[WIP] OpenId login support #271

strk · 2016-11-26T15:14:50Z

Far from ready, but open for contribution (mostly needs
UI and UX)

stevenroose · 2016-11-27T22:48:05Z

Fixes #185

ethantkoenig · 2016-12-14T18:11:12Z

routers/user/auth.go

@@ -100,6 +100,19 @@ func SignIn(ctx *context.Context) {
 	ctx.HTML(200, tplSignIn)
 }

+// OpenidVerify handles response from OpenID provider
+func OpenidVerify(ctx *context.Context) {


Should this be renamed to OpenIDVerify for consistency? It seems that most other names use OpenID instead of Openid?

ethantkoenig · 2016-12-14T18:11:56Z

models/user.go

@@ -85,6 +85,7 @@ type User struct {
 	Repos       []*Repository `xorm:"-"`
 	Location    string
 	Website     string
+	Openid      string


Should this be renamed OpenID for consistency?

strk · 2016-12-14T20:52:44Z

Renamed, although consistency is not the immediate problem with this work ... I wonder if OpenID should just be optionally associated to users who do also have another way to log in, as done with GNUSocial and Friendica, for example. I'm not sure if auto-registration makes sense with OpenID as you still need to provide a username just OpenID would replace your password, basically.

stevenroose · 2016-12-14T21:55:04Z

@strk I don't think OpenID as an "authentication method" makes a lot of sense. (It is a valid authentication method though, so it does make sense.)

The big advantage I would see from having OpenID is as a way of users to login without having been registered. Just like systems like Discuss allow anyone with an OpenID (even though Discuss requires this to be from a small set of providers) to make contributions in the form of issues or (federated) pull requests.

A possible setup that would benefit greatly from OpenID is the case of single-user usage. Gitea as a self-hosted Git homepage in which only one user has commit access, while he can allow anyone to open issues or request pulls with their OpenID (and a CAPTCHA ofc).

strk · 2016-12-14T22:31:25Z

I think you'll still want to create a local user for "guests" so to be able to grant them special access to some repos. The OpenID auth method is just a facility for those guests so they don't need to remember yet another password. The "registration" phase is still needed because you want: 1) To assign a username (for referencing) 2) To store an email (for notification) 3) To remember the user preferences I think what should happen in the "OpenID Login" page is that if your OpenID url is valid but not yet registered you're are asked to fill up the form (username/email/captcha?) and then you're in. For an OpenID url to be valid I guess we'd also want it not to be in a blacklist, or to be in a whitelist if given.

allandegnan · 2016-12-16T10:13:40Z

So actually we (https://github.com/UKHomeOffice) use OpenIDConnect to facilitate single sign on back to a single auth provider and we occasionally use SAML to provide the same thing.

Whilst I'm not saying that the addiontion of this feature itself would make us a gitea shop, not having it is a bit of a blocker when it comes to enteprisr adoption.

strk · 2016-12-16T10:22:57Z

@allandegnan this pr is about OpenID rather than OpenID Conenct. The difference is that while OpenID allows people to sign in using arbitrary URLS, OpenID Connect requires consumers to know providers in advance, restricting accessibility. I think there's an OpenID Connect extension allowing for discovery of providers, to do something similar to what OpenID does, but I've never seen an implmentation of such a system. Your UKHomeOffice usecase seems to be no different, is that correct ?

We still want to support OpenID Connect but should probably not replace OpenID.
See also #27

allandegnan · 2016-12-16T10:26:48Z

@strk That makes sense. Thanks for clearing up the nuances between the two standards.

strk · 2016-12-16T10:29:09Z

Issues to keep in mind while implementing OpenID: https://sites.google.com/site/openidreview/issues

strk · 2016-12-16T10:44:38Z

I love the way OpenID is implemented in GNUSocial. See an example: https://loadaverage.org/main/openid

How it goes:

From the login page you have a try OpenID login link
The OpenID login page asks for OpenID url and remember me option
If users is found by OpenID url, she's logged in
If user is not found, a, OpenID Account Setup page is shown, from here user can:
- connect her OpenID URL to an existing account, in which case the corresponding password is requested
- create a new user, in which case user and email are requested (defaulting to those communicated by the OpenID provider, if any.

bkcsoft · 2016-12-11T00:30:19Z

models/error.go

+// ErrDelegatedAuth is not a real error but notifies code that
+// authentication is delegated to a second request.
+type ErrDelegatedAuth struct {
+	OP string // OpenID Provider


Should probably be Provider or OpenIDProvider (I'm partial to the former)

strk · 2016-12-20T09:49:19Z

If we take the "dedicated OP login" approach this ErrDelegatedAuth would not be needed. It was just an hack to force OpenID into the chain of "login sources".

Handle OpenID redirection Implement the verfication routes ... still all to be architectured

willemvd · 2017-01-02T11:21:52Z

I'm searching through the different issues and pr's , but can find a final decision if OpenId Connect will be support or not.
Can somebody tell me if it is?

Oh and btw, found this library for OpenId Connect, maybe that might help :)
https://github.com/coreos/go-oidc

strk · 2017-01-02T12:13:41Z

On Mon, Jan 02, 2017 at 03:21:53AM -0800, willemvd wrote: I'm searching through the different issues and pr's , but can find a final decision if OpenId Connect will be support or not. Can somebody tell me if it is?

Free software is driven by do-ocracy. OpenID Connect will be available if anyone will code it. Are you up for it ?

willemvd · 2017-01-02T12:34:59Z

Guess the answer to my question is a "no" then

To answer your question... no, because I don't have any Go knowledge

strk · 2017-01-02T19:28:54Z

Your question was about decisions being taken, personally I think decision have no weight until backed up by actual work. To my knowledge there's no code yet for "OpenID Connect" support, but I've heard someone mentioning they'd want to implement it. You may file an issue suggesting it and see if anyone jumps in to provide code.

- Resolves go-gitea#271 - Ensure that the adminstrator password is at least `MIN_PASSWORD_LENGTH`.

- Resolves go-gitea#271 - Ensure that the adminstrator password is at least `MIN_PASSWORD_LENGTH`. (cherry picked from commit 28cb04c3f5040980e716ce66cd5906f324257e02) (cherry picked from commit 95371ebd92cd005e2d50a4754e60525cf6135b86) (cherry picked from commit a134288ab6b0291082d913c4e22456b31af58af9) (cherry picked from commit 4202f052cb32aec71a61dd2afd814035a9d85eea) (cherry picked from commit 510b7467d3ee0bf346ad1843775affe1df0675ae) (cherry picked from commit f3a6e1f121e89aaf608fd9890eaf06ed939d1006) (cherry picked from commit f340508819866f355feec6d01b349fa7df29ace9) (cherry picked from commit b891bb176d48c3855cc5b6e4573e7a337af9d382) (cherry picked from commit 1a1bfc38cc7863f5cb3022560cacb2006d08f113) (cherry picked from commit 083d5aefed10e54814c4438eabcd01973d305502) (cherry picked from commit 4586096be9b6214058245da3227541866ea4312f) (cherry picked from commit 039fa20cc8a5b50d5cc37de4503e8a9a80042bcc)

- Resolves go-gitea#271 - Ensure that the adminstrator password is at least `MIN_PASSWORD_LENGTH`. (cherry picked from commit 28cb04c3f5040980e716ce66cd5906f324257e02) (cherry picked from commit 95371ebd92cd005e2d50a4754e60525cf6135b86) (cherry picked from commit a134288ab6b0291082d913c4e22456b31af58af9) (cherry picked from commit 4202f052cb32aec71a61dd2afd814035a9d85eea) (cherry picked from commit 510b7467d3ee0bf346ad1843775affe1df0675ae) (cherry picked from commit f3a6e1f121e89aaf608fd9890eaf06ed939d1006) (cherry picked from commit f340508819866f355feec6d01b349fa7df29ace9) (cherry picked from commit b891bb176d48c3855cc5b6e4573e7a337af9d382) (cherry picked from commit 1a1bfc38cc7863f5cb3022560cacb2006d08f113) (cherry picked from commit 083d5aefed10e54814c4438eabcd01973d305502) (cherry picked from commit 4586096be9b6214058245da3227541866ea4312f) (cherry picked from commit 039fa20cc8a5b50d5cc37de4503e8a9a80042bcc) (cherry picked from commit 3ec9cb5) (cherry picked from commit 00be0eee3727130966c34a3b95b10f2af06ea2ec) (cherry picked from commit a1566030025df8cc83d20cbe2b6fb0f87304a1a5) (cherry picked from commit 4d305e77742c181f68cd24724dfc685723a41b31) (cherry picked from commit 51e8f21202ea766d69a4b3c26f44c6db07f47844) (cherry picked from commit 58e354c98e6b361f6d651ffdca3d5cb459adbf2f) (cherry picked from commit 20405564f56775ba0f29a54c9a6eca8136d8ac99) (cherry picked from commit 1d7f49568319cfa49e9c8338f2375432f4917739) (cherry picked from commit d457b9c9111c04ffcd26ff859e2ad804697c2621) (cherry picked from commit 72b54bc4cce030540310e50acc41ea789a1e5221) (cherry picked from commit d7ce723e350d21ef42eba7b7013543e2ba6e0e17) (cherry picked from commit ce5f863d5d3eff77b9736db453f0f9a65241c9bb) (cherry picked from commit 324b9318acbf5e12be922ee7f8fc0f0fece1743a) (cherry picked from commit fff11fc) (cherry picked from commit d3fa04aa699883df9b227382190f57726c591cb8) (cherry picked from commit d3b24691f389d863be834ccc8b2c8910b1614f30) (cherry picked from commit 736dfab3ae943fb1b87a5468248c5d80887a5e7c) (cherry picked from commit 8be95ef7f41c9e1d343a89cbfe67bdccc01df1f8) (cherry picked from commit 0ce04d93a858a61d322750906629ce7da0e22116)

strk force-pushed the openid-gitea branch from ec45db4 to 730bfc8 Compare November 26, 2016 15:55

andreynering added this to the 1.1.0 milestone Nov 26, 2016

andreynering added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Nov 26, 2016

lunny added the type/proposal The new feature has not been accepted yet but needs to be discussed first. label Nov 27, 2016

strk force-pushed the openid-gitea branch from 730bfc8 to e3cb8d5 Compare November 27, 2016 11:02

tboerger added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Nov 27, 2016

strk force-pushed the openid-gitea branch 4 times, most recently from 1e51a25 to 8c4784d Compare December 3, 2016 11:38

strk mentioned this pull request Dec 10, 2016

Support federated login for guest users (OpenID) #185

Closed

strk force-pushed the openid-gitea branch 3 times, most recently from 7bbaea1 to 174a949 Compare December 13, 2016 09:35

ethantkoenig reviewed Dec 14, 2016

View reviewed changes

strk force-pushed the openid-gitea branch from 2bc00fe to 1a69599 Compare December 16, 2016 13:57

bkcsoft suggested changes Dec 20, 2016

View reviewed changes

tboerger added the pr/wip This PR is not ready for review label Dec 20, 2016

strk force-pushed the openid-gitea branch from 1a69599 to 68eb6c1 Compare December 20, 2016 18:13

Stub openid support

cb2ce01

Handle OpenID redirection Implement the verfication routes ... still all to be architectured

strk force-pushed the openid-gitea branch from 68eb6c1 to cb2ce01 Compare December 24, 2016 16:31

strk closed this Jan 5, 2017

strk deleted the openid-gitea branch January 5, 2017 08:39

strk mentioned this pull request Jan 8, 2017

Login via OpenID-2.0 #618

Merged

tboerger removed this from the 1.1.0 milestone Jan 16, 2017

go-gitea locked and limited conversation to collaborators Nov 23, 2020

earl-warren pushed a commit to earl-warren/gitea that referenced this pull request Jun 24, 2023

Add password length check on install page

582aec8

- Resolves go-gitea#271 - Ensure that the adminstrator password is at least `MIN_PASSWORD_LENGTH`.

delvh added issue/not-a-bug The reported issue is the intended behavior or the problem is not inside Gitea and removed reviewed/invalid labels Oct 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] OpenId login support #271

[WIP] OpenId login support #271

strk commented Nov 26, 2016

stevenroose commented Nov 27, 2016

ethantkoenig Dec 14, 2016

ethantkoenig Dec 14, 2016

strk commented Dec 14, 2016 via email

stevenroose commented Dec 14, 2016 •

edited

Loading

strk commented Dec 14, 2016 via email

allandegnan commented Dec 16, 2016

strk commented Dec 16, 2016

allandegnan commented Dec 16, 2016

strk commented Dec 16, 2016

strk commented Dec 16, 2016

bkcsoft Dec 11, 2016

strk commented Dec 20, 2016 via email

willemvd commented Jan 2, 2017 •

edited

Loading

strk commented Jan 2, 2017 via email

willemvd commented Jan 2, 2017

strk commented Jan 2, 2017 via email

[WIP] OpenId login support #271

[WIP] OpenId login support #271

Conversation

strk commented Nov 26, 2016

stevenroose commented Nov 27, 2016

ethantkoenig Dec 14, 2016

Choose a reason for hiding this comment

ethantkoenig Dec 14, 2016

Choose a reason for hiding this comment

strk commented Dec 14, 2016 via email

stevenroose commented Dec 14, 2016 • edited Loading

strk commented Dec 14, 2016 via email

allandegnan commented Dec 16, 2016

strk commented Dec 16, 2016

allandegnan commented Dec 16, 2016

strk commented Dec 16, 2016

strk commented Dec 16, 2016

bkcsoft Dec 11, 2016

Choose a reason for hiding this comment

strk commented Dec 20, 2016 via email

willemvd commented Jan 2, 2017 • edited Loading

strk commented Jan 2, 2017 via email

willemvd commented Jan 2, 2017

strk commented Jan 2, 2017 via email

stevenroose commented Dec 14, 2016 •

edited

Loading

willemvd commented Jan 2, 2017 •

edited

Loading