This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hSHhhIMRRW2INPbqh2wi6O2DudNGX1fu2 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Quack, On 03/23/2016 06:53 PM, eyal edri [Administrator] (oVirt JIRA) wrote: This subject is still ongoing. I was finally able to talk to abompard about a few things related to the migration and auth (more details in the ticket). I'd just like to raise a specific point here. So the local auth using email addresses, like was used on MM2, is not working at the moment. abompard is working on it but he has other things in his plate and no idea when it will be finished. abompard suggested using Persona. So I don't know Persona well, but it is being decommissioned by Mozilla next October. He also heard some people would be willing to revive it (need more info on this). So this could be a path to handle the email address credentials and ease the migration from the previous installation. We could also wait for him to finish releasing MM 3.1 and then harass him (or bribe him with nice beers). I don't think allowing only external auth like Google OAuth2 would be nice at all. So before acting I'm going to have a look at Persona more deeply, but I wanted to have your opinion on this too. \_o< --hSHhhIMRRW2INPbqh2wi6O2DudNGX1fu2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" --hSHhhIMRRW2INPbqh2wi6O2DudNGX1fu2--

בתאריך 17 ביוני 2016 10:09,‏ "Marc Dequènes (Duck)" <duck(a)redhat.com&gt; כתב: I respectfully disagree. As long as we allow more then one provider, and also allow for some free ones like Fedora its not bad at all IMO. And it has the nice benofit of not having to secure any user credential database on our infra. We've been using that approach on oVirt Gerrit forever, and are looking at ways to expand it to other parts of the infra. Long term we would probaly like all authentication done against prividers via some sort of an sso layer, while authorization will be based on group assignments in Gerrit. We have a ticket about this somewhere... (Appologies for last blank message)

On 21 June 2016 at 12:14, Marc Dequènes (Duck) <duck(a)redhat.com&gt; wrote: Probably not FreeIPA as it is based around its own LDAP, but maybe something like Keycloak working against external providers. (We have OVIRT-527 in Jira for this) We'd probably better support GitHub too. Also we need to make sure we know how to converge credentials when the same users use different providers to login. (We have a detailed procedure on how to do this with Gerrit...) No harm in accounting. Since most users already need this to use Gerrit the impact will probably not be huge. -- Barak Korren bkorren(a)redhat.com RHEV-CI Team

This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ar20hAh3GuQHIu9TnnqoO7rNT0Mg2ht2j Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Quack again, So the work is located here: https://gitlab.com/duck-rh/ovirt-infra-ansib= le The roles are listed in the requirements.yml file (for Ansible galaxy). You can have a look at the web interface by adding this to your /etc/host= s: 66.187.230.55 lists.ovirt.org TLS certificates are not installed here, so HTTP only at the moment. I guess oVirt uses DigiCert for its certificates IIRC. If not also letsencrypt is a nice option. I will look into this later. If you want to experiment with admin rights and are in the Puppet admin list, then give me your account ID and I will upgrade your account. \_o< --ar20hAh3GuQHIu9TnnqoO7rNT0Mg2ht2j Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" --ar20hAh3GuQHIu9TnnqoO7rNT0Mg2ht2j--