Fedora in GNOME Online Accountes

Hello, I don't know if this is the right place to ask this question.
Btw, on Fedora 31, in the Online Accounts list there is a "Fedora"
voice  alongside "Google", "Nextcloud" and so on. What is its
purpose?

Thanks,
A.

[Felipe Borges]

Hi!

On Wed, Sep 18, 2019 at 11:07 AM <alciregi(a)gmail.com&gt; wrote:
>  Hello, I don't know if this is the right place to ask this question.
>  Btw, on Fedora 31, in the Online Accounts list there is a "Fedora"
>  voice  alongside "Google", "Nextcloud" and so on. What is its
> purpose? 
The "Fedora" account is just a branded Kerberos account. By adding a
Fedora account in GNOME Online Accounts you would get automatically
signed on whenever you'd need to enter your FAS credentials. This
means while accessing Pagure, participating in discussions in
discussion.fedoraproject.org, and also while using Bodhi, Koji, and
all.

>  Thanks,
>  A.
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]

On Wed, 2019-09-18 at 11:18 +0200, Felipe Borges wrote:
>  The "Fedora" account is just a branded Kerberos account. By
> adding a
>  Fedora account in GNOME Online Accounts you would get automatically
>  signed on whenever you'd need to enter your FAS credentials. This
>  means while accessing Pagure, participating in discussions in
>  discussion.fedoraproject.org, and also while using Bodhi, Koji, and
>  all. 
:-O
Nice!

Thank you for the answer.


Ciao,
A.

[Ismael Olea]

On Wed, Sep 18, 2019 at 11:21 AM Felipe Borges <feborges(a)redhat.com&gt; wrote:


The "Fedora" account is just a branded Kerberos account. By adding a
Fedora account in GNOME Online Accounts you would get automatically
signed on whenever you'd need to enter your FAS credentials.


Love it.

-- 

Ismael Olea

http://olea.org/diario/

[Sheogorath]

On 9/18/19 11:18 AM, Felipe Borges wrote:
>  Hi!
>  
>  On Wed, Sep 18, 2019 at 11:07 AM <alciregi(a)gmail.com&gt; wrote:
> >
> > Hello, I don't know if this is the right place to ask this question.
> > Btw, on Fedora 31, in the Online Accounts list there is a "Fedora"
> > voice  alongside "Google", "Nextcloud" and so on. What is its
> purpose?
>  
>  The "Fedora" account is just a branded Kerberos account. By adding a
>  Fedora account in GNOME Online Accounts you would get automatically
>  signed on whenever you'd need to enter your FAS credentials. This
>  means while accessing Pagure, participating in discussions in
>  discussion.fedoraproject.org, and also while using Bodhi, Koji, and
>  all.
>   
Just out of curiosity, is this done by a patch or with a separate package?

-- 
Signed
Sheogorath

OpenPGP: https://shivering-isles.com/openpgp/0xFCB98C2A3EC6F601.txt

[Ernestas Kulik]

On Wed, 2019-09-18 at 13:52 +0200, Sheogorath via devel wrote:
>  On 9/18/19 11:18 AM, Felipe Borges wrote:
>  > Hi!
>  > 
>  > On Wed, Sep 18, 2019 at 11:07 AM <alciregi(a)gmail.com&gt; wrote:
>  > > Hello, I don't know if this is the right place to ask this
>  > > question.
>  > > Btw, on Fedora 31, in the Online Accounts list there is a
>  > > "Fedora"
>  > > voice  alongside "Google", "Nextcloud" and so on. What is
> its
>  > > purpose?
>  > 
>  > The "Fedora" account is just a branded Kerberos account. By adding
>  > a
>  > Fedora account in GNOME Online Accounts you would get automatically
>  > signed on whenever you'd need to enter your FAS credentials. This
>  > means while accessing Pagure, participating in discussions in
>  > discussion.fedoraproject.org, and also while using Bodhi, Koji, and
>  > all.
>  > 
>  
>  Just out of curiosity, is this done by a patch or with a separate
>  package? 

Looks like https://gitlab.gnome.org/GNOME/gnome-online-accounts/merge_requests/27

-- 
Ernestas Kulik
Associate Software Engineer - Base Operating Systems (Core
Services/ABRT)
Red Hat Czech, s.r.o.

On Wed, Sep 18, 2019 at 11:18 am, Felipe Borges <feborges(a)redhat.com&gt; 
wrote:
>  The "Fedora" account is just a branded Kerberos account. By
> adding a
>  Fedora account in GNOME Online Accounts you would get automatically
>  signed on whenever you'd need to enter your FAS credentials. This
>  means while accessing Pagure, participating in discussions in
>  discussion.fedoraproject.org, and also while using Bodhi, Koji, and
>  all.
>   
Sadly, it's broken for me because it still doesn't work in flatpak. :(

I wonder if we can get the right people together to discuss how to make 
this work.

Michael

[Robbie Harwood]

mcatanzaro(a)gnome.org writes:

>  Felipe Borges <feborges(a)redhat.com&gt; wrote:
>
> > The "Fedora" account is just a branded Kerberos account. By adding a
> > Fedora account in GNOME Online Accounts you would get automatically
> > signed on whenever you'd need to enter your FAS credentials. This
> > means while accessing Pagure, participating in discussions in
> > discussion.fedoraproject.org, and also while using Bodhi, Koji, and
> > all.
>
>  Sadly, it's broken for me because it still doesn't work in flatpak. :(
>
>  I wonder if we can get the right people together to discuss how to make 
>  this work. 
Can you link the bug you've filed about this?

Thanks,
--Robbie

On Wed, Sep 18, 2019 at 10:43 am, Robbie Harwood <rharwood(a)redhat.com&gt; 
wrote:
>  Can you link the bug you've filed about this? 
I don't even know where to file a bug. Which component? kerberos? 
xdg-desktop-portal?

It's seems less like a bug in any Fedora component, rather something 
that's never been designed to work. How is kerberos supposed to work 
under flatpak without a desktop portal to make it work? I don't know. 
It needs people who understand both kerberos and flatpak to think about 
it.

Michael

[Robbie Harwood]

mcatanzaro(a)gnome.org writes:

>  Robbie Harwood <rharwood(a)redhat.com&gt; wrote:
>
> > Can you link the bug you've filed about this?
>
>  I don't even know where to file a bug. Which component? kerberos?
>  xdg-desktop-portal? 
When filing bugs that you don't know the cause of, it's best to start
with the highest level component that doesn't exhibit the behavior you
want and let the maintainers narrow it down and possibly reassign.

So: probably gnome-online-accounts.

>  It's seems less like a bug in any Fedora component, rather
> something
>  that's never been designed to work. How is kerberos supposed to work
>  under flatpak without a desktop portal to make it work? I don't know. 
There's basically no chance of it ever working if there's no bug :)

>  It needs people who understand both kerberos and flatpak to think
>  about it. 
Well, they probably don't exist, so if you don't want to file a bug,
you're out of luck.  I (krb5 maintainer) don't "understand" flatpak, at
any rate (beyond knowing that I don't have a use case for it).

Thanks,
--Robbie

[Debarshi Ray]

Hey,

Speaking as someone who understands a little bit of all the pieces
involved here, but without claiming to be an expert in anything ...

I would expect Flatpak containers to consume Kerberos in roughly the
same way as Toolbox [1] containers do.

First, the host must be configured to use KCM credential caches
[2]. That's been the case since Fedora 27.

The container should similarly be configured to use KCM. Then you bind
mount the KCM socket into the container, and things (eg., klist,
kinit, other libkrb5 consumers, etc.) should work.

On Fedora, you can see the path to the socket with:
$ systemctl show --value --property Listen sssd-kcm.socket

There's also libkrb5 API to do the same.

The socket usually lives at /var/run/.heim_org.h5l.kcm-socket

Now, since this is Flatpak, we may eventually want to have a desktop
portal to gate access to the socket instead of giving the application
blanket access. I vaguely recall these old mockups from pre-Flatpak
days, but they very likely need to be revisited:
https://wiki.gnome.org/Design/Whiteboards/EnterpriseLogin

I hope that makes sense.

Cheers,
Rishi

[1] https://github.com/debarshiray/toolbox
[2] https://fedoraproject.org/wiki/Changes/KerberosKCMCache

[Michael Catanzaro]

So with help from Rishi, we got it working by:

 * Adding a config file [1] into the container.
 * Poking a hole in the flatpak sandbox [2], though this is clearly a 
nasty hack.

I think this will do for now, though improvements would be good....

[1] 
https://gitlab.gnome.org/GNOME/gnome-build-meta/merge_requests/389/diffs
[2] 
https://gitlab.gnome.org/GNOME/epiphany/commit/bba622a1b92c29cad65af3ca27...

[Matthew Miller]

On Thu, Sep 19, 2019 at 09:42:04AM -0500, Michael Catanzaro wrote:
>  So with help from Rishi, we got it working by:
>  * Adding a config file [1] into the container.
>  * Poking a hole in the flatpak sandbox [2], though this is clearly a
>  nasty hack.
>  I think this will do for now, though improvements would be good.... 

Nasty hack and all, this is really cool! Thanks everyone for working to make
this happen!


-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[Peter Robinson]

On Wed, 18 Sep 2019, 11:21 Felipe Borges, <feborges(a)redhat.com&gt; wrote:

>  Hi!
>
>  On Wed, Sep 18, 2019 at 11:07 AM <alciregi(a)gmail.com&gt; wrote:
> >  
>  > Hello, I don't know if this is the right place to ask
> this question.
>  > Btw, on Fedora 31, in the Online Accounts list there is a "Fedora"
>  > voice  alongside "Google", "Nextcloud" and so on. What is its
> purpose?
>
>  The "Fedora" account is just a branded Kerberos account. By adding a
>  Fedora account in GNOME Online Accounts you would get automatically
>  signed on whenever you'd need to enter your FAS credentials. This
>  means while accessing Pagure, participating in discussions in
>  discussion.fedoraproject.org, and also while using Bodhi, Koji, and
>  all.
>  
Not everything afaict, pagure uses API keys for example, some Fedora
services are kerberised but it's far from all.

>