No description
Find a file
2017-08-10 14:52:58 +02:00
ansible Continued working on Ansible playbook 2017-04-09 23:25:33 +02:00
app Go back to Ruby 2.3. No main logo animation. 2017-07-26 11:34:19 +02:00
bin General version updates 2017-08-10 14:52:58 +02:00
config Added welcome and profile actions to the my controller 2017-04-23 13:37:48 +02:00
db Added welcome and profile actions to the my controller 2017-04-23 13:37:48 +02:00
doc Added welcome and profile actions to the my controller 2017-04-23 13:37:48 +02:00
lib Ruby 2.4 compatibility fix 2017-04-23 22:56:26 +02:00
log Blank rails 4.0 project started 2013-07-27 00:19:29 +02:00
nginx Dummy SSL certificate for localhost added 2017-04-22 18:25:25 +02:00
public SSO login buttons added 2017-04-19 13:00:07 +02:00
test Fixed deprecation warnings 2017-04-17 00:02:23 +02:00
vendor/assets Removed vendor jQuery fancybox stylesheet - it's included in the Gem 2016-04-06 16:42:20 +02:00
.gitignore Put variables into .rbenv-vars but don't check it in 2017-04-19 00:18:27 +02:00
.ruby-version Go back to Ruby 2.3. No main logo animation. 2017-07-26 11:34:19 +02:00
config.ru Blank rails 4.0 project started 2013-07-27 00:19:29 +02:00
Gemfile meta_request gem added to be able to use the RailsPanel browser addon 2017-04-22 17:40:14 +02:00
Gemfile.lock General version updates 2017-08-10 14:52:58 +02:00
Guardfile Removed "rails s" from Guardfile 2015-04-24 12:20:06 +02:00
Rakefile Blank rails 4.0 project started 2013-07-27 00:19:29 +02:00
README.developer.md Hint on how to setup Google OAuth added 2017-04-22 18:23:33 +02:00

Authentication

The application uses omniauth to allow local authentication for moderators and adds OAuth authentication to connect to Google+, Github and other authentication providers.

Documentation on omniauth:

https://github.com/omniauth/omniauth/wiki/List-of-Strategies https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview

List of strategies:

https://github.com/omniauth/omniauth/wiki/List-of-Strategies

Google

The client ID for the debshots and the private key must be set as environment variables before running the application:

  • GOOGLE_CLIENT_ID=…
  • GOOGLE_CLIENT_SECRET=…

To manage OAuth applications at Google: https://console.developers.google.com/apis/credentials

Authorized callback URLs must be set to:

Amazon

The client ID for the debshots and the secret must be set as environment variables before running the application:

  • AMAZON_CLIENT_ID=…
  • AMAZON_CLIENT_SECRET=…

Client ID:

amzn1.application-oa2-client.78d832919fc24456b0636762cf18efd9

Client Secret:

8c495d0940ca4100313c03e93b8b4240eef256d2fdbe672718506f29f5a20f61

Available login buttons: https://login.amazon.com/button-guide

Launchpad

TODO

Github

TODO

Caveats

The OAuth callback handling uses Ruby's "faraday" library. Unfortunately Faraday may easily miss the directory where the common CAs are stored. So the path to the certificates on the system needs to be provided:

config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}}

For another explanation of the issue see: https://gist.github.com/kt103099/3183125

Debian

The Debian SSO service uses certificates to provide access for Debian developers. If the frontend web server (e.g. nginx) is told to allow optional authentication using SSL client certificates then a visitor gets requested to send a certificates if one is installed in the browser. Otherwise users just do not notice anything.

Authentication can be tested by:

cd nginx
nginx -c `pwd`/nginx.conf

(Ignore the warning about the error log file.)

Then point your browser to: https://localhost:3001/

The relevant part of the Nginx configuration:

ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;

However the CRL (certificate revocation list) needs to be updated regularly. The appropriate update script can be found at: https://anonscm.debian.org/cgit/debian-sso/debian-sso.git/plain/update-debsso-ca