takezoe/gitbucket — pull request #199 by olivierdagenais (2013-11-18 22:24:09+00:00)
Title: Add single sign-on (SSO) support

Jenkins and Artifactory both support SSO through the use of an HTTP header sent by a reverse proxy. In Jenkins, this is handled by the [Reverse Proxy Auth Plugin](https://wiki.jenkins-ci.org/display/JENKINS/Reverse+Proxy+Auth+Plugin) while in Artifactory, it's part of the [Pro Power Pack](http://www.jfrog.com/home/v_artifactorypro_overview).

__How to configure SSO for GitBucket__
1. Configure a front-end reverse proxy to authenticate a request (such as IIS with Windows Authentication) and then delegate the request to the servlet container, augmenting it with a special header (let's call it `auth-user`).
2. Configure the servlet app to look for the [configurable] `auth-user` header, and if it's set, you can assume that the user named by the header is logged in, otherwise you continue with other authentication mechanisms. (this is the part I am submitting for review)

__Implementation details__
1. The LDAP configuration needs to record the name of the reverse-proxied SSO header (this is totally optional, if no value is provided, SSO won't be attempted and it will work as before).
2. When retrieving the `LoginAccount`, if the session is empty AND the SSO header has a value, then construct an `Option[Account]`, looking up the user's e-mail address, save the account in the session and return it, otherwise proceed as before.

__Manual testing__
1. Install Tomcat 7.0 and have it listen for requests on port 8080.
2. Deploy GitBucket in Tomcat.
3. Test GitBucket by visiting http://localhost:8080/gitbucket/
3.1 Notice that you can sign in as root and operate as usual.
3.2 Configure LDAP but don't set the `HTTP Single Sign-On header` field.
3.3 Notice that you can sign on as domain users, etc.
4. Configure IIS on port 80 to use Windows authentication.
5. Install the [BonCode Apache Tomcat AJP 1.3 Connector](http://boncode.net/connector/webdocs/Tomcat_Connector.htm) and configure it to bridge IIS to Tomcat.
5.1 You may want to test that you can navigate to http://localhost/gitbucket/ and it works like it did on Tomcat.
6. Configure the `HTTP Single Sign-On header` field to `auth-user`.
7. Test GitBucket w/SSO by visiting http://localhost/gitbucket/
7.1 You will be signed in automatically.
7.2 Clicking "Sign out" does nothing. (perhaps we would eventually want to hide that link when we detect SSO is enabled?)