Need Guidance on the Google App Engine Users API Future Directions

[PK]

I am looking for some guidance on the roadmap of the Users API.

The Users API is a great simple API and has served me OK for a while. However, I am getting a little bit uneasy with the lack of progress on the following issues. I would like to hear from Google whether these issues will be taken care of and by when or whether I should invest in some other Google Accounts authentication API that will integrate at the same level with GAE. In the latter case, what is that API.

Here is my list of issues, most of them with links to the public tracker:

1. Multiple Google users in the same browser session are not supported correctly. (see public tracker bugs  9045, 8916)

2. Certain Google authentication workflows lead to errors (see bug 10001)

3. Certain Google App Engine authentication workflows have usability issues with small displays (see bug 12537, 4935)

4. Finally, as my application matures I want to see additional functionality to the Users API that has not changed for five years now. For instance, I want to know whether a user used 2-step verification to login so that I can restrict access based on that information.

I would appreciate a response in public or private. I am willing to sign NDA as well because I need to make some decisions on how to proceed.

Thanks,
PK

www.gae123.com

[Darshan-Josiah Barber]

I don't know if this will be helpful to you or not, but I randomly came across the Google Identity Toolkit a few weeks ago and wished I'd known about it sooner.  It has some issues of its own, but it is being actively worked on and overall is a better solution for my current project than the App Engine Users API.

[Jeff Schnitzer]

I don't have any special information but I've noticed the Users API has remained pretty much as-is since I arrived. I also don't think it's particularly clever. Other than for prototyping in the early days, I have avoided it.

Google Identity Toolkit is nice. Or, if you want simple and google-only, just use the auth2 javascript (this is what I do now).

There's surprisingly little advantage to having an auth framework built into GAE. All you need is one CDN-hosted javascript for the client and a small token validation library for the server.

Jeff

--
You received this message because you are subscribed to the Google Groups "Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-appengi...@googlegroups.com.
To post to this group, send email to google-a...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-appengine.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-appengine/E0D23358-E1F7-4756-8FCC-0EAA33800015%40gae123.com.
For more options, visit https://groups.google.com/d/optout.

[pdknsk]

I don't know if this will be helpful to you or not, but I randomly came across the Google Identity Toolkit a few weeks ago and wished I'd known about it sooner.

Thanks for mentioning it. I have bookmarked it for later use.