Set OAuth external ID on CreateAccount call To create an account you either have to login via the UI or an admin has to create it via REST API. The former worked without issue, since OAuth is directly involved in account creation, i.e. the data returned by the identity provider is being used to set up the account. However, it was not possible to create an account via REST API and then log into it via OAuth. The reason was that the account created via REST API didn't get an external ID on creation that linked it to the IDP. On authentication Gerrit would thus complain that the account exists and that the provided secret didn't match the stored password instead of contacting the OAuth server. Gerrit provides an extension point where plugins can provide additional external IDs on account creation. This extension point is being implemented by this change. Change-Id: Ie643503f4e1c2247afd1674036aeaf3b33ca7665
With this plugin Gerrit can use OAuth2 protocol for authentication. Supported OAuth providers:
See the Wiki what it can do for you.
Prebuilt binary artifacts are available on release page. Make sure to pick the right JAR for your Gerrit version.
To build the plugin with Bazel, install Bazel and run the following:
git clone https://gerrit.googlesource.com/plugins/oauth cd oauth && bazel build oauth
Copy the bazel-bin/oauth.jar to $gerrit_site/plugins and re-run init to configure it:
java -jar gerrit.war init -d <site>
[...]
*** OAuth Authentication Provider
***
Use Bitbucket OAuth provider for Gerrit login ? [Y/n]? n
Use Google OAuth provider for Gerrit login ? [Y/n]?
Application client id : <client-id>
Application client secret :
confirm password :
Link to OpenID accounts? [true]:
Use GitHub OAuth provider for Gerrit login ? [Y/n]? n
Make sure to read the FAQ before reporting issues.
Apache License 2.0