Yubico Forum

Hi
I've created a little plugin for the Wordpress blog system.

http://henrik.schack.dk/yubikey-plugin/

The plugin uses the Yubico server for authentication, but I guess a future version will include support for
a buildin authenticationserver.

Awesome stuff!

Thanks Henrik!

Hi henrik,

The url to the plugin on your blog is not working, please could you provide me with the correct url?

Thanks in advance,
Wouter

Ooops, sorry a typo, I've fixed it now

Thank you!

Works like a charm! Great bit of sample code too!

I second that - awesome work!

I've just setup the plugin on a wordpress 2.5.1 under debian testing.

Initially i got this error when signing in with the plugin active



when signing in as php support for curl was not installed on my box



cured that. many thanks,

Dave.

Very neat! The code looks really clean and high quality too. Thanks, Henrik!

Since my own personal blog (blog.josefsson.org) uses wordpress, I'd like to use it... but when I enable it, I just get . The password is correct. Any ideas? Where are things logged anyway?

Using a packet sniffer, I can see that the request to/from api.yubico.com works fine, and comes back with an OK, so I believe the client key id/key is correct. I've tried setting the yubikey id both pasting in an entire OTP and cut'n'paste'ing in the first 12 characters only, but no difference.

Any ideas?

Is it possible to disable password authentication, and just use yubikey authentication?

/Simon

I solved the problem: My server still uses php4, so it doesn't have the 'hash' requirement. I modified the following line:



into:



So that it uses mhash instead of the newer hash interface. Then it worked fine. Great! Now 'blog.josefsson.org' is a user of the yubikey/wordpress-plugin!

I would suggest that the code checks for hash+curl libraries earlier, is it possible to do this using a 'require' or similar?

I'm still curious whether it is possible to disable password authentication.

/Simon

Happy You figured out the hash problem, I must admit I didn't think about testing against PHP4 as it is very very close to end of life.

I have been looking into ways of testing for Curl & Hash lib presence, but there isn't any really nice way to do it in Wordpress, you can't prevent the plugin from being installed or anything like that.
How about a solution where the plugin gets installed but the loginpage tells that the functionality has been disabled due to missing libs ?

I'm not sure there is a hook that makes it possible to disable password auth. But I'll look into it

/Henrik Schack

Looks very interesting. I will certainly try to look a bit into this code and try to use it in a future WordPress-installations.