add authentication doku

Signed-off-by: Basil Bruhn <basil.bruhn@psi.ch>

_toc.yml

@@ -228,6 +228,7 @@ chapters:
       - file: services/gitea/index
         sections:
           - file: services/gitea/gitea-faq
+          - file: services/gitea/authentication
           - file: services/gitea/gitea-migration
           - file: services/gitea/gitea-pages
           - file: services/gitea/gitea-runner

services/gitea/authentication.md

@@ -0,0 +1,44 @@
+# Authentication
+Information about authenticating with gitea and known flavours of operating systems. (windows, linux and mac)
+Authentication on the GUI (gitea.psi.ch) only works with a PSI account in EntraID (Azure AD). The login name is the UPN (UserPrincipleName) with your password and MFA token.
+
+## PSI User
+### GUI
+The UPN of a PSI user is its email address
+Password
+PSI MFA
+If you are logged in to outlook or any other PSI application that uses MFA you will be logged in automaticaly!
+
+### SSH
+RSA keys must be longer than 3000 bits! We suggest you create a eliptic curve key: 'ssh-keygen -t ed25519'
+
+To clone a repo or change its remote to SSH you can use this commands
+
+- 'git clone git@gitea.psi.ch:ORGANIZATION/REPOSITORY.git'
+- 'git remote set-url origin git@gitea.psi.ch:ORGANIZATION/REPOSITORY.git'
+
+### HTTPS
+GIT with HTTPS can be done with a Personal Access Token created here: https://gitea.psi.ch/user/settings/applications or with https://github.com/hickford/git-credential-oauth
+
+- 'git clone https://gitea.psi.ch/ORGANIZATION/REPOSITORY.git
+- Username
+- Password is your created token
+
+## External User
+External users must be created in DUO or via HR, otherwise they are not automatically synced to the correct access group: m365-app_git_rest. If this group is missing the user wont be able to login.
+Open a SNOW Ticket to get your user in that group or contact the AD Team.
+
+### GUI
+The UPN of a external user is 'ext-user_name@psi.ch'
+Password
+PSI MFA
+
+### SSH
+There are no restrictions for external users once added to a project
+
+### HTTPS
+External Users can use both methods that PSI users can.
+
+## Limitations
+
+So far there is a known issue with LFS authentication on windows. It's being investigated by gitea@psi.ch admins and will be updated in the documentation as soon as a solution is found.