Auto-attach: simplified registration/download process

This document describes a process by which volunteers download BOINC and attach to projects or account managers.

The current download/attach process has two problems:

• Too many clicks.
• Much of the GUI is in the Manager.

The new process reduces clicks and shifts most of the GUI to the web. This lets us use things like OpenAuth and Recaptcha, and provides a more unified experience.

Note: this process only works for "vetted" projects and AMs, i.e. those that appear on the BOINC web site. Making it work for arbitrary projects would decrease security.

New download/attach process

Front page

If no user is logged in, the project or AM front page has a button linked to a "Join" page (signup.php).

Join page

The page has a create account form. Submission of the form goes to the Download page.

Download page

This page says something like:

• To participate in X, your computer must have BOINC (and possibly VBox) installed.
• If these are already installed, a link to a page with instructions for adding project via the Manager.
• Possibly instructions for installing VBox
• Buttons to download BOINC and possibly BOINC+VBox. These show the download size, platform name, and version, like the download page on the BOINC web site.

Note: if your project requires VirtualBox, put

<need_vbox/>

in your config.xml.

If your project can use VirtualBox but doesn't require it, use

<recommend_vbox/>

If neither of these is present, VBox-related info won't be shown.

Manager

When the manager is first run, it is attached to the project or account manager, to the user's account. No user interaction with the Manager is needed.

User experience

In summary, the new-user process is:

1. Visit project or account manager web site, click on Join".
2. Enter email/passwd, click OK
3. Click Download
4. Click on installer, choose defaults

Improvements:

1. User doesn't leave the project web site (e.g. doesn't land on BOINC web site)
2. User doesn't see the list of all projects.

What projects must do to use this feature

• Have your project vetted if not already.
• Run the script html/ops/get_versions to get the current client version list. You must re-run this script after new client releases; I'll email to boinc_projects about this.
• Add to config.xml:

  <project_id>N</project_id>
  

  where N is the project's ID, as shown in ​https://boinc.berkeley.edu/project_list.php. And optionally:

   <min_core_client_version>70803</min_core_client_version>
   <need_vbox/>
  

• Add a button linking to register.php. During testing, hide this. After testing, put it on the home page.

Implementation

When a user is shown the Download page, the server code creates a "login token" - a string of 8 random hex chars. It stores the token and the current time in the user DB record.

The client installer is downloaded indirectly via a script on the BOINC web server (concierge.php). This is passed the project ID, the login token, and the installer filename. It downloads the file, appending the project ID and login token to the filename.

When the BOINC installer is launched, it writes the installer filename to a file "installer_filename.txt" in the BOINC data directory.

When the client startup it, it looks for this file. If found, does a "lookup account token" RPC to the project, obtaining the user name and a weak authenticator. It attaches to the project using this authenticator.

Unsupported platforms

What if the computer is of a type for which the project has no apps? The user should learn this immediately. E.g. viewed from an Android device, the front page could say something like:

This project is not able to use Android devices. Please visit this site from a Windows, Mac, or Linux computer.

Android case

The auto-attach mechanism doesn't work for Android. Instead, show:

• [Download BOINC] (link to Google or Amazon app store)
• Open BOINC, select Add Project, and choose (project name)