Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for reverse proxy header authentication with email alone #19948

Closed
mhlakhani opened this issue Jun 12, 2022 · 0 comments · Fixed by #19949
Closed

Add support for reverse proxy header authentication with email alone #19948

mhlakhani opened this issue Jun 12, 2022 · 0 comments · Fixed by #19949
Labels
type/feature Completely new functionality. Can only be merged if feature freeze is not active. type/proposal The new feature has not been accepted yet but needs to be discussed first.
Milestone
1.18.0

Comments

@mhlakhani
Copy link
Contributor

Feature Description

Hi!

I saw it's possible to authenticate using a reverse proxy by sending an X-Webauth-User header. Optionally (if enabled in settings), if the X-Webauth-Email header is provided a user is also auto-registered.

For my internal setup at home, my reverse proxy does not have access to gitea usernames, but the sign in system has access to emails. Would it be possible to extend the code to allow authenticating just via the contents of X-Webauth-Email?

I'm happy to try and put up a PR myself if there are no objections to this feature.

Screenshots

No response
@mhlakhani mhlakhani added type/feature Completely new functionality. Can only be merged if feature freeze is not active. type/proposal The new feature has not been accepted yet but needs to be discussed first. labels Jun 12, 2022
mhlakhani added a commit to mhlakhani/gitea that referenced this issue Jun 12, 2022
@mhlakhani
Add support for authentication based on reverse proxy email.
4f6f95e 
This is useful in scenarios where the reverse proxy may have knowledge
of user emails, but does not know about usernames set on gitea,
as in the feature request in go-gitea#19948.

I tested this by setting up a fresh gitea install with one user `mhl`
and email `m.hasnain.lakhani@gmail.com`. I then created a private repo,
and configured gitea to allow reverse proxy authentication.

Via curl I confirmed that these two requests now work and return 200s:

curl http://localhost:3000/mhl/private -I --header "X-Webauth-User: mhl"
curl http://localhost:3000/mhl/private -I --header "X-Webauth-Email: m.hasnain.lakhani@gmail.com"

Before this commit, the second request did not work.

I also verified that if I provide an invalid email or user,
a 404 is correctly returned as before

Closes go-gitea#19948
@mhlakhani mhlakhani mentioned this issue Jun 12, 2022
Merged
@lunny lunny added this to the 1.18.0 milestone Sep 19, 2022
6543 added a commit that referenced this issue Sep 28, 2022
@mhlakhani @lunny @6543
Add support for authentication based on reverse proxy email (#19949)
64c3d55 
This is useful in scenarios where the reverse proxy may have knowledge
of user emails, but does not know about usernames set on gitea,
as in the feature request in #19948.

I tested this by setting up a fresh gitea install with one user `mhl`
and email `m.hasnain.lakhani@gmail.com`. I then created a private repo,
and configured gitea to allow reverse proxy authentication.

Via curl I confirmed that these two requests now work and return 200s:

curl http://localhost:3000/mhl/private -I --header "X-Webauth-User: mhl"
curl http://localhost:3000/mhl/private -I --header "X-Webauth-Email: m.hasnain.lakhani@gmail.com"

Before this commit, the second request did not work.

I also verified that if I provide an invalid email or user,
a 404 is correctly returned as before

Closes #19948

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: 6543 <6543@obermui.de>
@go-gitea go-gitea locked and limited conversation to collaborators May 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
type/feature Completely new functionality. Can only be merged if feature freeze is not active. type/proposal The new feature has not been accepted yet but needs to be discussed first.
Projects
None yet
Milestone
1.18.0
Development

Successfully merging a pull request may close this issue.

Add support for authentication based on reverse proxy email mhlakhani/gitea
2 participants
@lunny @mhlakhani