Infrastructure

Guys,

do we have TDF accounts on google.com and github.com?

When logged in with those accounts, we need to create new
applications there and request OAuth2 credential. We would
need it to enable OAuth2 plugin on our Gerrit instance. We
would want to ceate two applications. Every application
contains callback URL that must be used. The callback URLs
would be:

• Application: "TDF Gerrit Code Review", callback = https://gerrit.libreoffice.org/oauth
• Application: "TDF Gerrit Code Review Staging", callback = https://gerrit-test.libreoffice.org/oauth

I can help with creating and configuring the applications on Google and GitHub.
I've also setup the plugin with both Google and GitHub OAuth provider on my
Gerrit instance for you to play:

https://review.idaia.de

I've also verified that the old Google OpenID accounts are linked correctly to new
OAuth2 providers (Google OpenID auth scheme was dropped early this year):

After connecting with OAuth2 with the same account, the OAuth2 identity is linked to the existing account that was created using Google OpenID:

mysql> select * from account_external_ids;
-------------------------------------------+----------+----------------------------------------------------------------------------------+ | account_id | email_address | password | external_id |
-------------------------------------------+----------+----------------------------------------------------------------------------------+ | 4 | john.doe@gmail.com | NULL | 1031623528736452451234 |
-------------------------------------------+----------+----------------------------------------------------------------------------------+

Changes in gerrit configuration site (gerrit.config):

[auth]
type = OPENID
trustedOpenID=^.*$

[plugin "gerrit-oauth-provider-google-oauth"]
client-id = <client-id>
client-secret = <client-secret>
link-to-existing-openid-accounts = true

[plugin "gerrit-oauth-provider-github-oauth"]
client-id = <client-id>
client-secret = <client-secret>

Plugin binary (can be fetched from master branch):

https://gerrit-ci.gerritforge.com/view/Plugins-master/job/plugin-gerrit-oauth-provider-gh-master/lastSuccessfulBuild/artifact/buck-out/gen/plugins/gerrit-oauth-provider/gerrit-oauth-provider.jar

Cloph has credentials and knows how to set it up I assume - can you poke
him?

My fault, I thought Cloph had access to the respective Google account already, which he hadn't
Just given him the credentials so he can have a look - sorry for the delay here!

Cloph sent OAuth credentials to David now