debshots/doc/README.authentication.md
2017-08-14 08:09:07 +02:00

92 lines
2.6 KiB
Markdown

# Authentication
The application uses _omniauth_ to allow local authentication for moderators
and adds OAuth authentication to connect to Google+, Github and other
authentication providers.
Documentation on omniauth:
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
List of strategies:
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
## Google
The client ID for the debshots and the private key must be set as environment
variables before running the application:
* GOOGLE_CLIENT_ID=…
* GOOGLE_CLIENT_SECRET=…
To manage OAuth applications at Google: https://console.developers.google.com/apis/credentials
Authorized callback URLs must be set to:
- https://screenshots.debian.net/users/auth/google_oauth2/callback
- https://localhost:3001/users/auth/google_oauth2/callback
## Amazon
The client ID for the debshots and the secret must be set as environment
variables before running the application:
* AMAZON_CLIENT_ID=…
* AMAZON_CLIENT_SECRET=…
Client ID:
amzn1.application-oa2-client.78d832919fc24456b0636762cf18efd9
Client Secret:
8c495d0940ca4100313c03e93b8b4240eef256d2fdbe672718506f29f5a20f61
Available login buttons: https://login.amazon.com/button-guide
## Launchpad
TODO
## Github
TODO
## Caveats
The OAuth callback handling uses Ruby's "faraday" library. Unfortunately
Faraday may easily miss the directory where the common CAs are stored.
So the path to the certificates on the system needs to be provided:
config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}}
For another explanation of the issue see: https://gist.github.com/kt103099/3183125
## Debian
The Debian SSO service uses certificates to provide access for Debian developers.
If the frontend web server (e.g. nginx) is told to allow optional authentication
using SSL client certificates then a visitor gets requested to send a certificates
if one is installed in the browser. Otherwise users just do not notice anything.
Authentication can be tested by:
cd nginx
nginx -c `pwd`/nginx.conf
(Ignore the warning about the error log file.)
Then point your browser to: https://localhost:3001/
The relevant part of the Nginx configuration:
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
However the CRL (certificate revocation list) needs to be updated regularly.
The appropriate update script can be found at:
https://anonscm.debian.org/cgit/debian-sso/debian-sso.git/plain/update-debsso-ca