Re: How can we improve the Changes Process?

On 7/6/26 13:01, Aurelien Bompard wrote:
>> FIDO2 tokens support for Noggin was implemented recently; I tried to
>> find *anyone* from the Fedora AAA team to talk about that work for about
>> a year, to no result. Even now, when the code is available, I have no
>> responses.
> 
> I have started looking at the PR, but it's very big, and full of sensitive things that I know nothing about.
> I am not working fulltime on Noggin, no one is, and I have had pretty urgent things to care about recently.
> I am considering just blindly merging the PR because I trust the author, but I'm still a bit reluctant to do that on principle. I know I wouldn't want another project to blindly merge anything I write, but then I'm not abbra.

Thank you. At this point I'm looking at any comments, even just an 
acknowledgement as above is fine. I also do not have a lot of time but 
when we know the effort would be supported by infra team, we can plan 
something properly.

Note that I also have another PR coming, that implements what Neal was 
asking for, account recovery feature based on the existing OTP tokens.

Is there a tooling to automatically provision noggin environments so 
that I can create an end to end test to help it getting merged?

> 
>> I have been working on solving those problems as well. It is a bit
>> frustrating to see no reaction from Fedora Infrastructure folks, though.
> 
> I understand, sorry about that. The people not working on Forgejo right now are spread pretty thin.
> 
>> For Ipsilon migration we were originally thinking about moving to
>> Keycloak but that doesn't solve a problem as Keycloak would need to gain
>> knowledge about IPA-specific features too. We have done some work on
>> that (ipa-tuura project) and even merged most of what we have in
>> Keycloak 26, but it still lacks few critical bits.
> 
> Yeah that's also what I found in my experiments.
> 
>> Then for IPA to IPA trust we need an integrated OAuth2 endpoint in
>> IPA. This was my focus for past several months and now we have Ahdapa,
>> https://ahdapa.dev/, which provides all required integration and can be
>> used by Fedora Infrastructure too. I showed it to nirik at the Flock
>> this year.
> 
> It looks very cool! Do you know if it does SAML2, or if it's planned? We do need it for  some apps (Bugzilla, Gitlab and Zabbix come to mind)

I have no plans for SAML2 yet, we do not need it ourselves. There are 
SAML2 SP/RP crates that could be used but my focus for FreeIPA is modern 
infra which is most entirely OAuth2.


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new