11-21-2019, 12:31 AM
Set up single sign-on for Fedora Project services
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services.png" width="929" height="419" title="" alt="" /></div><div><p>In addition to an operating system, the Fedora Project provides <a href="https://apps.fedoraproject.org/">services</a> for users and developers. Services such as <a href="https://ask.fedoraproject.org/">Ask Fedora</a>, the <a href="https://fedoraproject.org/wiki/Fedora_Project_Wiki">Fedora Project wiki</a> and the <a href="https://lists.fedoraproject.org/archives/">Fedora Project mailing lists</a> help users <a href="https://fedoramagazine.org/check-out-the-new-askfedora/">learn</a> how to best take advantage of Fedora. For developers of Fedora, there are many other services such as <a href="http://src.fedoraproject.org/">dist-git</a>, <a href="https://pagure.io">Pagure</a>, <a href="https://bodhi.fedoraproject.org">Bodhi</a>, <a href="https://copr.fedorainfracloud.org/">COPR</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> for the packaging and release process.</p>
<p>These services are available with a free account from the <a href="https://admin.fedoraproject.org/accounts">Fedora Accounts System</a> (FAS). This account is the passport to all things Fedora! This article covers how to get set up with an account and configure <a href="https://getfedora.org/">Fedora Workstation</a> for browser single sign-on.</p>
<p> <span id="more-29196"></span> </p>
<h2>Signing up for a Fedora account</h2>
<p>To create a FAS account, browse to the <a href="https://admin.fedoraproject.org/accounts/user/new">account creation page</a>. Here, you will fill out your basic identity data:</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services.png" alt="" class="wp-image-27962" /><figcaption>Account creation page</figcaption></figure>
<p>Once you enter your data, the account system sends an email to the address you provided, with a temporary password. Pick a strong password and use it.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-1.png" alt="" class="wp-image-27964" /><figcaption>Password reset page</figcaption></figure>
<p>Next, the account details page appears. If you want to contribute to the Fedora Project, you should complete the <a href="https://admin.fedoraproject.org/accounts/fpca/">Contributor Agreement</a> now. Otherwise, you are done and you can use your account to log into the various Fedora services.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-2.png" alt="" class="wp-image-27965" /><figcaption>Account details page</figcaption></figure>
<h2>Configuring Fedora Workstation for single sign-On</h2>
<p>Now that you have your account, you can sign into any of the Fedora Project services. Most of these services support single sign-on (SSO), so you can sign in without re-entering your username and password.</p>
<p>Fedora Workstation provides an easy workflow to add your Fedora credentials. The GNOME Online Accounts tool helps you quickly set up your system to access many popular services. To access it, go to the <em>Settings</em> menu.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-3.png" alt="" class="wp-image-29275" /></figure>
<p>Click on the option labeled <em>Fedora</em>. A prompt opens for you to provide your username and password for your Fedora Account.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-4.png" alt="" class="wp-image-29276" /></figure>
<p>GNOME Online Accounts stores your password in <a href="https://wiki.gnome.org/Projects/GnomeKeyring">GNOME Keyring</a> and automatically acquires your single-sign-on credentials for you when you log in.</p>
<h2>Single sign-on with a web browser</h2>
<p>Today, Fedora Workstation supports three web browsers out of the box with support for single sign-on with the Fedora Project services. These are <a href="https://www.mozilla.org/en-US/firefox">Mozilla Firefox</a>, <a href="https://wiki.gnome.org/Apps/Web">GNOME Web</a>, and <a href="https://www.google.com/chrome/">Google Chrome</a>.</p>
<p>Due to a <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1640158">bug</a> in Chromium, single sign-on doesn’t work currently if you have more than one set of Kerberos (SSO) credentials active on your session. As a result, Fedora doesn’t enable this function out of the box for Chromium in Fedora.</p>
<p>To sign on to a service, browse to it and select the <em>login</em> option for that service. For most Fedora services, this is all you need to do; the browser handles the rest. Some services such as the <a href="https://lists.fedoraproject.org">Fedora mailing lists</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> support multiple login types. For them, select the <em>Fedora</em> or <em>Fedora Account System</em> login type.</p>
<p>That’s it! You can now log into any of the Fedora Project services without re-entering your password.</p>
<h4>Special consideration for Google Chrome</h4>
<p>To enable single sign-on out of the box for Google Chrome, Fedora takes advantage of certain features in Chrome that are intended for use in “managed” environments. A managed environment is traditionally a corporate or other organization that sets certain security and/or monitoring requirements on the browser.</p>
<p>Recently, Google Chrome changed its behavior and it now reports <em>Managed by your organization</em> or possibly <em>Managed by fedoraproject.org</em> under the ⋮ menu in Google Chrome. That <a href="https://support.google.com/chrome/answer/9281740">link</a> leads to a page that says, “If your Chrome browser is managed, your administrator can set up or restrict certain features, install extensions, monitor activity, and control how you use Chrome.” However, <span><b><a href="https://fedoraproject.org/wiki/Legal:PrivacyPolicy">Fedora will never monitor your browser activity or restrict your actions</a>.</b> </span></p>
<p>Enter <em>chrome://policy</em> in the address bar to see exactly what settings Fedora has enabled in the browser. The <em>AuthNegotiateDelegateWhitelist</em> and <em>AuthServerWhitelist</em> options will be set to <em>*.fedoraproject.or</em>g. These are the only changes Fedora makes.</p>
</div>
https://www.sickgaming.net/blog/2019/11/...-services/
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services.png" width="929" height="419" title="" alt="" /></div><div><p>In addition to an operating system, the Fedora Project provides <a href="https://apps.fedoraproject.org/">services</a> for users and developers. Services such as <a href="https://ask.fedoraproject.org/">Ask Fedora</a>, the <a href="https://fedoraproject.org/wiki/Fedora_Project_Wiki">Fedora Project wiki</a> and the <a href="https://lists.fedoraproject.org/archives/">Fedora Project mailing lists</a> help users <a href="https://fedoramagazine.org/check-out-the-new-askfedora/">learn</a> how to best take advantage of Fedora. For developers of Fedora, there are many other services such as <a href="http://src.fedoraproject.org/">dist-git</a>, <a href="https://pagure.io">Pagure</a>, <a href="https://bodhi.fedoraproject.org">Bodhi</a>, <a href="https://copr.fedorainfracloud.org/">COPR</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> for the packaging and release process.</p>
<p>These services are available with a free account from the <a href="https://admin.fedoraproject.org/accounts">Fedora Accounts System</a> (FAS). This account is the passport to all things Fedora! This article covers how to get set up with an account and configure <a href="https://getfedora.org/">Fedora Workstation</a> for browser single sign-on.</p>
<p> <span id="more-29196"></span> </p>
<h2>Signing up for a Fedora account</h2>
<p>To create a FAS account, browse to the <a href="https://admin.fedoraproject.org/accounts/user/new">account creation page</a>. Here, you will fill out your basic identity data:</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services.png" alt="" class="wp-image-27962" /><figcaption>Account creation page</figcaption></figure>
<p>Once you enter your data, the account system sends an email to the address you provided, with a temporary password. Pick a strong password and use it.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-1.png" alt="" class="wp-image-27964" /><figcaption>Password reset page</figcaption></figure>
<p>Next, the account details page appears. If you want to contribute to the Fedora Project, you should complete the <a href="https://admin.fedoraproject.org/accounts/fpca/">Contributor Agreement</a> now. Otherwise, you are done and you can use your account to log into the various Fedora services.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-2.png" alt="" class="wp-image-27965" /><figcaption>Account details page</figcaption></figure>
<h2>Configuring Fedora Workstation for single sign-On</h2>
<p>Now that you have your account, you can sign into any of the Fedora Project services. Most of these services support single sign-on (SSO), so you can sign in without re-entering your username and password.</p>
<p>Fedora Workstation provides an easy workflow to add your Fedora credentials. The GNOME Online Accounts tool helps you quickly set up your system to access many popular services. To access it, go to the <em>Settings</em> menu.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-3.png" alt="" class="wp-image-29275" /></figure>
<p>Click on the option labeled <em>Fedora</em>. A prompt opens for you to provide your username and password for your Fedora Account.</p>
<figure class="wp-block-image"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/11/set-up-single-sign-on-for-fedora-project-services-4.png" alt="" class="wp-image-29276" /></figure>
<p>GNOME Online Accounts stores your password in <a href="https://wiki.gnome.org/Projects/GnomeKeyring">GNOME Keyring</a> and automatically acquires your single-sign-on credentials for you when you log in.</p>
<h2>Single sign-on with a web browser</h2>
<p>Today, Fedora Workstation supports three web browsers out of the box with support for single sign-on with the Fedora Project services. These are <a href="https://www.mozilla.org/en-US/firefox">Mozilla Firefox</a>, <a href="https://wiki.gnome.org/Apps/Web">GNOME Web</a>, and <a href="https://www.google.com/chrome/">Google Chrome</a>.</p>
<p>Due to a <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1640158">bug</a> in Chromium, single sign-on doesn’t work currently if you have more than one set of Kerberos (SSO) credentials active on your session. As a result, Fedora doesn’t enable this function out of the box for Chromium in Fedora.</p>
<p>To sign on to a service, browse to it and select the <em>login</em> option for that service. For most Fedora services, this is all you need to do; the browser handles the rest. Some services such as the <a href="https://lists.fedoraproject.org">Fedora mailing lists</a> and <a href="https://bugzilla.redhat.com">Bugzilla</a> support multiple login types. For them, select the <em>Fedora</em> or <em>Fedora Account System</em> login type.</p>
<p>That’s it! You can now log into any of the Fedora Project services without re-entering your password.</p>
<h4>Special consideration for Google Chrome</h4>
<p>To enable single sign-on out of the box for Google Chrome, Fedora takes advantage of certain features in Chrome that are intended for use in “managed” environments. A managed environment is traditionally a corporate or other organization that sets certain security and/or monitoring requirements on the browser.</p>
<p>Recently, Google Chrome changed its behavior and it now reports <em>Managed by your organization</em> or possibly <em>Managed by fedoraproject.org</em> under the ⋮ menu in Google Chrome. That <a href="https://support.google.com/chrome/answer/9281740">link</a> leads to a page that says, “If your Chrome browser is managed, your administrator can set up or restrict certain features, install extensions, monitor activity, and control how you use Chrome.” However, <span><b><a href="https://fedoraproject.org/wiki/Legal:PrivacyPolicy">Fedora will never monitor your browser activity or restrict your actions</a>.</b> </span></p>
<p>Enter <em>chrome://policy</em> in the address bar to see exactly what settings Fedora has enabled in the browser. The <em>AuthNegotiateDelegateWhitelist</em> and <em>AuthServerWhitelist</em> options will be set to <em>*.fedoraproject.or</em>g. These are the only changes Fedora makes.</p>
</div>
https://www.sickgaming.net/blog/2019/11/...-services/