3.2 KiB
Only local users (in the database) and single-sign-on via salsa.debian.org are currently supported.
Authentication
The application uses omniauth to allow local authentication for moderators and adds OAuth authentication to connect to Google+, Github and other authentication providers.
Documentation on omniauth:
https://github.com/omniauth/omniauth/wiki/List-of-Strategies https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
List of strategies:
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
The client ID for the debshots and the private key must be set as environment variables before running the application:
export GOOGLE_CLIENT_ID=…
export GOOGLE_CLIENT_SECRET=…
To manage OAuth applications at Google: https://console.developers.google.com/apis/credentials
Authorized callback URLs must be set to:
- https://screenshots.debian.net/users/auth/google_oauth2/callback
- https://localhost:3001/users/auth/google_oauth2/callback
Amazon
The client ID for the debshots and the secret must be set as environment variables before running the application.
Client ID and secret:
export AMAZON_CLIENT_ID=…
export AMAZON_CLIENT_SECRET=…
These credential only work with https://screenshots.debian.net/
Available login buttons: https://login.amazon.com/button-guide
Make sure that the allowed callback URL is: https://screenshots.debian.net/users/auth/amazon/callback
Launchpad
No configuration necessary.
Github
Environment variables have to be set before starting the application:
export GITHUB_KEY=…
export GITHUB_SECRET=…
Keys can be managed at https://github.com/settings/applications To register a new oauth key go to "Developer Settings" in your Github account.
Make sure that the allowed callback URL is: https://screenshots.debian.net/users/auth/github/callback
StackExchange
No configuration necessary.
Caveats
The OAuth callback handling uses Ruby's "faraday" library. Unfortunately Faraday may easily miss the directory where the common CAs are stored. So the path to the certificates on the system needs to be provided:
config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}}
For another explanation of the issue see: https://gist.github.com/kt103099/3183125
Debian
The Debian SSO service uses certificates to provide access for Debian developers. If the frontend web server (e.g. nginx) is told to allow optional authentication using SSL client certificates then a visitor gets requested to send a certificates if one is installed in the browser. Otherwise users just do not notice anything.
Authentication can be tested by:
cd nginx
nginx -c `pwd`/nginx.conf
(Ignore the warning about the error log file.)
Then point your browser to: https://localhost:3001/
The relevant part of the Nginx configuration:
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
However the CRL (certificate revocation list) needs to be updated regularly. The appropriate update script can be found at: https://salsa.debian.org/debsso-team/debsso/raw/master/update-debsso-ca