search

go-gitea / gitea

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
https://gitea.com
MIT License
44.34k stars 5.43k forks source link

Support SAML 2.0 as Login-Source (Service Provider) #5512

Open frostieDE opened 5 years ago

frostieDE commented 5 years ago

It would be nice to be able to configure Gitea as a SAML service provider in order to integrate Gitea with a corporate Single-Sign-On mechanism.

techknowlogick commented 5 years ago

@frostieDE which IDP are you using (so that it can be tested against)?

nigeltiany commented 5 years ago

gSuite/Google Admin is a good test

frostieDE commented 5 years ago

We are using an own implementation of a SAML IdP, you may use https://github.com/capriza/samling or https://simplesamlphp.org/ for testing (but I hope there is a library for SAML stuff) :-)

jtl999 commented 5 years ago

@frostieDE Very interesting with regards to your IdP implementation. I too think this would be a great feature for Gitea.

frostieDE commented 5 years ago

This library looks promising: https://github.com/crewjam/saml

Unfortunately, I do not have any experience with Go programming 😄

d-Pixie commented 5 years ago

I was also looking for a good way to extend our G Suite identities into Gitea. Any thoughts on this internally @techknowlogick ?

lpar commented 5 years ago

I have experience integrating Go web applications with IBM's SAML infrastructure. I've successfully used https://github.com/russellhaering/gosaml2 for the task.

techknowlogick commented 5 years ago

@d-Pixie you could use OpenID Connect (Oauth2) for GSuite for now.

I second @lpar's suggestion of https://github.com/russellhaering/gosaml2 as having used it and crewjam's, I prefer ressell's.

chb0github commented 4 years ago

Is SAML supported? I'm confused.

fuero commented 3 years ago

As SAML based authentication has lots of login flow scenarios with libraries in different languages supporting them often poorly, I'd suggest leaving the heavy SAML2 lifting to a proxy/preauthentication scenario. Examples given are for the Shibboleth SAML2 reference SP implementation.

How it would work:

Zocker1999NET commented 3 years ago

@fuero Good idea, this would allow Gitea to "support" any authentication scheme available. To extend this approach:

nlincke commented 2 years ago

This is a bad idea! This would blow GITEA up alot! SAML2, or OIDC for that matter, are quite simple (you do not have to integrate everithing since gitea needs to act as a service and not as an IDP. And since oAuth is already incoperated into gitea OIDC is just a "small" addon. If you are making use of well known libaries like (https://github.com/crewjam/saml), it will be mor complicatetd to come up with a well designed user admin interface....

I am always a fan of doing the security right in the application not infront of the application.

MohammedNoureldin commented 2 years ago

Isn't there at the moment any workaround to get SSO in GitTea?

Zocker1999NET commented 2 years ago

Isn't there at the moment any workaround to get SSO in GitTea?

Gitea already supports OpenID Connect (OIDC) / OAuth2. If your identity provider does only support SAML, you can implement a middle-man service to "translate" between SAML & OIDC. Keycloak can do that, it is a little bit heavy to configure but it does its job well. There are maybe also alternatives to Keycloak which can do the same.

MohammedNoureldin commented 2 years ago

Isn't there at the moment any workaround to get SSO in GitTea?

Gitea already supports OpenID Connect (OIDC) / OAuth2. If your identity provider does only support SAML, you can implement a middle-man service to "translate" between SAML & OIDC. Keycloak can do that, it is a little bit heavy to configure but it does its job well. There are maybe also alternatives to Keycloak which can do the same.

Thanks! I am still a noob in SSO, SAML and OIDC. I have to educate myself a bit more in these topics.

Does it have to be KeyCloak for some reason? Or does Authentik for example also work?

Zocker1999NET commented 2 years ago

Thanks! I am still a noob in SSO, SAML and OIDC. I have to educate myself a bit more in these topics.

Does it have to be KeyCloak for some reason? Or does Authentik for example also work?

Following their comparison chart, Authentik seems to support this as they can provide OIDC and support federating with SAML. So it should be possible.

timka commented 1 year ago

Isn't there at the moment any workaround to get SSO in GitTea?

Gitea already supports OpenID Connect (OIDC) / OAuth2. If your identity provider does only support SAML, you can implement a middle-man service to "translate" between SAML & OIDC. Keycloak can do that, it is a little bit heavy to configure but it does its job well. There are maybe also alternatives to Keycloak which can do the same.

Thanks! I am still a noob in SSO, SAML and OIDC. I have to educate myself a bit more in these topics.

Does it have to be KeyCloak for some reason? Or does Authentik for example also work?

I'm using Gitea with Authentic OpenID as in their docs. It works but I still have some issues which at the first glance don't have anything to do with this auth provider. Namely Gitea doesn't set session cookie expiration time and my users keep complaining they need to do 5 click sign-in too often. Obviously this isn't quite SSO yet but this shouldn't be hard to fix.

MohammedNoureldin commented 1 year ago

@timka @Zocker1999NET , thank you both! Should there be any difference between using Authentik or KeyCloak for this puprose? I don't think so right?

timka commented 1 year ago

I haven't used KeyCloak. I've chosen Authentic simply b/c it's not Java and has more features.

On Tue, 25 Oct 2022 at 20:50, Mohammed Noureldin @.***> wrote:

@timka https://github.com/timka @Zocker1999NET https://github.com/Zocker1999NET , thank you both! Should there be any difference between using Authentik or KeyCloak? I don't think so right?

— Reply to this email directly, view it on GitHub https://github.com/go-gitea/gitea/issues/5512#issuecomment-1290935320, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAU6AR2J37MSRILO5IXPVTWFAMV3ANCNFSM4GJNSWCQ . You are receiving this because you were mentioned.Message ID: @.***>

-- Timur Izhbulatov +7 (910) 4604059

Zocker1999NET commented 1 year ago

@timka @Zocker1999NET , thank you both! Should there be any difference between using Authentik or KeyCloak for this puprose? I don't think so right?

Don't know much about Authentik (have only used Keycloak until now) but it seems to me that Keycloak is the "can more than you need & want" solution (highly adaptable but sometimes a mess to configure & some features require custom JavaScript code extensions) and Authentik looks more like the "Apple" solution to me (may has not all features you may dream of, but is much easier to configure). I think for your use case, Authentik should be good enough & the better choice.

6543 commented 1 year ago

sorry that's a new FR ... -> #23016

6543 commented 1 year ago

need to look at https://github.com/mattermost/gosaml2, https://github.com/russellhaering/gosaml2, https://github.com/crewjam/saml ...

6543 commented 1 year ago

saml:Attribute Name="memberOf" is also interesting to do some mapping to org/team memberships ...

... but that's an addition to the initial support I would say :)

bwinston-sdp commented 1 year ago

hey @wfjake let me know if you'd like some help, i'm definitely interested in this feature as well!