Local administrator authentication?

[brylie]

Is it possible to authenticate administrative users using the local database, in addition to Google, Github, and Persona?

[GUI]

Yeah, it should be possible without a ton of effort, although not something we're currently setup for. We're using a combination of devise and omniauth for admin authentication. Omniauth is what's providing all the hooks into authentication services (Google, GitHub, Persona, etc). Devise normally provides authentication against a local database, we just have all that disabled in favor of using the various Omniauth strategies exclusively. But we do have an admin database table already (to track who should be let in from these external services), we'd just need to reconfigure Devise so it could handle passwords and authentication like it normally does.

However, this probably isn't something that's super high on our own priority list right now. We can certainly keep it on our radar, though, and we'd be more than happy to accept pull request.

Another option that might be quicker and more in line with the current strategy is adding additional omniauth strategies. So if you'd prefer to hook into some other third party (like Twitter, etc), or hook into a corporate LDAP database, CAS server, etc, those additional strategies are pretty trivial to add.

So out of curiosity, would other omniauth strategies potentially serve your needs, or would you definitely prefer a local database for admin accounts? As I mentioned, a local database shouldn't be particularly difficult to add, I just personally try to avoid introducing those whenever I can (since then you have to worry about storing passwords, brute force attacks, resetting passwords, two factor authentication usually isn't in the cards if you're rolling your own, etc). I'm not necessarily a huge fan of relying on third parties either, but lately my own personal opinion has been shifting more in that direction so I don't have to deal with the headache of managing more accounts. But that's just me, so I'd be happy to hear about if you'd still prefer a local db for any reason.

[brylie]

Haha, it looks like omniauth has us covered. E.g. we can probably get by with SAML, or OAuth2. It might be worth mentioning the Omniauth strategies in the api-umbrella.yml file, for curious administrators.

[brylie]

On further consideration, Google, Github, Persona, etc. are typically used as auxiliary authentication, i.e. to ease access for new sign-ups.

For the admin component, which is central to the platform, it seems important to offer username/password authentication as primary, with external auth. as secondary.

[brylie]

This has actually become somewhat of a blocking issue for the following reasons:

• I can't figure out how to properly configure Github (Github auth callback URL? #46) or Google (GoogleOauth2: "Invalid credentials". #44) authentication
• Our Project Manager has not received a verification email from Mozilla Persona

[brylie]

Related: #59

[GUI]

Local admin accounts are finally available in the v0.14.0 release.