Preconfigure Git Credential Manager as instance-wide OAuth application #11007

New Issue

GiteaMirror · 2025-11-02T09:24:44-06:00

GiteaMirror commented

2025-11-02 09:24:44 -06:00

Originally created by @shyim on GitHub (Jun 10, 2023).

Feature Description

It would be really nice if there would be a instance-wide OAuth application only for the purpose of using it with the Git Credential Manager or git-credential-oauth. This would allow Git authentication just work without passwords, personal access tokens or SSH keys.

The OAuth client details for both helpers are redirect URI http://127.0.0.1/, only the client-id needs to be same between all instances.

There is also a similar request to Gitlab: https://gitlab.com/gitlab-org/gitlab/-/issues/374172

Screenshots

No response

Originally created by @shyim on GitHub (Jun 10, 2023). ### Feature Description It would be really nice if there would be a instance-wide OAuth application only for the purpose of using it with the [Git Credential Manager](https://github.com/git-ecosystem/git-credential-manager) or [git-credential-oauth](https://github.com/hickford/git-credential-oauth). This would allow Git authentication *just work* without passwords, personal access tokens or SSH keys. The OAuth client details for both helpers are redirect URI http://127.0.0.1/, only the client-id needs to be same between all instances. There is also a similar request to Gitlab: https://gitlab.com/gitlab-org/gitlab/-/issues/374172 ### Screenshots _No response_

GiteaMirror added the proposal/accepted type/proposal type/feature labels 2025-11-02 09:24:44 -06:00

GiteaMirror closed this issue

2025-11-02 09:24:45 -06:00

GiteaMirror commented

2025-11-02 09:24:45 -06:00

@denyskon commented on GitHub (Jul 2, 2023):

@hickford You seem to be the author of git-credential-oauth. If we tried to integrate it into Gitea, would a pre-registered OAuth application be enough for it to work? Would we need to implement something else?

@denyskon commented on GitHub (Jul 2, 2023): @hickford You seem to be the author of git-credential-oauth. If we tried to integrate it into Gitea, would a pre-registered OAuth application be enough for it to work? Would we need to implement something else?

GiteaMirror commented

2025-11-02 09:24:45 -06:00

@hickford commented on GitHub (Jul 2, 2023):

@denyskon Two changes are necessary:

In a migration (pseudocode), insert an OAuth2Application record for git-credential-oauth. The client id must be the same on all instances.
So that git-credential-oauth can identify Gitea instances and select the appropriate configuration, change the 401 Unauthorized http header from Www-Authenticate: Basic realm="." to something like Www-Authenticate: Basic realm="Gitea"

@hickford commented on GitHub (Jul 2, 2023): @denyskon Two changes are necessary: 1. In a migration ([pseudocode](https://gitlab.com/gitlab-org/gitlab/-/issues/413809#note_1451710379)), insert an OAuth2Application record for git-credential-oauth. The client id must be the same on all instances. 2. So that git-credential-oauth can identify Gitea instances and select the appropriate configuration, change the 401 Unauthorized http header from `Www-Authenticate: Basic realm="."` to something like `Www-Authenticate: Basic realm="Gitea"`

GiteaMirror commented

2025-11-02 09:24:45 -06:00

@hickford commented on GitHub (Jul 3, 2023):

@shyim @denyskon I sketched an implementation in #25653 but it has a problem: the OAuth2Application isn't created on first time install. Maybe there's a better alternative to using a migration. If you have any ideas how to fix, please have a go.

@hickford commented on GitHub (Jul 3, 2023): @shyim @denyskon I sketched an implementation in #25653 but it has a problem: the OAuth2Application isn't created on first time install. Maybe there's a better alternative to using a migration. If you have any ideas how to fix, please have a go.

GiteaMirror commented

2025-11-02 09:24:45 -06:00

@denyskon commented on GitHub (Jul 3, 2023):

Thanks, I'll take a look tomorrow.

@denyskon commented on GitHub (Jul 3, 2023): Thanks, I'll take a look tomorrow.

GiteaMirror commented

2025-11-02 09:24:46 -06:00

@hickford commented on GitHub (Jul 8, 2023):

An alternative approach could be to hard code the application in GetOAuth2ApplicationByClientID without database records. https://github.com/go-gitea/gitea/pull/25774

@hickford commented on GitHub (Jul 8, 2023): An alternative approach could be to hard code the application in GetOAuth2ApplicationByClientID without database records. https://github.com/go-gitea/gitea/pull/25774

GiteaMirror commented

2025-11-02 09:24:46 -06:00

@hickford commented on GitHub (Jul 9, 2023):

@shyim @denyskon https://github.com/go-gitea/gitea/pull/25653 working, ready for review

@hickford commented on GitHub (Jul 9, 2023): @shyim @denyskon https://github.com/go-gitea/gitea/pull/25653 working, ready for review

GiteaMirror commented

2025-11-02 09:24:47 -06:00

@hickford commented on GitHub (Jul 10, 2023):

Security wise, it would be prudent to fix https://github.com/go-gitea/gitea/issues/25061 and #25813 , because these would protect the preconfigured OAuth client from client impersonation, and limit its scope.

@hickford commented on GitHub (Jul 10, 2023): Security wise, it would be prudent to fix https://github.com/go-gitea/gitea/issues/25061 and #25813 , because these would protect the preconfigured OAuth client from client impersonation, and limit its scope.

GiteaMirror commented

2025-11-02 09:24:47 -06:00

@lunny commented on GitHub (Aug 10, 2023):

This has been resolved by #26291

@lunny commented on GitHub (Aug 10, 2023): This has been resolved by #26291

GiteaMirror commented

2025-11-02 09:24:47 -06:00

@hickford commented on GitHub (Aug 10, 2023):

Released https://github.com/hickford/git-credential-oauth/releases/tag/v0.10.0 with universal Gitea support

Tested with https://try.gitea.io/

Requires both:

Gitea 1.21 or greater
Git 2.41 or greater

@hickford commented on GitHub (Aug 10, 2023): Released https://github.com/hickford/git-credential-oauth/releases/tag/v0.10.0 with universal Gitea support Tested with https://try.gitea.io/ Requires both: * Gitea 1.21 or greater * Git 2.41 or greater

GiteaMirror commented

2025-11-02 09:24:48 -06:00

@denyskon commented on GitHub (Aug 10, 2023):

@hickford Thanks for that quick implementation! Is anything needed from Gitea's side to also make it happen for Git Credential Manager?

@denyskon commented on GitHub (Aug 10, 2023): @hickford Thanks for that quick implementation! Is anything needed from Gitea's side to also make it happen for Git Credential Manager?

GiteaMirror commented

2025-11-02 09:24:48 -06:00

@hickford commented on GitHub (Aug 10, 2023):

Is anything needed from Gitea's side to also make it happen for Git Credential Manager?

@denyskon I don't think so. The implementation would be similar to 79a00fb737

@hickford commented on GitHub (Aug 10, 2023): > Is anything needed from Gitea's side to also make it happen for [Git Credential Manager](https://github.com/git-ecosystem/git-credential-manager)? @denyskon I don't think so. The implementation would be similar to https://github.com/hickford/git-credential-oauth/commit/79a00fb737159a6bbb245d0a42f94ce0c78d0957

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11007