evank / redmine-authsource-clientlogin

An AuthSource subclass for Redmine to allow logging in via Gmail and/or Hosted Google Apps accounts

Google ClientLogin Authentication for Redmine

NOTE: This is still in an very early non-stable state (ie: may break without warning or reason).

Installation

First of all, you may need to install the Google Data APIs Ruby Utility Library. I've verified this code works with as early as version 1.1.0 of the gem.

sudo gem install gdata

Next, insert a new record into your Redmine's auth_sources table. An example insert can be found in the included auth_source.sql file. Items of note in said SQL include:

• account - The default domain to authenticate against, for example a Google Apps hosted domain
• base_dn - The accountType that we should use for authenticating, see ClientLogin documentation for more details
• onthefly_register - Yes, if this source authenticates the user then Redmine should create an internal record for them (w/o password info)

Finally, place the included auth_source_clientlogin.rb file in your Redmine codebase under app/models/ and restart Redmine.

But wait...Something's not working!

If you have followed the above instructions, check any known issues. If that doesn't shed any light, please feel free to file a new issue.

What if I already have users set up with the built-in authentication?

Changing their authentication method is fairly trivial if my experience is any indication. That said, it does require some direct changes to your backend database, so before you try this you should make a complete and current backup of your database if you don't already have one. I shall repeat this because it bears repeating: you should make a complete and up-to-date backup of your Redmine database before doing any of the following steps!

First things first, the user(s) you're meddling with should have their email address in Redmine set to a Gmail or Google Apps address that supports the ClientLogin protocol.

Now, assuming you've installed our new AuthSource subclass, we need its unique id from the auth_sources table. We can get this with a simple SQL query:

mysql> SELECT id FROM auth_sources WHERE type='AuthSourceClientLogin';
+----+
| id |
+----+
|  1 |
+----+
1 row in set

Now, for the user(s) we're going to modify, we'll need to change the login field to their current email address, clear their hashed_password, and set their auth_source_id to the value we retrieved in the previous step:

mysql> UPDATE users SET login=mail, hashed_password='', auth_source_id=1 WHERE login='evan';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0

The user(s) in question should now be able to login with their Google-hosted email address and password! Note that their username has actually changed from whatever it was before to their full email address!

redmine-authsource-clientlogin's Issues

User first/last name may not be filled in if user has more contacts than the max-results being pulled

Currently, the user's first and last name are searched for and automagically populated from their Google Contacts, which is intentionally limited to no more than 100 entries. If the user has more than 100 contact entries and their own contact entry is outside of the result-set that we pull, their name won't be auto-filled in.

This is not a major issue, as Redmine will prompt them for said information if its not provided for the AuthSource. Nonetheless, I figured I should make a note of it as a (subsequently closed) issue.

Breaks if Google requires CAPTCHA verification

Under certain circumstances, ClientLogin attempts will fail and issue a CAPTCHA challenge (on repeated failed logins, as far as I can tell). Normally an app using ClientLogin would simply display the CAPTCHA to the end user to solve, and then pass their answer back in the next auth attempt.

Since redmine's AuthSource subclasses never reach the end-user, I cannot currently see a way around this issue. The best solution I have is to consider it as a "cooldown" period until the CAPTCHA challenge hopefully times out.

is this project still alive

or is there a recommended alternative?