customize login in google app engine

Question

I need to add few more options for login and therefor need to customize create_login_url with some html code. Is there a way to add on your code in default login screen of google? ENvironment - python-google app engine. I want to continue having the default google ext class Users behavior to conntinue to be in place.

Answer 1

You can't customize the login page. Allowing you to do so would introduce the possibility of XSS vulnerabilities, as well as making it harder for users to identify a legitimate login page.

If you want to provide for federated login, you may want to simply redirect users to an interstitial page that allows them to pick standard Google login, or one of a number of other services.

Answer 2

You might consider OpenID, through any of the various open-source app engine projects for the purpose, such as this one for Django.

You can't use the existing Users module with those (save perhaps with some serious hacking, but I have not attempted such feats and would not necessarily recommend them;-), but the various projects in question tend to offer usable replacements.

Making your own login pages is also not too hard with these approaches, of course, since you start with all the sources to the "OpenID consumer" you choose to use.

I don't know if all the domains you want to support are OpenID providers (though I don't see why any site supporting its own user logins wouldn't also be an OpenID provider -- it's easy and makes it more valuable for users to have logins on that site!-), but I hope this will take you some part of the way towards your goal!

Answer 3

Nick Johnson recently released an alpha version of a WSGI middleware that you could use. The API is very similar to the standard Users API in app engine. It is a way to support auth via OpenID (something Alex Martelli suggested in his answer). Therefore you are able to support Google as Identity Provider as well as others. If you only want to support Google accounts for some reason, you could certainly only whitelist them though.

Nick's blog announcement also lists some things to consider (these might be deal-breakers for you):

• Users are identified uniquely by their OpenID endpoint.
• You can't construct a User object without specifying an OpenID URL.
• Nicknames and email addresses are user-supplied, so they're not guaranteed unique or validated.
• is_current_user_admin() is not yet implemented.
• login: clauses in app.yaml are not affected by AEoid - they still authenticate using the regular Users API.