From 48726958b6cffbd26e75679da6010fd138f4c50f Mon Sep 17 00:00:00 2001 From: Basil Bruhn Date: Fri, 27 Jun 2025 11:59:35 +0200 Subject: [PATCH] add authentication doku Signed-off-by: Basil Bruhn --- _toc.yml | 1 + services/gitea/authentication.md | 44 ++++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 services/gitea/authentication.md diff --git a/_toc.yml b/_toc.yml index 15a7fd5f..19368e5d 100644 --- a/_toc.yml +++ b/_toc.yml @@ -228,6 +228,7 @@ chapters: - file: services/gitea/index sections: - file: services/gitea/gitea-faq + - file: services/gitea/authentication - file: services/gitea/gitea-migration - file: services/gitea/gitea-pages - file: services/gitea/gitea-runner diff --git a/services/gitea/authentication.md b/services/gitea/authentication.md new file mode 100644 index 00000000..b2dc1f25 --- /dev/null +++ b/services/gitea/authentication.md @@ -0,0 +1,44 @@ +# Authentication +Information about authenticating with gitea and known flavours of operating systems. (windows, linux and mac) +Authentication on the GUI (gitea.psi.ch) only works with a PSI account in EntraID (Azure AD). The login name is the UPN (UserPrincipleName) with your password and MFA token. + +## PSI User +### GUI +The UPN of a PSI user is its email address +Password +PSI MFA +If you are logged in to outlook or any other PSI application that uses MFA you will be logged in automaticaly! + +### SSH +RSA keys must be longer than 3000 bits! We suggest you create a eliptic curve key: 'ssh-keygen -t ed25519' + +To clone a repo or change its remote to SSH you can use this commands + +- 'git clone git@gitea.psi.ch:ORGANIZATION/REPOSITORY.git' +- 'git remote set-url origin git@gitea.psi.ch:ORGANIZATION/REPOSITORY.git' + +### HTTPS +GIT with HTTPS can be done with a Personal Access Token created here: https://gitea.psi.ch/user/settings/applications or with https://github.com/hickford/git-credential-oauth + +- 'git clone https://gitea.psi.ch/ORGANIZATION/REPOSITORY.git +- Username +- Password is your created token + +## External User +External users must be created in DUO or via HR, otherwise they are not automatically synced to the correct access group: m365-app_git_rest. If this group is missing the user wont be able to login. +Open a SNOW Ticket to get your user in that group or contact the AD Team. + +### GUI +The UPN of a external user is 'ext-user_name@psi.ch' +Password +PSI MFA + +### SSH +There are no restrictions for external users once added to a project + +### HTTPS +External Users can use both methods that PSI users can. + +## Limitations + +So far there is a known issue with LFS authentication on windows. It's being investigated by gitea@psi.ch admins and will be updated in the documentation as soon as a solution is found.