HTTP Authentication no longer works after enabling oauth

[jameshartig]

We we're trying out 2.14.x and after setting auth=OAUTH we now get the following error when users try to HTTP authenticate with their git clients:

java.lang.UnsupportedOperationException: git over oauth is not implemented by gerrit-oauth-provider plugin
at com.googlesource.gerrit.plugins.oauth.DisabledOAuthLoginProvider.login(DisabledOAuthLoginProvider.java:36)
at com.google.gerrit.server.auth.oauth.OAuthRealm.authenticate(OAuthRealm.java:91)
at com.google.gerrit.server.account.AccountManager.authenticate(AccountManager.java:111)
at com.google.gerrit.httpd.ProjectOAuthFilter.verify(ProjectOAuthFilter.java:171)
at com.google.gerrit.httpd.ProjectOAuthFilter.doFilter(ProjectOAuthFilter.java:114)
at com.google.gerrit.httpd.RequestMetricsFilter.doFilter(RequestMetricsFilter.java:57)
at com.google.gerrit.httpd.AllRequestFilter$FilterProxy$1.doFilter(AllRequestFilter.java:133)
at com.google.gerrit.httpd.AllRequestFilter$FilterProxy.doFilter(AllRequestFilter.java:135)
at com.google.gerrit.httpd.RequestContextFilter.doFilter(RequestContextFilter.java:72)
at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:120)
at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:135)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1759)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:582)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:224)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1180)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:512)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1112)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
at org.eclipse.jetty.server.Server.handle(Server.java:534)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:283)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:108)
at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:93)
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.executeProduceConsume(ExecuteProduceConsume.java:303)
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:148)
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:136)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:671)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:589)
at java.lang.Thread.run(Thread.java:745)

[davido]

/CC @lucamilanesio

[lucamilanesio]

Yeah, that is something specific to Ver. 2.14: HTTP Digest Auth isn't there anymore and all authentications are specific to the provider. I recall, however, we introduced a policy to still allow standard HTTP passwords, isn't it?

[davido]

What was that policy exactly? Or should the provider now implement itself OAuth-token based authentication, like cfoauth plugin is doing?

[lucamilanesio]

There you go: https://gerrit-review.googlesource.com/Documentation/config-gerrit.html#auth.gitBasicAuthPolicy
If you set auth.gitBasicAuthPolicy = HTTP ... it should work again :-)

[davido]

Thanks, I think I understand now what happened. To rectify #84, i added DisabledOAuthLoginProvider in: [1]. Later, you have added OAUTH to the auth.gitBasicAuthPolicy policy in: [2].

So the solution is as easy as: adding this option to the gerrit.config should fix it:

  auth.gitBasicAuthPolicy = HTTP

We should add this to the plugin documentation and FAQ. Will do it later, and let this issue open for a while.

• [1] https://gerrit-review.googlesource.com/98997
• [2] https://gerrit-review.googlesource.com/#/c/99079/5/gerrit-extension-api/src/main/java/com/google/gerrit/extensions/client/GitBasicAuthPolicy.java@21

[jameshartig]

Thanks @davido and @lucamilanesio for the quick turnaround. I can confirm that adding that option fixed the issue for me.

[lucamilanesio]

@fastest963 we shouldn't discuss Gerrit issues on GitHub though: typically all the issues are discussed on the Gerrit issue tracker or the mailing list.
See:

• https://www.gerritcodereview.com/issues.md
• https://groups.google.com/forum/#!forum/repo-discuss

[jameshartig]

@lucamilanesio I had thought that this plugin was the issue, I didn't realize the followup comments that it was a gerrit issue. The error made it seem like this plugin didn't support HTTP authentication for git requests and I saw that there was a change in #84 specifically that added that error message that I was seeing.

[lucamilanesio]

@fastest963 this plugin is on Gerrit Code Review as well (https://gerrit.googlesource.com/plugins/oauth) :-) This is simply the original repo where it was developed and is not the master "source of truth anymore"

[jameshartig]

@lucamilanesio oops! Didn't see that. I just found the plugin by searching google. Thanks for the info.

[lucamilanesio]

Btw ... I've created an issue on Gerrit => https://bugs.chromium.org/p/gerrit/issues/detail?id=6034

[jameshartig]

The issue listed above was merged and so this should be closed.