85 lines
2.4 KiB
Markdown
85 lines
2.4 KiB
Markdown
# Authentication
|
|
|
|
The application uses _omniauth_ to allow local authentication for moderators
|
|
and adds OAuth authentication to connect to Google+, Github and other
|
|
authentication providers.
|
|
|
|
Documentation on omniauth:
|
|
|
|
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
|
|
https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
|
|
|
|
List of strategies:
|
|
|
|
https://github.com/omniauth/omniauth/wiki/List-of-Strategies
|
|
|
|
## Google
|
|
|
|
The client ID for the debshots and the private key must be set as environment
|
|
variables before running the application:
|
|
|
|
* GOOGLE_CLIENT_ID=…
|
|
* GOOGLE_CLIENT_SECRET=…
|
|
|
|
## Amazon
|
|
|
|
The client ID for the debshots and the secret must be set as environment
|
|
variables before running the application:
|
|
|
|
* AMAZON_CLIENT_ID=…
|
|
* AMAZON_CLIENT_SECRET=…
|
|
|
|
|
|
Client ID:
|
|
|
|
amzn1.application-oa2-client.78d832919fc24456b0636762cf18efd9
|
|
|
|
Client Secret:
|
|
|
|
8c495d0940ca4100313c03e93b8b4240eef256d2fdbe672718506f29f5a20f61
|
|
|
|
Available login buttons: https://login.amazon.com/button-guide
|
|
|
|
## Launchpad
|
|
|
|
TODO
|
|
|
|
## Github
|
|
|
|
TODO
|
|
|
|
## Caveats
|
|
|
|
The OAuth callback handling uses Ruby's "faraday" library. Unfortunately
|
|
Faraday may easily miss the directory where the common CAs are stored.
|
|
So the path to the certificates on the system needs to be provided:
|
|
|
|
config.omniauth :google_oauth2, '398593918966-0fpmit0pb6ptio1ndsie5dfcnqhei63l.apps.googleusercontent.com', 'uRQq_dLs1kx7l5sYIyEyPVRc', :client_options => {:ssl => {:ca_path => '/etc/ssl/certs'}}
|
|
|
|
For another explanation of the issue see: https://gist.github.com/kt103099/3183125
|
|
|
|
## Debian
|
|
|
|
The Debian SSO service uses certificates to provide access for Debian developers.
|
|
If the frontend web server (e.g. nginx) is told to allow optional authentication
|
|
using SSL client certificates then a visitor gets requested to send a certificates
|
|
if one is installed in the browser. Otherwise users just do not notice anything.
|
|
|
|
Authentication can be tested by:
|
|
|
|
cd nginx
|
|
nginx -c `pwd`/nginx.conf
|
|
|
|
(Ignore the warning about the error log file.)
|
|
|
|
Then point your browser to: https://localhost:3001/
|
|
|
|
The relevant part of the Nginx configuration:
|
|
|
|
ssl_client_certificate debsso.crt;
|
|
ssl_crl debsso.crl;
|
|
ssl_verify_client optional;
|
|
|
|
However the CRL (certificate revocation list) needs to be updated regularly.
|
|
The appropriate update script can be found at:
|
|
https://anonscm.debian.org/cgit/debian-sso/debian-sso.git/plain/update-debsso-ca
|