return false for captive log-ins) and at least add an `isCaptive()` method to report captive logins. All the JUser authorization methods also need to change. Furthermore, JApplicationWeb would need to catch captive logins and only allow a specific com_users page to be displayed, much like we force the Joomla! login page in the backend when there's no logged in user. All of that is way out of scope of this PR and right into Joomla! 4 or Joomla! X territory.\r\n\r\nSo trust me when I say that your only option is to disregard TFA with social logins, much like every existing implementation out there (and not just Joomla ones!) currently does.\r\n\r\n### Email spoofing\r\n\r\nAs it is right now, any Facebook account that matches the email address of a user account in Joomla will result in the user getting logged in as the matching user account. If you have a Joomla user account with the email `foo@example.com` and someone else creates a FB account with the email `foo@example.com` they can login as you. This implies that they know your email address and you don't have a Facebook account under that email.\r\n\r\nThere are two ways to deal with that.\r\n\r\n1. **Only allow verified accounts to log in**. Only persons who have verified their phone or email address with Facebook will be able to use the Facebook Login feature. This MAY cause some problems with users who haven't bothered to do that. I don't know how common an unverified account is.\r\n2. **Require manually linking the Facebook account with the Joomla user account**. That would happen either implicitly (a new user account is created through the Facebook Login feature) or explicitly (the user links their Facebook account with the site). The latter requires writing a user plugin to handle that case.\r\n\r\n### Stolen Facebook accounts\r\n\r\nObviously, if someone steals your Facebook account credentials or otherwise manages to get hold of your Facebook account they can use it to log in to your site.\r\n\r\n### MITM attacks\r\n\r\nFacebook Login hinges on the secure exchange of information from your site to Facebook (exchanging a temporary code with a Facebook token). This communication does take place through HTTPS and we do check the certificate's validity. A Man In The Middle attack would require not just DNS spoofing or an active MITM attack, but also a \"perfect\" forged certificate for facebook.com, signed by a commercial CA. This means that this kind of attack is only possible forvery sophisticated attackers or state actors.\r\n\r\n### No account unlinking\r\n\r\nAt this point there's no way to unlink your Facebook account from the site. Doing so would require two things:\r\n\r\n1. A user plugin to let you link / unlink a Facebook account to your user account. I didn't write one because at this point the PR is speculative, there's no Joomla roadmap and I don't know if I have wasted my time or if people are REALLY interested in my code :p\r\n2. Implementing yet another callback in the plugin which would let Facebook ping us when a user revokes our application's privileges inside Facebook itself (\"uninstall\" the app from their profile). I think that's a useless feature since even if he does and we do nothing about it (the code as is) any further logins will simply display the app authorization page again. No big deal.\r\n\r\nSo unless you want to make privacy paranoids happy there's no need to expend energy towards this."},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/242982098","html_url":"https://github.com/joomla/joomla-cms/pull/11778#issuecomment-242982098","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/11778","id":242982098,"user":{"login":"PhilETaylor","id":400092,"avatar_url":"https://avatars.githubusercontent.com/u/400092?v=3","gravatar_id":"","url":"https://api.github.com/users/PhilETaylor","html_url":"https://github.com/PhilETaylor","followers_url":"https://api.github.com/users/PhilETaylor/followers","following_url":"https://api.github.com/users/PhilETaylor/following{/other_user}","gists_url":"https://api.github.com/users/PhilETaylor/gists{/gist_id}","starred_url":"https://api.github.com/users/PhilETaylor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PhilETaylor/subscriptions","organizations_url":"https://api.github.com/users/PhilETaylor/orgs","repos_url":"https://api.github.com/users/PhilETaylor/repos","events_url":"https://api.github.com/users/PhilETaylor/events{/privacy}","received_events_url":"https://api.github.com/users/PhilETaylor/received_events","type":"User","site_admin":false},"created_at":"2016-08-28T15:54:02Z","updated_at":"2016-08-28T15:54:02Z","body":"@nikosdion could this not be yet another \"option\" that can be set by the site admin? "}}
{"actor":{"display_login":"PhilETaylor"}}