Add OAuth token revocation support Add RFC 7009 revocation to the native HTTP client and wire Google and Keycloak to their provider revocation endpoints. Flush cached Git-over-HTTP validations when core revokes a token, using targeted invalidation when possible and a full flush when the account cannot be mapped safely. Depends-On: https://gerrit-review.googlesource.com/c/gerrit/+/630424 Change-Id: I74514da03cd5a75e26ec7549c1f0a9ebec9c032d
With this plugin Gerrit can use OAuth2 protocol for authentication. Supported OAuth providers:
Auth0, Authentik, Amazon Cognito, LemonLDAP::NG and Tuleap were previously shipped as dedicated providers. They are standard OpenID Connect providers, so they have been removed in favour of the generic Discovery provider; see Documentation/config-discovery.md for how to migrate their configuration.
See Documentation/providers.md for a per-provider capability matrix, and the Wiki for what it can do for you.
Prebuilt binary artifacts are available on release page. Make sure to pick the right JAR for your Gerrit version.
To build the plugin with Bazel, install Bazel and run the following:
git clone https://gerrit.googlesource.com/plugins/oauth cd oauth && bazel build oauth
Copy the bazel-bin/oauth.jar to $gerrit_site/plugins and re-run init to configure it:
java -jar gerrit.war init -d <site>
[...]
*** OAuth Authentication Provider
***
Use Bitbucket OAuth provider for Gerrit login ? [Y/n]? n
Use Google OAuth provider for Gerrit login ? [Y/n]?
Application client id : <client-id>
Application client secret :
confirm password :
Link to OpenID accounts? [true]:
Use GitHub OAuth provider for Gerrit login ? [Y/n]? n
Make sure to read the FAQ before reporting issues.
Apache License 2.0