Re: git smart http + apache mod_auth_openidc

2019-10-17 Thread Ralph Ewig
Understood (and agree). We do use git for source code (where we use SSH and key authentication for CI/CD), but also for configuration control of other files like financial reports, engineering drawings, etc. where access is via HTTPS.  In that 2nd group the challenge is to make it as "not cod

Re: git smart http + apache mod_auth_openidc

2019-10-17 Thread brian m. carlson
On 2019-10-17 at 14:33:38, Ralph Ewig wrote: > Quick follow up question: can the git client pass > a token read from a cookie with a request? That > would enable users to sign-in via a browser, store > the cookie, and then use that as the access token > to authenticate a git request. Git has an op

Re: git smart http + apache mod_auth_openidc

2019-10-17 Thread Ralph Ewig
Quick follow up question: can the git client pass a token read from a cookie with a request? That would enable users to sign-in via a browser, store the cookie, and then use that as the access token to authenticate a git request. On 10/16/2019 11:03 PM, Jeff King wrote: > On Thu, Oct 17, 2019

Re: git smart http + apache mod_auth_openidc

2019-10-17 Thread Ralph Ewig
Interesting ... I have not looked at access tokens before, but did find some documentation online that describes how Azure AD Jason Web Tokens can be used to authenticate a headless API (https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens), This seems to be a fit in thi

Re: git smart http + apache mod_auth_openidc

2019-10-16 Thread Jeff King
On Thu, Oct 17, 2019 at 03:00:58AM +, Ralph Ewig wrote: > Thanks for the reply. I was hoping the Git GUI > might be able to handle the OpenID authentication > flow, but it makes sense that it would be > inconsistent with other git clients. I don't think we'd ever do the full flow, but it m

Re: git smart http + apache mod_auth_openidc

2019-10-16 Thread Ralph Ewig
Thanks for the reply. I was hoping the Git GUI might be able to handle the OpenID authentication flow, but it makes sense that it would be inconsistent with other git clients. Azure AD does support both LDAP and Kerberos, but unfortunately only as an extra cost add-on called "Domain Services"

Re: git smart http + apache mod_auth_openidc

2019-10-16 Thread brian m. carlson
On 2019-10-15 at 15:59:03, Ralph Ewig wrote: > Hi Everyone, hoping you might have a solution for > this problem: > > CONTEXT > >  * I'm serving git repos using "smart https" via > apache and basic authentication; everything works > fine. >  * We're moving to SSO via Azure AD and apache > mo

git smart http + apache mod_auth_openidc

2019-10-15 Thread Ralph Ewig
Hi Everyone, hoping you might have a solution for this problem: CONTEXT  * I'm serving git repos using "smart https" via apache and basic authentication; everything works fine.  * We're moving to SSO via Azure AD and apache mod_auth_openidc; this works fine for gitweb (on the same server a