search

jruesga / rview

A Gerrit client application for Android
Apache License 2.0
66 stars 21 forks source link

OAuth support #62

Open martin-kaiser opened 6 years ago

martin-kaiser commented 6 years ago

I just downloaded rview from Google Play, it looks quite good. Thanks for all the work to make this happen.

One thing I would like to see as an improvement is support for OAuth.I would like to use rview with Wireshark's gerrit ( https://code.wireshark.org/review/ ), where it's possible to log in using a google or github account. It seems that this is not supported by rview, a local account on the gerrit server is required.

jruesga commented 6 years ago

@martin-kaiser OAuth is only supported for the web, the REST API cannot obtain a access_token and a refresh_token to create a good UX for the user. The only thing (although is really hacky and not recommended by Google) one can do is to obtain the XSRF cookie, but it tied to a web session, so when the cookie expiration time get reach, i have to show the oauth dialog again to the user to login again. In fact, I opened a Gerrit ticket a cople days ago to just ask about future OAuth plans for REST api (https://groups.google.com/forum/#!topic/repo-discuss/l3tGPm72I6A).

If you want to use the access wireshark with authentication, you should use an "http password". Just login into the Wireshark Gerrit website, and go to settings. There is a settings called "HTTP password" which allows you to generate a token password for the use with the REST api. Create a new account inside Rview and in the authentication wizard type the username and password from that pages. For simplify things, in that account wizard page, there is a link (a red 'here' link) that redirects you to the settings page (after request you to login in the Gerrit instance). Copy the password and return back to the wizard and paste the password.

Anyway, I will leave this request open, since I'm also insterested in support OAuth as an authentication mecanish for Rview.

micgro42 commented 5 years ago

This issue exists for https://gerrit.wikimedia.org/r/ as well. Could you add a note somewhere in the app that explains informs the user about this?

jruesga commented 5 years ago

@micgro42 in the authentication account wizard page, there is a help menu (im the three dots menu) that displays a dialog explaining all the supported authentication methods.