How are we trying to implement this ?
https://pythonhosted.org/Flask-GoogleLogin/

this is what i came up with for google login.

saml2 is a more general way to do federation for web authentication. Many U.S. and European universities use this.

Many U.S. and European universities use this.

Unless the idea is to deploy pagure for an univeristy, I would not recommend allow to authenticate against a public pagure instance using University accounts, as this mean that when the account is closed, the user loses the possibility to log in with it and as such all of his/her history and ACLs get losts.

In my case, I'm looking to see if we could use pagure as an alternative to gitlab for our Universities IT departments. I am also aware of LIGO using federation with our identity provder and probably others. So I am mostly interested in it for employees. Some of the code wouldn't be public so right now if we were to do one repository it would be gitlab. But I think a forge that doesn't have a conflict of interest (between community and enterprise editions) would be better.
But even if students started using it, their credentials work after they leave, though they lose access to some services, at our university.
Any time you use an identity provideryou risk not having access to it any more ,sometime in the future.

Oh, that sounds nice, now I see what is your problematic :)

Private repos is something that is being worked on as part of GSoC this summer, so hopefully by fall pagure will have this feature (but it will be default to open).

True that give us sometime and hopefully private repo will be implemented.

It looks like github provides openauth2 which could be used to use their credentials as long as they permit it. You seem to need an app key for this to work. If this could work alongside the FAS credentials it could lower the barrier to entry for contributions.

This does bring up other issues with default licenses and binding credentials to accounts. But long run, seems like it would be useful.

I would suggest using https://github.com/puiterwijk/flask-oidc.

That will work with any OAuth2/OpenID Connect compliant provider, and will be the supported solution for Fedora Infra in the near future.

(yes, I'm the maintainer of this now. So that makes feature requests easy as well).

It looks like github is nice so far in letting competitors use their authentication. Currently allows github based authentication, and if github isn't blocking that, they probably won't for pagure.io.

Please do not add this "feature". The appeal of Pagure (to me at least), is that it's simple to use, unbloated, and above all free software. I like Pagure because it never makes me feel like it's tricking me into using proprietary software/plugins/services. It feels like home.
There is no need to add a github, yahoo, google or twitter "social account". It's a fad. Whenever I see these "social logins" I immediately think "is there more? Is this website selling me? Do I trust this website or are there other unnecessary non-free components that I should be afraid of?".

It would be cool to have a way to login on pagure via, say github, yahoo, google or twitter.

No, this is not cool. If you want to add any "social login" at least you should use GNU Social; that would be acceptable. Or federation among Pagure instances.

If this could work alongside the FAS credentials it could lower the barrier to entry for contributions.

Please stop looking at GitHub. Pagure is easy to use. If people want to contribute to Pagure, it's easy to login, fork, send a PR. There is no need for a service like GitHub. But if for any reason a contributor wants to use GitHub no matter what, I guess he can still develop his fork on GitHub and then ask the maintainers here to pull from it. There is no "barrier to entry".
If you want to become a GitHub subsidiary, then there is no reason for people to use Pagure; they will just keep using GitHub because it's same thing anyway.

It looks like github is nice so far in letting competitors use their authentication. Currently allows github based authentication, and if github isn't blocking that, they probably won't for pagure.io.

I think this comments illustrates very well the problem with GitHub. Do you want Pagure to be at the mercy of GitHub? What if GitHub stops at being "nice in letting competitors use their authentication"?

I believe GitHub was used as an example, the idea is to allow logging into a pagure instance via an account opened another website/system.

Most often people do not like creating yet another account, so having support for third-party auth would help on this. 3rd party in this case could be: GitHub, Google, Yahoo, FAS (it's an openid!), Linkedin (I think they do offer auth, no idea tbh), Twitter (they also offer auth iirc), your own local openid server, your own FreeIPA via kerberos tickets.... There are many many options there and we could support them all in one go.

Having said that, pagure has already three types of authentication system (FAS via OpenID, regular OpenID and local account systems), so having a 'Social auth' would be just another one and it would be up to the admin configuring pagure to pick the type of auth desired.
This feature could be useful if we were to make an entirely public pagure instance, and based on your comment, maybe we should then consider a fifth authentication type: Social+local allowing to either logging in via a 3rd party or to create a local account for people who like you aren't trusting these type of auth.

As for pagure.io, I do not see us changing its auth method anytime soon, now that it is tied into FAS, it will remain Fedora-specific :)

Just want to make clear that I'm not against OpenID/OAuth; I do agree that it's a very useful protocol for decentralized authentication. What I'm trying to say, is that I believe Pagure should allow users to login using local accounts or OpenID but not any of those "Log in with [proprietary service]" buttons.

I don't think there's any problem with a login like this

but I do think there's a problem with a login like this

For example I already have a FAS account, therefore I could login using my OpenID URL "username.id.fedoraproject.org". Or maybe I could use my own OpenID provider. If GitHub/Twitter/Google/Yahoo also offer OpenID and people use it (for example with URLs like user.openid.google.com or whatever), then it's probably OK too. Pagure can't do anything about this and ultimately it's up to users to decide who they trust. But I believe Pagure should not encourage users to login using any of those proprietary services, which is what this open issue seems to suggest.

As for pagure.io, I do not see us changing its auth method anytime soon, now that it is tied into FAS, it will remain Fedora-specific :)

OK not a problem, Pagure is a Fedora project anyway :-)

The last update was 6 years ago, no further requests, updates or actionable tasks since then, I'm going to close this issue for now to reduce our backlog.