Shibboleth authentication for Redmine, Jenkins, Git, SVN

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2017-06-28 18:06]:
> You can't authenticate non-web applications like that (the latter,
> two I mean). You can essentially web-protect interfaces for managing
> public keys in order to chain them together, that's about it. That's
> a fairly good strategy for a wide range of SSH-based problems.

I'm assuming the question was for https based resources, but my reply
would have been the same:

Switch to SSH access with public keys for both SVN and Git everywhere
and use a VCS web UI that allows people to easily manage their SSH
keys over the web -- and integrate that web UI with SAML/Shibboleth.

E.g. both Gitlab and Gogs (a great, small, pretty complete GitHub
clone in a single Go binary, if you can believe it) make that trivial
and provide more modern interfaces and features, too.

Assuming you have lots of content in Redmine you have no interest in
migrating, a quick search brings up this:
https://github.com/DARIAH-DE/redmine_shibboleth
(As well as an Omniauth based on.)
So integration with Shibboleth certainly seems possible.

For Jenkins I think I used some built-in SAML functionality (something
that foced the entityID to be
https://example.org//jenkins/securityRealm/finishLogin -- might have
been this one: https://wiki.jenkins.io/display/JENKINS/SAML+Plugin ).
But I'm pretty sure you can also go the usual route of fronting the
Java servlet container with Apache httpd and mod_proxy_ajp plus the
Shibboleth SP and configure the application apppripriately.

Since Gitlab has a nice CI/CD system fully integrated I've retired our
own use of Jenkins.

For Gitlab's SAML integration I've successfully used Gitlab fronted
with Apache httpd and the Shib SP before (proxying to a listening Unix
socket from their internal web server[1]) but I'm currently using it
"plain vanilla" with the (very limited) Omniauth SAML plugin that
comes out of the box with the Omnibus package (i.e., no httpd).

As I've also mentioned Gogs before: The integration with SAML required
HTTP proxying from httpd plus the Shib SP, which was easy enough. Gogs
has no CI/CD functionality, though, so for now we're using Gitlab.

-peter

[1] https://gitlab.com/gitlab-org/gitlab-recipes/issues/57#note_22130522