Docs on Debian SSO added

This commit is contained in:
Christoph Haas 2017-04-19 00:19:20 +02:00
parent 601f202463
commit 6c938df258

View file

@ -40,10 +40,14 @@ Client Secret:
Available login buttons: https://login.amazon.com/button-guide
## launchpad
## Launchpad
TODO
## Github
TODO
## Caveats
The OAuth callback handling uses Ruby's "faraday" library. Unfortunately
@ -53,3 +57,29 @@ So the path to the certificates on the system needs to be provided:
config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}}
For another explanation of the issue see: https://gist.github.com/kt103099/3183125
## Debian
The Debian SSO service uses certificates to provide access for Debian developers.
If the frontend web server (e.g. nginx) is told to allow optional authentication
using SSL client certificates then a visitor gets requested to send a certificates
if one is installed in the browser. Otherwise users just do not notice anything.
Authentication can be tested by:
cd nginx
nginx -c `pwd`/nginx.conf
(Ignore the warning about the error log file.)
Then point your browser to: https://localhost:3001/
The relevant part of the Nginx configuration:
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
However the CRL (certificate revocation list) needs to be updated regularly.
The appropriate update script can be found at:
https://anonscm.debian.org/cgit/debian-sso/debian-sso.git/plain/update-debsso-ca