Project abandoned?

[edwinbalani]

There are a variety of open issues and bugfix PRs, dating back three years now.

Is UIS/@cambridgeuniversity still maintaining mod_ucam_webauth?

I note that https://raven.cam.ac.uk/project/#aa says:

University Information Services maintains and supports:

• an Ucam WebAuth authentication handler for Apache [i.e. mod_ucam_webauth]
• a Java toolkit implementing Ucam WebAuth functionality

(I assume the above URL is still maintained...)

Admittedly the prominent banner at the top of that page says "[t]he WebAuth protocol should not be used for new sites or applications", but this does not necessarily mean that UIS has withdrawn support for it or prevented its use. Indeed there are plenty of existing sites and applications today using the deprecated protocol against the UIS-run Raven service.

What is the plan for mod_ucam_webauth and the protocol it speaks?

[mgkuhn]

Good question. Both the inventor of the UcamWebauth protocol and initial author of mod_ucam_webauth (John Warbrick @jw35) and its main developer (Matthew Vernon mcv21) have left the University. A more recent maintainer (Sam Wenham @sdwenham sdw37) still works at the UIS, but appears to have only looked after the build mechanics for Linux distribution packages, rather than the main code base.

The only post-2015 development commits were regarding a number of itches of mine for which I prepared pull requests in 2017 (which @jw35 merged here), mainly avoiding secret keys in config files #19 and displaying more correct error pages #17. I don't have any commit rights here.

The new main Raven developer (Rich Wareham) is keen to switch to OpenID Connect as the future main authentication protocol of Raven (probably not a bad idea), and so I suspect mod_auth_openidc might eventually become the successor of this module. You can use that already now via https://accounts.google.com/, which has long passed all [email protected] logins through Raven.

So if you are keen to continue development of mod_ucam_webauth, it is probably time to fork this project, as I don't expect any more work on it from the UIS.

I have started to campaign that my past mod_ucam_webauth issues now also get also fixed in mod_auth_openidc (which repeats some of the shortcomings of mod_ucam_webauth that I had already fixed there).

[mgkuhn]

If the current owners of this repository were willing to give me write access to this repository, I would also be happy to review and merge pull requests that are obviously uncontroversial. I do not work for the UIS; I'm just a lecturer/webmaster next door at the computer-science department who happens to know many of the people involved in Raven.