{"action":"created","issue":{"url":"https://api.github.com/repos/go-gitea/gitea/issues/1844","repository_url":"https://api.github.com/repos/go-gitea/gitea","labels_url":"https://api.github.com/repos/go-gitea/gitea/issues/1844/labels{/name}","comments_url":"https://api.github.com/repos/go-gitea/gitea/issues/1844/comments","events_url":"https://api.github.com/repos/go-gitea/gitea/issues/1844/events","html_url":"https://github.com/go-gitea/gitea/pull/1844","id":232615920,"number":1844,"title":"LDAP Public SSH Keys synchronization","user":{"login":"dnmgns","id":2789087,"avatar_url":"https://avatars1.githubusercontent.com/u/2789087?v=4","gravatar_id":"","url":"https://api.github.com/users/dnmgns","html_url":"https://github.com/dnmgns","followers_url":"https://api.github.com/users/dnmgns/followers","following_url":"https://api.github.com/users/dnmgns/following{/other_user}","gists_url":"https://api.github.com/users/dnmgns/gists{/gist_id}","starred_url":"https://api.github.com/users/dnmgns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnmgns/subscriptions","organizations_url":"https://api.github.com/users/dnmgns/orgs","repos_url":"https://api.github.com/users/dnmgns/repos","events_url":"https://api.github.com/users/dnmgns/events{/privacy}","received_events_url":"https://api.github.com/users/dnmgns/received_events","type":"User","site_admin":false},"labels":[{"id":474798837,"url":"https://api.github.com/repos/go-gitea/gitea/labels/kind/feature","name":"kind/feature","color":"006b75","default":false},{"id":475283668,"url":"https://api.github.com/repos/go-gitea/gitea/labels/lgtm/done","name":"lgtm/done","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/go-gitea/gitea/milestones/21","html_url":"https://github.com/go-gitea/gitea/milestone/21","labels_url":"https://api.github.com/repos/go-gitea/gitea/milestones/21/labels","id":3004249,"number":21,"title":"1.5.0","description":"","creator":{"login":"lunny","id":81045,"avatar_url":"https://avatars2.githubusercontent.com/u/81045?v=4","gravatar_id":"","url":"https://api.github.com/users/lunny","html_url":"https://github.com/lunny","followers_url":"https://api.github.com/users/lunny/followers","following_url":"https://api.github.com/users/lunny/following{/other_user}","gists_url":"https://api.github.com/users/lunny/gists{/gist_id}","starred_url":"https://api.github.com/users/lunny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lunny/subscriptions","organizations_url":"https://api.github.com/users/lunny/orgs","repos_url":"https://api.github.com/users/lunny/repos","events_url":"https://api.github.com/users/lunny/events{/privacy}","received_events_url":"https://api.github.com/users/lunny/received_events","type":"User","site_admin":false},"open_issues":35,"closed_issues":75,"state":"open","created_at":"2017-12-30T04:21:56Z","updated_at":"2018-03-07T10:00:57Z","due_on":"2018-05-23T07:00:00Z","closed_at":null},"comments":18,"created_at":"2017-05-31T16:03:25Z","updated_at":"2018-03-08T20:27:41Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/go-gitea/gitea/pulls/1844","html_url":"https://github.com/go-gitea/gitea/pull/1844","diff_url":"https://github.com/go-gitea/gitea/pull/1844.diff","patch_url":"https://github.com/go-gitea/gitea/pull/1844.patch"},"body":"This PR will implement a way to synchronize Public SSH Keys from LDAP when Public SSH Key(s) are stored as LDAP attribute in LDAP server.\r\n\r\nNot long ago, #1478 was merged, which added a LDAP user synchronization feature. This PR will sort-of extend that one and and include a (optional) Public SSH Key synchronization feature.\r\n\r\n# The PR introduces the following changes in short:\r\n* `Public SSH key attribute` setting for add/edit Login Source (when Authentication Type = LDAP (via BindDN))\r\n~~* `Enable Public SSH key synchronization` checkbox for add/edit Login Source~~\r\n~~* `REPLACE_PUBLIC_SSH_KEYS` setting in app.ini (Default: false), when set to true it replaces all public ssh keys for users synchronized from LDAP and replaces them with the public keys from LDAP~~\r\n* `login_source_id` column in public_key table to keep track of the public_key source (When deleting keys, we therefore can choose to only delete those synchronized with LDAP. Plus it makes life easier for sysadmin)\r\n\r\n~~# Why d54d92f and 9e09a9c are included in this PR~~\r\n~~Note that d54d92f0b81e1d71fa2a4b2aedca985e7aa841d7 and 9e09a9ccd83130cccdfa71c8000db48310d7a8ea addresses two issues found in Gitea, they are not specifically for this synchronization feature. But I choose to include them, as using this key sync feature could lead to some pretty serious issues otherwise. Depending on the update interval for LDAP User synchronization and available resources, the system could end up with lots of bak-files for authorized_keys and lots of public tmp-files causing inode issue and running out of free space. Therefore I choose to also the following changes in this PR:~~\r\n~~* Delete the temporary public key file after it has been used to calculate the public key fingerprint~~\r\n~~* Setting in app.ini to completely disable authorized_keys backup (default: disabled)~~\r\nEdit: Created two separate PR for this.\r\n\r\n# Thoughts\r\n~~While the synchronization part (where LDAP keys are added to DB) could be a lot smarter, It is a thoughtful choice to always drop all LDAP keys from DB and add all LDAP keys fetched from the LDAP server again. This reduces the complexity with handling every case (and requires fewer lines of code) while meeting the desired result.~~\r\nEdit: I've added some logic for the key synchronization now, as dropping all keys and adding them again caused some auto increment leakage along with the key not being available for a split second.\r\n\r\nThis is almost my first time writing any go code at all, I've just read plenty of go code before and made some one-row-changes here and there, so feel free to comment on the code itself along with the design.\r\n\r\nThere's currently no known issues with this new functionality."},"comment":{"url":"https://api.github.com/repos/go-gitea/gitea/issues/comments/371613787","html_url":"https://github.com/go-gitea/gitea/pull/1844#issuecomment-371613787","issue_url":"https://api.github.com/repos/go-gitea/gitea/issues/1844","id":371613787,"user":{"login":"dnmgns","id":2789087,"avatar_url":"https://avatars1.githubusercontent.com/u/2789087?v=4","gravatar_id":"","url":"https://api.github.com/users/dnmgns","html_url":"https://github.com/dnmgns","followers_url":"https://api.github.com/users/dnmgns/followers","following_url":"https://api.github.com/users/dnmgns/following{/other_user}","gists_url":"https://api.github.com/users/dnmgns/gists{/gist_id}","starred_url":"https://api.github.com/users/dnmgns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnmgns/subscriptions","organizations_url":"https://api.github.com/users/dnmgns/orgs","repos_url":"https://api.github.com/users/dnmgns/repos","events_url":"https://api.github.com/users/dnmgns/events{/privacy}","received_events_url":"https://api.github.com/users/dnmgns/received_events","type":"User","site_admin":false},"created_at":"2018-03-08T20:27:40Z","updated_at":"2018-03-08T20:27:40Z","author_association":"CONTRIBUTOR","body":"@lunny - rebased\r\n@lafriks - looks good?"}}
{"actor":{"display_login":"dnmgns"}}