When logging in to Phabricator with a developer account, https://idp.wikimedia.org should be used instead of a direct LDAP authentication form.
Description
Description
Details
Details
Related Changes in Gerrit:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T189531 All Wikimedia developer services should use single sign-on | |||
| Open | Feature | None | T377061 Phabricator should use IDP for developer account logins |
Event Timeline
Comment Actions
I find a lot of tasks linking to changes in the operations/puppet repo but understandably no patches that "added" support to an existing tool/website.
Now let me happily expose my lack of technical knowledge via questions:
- Which protocol(s) do we use and/or which protocols are available/enabled in our CAS-SSO configuration? If OAuth2 there is probably stuff to adapt in https://we.phorge.it/source/phorge/browse/master/src/applications/auth/adapter/ (as https://gitlab.wikimedia.org/repos/phabricator/extensions/-/tree/wmf/stable/src/oauth is our custom MW OAuth1 stuff).
- Do we have a test instance somewhere which allows to test auth against?
(I looked at https://wikitech.wikimedia.org/wiki/CAS-SSO, https://wikitech.wikimedia.org/wiki/IDM, https://wikitech.wikimedia.org/wiki/Single_Sign_On but maybe I missed info for... "developers".)
For the records, our current Phabricator LDAP code is https://we.phorge.it/source/phorge/browse/master/src/applications/auth/adapter/PhutilLDAPAuthAdapter.php
Comment Actions
Which protocol(s) do we use and/or which protocols are available/enabled in our CAS-SSO configuration? If OAuth2 there is probably stuff to adapt in https://we.phorge.it/source/phorge/browse/master/src/applications/auth/adapter/ (as https://gitlab.wikimedia.org/repos/phabricator/extensions/-/tree/wmf/stable/src/oauth is our custom MW OAuth1 stuff).
I had a look around and found https://gerrit.wikimedia.org/r/plugins/gitiles/operations/software/cas-overlay-template/+/refs/heads/master/build.gradle#277. OAuth2 isn't enabled, however OIDC is which is based on OAuth2. Related upstream task: https://we.phorge.it/T15942, and it doesn't look too hard to implement either.
Do we have a test instance somewhere which allows to test auth against?
Comment Actions
Uh, thanks a lot for finding those, that's very helpful! https://secure.phabricator.com/T524#249767 also looks interesting.
Comment Actions
Change #1117842 had a related patch set uploaded (by Aklapper; author: Aklapper):
[operations/puppet@production] idp-test: add Phabricator test instance client
Comment Actions
We haven't tried to do a "pure" OAuth2 client yet, but I'm happy to setup both an OAuth2 or OIDC, which every you prefer (or both) on test.
Phabricator does have a TOTP as a two factor authentication step, and we're currently working on providing 2FA via CAS-SSO, but it's not in place yet.
Comment Actions
Change #1136327 had a related patch set uploaded (by Slyngshede; author: Slyngshede):
[labs/private@master] IDP: Add dummy secret for Phabricator (test)
Comment Actions
Change #1136327 merged by Slyngshede:
[labs/private@master] IDP: Add dummy secret for Phabricator (test)
Comment Actions
Change #1117842 merged by Slyngshede:
[operations/puppet@production] idp-test: add Phabricator test instance client
Comment Actions
@Aklapper I've merged the Phabricator Dev service configuration for IDP. Can you drop me an email or an IRC ping as to how to best get you the client secret.
Comment Actions
I need to get back to this but currently using the test instance to test upgrades in T370266: Update to Phorge upstream 2024.35 release and T386558: Update to Phorge upstream 2025.18 release has priority, sorry :-/
Comment Actions
Tyler mentioned CAS for Spiderpig implementation; maybe parts are reusable? https://gitlab.wikimedia.org/repos/releng/scap/-/blob/master/local-dev/cas_server.py (may want to talk to @dancy at some point whenever someone finds time to look into this again)