I am working on a central login system for an application that is written in Django, with a MediaWiki wiki and a Roundup bugtracker. At present, the method I am thinking of going with is to use the AuthDjango extension for Mediawiki (https://bitbucket.org/toml/django-mediawiki-authentication/src) and hack up something similar for Roundup. This method relies on the creation of a SessionProfile model in Django which maps session IDs (taken from cookies) to User instances, and MediaWiki/Roundup accesses the data by directly querying the Django database.
The advantage of this are that login, session and logout processes across all three apps are easily unified. However, the issue I have is that it relies on MediaWiki/Roundup having stored credentials for the Django database, and the requirements to get access to the MediaWiki or Roundup shell accounts are intentionally less stringent than for the main Django app (currently only one person has Django production access). So admins of the MediaWiki/Roundup instance (i.e. with shell access), or anyone who broke in via a remote exploit, would potentially be able to hijack user accounts on the main site.
So my question is: does anyone know of a better way to integrate the login mechanisms of these systems? Or, how would I be able to give MediaWiki/Roundup secure access to the Django database while minimizing the potential for abuse by people with access to the MediaWiki shell?
Instead of providing direct DB access, you could use Django to create a (JSON/XML/whatever) web service to perform only the actions you need - log in, query session validity and user, log out. This way only Django has the ability to edit data in the database.
Mediawiki and Roundup would then connect to your Django app (which you could lock down, e.g. it can only be accessed internally if all 3 apps are running on the same server) via a HTTP(S) call to check which user is associated with a particular session.
Even better, redirect users to the Django app to perform login and logout functions; that way Mediawiki and Roundup won't have access to user credentials at all - they can only retrieve user information if they provide a valid session ID.