Re: Salsa as authentication provider for Debian
]] Enrico Zini
> On Sat, Apr 11, 2020 at 09:47:39PM +0200, Tollef Fog Heen wrote:
>
> > We quite regularly have upstreams getting access for weird architecture
> > failures. There's no particular reason for those people to have salsa
> > accounts.
>
> I understand those are temporary accounts. Do those cases need an
> arbitrary name from the LDAP namespace?
>
> Several places I worked with use a pool of time-limited accounts from a
> guestNNN namespace, for example: that could address your use case
> without overlapping with anything else.
We have guest accounts that have been in use longer than the lifecycle
of some DD accounts, so while it would technically work, it wouldn't be
a particularly nice solution. (You can of course say that requiring
non-DDs registering on salsa to have a -guest suffix isn't nice either,
something I can agree with.)
> > It does to me, since suddenly we have to care about what's on salsa,
> > something we've never had to care about before.
>
> As I said in [🔎] 20200409181701.3qqsn5sqq3xbu2ia@enricozini.org, no, you
> don't need to care about anything: you keep doing what you want, and we
> deal with it.
I think we in practice will want to do that in order to avoid triggering
bugs in software that assumes that user names are consistent.
> So far, I only received requests to keep the status quo as it is
> indefinitely, and very little in terms of counterprosals actionable now,
> besides theoretical new software solutions to be explored, that would
> address the problems I am having.
In case that was directed at me, rather than the wider world: I'm not
requesting you do one thing or another, I'm pointing out some possible
ramifications.
It's not clear to me why removing the -guest restriction has to happen
for sso.d.o to be using Salsa as an IdP, which seems to be your primary
goal? That's my most immediate concern. Switching to oauth2/OIDC seems
like a good idea, and assuming we can move to another broker somewhere
down the line, I have no problems with that happening.
--
Tollef Fog Heen
UNIX is user friendly, it's just picky about who its friends are
Reply to: