is it possible to create the gerrit admin user on the command line instead of in the web interface?

[erik.s...@gmail.com]

A quote from:

https://gerrit-documentation.storage.googleapis.com/Documentation/2.11/install-quick.html

"The first user to sign-in and register an account will be automatically placed into the fully privileged Administrators group, permitting server management over the web and over SSH. Subsequent users will be automatically registered as unprivileged users."

I wonder if it is possible to create the admin user on the command line instead of in the web interface?

The use case scenario I'm thinking of, is when you want to have install script that also tries to configure gerrit as much as possible.

With a bit of guessing I tried it this way:

$  java -jar /tmp/gerrit-2.10.war init --batch -d /home/ubuntu/gerrit --install-plugin=download-commands

Generating SSH host key ... rsa(simple)... done

Initialized /home/ubuntu/gerrit

Executing /home/ubuntu/gerrit/bin/gerrit.sh start

$ cat id_rsa.pub | java -jar /tmp/gerrit-2.10.war create-account --group Administrators --ssh-key - -d /home/ubuntu/gerrit gerrit-admin

fatal: unknown command create-account

      (no com.google.gerrit.pgm.create-account)

But it doesn't work.

cheers,

Erik

[David Pursehouse]

On 03/11/2015 11:51 PM, erik.s...@gmail.com wrote:
> A quote from:
> https://gerrit-documentation.storage.googleapis.com/Documentation/2.11/install-quick.html
>
> "The first user to sign-in and register an account will be automatically
> placed into the fully privileged Administrators group, permitting server
> management over the web and over SSH. Subsequent users will be
> automatically registered as unprivileged users."
>
> I wonder if it is possible to create the admin user on the command line
> instead of in the web interface?
> The use case scenario I'm thinking of, is when you want to have install
> script that also tries to configure gerrit as much as possible.
>

In the latest master version of gerrit it's possible to auto-create the
admin user during site init, but only when the authentication type is
"become any account", i.e. when running in development mode.

There has also recently been some work done by Luca Milanesio to
generate installation packages for Gerrit. It might be possible to
extend that to set up the admin user (if it doesn't do that already).

> With a bit of guessing I tried it this way:
>
> $ java -jar /tmp/gerrit-2.10.war init --batch -d /home/ubuntu/gerrit
> --install-plugin=download-commands
> Generating SSH host key ... rsa(simple)... done
> Initialized /home/ubuntu/gerrit
> Executing /home/ubuntu/gerrit/bin/gerrit.sh start
> $ cat id_rsa.pub | java -jar /tmp/gerrit-2.10.war create-account --group
> Administrators --ssh-key - -d /home/ubuntu/gerrit gerrit-admin
> fatal: unknown command create-account
> (no com.google.gerrit.pgm.create-account)
>
> But it doesn't work.
>

The create-account command is not a site program (like for example
'reindex'), but an ssh command. You need to already have an account
with associated ssh keys before being able to use it.

[Erik Sjölund]

On Thu, Mar 12, 2015 at 1:12 AM, David Pursehouse
<david.pu...@sonymobile.com> wrote:
> On 03/11/2015 11:51 PM, erik.s...@gmail.com wrote:
>>
>> A quote from:
>>
>> https://gerrit-documentation.storage.googleapis.com/Documentation/2.11/install-quick.html
>>
>> "The first user to sign-in and register an account will be automatically
>> placed into the fully privileged Administrators group, permitting server
>> management over the web and over SSH. Subsequent users will be
>> automatically registered as unprivileged users."
>>
>> I wonder if it is possible to create the admin user on the command line
>> instead of in the web interface?
>> The use case scenario I'm thinking of, is when you want to have install
>> script that also tries to configure gerrit as much as possible.
>>
>
> In the latest master version of gerrit it's possible to auto-create the
> admin user during site init, but only when the authentication type is
> "become any account", i.e. when running in development mode.
>
> There has also recently been some work done by Luca Milanesio to generate
> installation packages for Gerrit. It might be possible to extend that to
> set up the admin user (if it doesn't do that already).

Thanks for the information!

>
>
>> With a bit of guessing I tried it this way:
>>
>> $ java -jar /tmp/gerrit-2.10.war init --batch -d /home/ubuntu/gerrit
>> --install-plugin=download-commands
>> Generating SSH host key ... rsa(simple)... done
>> Initialized /home/ubuntu/gerrit
>> Executing /home/ubuntu/gerrit/bin/gerrit.sh start
>> $ cat id_rsa.pub | java -jar /tmp/gerrit-2.10.war create-account --group
>> Administrators --ssh-key - -d /home/ubuntu/gerrit gerrit-admin
>> fatal: unknown command create-account
>> (no com.google.gerrit.pgm.create-account)
>>
>> But it doesn't work.
>>
>
> The create-account command is not a site program (like for example
> 'reindex'), but an ssh command. You need to already have an account with
> associated ssh keys before being able to use it.

Ok, I was guessing that was the case.

[Akshay Moghe]

So this means that until the first user is added to the system (possibly via the first login, as described in the docs) and sets up his/her SSH keys, this command cannot be run. Am I correct in my understanding? 

[David Pursehouse]

Correct.  The ssh commands can only be run by a registered user who has set up at least one SSH key.

Additionally, this specific command (create-project) requires the 'Administrate Server' capability (which will be automatically given to the first registered user) or the 'Create Project' capability.

 

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[luca.mi...@gmail.com]

Are you trying to automate Gerrit setup? 

Why don't you use native packages and customise the post insta scripts?

Native packages start with development_become_any_account with the first admin User with password secret setup.

Then you can use this credentials to run the SSH post install. When everything is initialised you can switch the auth.

Luca

Sent from my iPhone

[Akshay Moghe]

Thanks for the tip Luca. 

Yes, I am trying to automate the installation (in a docker container) such that the resulting container has a local admin user (no web access) that can be used to run commands over ssh (such as add-user or add-groups). I looked at the sources for building the native pkgs (gerrit-installer tools) but they don't seem to do any customization as I'm trying to do.

Whats not clear to me is how in DEVELOPMENT_BECOME_ANY_ACCOUNT mode the admin user is able to login via ssh (in order to run the commands) without setting up a keypair. As I see it the builtin ssh server only offers "publickey" as an auth mechanism and I don't see a way to change this via the config. So I guess I'm missing something from what you suggested. Furthermore, its not clear whether API access behaves differently in this auth mode (I'm yet to experiment with it).

So in short, I'm unsure how to create default projects, groups in a scripted fashion (after/during installation) even if I set the auth type to DEVELOPMENT_BECOME_ANY_ACCOUNT.

Any pointers/help would be greatly appreciated.

--
--
To unsubscribe, email repo-discuss+unsubscribe@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
--
To unsubscribe, email repo-discuss+unsubscribe@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss+unsubscribe@googlegroups.com.

[Edwin Kempin]

On Fri, Oct 7, 2016 at 11:35 PM, Akshay Moghe <akshay...@gmail.com> wrote:

Thanks for the tip Luca. 

Yes, I am trying to automate the installation (in a docker container) such that the resulting container has a local admin user (no web access) that can be used to run commands over ssh (such as add-user or add-groups). I looked at the sources for building the native pkgs (gerrit-installer tools) but they don't seem to do any customization as I'm trying to do.

Whats not clear to me is how in DEVELOPMENT_BECOME_ANY_ACCOUNT mode the admin user is able to login via ssh (in order to run the commands) without setting up a keypair. As I see it the builtin ssh server only offers "publickey" as an auth mechanism and I don't see a way to change this via the config. So I guess I'm missing something from what you suggested. Furthermore, its not clear whether API access behaves differently in this auth mode (I'm yet to experiment with it).

DEVELOPMENT_BECOME_ANY_ACCOUNT allows any user to impersonate any other user.

 

So in short, I'm unsure how to create default projects, groups in a scripted fashion (after/during installation) even if I set the auth type to DEVELOPMENT_BECOME_ANY_ACCOUNT.

Any pointers/help would be greatly appreciated.

DEVELOPMENT_BECOME_ANY_ACCOUNT has an init step that creates the admin user [1]. You may write a plugin with a similar init step to automatically create an admin user on init when another auth type is used.

[1] https://gerrit.googlesource.com/gerrit/+/refs/heads/master/gerrit-pgm/src/main/java/com/google/gerrit/pgm/init/InitAdminUser.java

[Akshay Moghe]

Folks, thanks for the tip on using the ...BECOME_ANY_ACCOUNT  to configure gerrit before using it in production. It works like a charm. However this I'm running into a slightly different problem further downstream in my workflow:

My intention is to create an admin account (which I do when I initialize gerrit using ..._BECOME_ANY_ACCOUNT), and some user accounts (via the REST API, using the admin user). Later, in production the users are going to access gerrit via a frontend http proxy (where I will authenticate them, so I set auth = HTTP in the gerrit config). However when I test this, gerrit is not able to correctly identify/authenticat the user (set in the auth.httpHeader) even though the user was created via the REST API.

I notice that when creating users via the REST API (using the admin account), they get added to the ACCOUNT_EXTERNAL_IDS, but when a new user is added via the "normal" web workflow (hitting gerrit UI directly), they also have a corresponding "gerrit:userfoo" entry in that table. I see these errors in the logs:

[2016-10-25 00:08:11,481] [HTTP-48] ERROR com.google.gerrit.server.account.AccountManager : Cannot assign user name "userfoo" to account 1000012; name already in use.

[2016-10-25 00:08:11,482] [HTTP-48] ERROR com.google.gerrit.httpd.auth.container.HttpLoginServlet : Unable to authenticate user "userfoo"

This leads me to believe that gerrit is attempting to create a new account for the user "userfoo"  even when I've already created this user via the REST API.

Is there a way to tell gerrit that when I create a user (via the REST API) , that the user will be logging in via auth=HTTP? Or am I missing some critical step during user creation thats causing this authentication problem? Unfortunately I don't quite understand the schema of the ACCOUNT_EXTERNAL_IDS table to make sense of what is going on.

Thanks

--
--
To unsubscribe, email repo-discuss...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
--
To unsubscribe, email repo-discuss...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
--
To unsubscribe, email repo-discuss...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

[Björn Pedersen]

HI,

this is  a bug that  was fixed in 2.12.5: https://gerrit-review.googlesource.com/#/c/85197/

Björn

[Akshay Moghe]

I've narrowed it down to this difference in the ACCOUNT_EXTERNAL_IDS table:

gerrit> select * from account_external_ids;

 ACCOUNT_ID | EMAIL_ADDRESS           | PASSWORD    | EXTERNAL_ID

 -----------+-------------------------+-------------+-------------------------------

 1000001    | NULL                    | password    | username:foobar

 1000001    | foo...@internaluser.com | NULL        | mailto:foo...@internaluser.com

 1000005    | NULL                    | NULL        | gerrit:bubbles

 1000005    | NULL                    | NULL        | username:bubbles

 1000006    | NULL                    | NULL        | gerrit:fluffy

 1000006    | NULL                    | NULL        | username:fluffy

In this case, the user "foobar" was created via the API. It gets a username:foobar entry, and a mailto:<email> entry. However the other two also get a "gerrit:<username>" entry.

I've narrowed it down to private AccountExternalId getAccountExternalId(ReviewDb db,AccountExternalId.Key key)

To me it seems like when auth=HTTP , gerrit only picks the SCHEME_GERRIT (which has the "gerrit:" prefix string), whereas when creating the user via the REST API, it sets the SCHEME_USERNAME (which has the prefix string "username:").

Any clues on how I could either (a) create the user with the SCHEME_GERRIT , or force the authentication code to pick SCHEME_USERNAME ?

[Akshay Moghe]

Hi Bjorn. Thanks for the quick response. However I think that bug you pointed me to is specifically for auth using LDAP, where the username was made case sensitive. As I pointed out in the earlier message, I believe this has to do with the selection of either SCHEME_USERNAME, or SCHEME_GERRIT from the AccountExternalId (as used in AccountManager.java where it tries to authenticate the user, and tries to create a new user if it cannot find the Id).

[Tomasz Szandała]

I am sorry, but I've stucked on this:
I have my gerrit started in development mode (init with --batch and --dev param), but how can I perform any SSH task?
How to get key to admin user?

--
--
To unsubscribe, email repo-discuss...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
--
To unsubscribe, email repo-discuss...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
--
To unsubscribe, email repo-discuss...@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

[Edwin Kempin]

On Fri, Dec 30, 2016 at 12:57 PM, Tomasz Szandała <tomasz....@gmail.com> wrote:

I am sorry, but I've stucked on this:
I have my gerrit started in development mode (init with --batch and --dev param), but how can I perform any SSH task?
How to get key to admin user?

The init step that creates the admin user for the development mode takes the public SSH key from your home directory (~/.ssh/id_rsa.pub). If you don't have an SSH key there, you must generate it before initializing Gerrit for the first time.

 

--
--
To unsubscribe, email repo-discuss+unsubscribe@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss+unsubscribe@googlegroups.com.

[Saša Živkov]

On Fri, Dec 30, 2016 at 12:57 PM, Tomasz Szandała <tomasz....@gmail.com> wrote:

I am sorry, but I've stucked on this:
I have my gerrit started in development mode (init with --batch and --dev param), but how can I perform any SSH task?

$ ssh -p29418 admin@localhost gerrit ...

 

How to get key to admin user?

The --dev option created an "admin" user and also uploaded your public SSH key to the admin user's account in Gerrit.

 

--
--
To unsubscribe, email repo-discuss+unsubscribe@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss+unsubscribe@googlegroups.com.

[Tomasz Szandała]

Thank You, Thank You :D
It was the thing I was missing

[Sven Selberg]

If you want to use ssh commands locally, from within the container, you can also use the default user "Gerrit Code Review" and Gerrit's own ssh key {GERRIT_SITE}/etc/ssh_history_rsa (don't know if I recall the name correctly).

Sven Selberg

---- Tomasz Szandała skrev ----

[Cayo M.]

could you help me out with this also? Im setting up an docker image based on https://github.com/GerritCodeReview/docker-gerrit/blob/master/centos/7/Dockerfile

but its not working as supposed.

I created ssh-keys into the gerrit-homedir and inserted the flag "--dev" into the init command, but there is no way the Administrator user is getting the SSH-Key inserted automatically with that.

Unfortunately i couldn't find anything about this in other places or official documentation...

Any hint would help me a lot.

Thanks

[Cayo M.]

is the --dev option working in another way in version 2.15? Im stuck on this since days and cant make it work as describe here... no matter what/how i do it, the ssh-keys will not be uploaded to the default/admin user.

Am Freitag, 30. Dezember 2016 13:06:34 UTC+1 schrieb zivkov:

[Edwin Kempin]

On Mon, Dec 18, 2017 at 3:11 PM, 'Cayo M.' via Repo and Gerrit Discussion <repo-d...@googlegroups.com> wrote:

is the --dev option working in another way in version 2.15? Im stuck on this since days and cant make it work as describe here... no matter what/how i do it, the ssh-keys will not be uploaded to the default/admin user.

The --dev option must only be used for development, not for initializing productive systems.

By default init can't create the initial admin user if the authentication type is not DEVELOPMENT_BECOME_ANY_ACCOUNT.

However it is possible to that you write a plugin that adds an init step that creates the initial admin user for whatever authentication type you use.

The code should be similar to InitAdminUser class that creates the initial admin user for --dev mode.

 

--
--
To unsubscribe, email repo-discuss+unsubscribe@googlegroups.com

More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss+unsubscribe@googlegroups.com.

[Cayo M.]

Thank you for the quick answer. Im playing around and its a development environment. Using the flag —dev it sets the auth type as DEVELOPMENT_BECOME_ANY_ACCOUNT, but however it is not uploading the ssh-keys from Gerrits home dir to that user (and because of that im not able to create a Jenkins user into the "non-interactive users“.

I think I tried almost everything but the correct steps -.-

[Edwin Kempin]

On Mon, Dec 18, 2017 at 3:40 PM, Cayo M. <cam...@googlemail.com> wrote:

Thank you for the quick answer. Im playing around and its a development environment. Using the flag —dev it sets the auth type as DEVELOPMENT_BECOME_ANY_ACCOUNT, but however it is not uploading the ssh-keys from Gerrits home dir to that user (and because of that im not able to create a Jenkins user into the "non-interactive users“.

The init step that creates the admin user reads the 'user.home' system property and then appends ".ssh/id_rsa.pub".

Do you have this system property set? Does a valid .ssh/id_rsa.pub file exist in this folder?

Please note that this init step is not executed if any account already exists.

I think I tried almost everything but the correct steps -.-

If it's a development system, just log in as the admin user and add the SSH key from the UI.

[Cayo M.]

yes. Everything looks good actually.

bash-4.2$ echo $HOME

/var/gerrit

bash-4.2$ id

uid=1000(gerrit) gid=1000(gerrit) groups=1000(gerrit)

bash-4.2$ echo $HOME

/var/gerrit

bash-4.2$ ls -la /var/gerrit/.ssh/

total 24

drwxr-xr-x 2 gerrit gerrit 4096 Dec 14 10:53 .

drwxr-xr-x 1 gerrit gerrit 4096 Dec 13 09:06 ..

-rw-r--r-- 1 gerrit gerrit  757 Dec 13 09:10 authorized_keys

-rw-r--r-- 1 gerrit gerrit  390 Dec 13 09:05 id_jenkins.pub

-rw------- 1 gerrit gerrit 1679 Dec 14 10:53 id_rsa

-rw-r--r-- 1 gerrit gerrit  401 Dec 14 10:53 id_rsa.pub

Im making a PoC for a containerized solution to the whole application life cycle. Thats why I want to make the full setup automatically and till yet its been a pain in the ass configuring it.