openid configuration
208 views
Skip to first unread message
Matthieu
Feb 16, 2011, 2:06:22 AM2/16/11
to jenkins...@googlegroups.com
Hello,
I am trying to set up openid authentication on my jenkins server. However, my openid.return_to has to be changed, and i have found no trace of where to set this var in the config.xml... Has someone succeeded into changing this parameter?
Kohsuke Kawaguchi
Feb 16, 2011, 11:20:10 AM2/16/11
to jenkins...@googlegroups.com, Matthieu
I'm not sure what you mean by changing "openid.return_to", but I suspect
you need to configure Hudson and teach its own URL.
It's in the system configuration page, under the e-mail section.
--
Kohsuke Kawaguchi | CloudBees, Inc. | http://cloudbees.com/
Matthieu
Feb 16, 2011, 1:02:00 PM2/16/11
to Kohsuke Kawaguchi, jenkins...@googlegroups.com
---------- Forwarded message ----------
From: Matthieu Bertin <matthie...@brzhk.info>
Date: Wed, Feb 16, 2011 at 6:22 PM
Subject: Re: openid configuration
To: Kohsuke Kawaguchi <kkawa...@cloudbees.com>
Cc: jenkins...@googlegroups.com
thanks for answering my question, but i will hand to myself today's stupid question trophee. I found out what my problem was: i did not set up all the necessary stuff for my domain to handle the openid protocol entirely. According to this tutorial http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/ , i forgot to do the second step.
From: Matthieu Bertin <matthie...@brzhk.info>
Date: Wed, Feb 16, 2011 at 6:22 PM
Subject: Re: openid configuration
To: Kohsuke Kawaguchi <kkawa...@cloudbees.com>
Cc: jenkins...@googlegroups.com
thanks for answering my question, but i will hand to myself today's stupid question trophee. I found out what my problem was: i did not set up all the necessary stuff for my domain to handle the openid protocol entirely. According to this tutorial http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/ , i forgot to do the second step.
unfortunately, it hasn't solved the problem entirely. It ends up with jenkins telling me 'failed to login'. the logs shows this:
16 févr. 2011 18:17:15 org.openid4java.discovery.Discovery discover
INFO: Starting discovery on URL identifier: https://www.google.com/accounts/o8/site-xrds?hd=example.com
16 févr. 2011 18:17:17 org.openid4java.discovery.yadis.YadisResolver discover
INFO: Yadis discovered 1 endpoints from: https://www.google.com/accounts/o8/site-xrds?hd=example.com
16 févr. 2011 18:17:17 org.openid4java.discovery.Discovery discover
INFO: Discovered 1 OpenID endpoints.
16 févr. 2011 18:17:17 org.openid4java.consumer.ConsumerManager associate
INFO: Trying to associate with https://www.google.com/a/example.com/o8/ud?be=o8 attempts left: 4
16 févr. 2011 18:17:17 org.openid4java.consumer.ConsumerManager associate
INFO: Associated with https://www.google.com/a/example.com/o8/ud?be=o8 handle: HhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHhHh
16 févr. 2011 18:17:17 org.openid4java.consumer.ConsumerManager authenticate
INFO: Creating authentication request for OP-endpoint: https://www.google.com/a/example.com/o8/ud?be=o8 claimedID: http://specs.openid.net/auth/2.0/identifier_select OP-specific ID: http://specs.openid.net/auth/2.0/identifier_select
16 févr. 2011 18:17:17 org.openid4java.server.RealmVerifier match
INFO: Return URL: http://mymachine.example.com/jenkins/securityRealm/finishLogin matches realm: http://mymachine.example.com/jenkins/securityRealm/finishLogin
16 févr. 2011 18:17:21 org.openid4java.consumer.ConsumerManager verify
INFO: Verifying authentication response...
16 févr. 2011 18:17:21 org.openid4java.consumer.ConsumerManager verify
INFO: Received positive auth response.
16 févr. 2011 18:17:21 org.openid4java.discovery.Discovery discover
INFO: Starting discovery on URL identifier: http://example.com/openid?id=010101010101010101010
16 févr. 2011 18:17:22 org.openid4java.discovery.yadis.YadisResolver discover
INFO: Yadis discovered 0 endpoints from: http://example.com/openid?id=010101010101010101010
16 févr. 2011 18:17:22 org.openid4java.discovery.Discovery discover
INFO: No OpenID service endpoints discovered through Yadis; attempting HTML discovery...
16 févr. 2011 18:17:22 org.openid4java.util.HttpCache match
INFO: Cached GET response does not match the required content type, removing.
16 févr. 2011 18:17:22 org.openid4java.util.HttpCache get
INFO: Removing cached GET for http://example.com/openid?id=010101010101010101010
16 févr. 2011 18:17:22 org.openid4java.util.HttpCache removeGet
INFO: Removing cached GET response for http://example.com/openid?id=010101010101010101010
16 févr. 2011 18:17:22 org.openid4java.discovery.html.HtmlResolver discoverHtml
INFO: HTML discovery completed on: http://example.com/openid?id=010101010101010101010
16 févr. 2011 18:17:22 org.openid4java.discovery.Discovery discover
INFO: Discovered 0 OpenID endpoints.
16 févr. 2011 18:17:22 org.openid4java.consumer.ConsumerManager verifyDiscovered2
GRAVE: No service element found to match the ClaimedID / OP-endpoint in the assertion.
16 févr. 2011 18:17:22 org.openid4java.consumer.ConsumerManager verify
GRAVE: Discovered information verification failed.
i am still trying to find out what's wrong with this.
Kohsuke Kawaguchi
Feb 17, 2011, 6:18:08 PM2/17/11
to Matthieu Bertin, jenkins...@googlegroups.com
On 02/16/2011 09:22 AM, Matthieu Bertin wrote:
> thanks for answering my question, but i will hand to myself today's stupid
> question trophee. I found out what my problem was: i did not set up all the
> necessary stuff for my domain to handle the openid protocol entirely. According
> to this tutorial
> http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/ , i
> forgot to do the second step.
>
> unfortunately, it hasn't solved the problem entirely. It ends up with jenkins
> telling me 'failed to login'. the logs shows this:
> thanks for answering my question, but i will hand to myself today's stupid
> question trophee. I found out what my problem was: i did not set up all the
> necessary stuff for my domain to handle the openid protocol entirely. According
> to this tutorial
> http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/ , i
> forgot to do the second step.
>
> unfortunately, it hasn't solved the problem entirely. It ends up with jenkins
> telling me 'failed to login'. the logs shows this:
Are you trying to use your Google App accounts for OpenID? Or are you
trying to run your own server?
Does your OpenID work with other sites that accept OpenID?
Kohsuke Kawaguchi
Feb 17, 2011, 6:29:30 PM2/17/11
to Matthieu Bertin, jenkins...@googlegroups.com
If I'm reading the link right, this involves a proprietary discovery
protocol. I suspect that's why it doesn't work with the OpenID plugin.
Matthieu
Feb 18, 2011, 1:16:05 AM2/18/11
to jenkins...@googlegroups.com, Kohsuke Kawaguchi
it is, actually, google apps accounts for OpenID.. So they do involve proprietary discovery protocol?
I guess i'll have to start coding a little bit for the OpenID plugin.. :)
Matthieu
Feb 18, 2011, 4:10:53 AM2/18/11
to jenkins...@googlegroups.com, Kohsuke Kawaguchi
I forgot to mention: it does work with some websites, and, won't with some others.
And first login went well, except that the openid provided was a google-url based one instead of my domain name. When i switched to 'matrix based ' and entered my 'google' openid, it would not let me in anymore.
Hampr works well, but they mention accepting google accounts as well...
http://www.scribblelive.com works too.
http://ccmixter.org works.
I've tried changing the openid endpoint with
https://www.google.com/accounts/o8/id
instead of
And first login went well, except that the openid provided was a google-url based one instead of my domain name. When i switched to 'matrix based ' and entered my 'google' openid, it would not let me in anymore.
Paul Sandoz
Feb 18, 2011, 8:08:40 AM2/18/11
to jenkins...@googlegroups.com
On Feb 18, 2011, at 7:16 AM, Matthieu wrote:
> it is, actually, google apps accounts for OpenID.. So they do involve proprietary discovery protocol?
>
> I guess i'll have to start coding a little bit for the OpenID plugin.. :)
>
It may require extensions of or changes to the OpenID4Java library, which the OpenID plugin uses.
My guess is one would extend org.openid4java.discovery.Discovery [1] to support the requirements specific to Google's extensions described here [2].
Paul.
[1] http://code.google.com/p/openid4java/source/browse/trunk/src/org/openid4java/discovery/Discovery.java?r=591
[2] http://groups.google.com/group/google-federated-login-api/web/openid-discovery-for-hosted-domains?pli=1
Reply all
Reply to author
Forward
0 new messages