pagure

#3969 Add REMOTE_USER authentication support
Closed by ryanlerch. Opened by tasansga.
tasansga/pagure add_REMOTE_USER_authentication_support  into  master

Download 3969.patch

This patch adds support for REMOTE_USER authentication, which relies on webserver/reverse proxy-induced authentication. New users are asked to provide full name and email address. /login/ and /user/remote/new/ need to be protected by webserver. Anonymous access is still possible, open sessions are tracked by token similar to local login auth. Set PAGURE_AUTH = 'remoteuser' in pagure.cfg to enable.

Example for a simple file-based Apache httpd config (only what's relevant for auth):

<Location ~ "/(login|user/remote/new)">
    AuthType Basic
    AuthName "Pagure Login"
    AuthBasicProvider file
    AuthUserFile "/path/to/htpasswd"
    Require valid-user
</Location>

This should also work with other mod_auth modules like Kerberos/SAML/OIDC and with any WSGI-compatible webserver or reverse proxy.

It looks like it only failed the style test:

15:26:10 Failed tests:
15:26:10 FAILED test: py-test_style

Our code style is enforced by the black tool, which on Fedora is provided by the python3-black package.

1 new commit added

  • style fixes, thanks for all the work 'black'

:thumbsup:

I believe the endpoint argument isn't needed since the function name is the same

Let's put the flush in the try/except below since flush can raise an SQLAlchemyError

I'm not sure I see where this is being used, is it?

4 new commits added

  • fixed formatting issue
  • removed dead code
  • moved flush() to db try/except block
  • removed unneeded endpoint name

pretty please pagure-ci rebuild

rebased onto 9c444c7255765a60ad1d9277e8e54d25dd695b06

rebased onto 9c444c7255765a60ad1d9277e8e54d25dd695b06

pretty please pagure-ci rebuild

@ngompa what your thoughts on this one?

This needs reworking, but I think it would make sense to have support for it. There are plenty of weird auth methods out there that we don't have a good way to natively support, but can be proxied through some other way and pass through REMOTE_USER.

This project has moved to https://forge.fedoraproject.org/apps/pagure. As part of the migration, all open pull requests on pagure.io have been closed. If you'd like to continue working on this, please fork the repository on the new forge and re-submit your PR there.

Pull-Request has been closed by ryanlerch
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.