The typo3.org project

The problem with the login is the following (I wrote mails to Andi, Robert and Karsten informing them about that fact):

The username and password fields on the conference website are obsolete and cannot work, because we now use rsa encryption on typo3.org.

On the old typo3.org it worked out to directly send a post request via https to typo3.org with the correct username and password parameters, triggering a login on typo3.org. After the user was logged in, the SSO plugin was triggered and the user got redirected back to the conference site with the correct SSO parameters triggering authentication on the conference website.

Now that we use rsa encryption on typo3.org the conference website cannot share a session with typo3.org where parts of the rsa key to encrypt the password are stored. Thus submitting username and plaintext password (https encrypted) to typo3.org does not do anything, but presenting a login box on typo3.org where the user must again enter username and password. After that login is successful, the SSO plugin redirects back to the conference site with a valid token so that finally the user is logged in there.

Basically, one can just submit the login form on the conference site with no credentials at all, the important part only is logging in at typo3.org and being redirected back to the conference site.

As said above, I already suggested to change the login box on the conference site(s) to just be a link to the sso-plugin on typo3.org like on every other page (wiki, forge, mantis) we have, but nothing has been done in that regard yet.