Google Git Google Git
Sign in
gerrit/plugins/oauth/36cff8d52f25ee2fa2ca083d4f0c245410af41ad
commit
36cff8d52f25ee2fa2ca083d4f0c245410af41ad
[log]
author
David Ostrovsky <david@ostrovsky.org>
Sat Oct 10 23:14:09 2026 +0200
committer
David Ostrovsky <david@ostrovsky.org>
Sat Oct 10 15:01:13 2026 -0700
tree
5549fa5cf2db4cc370b6a75f05c9c996c110183a
parent
c8accf8c85ee091c1473baf6d380fce9338e8b3f [diff] 
Use core SecureRandomUtil for the PKCE code_verifier

Core added com.google.gerrit.util.crypto.SecureRandomUtil as the single
source of cryptographically strong randomness and migrated its callers
to it. Migrate the plugin's only SecureRandom use, the PKCE
code_verifier in HttpOAuthClient, to it.

SecureRandomUtil.newRandomString32() returns 32 bytes of entropy as
unpadded base64url, which is identical to the previous SecureRandom
plus base64url encoding and a valid RFC 7636 code_verifier, so there is
no behaviour change.

Change-Id: Id7909f834f793ee720e9dac26808699e3c1368ef
1 file changed
tree: 5549fa5cf2db4cc370b6a75f05c9c996c110183a
  1. .settings/
  2. contrib/
  3. src/
  4. .bazelversion
  5. .gitignore
  6. BUILD.bazel
  7. external_plugin_deps.MODULE.bazel
  8. LICENSE
  9. MODULE.bazel
  10. MODULE.bazel.lock
  11. oauth_plugin_deps.lock.json
  12. oauth_third_party_runtime_jars.allowlist.txt
  13. provider.bzl
  14. README.md
README.md

Gerrit OAuth2 authentication provider

With this plugin Gerrit can use OAuth2 protocol for authentication. Supported OAuth providers:

Auth0, Authentik, Amazon Cognito, LemonLDAP::NG and Tuleap were previously shipped as dedicated providers. They are standard OpenID Connect providers, so they have been removed in favour of the generic Discovery provider; see Documentation/config-discovery.md for how to migrate their configuration.

See Documentation/providers.md for a per-provider capability matrix, and the Wiki for what it can do for you.

Prebuilt artifacts

Prebuilt binary artifacts are available on release page. Make sure to pick the right JAR for your Gerrit version.

Build

This plugin is built with Bazel inside the Gerrit source tree. Clone or link it into Gerrit's plugins directory, link its dependency fragment over the placeholder, and build it from the Gerrit tree:

  git clone https://gerrit.googlesource.com/gerrit
  git clone https://gerrit.googlesource.com/plugins/oauth
  cd gerrit/plugins
  ln -s ../../oauth .
  rm external_plugin_deps.MODULE.bazel
  ln -s oauth/external_plugin_deps.MODULE.bazel .
  cd ..
  bazel build plugins/oauth

Besides the default oauth.jar, the plugin can also be built as slim, single-provider artifacts that bundle just one provider plus the shared core. Each registers as the same gerrit-oauth-provider plugin and ships its own init step; see Documentation/build.md for the target list. SAP IAS is shipped only as the oauth-sapias artifact.

Install

Copy the bazel-bin/plugins/oauth/oauth.jar to $gerrit_site/plugins and re-run init to configure it:

  java -jar gerrit.war init -d <site>
  [...]
  *** OAuth Authentication Provider
  ***
  Use Bitbucket OAuth provider for Gerrit login ? [Y/n]? n
  Use Google OAuth provider for Gerrit login ? [Y/n]?
  Application client id          : <client-id>
  Application client secret      : 
                confirm password : 
  Link to OpenID accounts? [true]: 
  Use GitHub OAuth provider for Gerrit login ? [Y/n]? n

Reporting bugs

Make sure to read the FAQ before reporting issues.

License

Apache License 2.0