From 6c938df2581071c807536040423ac7ec4b665770 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Wed, 19 Apr 2017 00:19:20 +0200 Subject: [PATCH] Docs on Debian SSO added --- README.developer.md | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/README.developer.md b/README.developer.md index 412b8fb..3fb58ac 100644 --- a/README.developer.md +++ b/README.developer.md @@ -40,10 +40,14 @@ Client Secret: Available login buttons: https://login.amazon.com/button-guide -## launchpad +## Launchpad + +TODO ## Github +TODO + ## Caveats The OAuth callback handling uses Ruby's "faraday" library. Unfortunately @@ -53,3 +57,29 @@ So the path to the certificates on the system needs to be provided: config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}} For another explanation of the issue see: https://gist.github.com/kt103099/3183125 + +## Debian + +The Debian SSO service uses certificates to provide access for Debian developers. +If the frontend web server (e.g. nginx) is told to allow optional authentication +using SSL client certificates then a visitor gets requested to send a certificates +if one is installed in the browser. Otherwise users just do not notice anything. + +Authentication can be tested by: + + cd nginx + nginx -c `pwd`/nginx.conf + +(Ignore the warning about the error log file.) + +Then point your browser to: https://localhost:3001/ + +The relevant part of the Nginx configuration: + + ssl_client_certificate debsso.crt; + ssl_crl debsso.crl; + ssl_verify_client optional; + +However the CRL (certificate revocation list) needs to be updated regularly. +The appropriate update script can be found at: +https://anonscm.debian.org/cgit/debian-sso/debian-sso.git/plain/update-debsso-ca