1 |
On Mon, May 18, 2020 at 11:47 PM Michał Górny <mgorny@g.o> wrote: |
2 |
|
3 |
> On Mon, 2020-05-18 at 18:42 -0700, Alec Warner wrote: |
4 |
> > TL;DR: What if we launched id.gentoo.org, an identity provider that |
5 |
> > provides authentication for Gentoo properties? Basically, 1 username / |
6 |
> > password for wiki, bugs, email, forums, and any other http service[0][1]. |
7 |
> > |
8 |
> > Today Gentoo has numerous systems that mostly work in a segmented way. |
9 |
> > |
10 |
> > - To connect to hosts, we use ssh keys. |
11 |
> > - Git is authenticated via ssh keys. |
12 |
> > - Email uses LDAP passwords. |
13 |
> > - Bugzilla has its own identities, with their own passwords. |
14 |
> > - Wiki is separate, with its own passwords. |
15 |
> > - Forums are separate. |
16 |
> > - Infra has an additional 4 systems that use separate credentials. |
17 |
> > |
18 |
> > Some applications support 2FA (such as wiki.) |
19 |
> > Some applications do not support 2FA. |
20 |
> > Applications that require 2FA have a configuration for each app, so you |
21 |
> > have N configurations. |
22 |
> > |
23 |
> > If we configured id.gentoo.org you would have 1 identity across all |
24 |
> gentoo |
25 |
> > properties. |
26 |
> > |
27 |
> > Is this a thing people are interested in? |
28 |
> > |
29 |
> |
30 |
> What a coincidence I've just archived our old identity.gentoo.org [1] |
31 |
> project. And yes, we almost had this back in 2013 but Infra failed to |
32 |
> deploy, and it was claimed obsolete by the time I joined Infra. |
33 |
> |
34 |
> Do you have any specific solution in mind? |
35 |
> |
36 |
|
37 |
Currently we have a standalone keycloak install with LDAP user federation. |
38 |
We are looking to do a domain installation for redundancy purposes. |
39 |
Our existing LDAP infrastructure for example (which few services use for |
40 |
Auth) has at least 3 replicas. |
41 |
|
42 |
-A |
43 |
|
44 |
|
45 |
> |
46 |
> [1] https://gitweb.gentoo.org/archive/proj/identity.gentoo.org.git/ |
47 |
> |
48 |
> |
49 |
> -- |
50 |
> Best regards, |
51 |
> Michał Górny |
52 |
> |
53 |
> |