105 lines
No EOL
3.2 KiB
Markdown
105 lines
No EOL
3.2 KiB
Markdown
_Only local users (in the database) and single-sign-on via salsa.debian.org are currently supported._
|
|
|
|
# Authentication
|
|
|
|
The application uses _omniauth_ to allow local authentication for moderators
|
|
and adds OAuth authentication to connect to Google+, Github and other
|
|
authentication providers.
|
|
|
|
Documentation on omniauth:
|
|
|
|
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
|
|
https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
|
|
|
|
List of strategies:
|
|
|
|
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
|
|
|
|
## Google
|
|
|
|
The client ID for the debshots and the private key must be set as environment
|
|
variables before running the application:
|
|
|
|
export GOOGLE_CLIENT_ID=…
|
|
export GOOGLE_CLIENT_SECRET=…
|
|
|
|
To manage OAuth applications at Google: https://console.developers.google.com/apis/credentials
|
|
|
|
Authorized callback URLs must be set to:
|
|
|
|
- https://screenshots.debian.net/users/auth/google_oauth2/callback
|
|
- https://localhost:3001/users/auth/google_oauth2/callback
|
|
|
|
## Amazon
|
|
|
|
The client ID for the debshots and the secret must be set as environment
|
|
variables before running the application.
|
|
|
|
Client ID and secret:
|
|
|
|
export AMAZON_CLIENT_ID=…
|
|
export AMAZON_CLIENT_SECRET=…
|
|
|
|
These credential only work with https://screenshots.debian.net/
|
|
|
|
Available login buttons: https://login.amazon.com/button-guide
|
|
|
|
Make sure that the allowed callback URL is:
|
|
https://screenshots.debian.net/users/auth/amazon/callback
|
|
|
|
## Launchpad
|
|
|
|
No configuration necessary.
|
|
|
|
## Github
|
|
|
|
Environment variables have to be set before starting the application:
|
|
|
|
export GITHUB_KEY=…
|
|
export GITHUB_SECRET=…
|
|
|
|
Keys can be managed at https://github.com/settings/applications
|
|
To register a new oauth key go to "Developer Settings" in your Github account.
|
|
|
|
Make sure that the allowed callback URL is:
|
|
https://screenshots.debian.net/users/auth/github/callback
|
|
|
|
## StackExchange
|
|
|
|
No configuration necessary.
|
|
|
|
## Caveats
|
|
|
|
The OAuth callback handling uses Ruby's "faraday" library. Unfortunately
|
|
Faraday may easily miss the directory where the common CAs are stored.
|
|
So the path to the certificates on the system needs to be provided:
|
|
|
|
config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}}
|
|
|
|
For another explanation of the issue see: https://gist.github.com/kt103099/3183125
|
|
|
|
## Debian
|
|
|
|
The Debian SSO service uses certificates to provide access for Debian developers.
|
|
If the frontend web server (e.g. nginx) is told to allow optional authentication
|
|
using SSL client certificates then a visitor gets requested to send a certificates
|
|
if one is installed in the browser. Otherwise users just do not notice anything.
|
|
|
|
Authentication can be tested by:
|
|
|
|
cd nginx
|
|
nginx -c `pwd`/nginx.conf
|
|
|
|
(Ignore the warning about the error log file.)
|
|
|
|
Then point your browser to: https://localhost:3001/
|
|
|
|
The relevant part of the Nginx configuration:
|
|
|
|
ssl_client_certificate debsso.crt;
|
|
ssl_crl debsso.crl;
|
|
ssl_verify_client optional;
|
|
|
|
However the CRL (certificate revocation list) needs to be updated regularly.
|
|
The appropriate update script can be found at:
|
|
https://salsa.debian.org/debsso-team/debsso/raw/master/update-debsso-ca |