05-21-2019, 02:08 AM
Getting set up with Fedora Project services
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services.png" width="929" height="419" title="" alt="" /></div><div><p>In addition to providing an operating system, the Fedora Project provides numerous <a href="https://apps.fedoraproject.org/">services</a> for users and developers. Services such as <a href="https://ask.fedoraproject.org/">Ask Fedora</a>, the <a href="https://fedoraproject.org/wiki/Fedora_Project_Wiki">Fedora Project Wiki</a> and the <a href="https://lists.fedoraproject.org/archives/">Fedora Project Mailing Lists</a> provide users with valuable resources for <a href="https://fedoramagazine.org/check-out-the-new-askfedora/">learning</a> how to best take advantage of Fedora. For developers of Fedora, there are many other services such as <a href="http://src.fedoraproject.org/">dist-git</a>, <a href="https://pagure.io">Pagure</a>, <a href="https://bodhi.fedoraproject.org">Bodhi</a>, <a href="https://copr.fedorainfracloud.org/">COPR</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> that are involved with the packaging and release process.</p>
<p>These services are available for use with a free account from the <a href="https://admin.fedoraproject.org/accounts">Fedora Accounts System</a> (FAS). This account is the passport to all things Fedora! This article covers how to get set up with an account and configure <a href="https://getfedora.org/">Fedora Workstation</a> for browser single sign-on.</p>
<h2>Signing up for a Fedora account</h2>
<p>To create a FAS account, browse to the <a href="https://admin.fedoraproject.org/accounts/user/new">account creation page</a>. Here, you will fill out your basic identity data:</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services.png" alt="" class="wp-image-27962" /><figcaption>Account creation page</figcaption></figure>
<p>Once you enter your data, an email will be sent to the email address provided, with a temporary password. Pick a strong password and use it.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-1.png" alt="" class="wp-image-27964" /><figcaption>Password reset page</figcaption></figure>
<p>Next, the account details page appears. If you intend to become a contributor to the Fedora Project, you should complete the <a href="https://admin.fedoraproject.org/accounts/fpca/">Contributor Agreement</a> now. Otherwise, you are done and your account can now be used to log into the various Fedora services.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-2.png" alt="" class="wp-image-27965" /><figcaption>Account details page</figcaption></figure>
<h2>Configuring Fedora Workstation for single sign-On</h2>
<p>Now that you have your account, you can sign into any of the Fedora Project services. Most of these services support single sign-on (SSO), allowing you to sign in without re-entering your username and password.</p>
<p>Fedora Workstation provides an easy workflow to add SSO credentials. The GNOME Online Accounts tool helps you quickly set up your system to access many popular services. To access it, go to the <em>Settings</em> menu.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-3.png" alt="" class="wp-image-27967" /><figcaption>GNOME Online Accounts<br /></figcaption></figure>
<p>Click on the ⋮ button and select <em>Enterprise Login (Kerberos)</em>, which provides a single text prompt for a principal. Enter <em>[email protected]</em> (being sure to capitalize <em>FEDORAPROJECT.ORG</em>) and click <em>Connect</em>.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-4.png" alt="" class="wp-image-27968" /><figcaption>Kerberos principal dialog<br /></figcaption></figure>
<p>GNOME prompts you to enter your password for FAS and given the option to save it. If you choose to save it, it is stored in <a href="https://wiki.gnome.org/Projects/GnomeKeyring">GNOME Keyring</a> and unlocked automatically at login. If you choose not to save it, you will need to open GNOME Online Accounts and enter your password each time you want to enable single sign-on.</p>
<h2>Single sign-on with a web browser</h2>
<p>Today, Fedora Workstation supports two web browsers “out of the box” with support for single sign-on with the Fedora Project services. These are <a href="https://www.mozilla.org/en-US/firefox">Mozilla Firefox</a> and <a href="https://www.google.com/chrome/">Google Chrome</a>. Due to a <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1640158">bug</a> in Chromium, single sign-on does not currently work properly in many cases. As a result, this has not been enabled for Chromium in Fedora.</p>
<p>To sign on to a service, browse to it and select the “login” option for that service. For most Fedora services, this is the only thing you need to do and the browser handles the rest. Some services such as the <a href="https://lists.fedoraproject.org">Fedora Mailing Lists</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> support multiple login types. For them, you need to select the “Fedora” or “Fedora Account System” login type.</p>
<p>That’s it! You can now log into any of the Fedora Project services without re-entering your password.</p>
<h4>Special consideration for Google Chrome</h4>
<p>In order to enable single sign-on out of the box for Google Chrome, Fedora needed to take advantage of certain features in Chrome that are intended for use in “managed” environments. A managed environment is traditionally a corporate or other organization that sets certain security and/or monitoring requirements on the browser.</p>
<p>Recently, Google Chrome changed its behavior and it now reports <em>“Managed by your organization”</em> under the ⋮ menu in Google Chrome. That <a href="https://support.google.com/chrome/answer/9281740">link</a> leads to a page that states “If your Chrome browser is managed, your administrator can set up or restrict certain features, install extensions, monitor activity, and control how you use Chrome.” <span><b><a href="https://fedoraproject.org/wiki/Legal:PrivacyPolicy">Fedora will never monitor your browser activity or restrict your actions</a>.</b> </span></p>
<p>Enter <em>chrome://policy</em> in the address bar to see exactly what settings Fedora has enabled in the browser. The <em>AuthNegotiateDelegateWhitelist</em> and <em>AuthServerWhitelist</em> options will be set to <em>*.fedoraproject.or</em>g. These are the only changes Fedora makes.</p>
</div>
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services.png" width="929" height="419" title="" alt="" /></div><div><p>In addition to providing an operating system, the Fedora Project provides numerous <a href="https://apps.fedoraproject.org/">services</a> for users and developers. Services such as <a href="https://ask.fedoraproject.org/">Ask Fedora</a>, the <a href="https://fedoraproject.org/wiki/Fedora_Project_Wiki">Fedora Project Wiki</a> and the <a href="https://lists.fedoraproject.org/archives/">Fedora Project Mailing Lists</a> provide users with valuable resources for <a href="https://fedoramagazine.org/check-out-the-new-askfedora/">learning</a> how to best take advantage of Fedora. For developers of Fedora, there are many other services such as <a href="http://src.fedoraproject.org/">dist-git</a>, <a href="https://pagure.io">Pagure</a>, <a href="https://bodhi.fedoraproject.org">Bodhi</a>, <a href="https://copr.fedorainfracloud.org/">COPR</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> that are involved with the packaging and release process.</p>
<p>These services are available for use with a free account from the <a href="https://admin.fedoraproject.org/accounts">Fedora Accounts System</a> (FAS). This account is the passport to all things Fedora! This article covers how to get set up with an account and configure <a href="https://getfedora.org/">Fedora Workstation</a> for browser single sign-on.</p>
<h2>Signing up for a Fedora account</h2>
<p>To create a FAS account, browse to the <a href="https://admin.fedoraproject.org/accounts/user/new">account creation page</a>. Here, you will fill out your basic identity data:</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services.png" alt="" class="wp-image-27962" /><figcaption>Account creation page</figcaption></figure>
<p>Once you enter your data, an email will be sent to the email address provided, with a temporary password. Pick a strong password and use it.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-1.png" alt="" class="wp-image-27964" /><figcaption>Password reset page</figcaption></figure>
<p>Next, the account details page appears. If you intend to become a contributor to the Fedora Project, you should complete the <a href="https://admin.fedoraproject.org/accounts/fpca/">Contributor Agreement</a> now. Otherwise, you are done and your account can now be used to log into the various Fedora services.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-2.png" alt="" class="wp-image-27965" /><figcaption>Account details page</figcaption></figure>
<h2>Configuring Fedora Workstation for single sign-On</h2>
<p>Now that you have your account, you can sign into any of the Fedora Project services. Most of these services support single sign-on (SSO), allowing you to sign in without re-entering your username and password.</p>
<p>Fedora Workstation provides an easy workflow to add SSO credentials. The GNOME Online Accounts tool helps you quickly set up your system to access many popular services. To access it, go to the <em>Settings</em> menu.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-3.png" alt="" class="wp-image-27967" /><figcaption>GNOME Online Accounts<br /></figcaption></figure>
<p>Click on the ⋮ button and select <em>Enterprise Login (Kerberos)</em>, which provides a single text prompt for a principal. Enter <em>[email protected]</em> (being sure to capitalize <em>FEDORAPROJECT.ORG</em>) and click <em>Connect</em>.</p>
<figure class="wp-block-image"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/05/getting-set-up-with-fedora-project-services-4.png" alt="" class="wp-image-27968" /><figcaption>Kerberos principal dialog<br /></figcaption></figure>
<p>GNOME prompts you to enter your password for FAS and given the option to save it. If you choose to save it, it is stored in <a href="https://wiki.gnome.org/Projects/GnomeKeyring">GNOME Keyring</a> and unlocked automatically at login. If you choose not to save it, you will need to open GNOME Online Accounts and enter your password each time you want to enable single sign-on.</p>
<h2>Single sign-on with a web browser</h2>
<p>Today, Fedora Workstation supports two web browsers “out of the box” with support for single sign-on with the Fedora Project services. These are <a href="https://www.mozilla.org/en-US/firefox">Mozilla Firefox</a> and <a href="https://www.google.com/chrome/">Google Chrome</a>. Due to a <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1640158">bug</a> in Chromium, single sign-on does not currently work properly in many cases. As a result, this has not been enabled for Chromium in Fedora.</p>
<p>To sign on to a service, browse to it and select the “login” option for that service. For most Fedora services, this is the only thing you need to do and the browser handles the rest. Some services such as the <a href="https://lists.fedoraproject.org">Fedora Mailing Lists</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> support multiple login types. For them, you need to select the “Fedora” or “Fedora Account System” login type.</p>
<p>That’s it! You can now log into any of the Fedora Project services without re-entering your password.</p>
<h4>Special consideration for Google Chrome</h4>
<p>In order to enable single sign-on out of the box for Google Chrome, Fedora needed to take advantage of certain features in Chrome that are intended for use in “managed” environments. A managed environment is traditionally a corporate or other organization that sets certain security and/or monitoring requirements on the browser.</p>
<p>Recently, Google Chrome changed its behavior and it now reports <em>“Managed by your organization”</em> under the ⋮ menu in Google Chrome. That <a href="https://support.google.com/chrome/answer/9281740">link</a> leads to a page that states “If your Chrome browser is managed, your administrator can set up or restrict certain features, install extensions, monitor activity, and control how you use Chrome.” <span><b><a href="https://fedoraproject.org/wiki/Legal:PrivacyPolicy">Fedora will never monitor your browser activity or restrict your actions</a>.</b> </span></p>
<p>Enter <em>chrome://policy</em> in the address bar to see exactly what settings Fedora has enabled in the browser. The <em>AuthNegotiateDelegateWhitelist</em> and <em>AuthServerWhitelist</em> options will be set to <em>*.fedoraproject.or</em>g. These are the only changes Fedora makes.</p>
</div>