Allow authentication to be set in app.ini / migrate all authentication to app.ini

[stevenroose]

From @stevenroose on May 28, 2016 0:38

We are trying to package Gogs to work with YunoHost, but this issue affects anyone packaging Gogs automatic installation.

We want to enable LDAP authentication during installation, but when automating the installation, it is hard to inject the authentication config into the SQL table because the table is only initialized on the first run.
Since the app.ini is the place we can manipulate Gogs configuration for automated installation, ideally authentication configuration should be here too.

Since I have no idea of how authentication is implemented in general, I don't know if there are arguments why authentication should be in SQL at all. If there are no fundamental arguments, I would be willing to try and migrate authentication config to app.ini, making sure compatibility is maintained for upgrading users.

Copied from original issue: gogs/gogs#3142

[stevenroose]

From @unknwon on July 2, 2016 15:45

Hi... actually I'm not quite understand what you're trying to describe... but set auth info in app.ini would be acceptable, it seems a dirty workaround instead of a solution.

[stevenroose]

It just seems to me that authentication settings are part of the installation configuration rather than something to do at runtime. So it should be put in app.ini instead of the database.

Many packaged versions of Gogs that are specifically made for a certain software distribution will want to automatically integrate Gogs with the authentication scheme they use during the installation period. That is currently impossible because the authentication section from Gogs can only be accessed while it is running through the web interface or through the underlying SQL DB.

So what I propose is a new app.ini section f.e. [authentication] or [ldap] where the required LDAP parameters can be provided.

Examples of apps using config files for auth (I think the ones that don't are actually very rare) are: Owncloud, Seafile, Roundcube, Ampache, Baikal and actually all of the ones that I came across when packaging apps for YunoHost.

[stevenroose]

From @unknwon on July 7, 2016 23:53

Gogs supports theoretically unlimited authentication sources, that's why config in file is not possible.

[stevenroose]

From @jerrykan on July 8, 2016 12:48

Having to configure the authentication sources in the DB is an impediment to being able to deploy gogs using configuration management tools. I imagine it would be possible to implement any number of authentication sources using the following sort of scheme in the app.ini

[auth]
backend = ldap_ad, ldap_openldap, pam

[auth_ldap_ad]
type = ldap
... (other ldap specific settings) ..

[auth_ldap_ad]
type = ldap
... (ldap specific settings) ..

[auth_pam]
type = pam
... (pam specific settings) ..

the backend value in the [auth] section defines the priority of the authentication sources that are enabled and are references to the [auth_*] sections which contain the configuration for each authentication source.

It may require a little more processing of the app.ini file to load the configuration settings, but it should be possible.

[stevenroose]

From @unknwon on July 8, 2016 13:6

@jerrykan good point, but I think we probably should just make a new file named auth_sources.ini or auth_sources.conf?

[stevenroose]

From @jerrykan on July 9, 2016 14:2

@unknwon my personal preference would be to keep everything in app.ini so there is only one file to configure/manage, but I don't see any major issues if it were to be implemented in another config file.

[stevenroose]

From @unknwon on July 9, 2016 14:15

app.ini is more about site configuration, but authentication sources are site data in my opinion.

[stevenroose]

From @jerrykan on July 10, 2016 13:19

I don't see configuring authentication backends as being any different to configuring the database or mail servers. It is site specific, generally configured during initial setup, and rarely changes. So I wouldn't really consider the it data.

[stevenroose]

@unknwon Can you point me to where auth configuration is located? Perhaps I can try and implement the migration myself.

[stevenroose]

From @unknwon on August 3, 2016 4:23

@stevenroose login_source table.

[lunny]

I don't think that storeing LDAP configuration on app.ini is a better idea. But I think It could be done via Gitea APIs. We can provide LDAP configuration API so that you can add it just call the APIs.