announcing HTTPS pushing to dist-git/src.fedoraproject.org for packagers and non-packagers

[Kevin Fenzi]

Greetings.

I'm happy to announce that you can now use https to push commits

to src.fedoraproject.org. You will need to use 'fedpkg clone -a'

and have a session with a running browser to do the initial
authentication, but after that everything should be transparent.

Users who are not part of the 'packager' group can now use
this to push to forks of projects to create pull requests.

Please see https://fedoraproject.org/wiki/Infrastructure/HTTPS-commits

for more details.

We hope this support will allow more community members to
contribute along with allowing more flexibility to maintainers
who don't always have SSH access.

kevin

_______________________________________________
devel-announce mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]...

[Simo Sorce]

Any reason why oidc is required instead of a simple GSSAPI (via
mod_auth_gssapi) ?
GSSAPI authentication won't require a graphical session to work.

Simo.

On Mon, 2019-04-22 at 11:22 -0700, Kevin Fenzi wrote:
> Greetings.
>
> I'm happy to announce that you can now use https to push commits
>
> to src.fedoraproject.org. You will need to use 'fedpkg clone -a'
>
> and have a session with a running browser to do the initial
> authentication, but after that everything should be transparent.
>
> Users who are not part of the 'packager' group can now use
> this to push to forks of projects to create pull requests.
>
> Please see https://fedoraproject.org/wiki/Infrastructure/HTTPS-commits
>
> for more details.
>
> We hope this support will allow more community members to
> contribute along with allowing more flexibility to maintainers
> who don't always have SSH access.
>
> kevin
>
> devel-announce mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]...
> _______________________________________________
> devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]

[Patrick Uiterwijk]

Hi Simo,

On Mon, 22 Apr 2019 at 20:39, Simo Sorce  wrote:
> Any reason why oidc is required instead of a simple GSSAPI (via
> mod_auth_gssapi) ?
> GSSAPI authentication won't require a graphical session to work.

The main reasons for going with OIDS rather than GSSAPI are:

1. User support: we have had a *lot* of contributors that had issues
using GSSAPI for Fedora, often because they have older or
employer-specific krb configurations: a lot of them are for example
missing the "includedir /etc/krb5.conf.d" and the dns_kdc_lookup
options.
One other very common occurrence are the dns_canonicalize_hostname and
rdns options: the Fedora defaults for these options are required for
the Fedora Infra krb5 to work, but a lot of employers set (or even
require) these to be set to "true". Fedora Infra is unable to work
with these options set to true, because we have a lot of nodes for
which we do not control recursive DNS, in addition to the fact that we
have the exact same set of entry points for all services, which means
reverse DNS is useless.

2. With the upcoming account system change (to be backed by FreeIPA)
our plan is to start requiring 2 factor auth for some groups
(primarily the system administrators, it'll be opt-in for other
users), and then we want to be able to enforce using the same 2fa
tokens for any access.
The 2FA scheme that we are solely planning to support is U2F/FIDO2,
and to the best of my knowledge there has so far not been any work on
integrating this with any krb5 server.
The current plan is to integrate the 2FA flow into the identity
provider, and have it enforce and check the tokens. Using OpenID
Connect for this login would mean that we get the 2fa enforcement "for
free".

Also, please note that there are concrete plans to lift the
requirement for a graphical session for OpenID Connect tokens, but
that would be part of the same authentication work.

Patrick

[Simo Sorce]

On Mon, 2019-04-22 at 22:06 +0200, Patrick Uiterwijk wrote:
> Hi Simo,
>
> On Mon, 22 Apr 2019 at 20:39, Simo Sorce  wrote:
> > Any reason why oidc is required instead of a simple GSSAPI (via
> > mod_auth_gssapi) ?
> > GSSAPI authentication won't require a graphical session to work.
>
> The main reasons for going with OIDS rather than GSSAPI are:
> User support: we have had a *lot* of contributors that had issues
>
> using GSSAPI for Fedora, often because they have older or
> employer-specific krb configurations: a lot of them are for example
> missing the "includedir /etc/krb5.conf.d" and the dns_kdc_lookup
> options.
> One other very common occurrence are the dns_canonicalize_hostname and
> rdns options: the Fedora defaults for these options are required for
> the Fedora Infra krb5 to work, but a lot of employers set (or even
> require) these to be set to "true". Fedora Infra is unable to work
> with these options set to true, because we have a lot of nodes for
> which we do not control recursive DNS, in addition to the fact that we
> have the exact same set of entry points for all services, which means
> reverse DNS is useless.
> With the upcoming account system change (to be backed by FreeIPA)
>
> our plan is to start requiring 2 factor auth for some groups
> (primarily the system administrators, it'll be opt-in for other
> users), and then we want to be able to enforce using the same 2fa
> tokens for any access.
> The 2FA scheme that we are solely planning to support is U2F/FIDO2,
> and to the best of my knowledge there has so far not been any work on
> integrating this with any krb5 server.
> The current plan is to integrate the 2FA flow into the identity
> provider, and have it enforce and check the tokens. Using OpenID
> Connect for this login would mean that we get the 2fa enforcement "for
> free".
>
> Also, please note that there are concrete plans to lift the
> requirement for a graphical session for OpenID Connect tokens, but
> that would be part of the same authentication work.

I guess I should have asked why don't you allow *both*.

Apache definitely support stacking multiple auth methods and then users
could use either (not admins once 2FA is required at least until they
will be able to get krb creds via 2FA, but that's ok).

Simo.

[Robbie Harwood]

> The 2FA scheme that we are solely planning to support is U2F/FIDO2, and to the best of my knowledge there has so far not been any work on integrating this with any krb5 server.

It's not done, but I'm definitely working on this.  We deployed [SPAKE](https://www.ietf.org/id/draft-ietf-kitten-krb-spake-preauth-06.txt) which was the first step, and it is planned.

You know who we are and can absolutely reach out to us when you have feature requests.  I enjoy hearing from users - especially when I can make things better, which I can't do when I don't know what the problems are.

Thanks,
--Robbie

[Vitaly Zaitsev]

Hello, Kevin Fenzi.

Mon, 22 Apr 2019 11:22:27 -0700 you wrote:
> If you are in the packager group you can still push via ssh for now. In time, we are planning to deprecate this.

And this is not good. Received HTTPS tokens can be easily stolen. SSH
keys using hardware tokens much more secure.

--
Sincerely,
 Vitaly Zaitsev ([e-mail])

[Nicolas Mailhot]

Le lundi 22 avril 2019 à 11:22 -0700, Kevin Fenzi a écrit :
> Greetings.
>
> I'm happy to announce that you can now use https to push commits
>
> to src.fedoraproject.org.

Awesome. Can it be extended to pagure.io pretty please? For Fedora
projects hosted here, the number of pagure commits dwarfs the numer of
src.fedoraproject.org commits

Regards,

[Kevin Fenzi]

On 4/22/19 11:41 PM, Nicolas Mailhot wrote:
> Le lundi 22 avril 2019 à 11:22 -0700, Kevin Fenzi a écrit :
> > Greetings.
> >
> > I'm happy to announce that you can now use https to push commits
> >
> > to src.fedoraproject.org.
>
> Awesome. Can it be extended to pagure.io pretty please? For Fedora
> projects hosted here, the number of pagure commits dwarfs the numer of
> src.fedoraproject.org commits

Sure, we would love to have something like this there, but it's not
going to be possible to do it the same way. We don't have a 'fedpkg'
there and thats what does all the setup getting tokens and configuring git.

In any case, it's definitely on the radar...

kevin