feat: enable Lix admins to admin the Buildbot properly #16
Loading…
Reference in a new issue
No description provided.
Delete branch "authz"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This removes the need for a proxy and rely on the
groups
property ofthe
userDetails
passed at the authentication layer.To add a certain role, add the group
buildbot-$role
to that user viaKeycloak.
The next steps are to slowly add ways to give trusted actions to trusted developers.
Signed-off-by: Raito Bezarius raito@lix.systems
uh why does this imply it uses emails? i would like to just put a role in the oidc token.
Because I'm not sure this will work out with the
role
in the OIDC token, but we can try with that first if you prefer.I don't understand how this PR gets authorization information in the first place; how does it get emails? If it is getting emails, surely it sees other parts of the token, right?
I assume that Buildbot pulls the standard fields from the OAuth 2 token yes, this, I am pretty sure it would ~work out of the box. As for the rest of the token, I would need to dig more in the Buildbot code and I would prefer to test it "live" and adjust or we need to deploy a staging Buildbot maybe…
Take the owner role, this is induced by looking at Gerrit commit's emails and comparing them over the authenticated's email address to give the "owner" role.
97a2b79dba
toefa7a950c3
I pushed an alternative proposal using
groups
, I do not have in-depth view in how Keycloak will transmitgroups
, but if that's helpful to you, here's a version without emails.i know how that works. i think that groups isn't actually sent in our tokens at all which is perfect because we can just send client roles in there instead. or we can override it at least.
ok nope, we need to change our subclass of OAuth2Auth to actually read a groups claim out of the token. We should call the token field
buildbot_roles
and I can make that happen on the Keycloak end.96c50524ed/master/buildbot/www/oauth2.py (L403-L423)
re "is passing scope necessary" comment, maybe, but it should give scope "email openid profile" for correctness.
OK, I will rework this towards that target.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.