{"action":"created","issue":{"url":"https://api.github.com/repos/quassel/quassel/issues/170","repository_url":"https://api.github.com/repos/quassel/quassel","labels_url":"https://api.github.com/repos/quassel/quassel/issues/170/labels{/name}","comments_url":"https://api.github.com/repos/quassel/quassel/issues/170/comments","events_url":"https://api.github.com/repos/quassel/quassel/issues/170/events","html_url":"https://github.com/quassel/quassel/pull/170","id":124848599,"number":170,"title":"Added support for authentication providers; wrote an LDAP auth provider.","user":{"login":"TC01","id":1669136,"avatar_url":"https://avatars.githubusercontent.com/u/1669136?v=3","gravatar_id":"","url":"https://api.github.com/users/TC01","html_url":"https://github.com/TC01","followers_url":"https://api.github.com/users/TC01/followers","following_url":"https://api.github.com/users/TC01/following{/other_user}","gists_url":"https://api.github.com/users/TC01/gists{/gist_id}","starred_url":"https://api.github.com/users/TC01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TC01/subscriptions","organizations_url":"https://api.github.com/users/TC01/orgs","repos_url":"https://api.github.com/users/TC01/repos","events_url":"https://api.github.com/users/TC01/events{/privacy}","received_events_url":"https://api.github.com/users/TC01/received_events","type":"User","site_admin":false},"labels":[{"id":21208865,"url":"https://api.github.com/repos/quassel/quassel/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"Sput42","id":2965622,"avatar_url":"https://avatars.githubusercontent.com/u/2965622?v=3","gravatar_id":"","url":"https://api.github.com/users/Sput42","html_url":"https://github.com/Sput42","followers_url":"https://api.github.com/users/Sput42/followers","following_url":"https://api.github.com/users/Sput42/following{/other_user}","gists_url":"https://api.github.com/users/Sput42/gists{/gist_id}","starred_url":"https://api.github.com/users/Sput42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sput42/subscriptions","organizations_url":"https://api.github.com/users/Sput42/orgs","repos_url":"https://api.github.com/users/Sput42/repos","events_url":"https://api.github.com/users/Sput42/events{/privacy}","received_events_url":"https://api.github.com/users/Sput42/received_events","type":"User","site_admin":false},"assignees":[{"login":"Sput42","id":2965622,"avatar_url":"https://avatars.githubusercontent.com/u/2965622?v=3","gravatar_id":"","url":"https://api.github.com/users/Sput42","html_url":"https://github.com/Sput42","followers_url":"https://api.github.com/users/Sput42/followers","following_url":"https://api.github.com/users/Sput42/following{/other_user}","gists_url":"https://api.github.com/users/Sput42/gists{/gist_id}","starred_url":"https://api.github.com/users/Sput42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sput42/subscriptions","organizations_url":"https://api.github.com/users/Sput42/orgs","repos_url":"https://api.github.com/users/Sput42/repos","events_url":"https://api.github.com/users/Sput42/events{/privacy}","received_events_url":"https://api.github.com/users/Sput42/received_events","type":"User","site_admin":false}],"milestone":null,"comments":31,"created_at":"2016-01-04T21:57:17Z","updated_at":"2016-11-01T21:39:04Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/quassel/quassel/pulls/170","html_url":"https://github.com/quassel/quassel/pull/170","diff_url":"https://github.com/quassel/quassel/pull/170.diff","patch_url":"https://github.com/quassel/quassel/pull/170.patch"},"body":"(Sorry for re-opening this and closing [the other one](https://github.com/quassel/quassel/pull/169), but I managed to break the previous branch through a couple of silly operations and wanted to clean things up, so here we are, after @AlD  suggested I do a rebase. Anyway, nothing has changed really but here's the description from before):\n\nThis branch is a fairly substantial change: it adds support for selecting an auth provider (also referred to as an authenticator or auth backend in the code) to quassel during core setup, in addition to selecting a storage backend.\n\nThis allows external auth providers to be written that can do e.g. LDAP, PAM, Kerberos, etc. authentication in a relatively modular way. As an example of what can be done (and also because I suspect it's the most important use case), I took [this pull request by abustany](https://github.com/quassel/quassel/pull/4) and refactored most of his LDAP code to write a new LdapAuthenticator class. If cmake fails to find the LDAP libraries then this part of the core will not be built.\n\nThis does not break protocol compatibility; it adds optional parameters to the ClientInitAck/ClientRegistered handshake (for passing a QVariantList of auth providers and their setup information) and two optional parameters to the SetupData handshake (for passing the configuration information about auth providers). I added a new CoreFeature, `AuthBackends = 0x0020`, that the client uses to determine whether or not it should display the authentication selection page in core setup if it's configuring an older core. On the other hand, if the newer core is being configured by an older client, then the core simply defaults to using the \"SqlAuthenticator\" provider as its auth backend: this is a class that is simply a wrapper for the existing auth in quassel (try to check the password against the one stored in the database). Because new client-side code was required to display the auth provider setup page in the core setup dialog, older clients cannot configure newer cores to use anything but local authentication.\n\nAuthentication now works as follows: the core auth handler first calls `Core::validateUser` as before, attempting to do local authentication. If local authentication fails and an external provider is configured, the auth handler calls  `Core::authenticateUser`, which calls the current authenticator's `validateUser()` method. The naming is now slightly odd, but this is done so that the SqlAuthenticator class can simply call `Core::validateUser` without doing anything more complicated. \n\nIn addition to what I've written above I'm more than willing to contribute documentation on my changes and how to add new auth providers to e.g. the quassel wiki, but I haven't gotten around to it yet. (I will likely also implement some kind of Kerberos auth provider too now that the framework to do so exists).\n\nOther comments on password changing:\n\nThe authenticator each user was configured with is now a string stored in the quasseluser table. This string defaults to \"Database\" and is checked twice: once when a user logs in (to verify they are logging in with the auth provider they were configured with) and once when a user tries to change their password (or the admin does, from the command line).\n\nThe password changing logic now works as follows:\n- If the user was configured with the Database authenticator, allow them to change their password always. (This is a crutch because we always need to be capable of doing database auth but the core doesn't always have a database authenticator stored, because the core can currently only remember one auth provider at a time).\n- If the user was configured with a different authenticator, and it's _not_ the one authenticator the core currently knows about, do not allow password changes. This is currently a nonissue because there aren't any other auth providers yet.\n- If the user was configured with an authenticator that the core currently knows about, check what `authenticator->canChangePassword()` returns. For ldapauthenticator, this is a hardcoded function that always returns false.\n\nThere may be other issues that I have not thought about, too. Please let me know if you have feedback, suggestions on dealing with the above, or if you find issues, etc!\n"},"comment":{"url":"https://api.github.com/repos/quassel/quassel/issues/comments/257706869","html_url":"https://github.com/quassel/quassel/pull/170#issuecomment-257706869","issue_url":"https://api.github.com/repos/quassel/quassel/issues/170","id":257706869,"user":{"login":"jaakristioja","id":2684083,"avatar_url":"https://avatars.githubusercontent.com/u/2684083?v=3","gravatar_id":"","url":"https://api.github.com/users/jaakristioja","html_url":"https://github.com/jaakristioja","followers_url":"https://api.github.com/users/jaakristioja/followers","following_url":"https://api.github.com/users/jaakristioja/following{/other_user}","gists_url":"https://api.github.com/users/jaakristioja/gists{/gist_id}","starred_url":"https://api.github.com/users/jaakristioja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaakristioja/subscriptions","organizations_url":"https://api.github.com/users/jaakristioja/orgs","repos_url":"https://api.github.com/users/jaakristioja/repos","events_url":"https://api.github.com/users/jaakristioja/events{/privacy}","received_events_url":"https://api.github.com/users/jaakristioja/received_events","type":"User","site_admin":false},"created_at":"2016-11-01T21:39:04Z","updated_at":"2016-11-01T21:39:04Z","body":"I'm getting the following SQL errors with a05e435 which also seem to result in low performance logging in (at least the first time). I don't know if these are relevant or not. Attaching the [core log](https://github.com/quassel/quassel/files/565117/quassel-core-stdout.txt).\r\n\r\n"}}
{"actor":{"display_login":"jaakristioja"}}