[chef] Re: Automating Gerrit Ssh Keys

[Steffen Gebert < >]

> If anybody else knows better than we both here do, I'm happy to hear
> from you. Otherwise I try to post it to repo-discuss hopefully still
> tonight.

The moment, when you google sth. and find your own post :D
https://groups.google.com/forum/#!msg/repo-discuss/BrapgsIvibI/7ntUuO6gTpwJ
So I've posted that problem already more than a year ago, but did some
other mistake back then. So I will continue in that thread.

Steffen

On 09/01/14 21:41, Steffen Gebert wrote:
> Hi Stephen,
> 
> I'm having nearly the same problem and I want to solve it during the
> weekend. Or: I have solved it in a way before that I don't like to
> implement a second time now again.
> 
> In addition to the possibilities there are some more:
> 4) Use the REST API, however that might be a chicken-egg problem again:
> How do you authenticate against that?
> 
> 5) Use the suexec [1] / peer_keys mechanism [2]
> In [3], I'm doing some black magic (with my early Ruby knowledge) to
> create a SSH keypair and place its pubkey in the file etc/peer_keys
> (without a leading ssh-(rsa|dsa)). Using that key, you can log into
> Gerrit as user "Gerrit Code Review". (*)
> However, that's what bothers me, you can only impersonate other users
> this way - so you can't directly issue a "gerrit create-account"
> command, but have to specify the email address of the Gerrit user (that
> needs to be an admin) as whom you want to act. And yes.. welcome
> chicken-egg problem - how to create that user?
> 
> So I'm about to post problem that to the list that probably fits even
> better than this one (repo-discuss [4]).
> While I can issue like show-caches, I get a "Not Signed In" Exception,
> as soon as I issue e.g. a flush-caches or create-user without a suexec
> impersonation. Yes.. that makes it hard to automatize and I see no
> reason, why it would be bad to allow me issuing such commands, when I
> have the power to impersonate any user.
> 
> If anybody else knows better than we both here do, I'm happy to hear
> from you. Otherwise I try to post it to repo-discuss hopefully still
> tonight.
> 
> Yours
> Steffen
>