Gerrit User Authentication

David Ostrovsky

Gerrit User Authentication

Gerrit UI authentication

Auth schemes used by open source projects

Google shuts down the OpenID 2.0

OpenID 2.0 for Google Accounts has gone

img/openid-for-google-accounts-has-gone.png

Adjust Gerrit to Google’s OpenID 2.0 shutdown

Migration path from Google OpenID 2.0 to …

Options for Gerrit users

Vote on the issue in issue tracker

img/gerrit-issue-openid-not-supported-by-google.png

So let’s add GitHub OAuth support to Gerrit core

img/github-oauth-support-in-gerrit-core.png

Lessons learned?

Pluggable OAuth provider approach (1)

Pluggable OAuth provider approach (2)

@ExtensionPoint
public interface OAuthServiceProvider {
  /**
   * Returns the URL where you should redirect your users to
   * authenticate your application.
   */
  String getAuthorizationUrl();

  /**
   * Retrieve the access token
   */
  OAuthToken getAccessToken(OAuthVerifier verifier);

   /**
   * After establishing of secure communication channel,
   * this method supossed to access the protected resoure
   * and retrieve the user infos.
   */
  OAuthUserInfo getUserInfo(OAuthToken token) throws IOException;
}

Pluggable OAuth provider approach (3)

img/gerrit-pluggable-oauth-provider-approach.png

Pluggable OAuth provider approach (4)

img/gerrit-oauth-provider-plugin.png

Pluggable OAuth provider approach (5)

img/gerrit-oauth-signin-multiple-providers.png

GitHub OAuth plugin

public class GitHubApi {

  private static final String AUTHORIZE_URL =
      "https://github.com/login/oauth/authorize?client_id=%s&redirect_uri=%s";

  @Override
  public String getAccessTokenEndpoint() {
    return "https://github.com/login/oauth/access_token";
  }
  [...]

Google OAuth plugin

public class GoogleApi {

  private static final String AUTHORIZE_URL =
      "https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=%s&redirect_uri=%s&scope=%s";

  @Override
  public String getAccessTokenEndpoint() {
    return "https://accounts.google.com/o/oauth2/token?grant_type=authorization_code";
  }
  [...]

Job done

What is with existing Gerrit sites?

Hybrid OpenID+OAuth auth scheme (1)

Hybrid OpenID+OAuth auth scheme (2)

img/gerrit-oauth-openid-hybrid-auth-scheme.png

Hybrid OpenID+OAuth auth scheme (3)

Linking between OpenID and OAuth

Resources

Questions

New and Noteworthy in Gerrit (1)

New and Noteworthy in Gerrit (2)

New and Noteworthy in gerrit (3)

img/gerrit-import-gpg-key-view.png

New and Noteworthy in Gerrit (4)

img/gerrit-signed-push-confirmation.png

New and Noteworthy in Gerrit (5)

New and Noteworthy in Gerrit (6)

New and Noteworthy in Gerrit (7)

Conclusion

Thank you

David Ostrovsky

Maintainer, Gerrit Code Review