Find a file
Rémy Coutable 3cb69f0c0b Merge branch '15337-yubikey-support' into 'master'
Allow a U2F Device to be the Second Factor for Authentication

Parent Issue: #15337 

## TODO
- [ ] #15337 (!3905) FIDO/U2F 2FA using Yubikey
    - [x] Order a Yubikey?
    - [x] Do some reading to figure out what all this stuff means
    - [x] Look through the existing MR
    - [x] Browser support?
    - [x] Implementation
        - [x] User can register 2FA using their U2H device instead of authenticator
            - [x] Barebones flow
            - [x] Save the registration in the database
            - [x] Authentication flow
            - [x] First try after login/server start doesn't work
        - [x] User can log in using their U2F device
        - [x] Allow setting up authenticator if U2F is already set up (or vice versa)
        - [x] Change `two_factor_auths/new` to `show`
        - [x] `sign_requests` during registration? (Registering a device that has already been registered)
        - [x] 2FA skippable flow?
        - [x] Enforced 2FA flow (grace period?)
        - [x] Move the "Configure it Later" button to the right place
        - [x] Don't allow registration when the yubikey isn't plugged in
        - [x] Polish authentication flow
        - [x] Login should only show the 2FA method that's enabled
            - [x] Message to say that u2f only works on chrome, and it's recommended to enable otp as well.
        - [x] Index for key_handle
        - [x] Server-side errors while registering/logging in
        - [x] Handle non-chrome browsers
        - [x] Try to authenticate with a key that hasn't been registered (shouldn't work)
        - [x] Try the same key for multiple user accounts (should work)
        - [x] Fix existing tests
        - [x] Make sure CI is green
        - [x] Add tests
            - [x] Figure out how to fake the Yubikey
            - [x] Teaspoon tests for the React components
                - [x] Each device can only be registered once per user
            - [x] Feature specs
                - [x] Regular flows
                - [x] Test error cases
        - [x] Refactoring
            - [x] Refactor App ID
            - [x] Clean up the `show` action
        - [x] Annotate methods with definition of U2F
        - [x] Changelog
        - [x] Fix merge conflicts
        - [x] Verify flows
            - [x] Authenticator + no U2F
            - [x] U2F + no authenticator
            - [x] U2F + authenticator
            - [x] U2F + authenticator -> disable 2FA
            - [x] 2FA required with different grace periods
        - [x] Screenshots for MR
    - [x] Augment the [help docs](http://localhost:3000/help/profile/two_factor_authentication)
    - [x] Assign to endboss
    - [x] Ask for feedback on UI/UX
    - [x] Ask for feedback on copy
    - [x] Wait for review/merge
    - [x] Fix merge conflicts
    - [x] Wait for CI to pass
    - [x] Implement review comments/suggestions
        - [x] Move `TwoFactorAuthController#create_u2f` to a service
        - [x] Extra space before `Base64` in `u2f_registration` model
        - [x] Move `with/without_two_factor` scopes to class methods
        - [x] In `profiles/accounts/show`, add spaces at `{` and `}`
        - [x] Remove blank lines in `profiles/two_factor_auths/show`
        - [x] Fix typo in doc. "(universal 2nd factor )"
        - [x] Add "Added in 8.8" to doc
        - [x] In the doc, use 'Enable 2FA via mobile application' instead of 'Via Mobile Application'
        - [x] In the doc, use 'Enable 2FA via U2F device' instead of 'Via U2F Device
        - [x] Use "Two-Factor Authentication" everywhere
        - [x] Use `#icon` wrapper instead of `fa_stacked_icon`
        - [x] Check if `string` is enough for `key_handle` and `public_key`
        - [x] Separate `exercise` and `verify` phases of test (u2f_spec)
        - [x] Assert that `user_without_2fa` is _not_ in results (with_two_factor)
            - [x] Remove rubocop exception
        - [x] Refactor call to `User.with_two_factor.count` to not include `.length`
        - [x] Add a note that makes the "Disable" button/feature obvious
        - [x] Remove i18n
        - [x] Test in Firefox with addon (+ create new issue for support)
        - [x] Remove React
            - [x] Rewrite registration
            - [x] Switch underscore template to default style
            - [x] Rewrite authentication
            - [x] Move `register` haml to `u2f` dir
            - [x] Remove instance variables
            - [x] Fix tests
            - [x] Read SCSS guidelines
            - [x] Address @connorshea's comments regarding text style
            - [x] Make sure all classes and IDs are in line (add `js-` prefixes)
                - [x] Register
                - [x] Authenticate
            - [x] Refactoring?
        - [x] Include non-minifed version of bowser
        - [x] Audit log
        - [x] Look at the `browser` gem (and don't use bowser)
        - [x] Error message when on HTTP?
    - [x] Test on Mobile
    - [x] Fix merge conflicts
    - [x] Retest all flows
    - [x] Back to Rémy for review
    - [x] Make sure CI is green
    - [x] Wait for merge / more feedback
    - [x] Implement @rymai's changes
        - [x] JS/Coffeescript variables should be lowerCamelCase
        - [x] Spaces before/after `}` and `{` in HAML (and elsewhere)
        - [x] Rails view helpers in u2f HAML
        - [x] `%div.row.append-bottom-10`
        - [x] Wrap line in `without_two_factor` scope
        - [x] Exception-less flow in `U2F::CreateService`
    - [x] Fix merge conflicts
    - [x] Move service to model class method
    - [x] Fix teaspoon specs
    - [x] Address @rymai's suggestions about error handing
    - [x] Javascript error constants
    - [x] Fix merge conflicts
    - [x] One final review
        - [x] Test "registration with errors" flow
    - [x] Assign to Remy
    - [x] Wait for replies from @jschatz1
    - [x] Address @rymai's comments
        - [x] Omit `%div`
        - [x] Scope `$.find` globally
        - [x] Replace `find('#element-id).click` with `click_on('Element Text')
    - [x] Rebase master + conflicts
    - [x] Look at https://news.ycombinator.com/item?id=11690774
    - [x] Address @connorshea's comment regarding HTTPS on localhost
    - [x] Final sanity check
    - [x] Wait for [CI to pass](c84179ad23/builds)
    - [x] Address @rymai's next round of comments
        - [x] Interpolate `true` and `false` in DB scopes
        - [x] Why have `Gon::Base.render_data` thrice?
        - [x] `user_spec` should have correct spacing
        - [x] Use `arel_table[:id]` instead of `users.id`
        - [x] URL helper in `app/views/profiles/two_factor_auths/show.html.haml`
        - [x] Remove polyfill change
    - [x] Wait for [CI to pass](https://gitlab.com/gitlab-org/gitlab-ce/commit/0123ab8/builds)
    - [x] Address @jschatz1's comments
        - [x] Use `on('click', ...)` instead of `click(...)`
        - [x] Use `is` and `isnt` in coffeescript
        - [x] Use `and` and `or` in coffeescript
    - [x] Add `Gon::Base.render_data` to `devise_empty` (and other base layouts)
    - [x] Wait for [CI to pass](4019163973/builds)
    - [x] Wait for [build](75955710ef/builds) to pass
    - [x] Fix merge conflicts
    - [x] Inspect diff / workflow
    - [x] Assign back to @rymai
    - [x] Make sure [ci](2c6316b29a/builds) has passed
    - [x] Fix merge conflicts (probably introduced by [devise upgrade](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/4216)
    - [x] Wait for [CI](a5ef48b7aa/builds) to pass
    - [x] Respond to @rymai's comments
        - [x] Use `elsif`
        - [x] Check if we need `and return`
        - [x] Only fetch key handles from the DB
        - [x] No annotations to models?
        - [x] Align hash keys in model
    - [x] Wait for [build](e0ef504734/builds) to pass
    - [ ] Wait for merge

## Screenshots

![Screenshot_2016-05-03_09.53.04](/uploads/1af3f277efa488dc107d36e6b4b07ca4/Screenshot_2016-05-03_09.53.04.png)
![Screenshot_2016-05-03_10.19.53](/uploads/2bfc67dfb96c0e005cce033d8b456813/Screenshot_2016-05-03_10.19.53.png)
![Screenshot_2016-05-03_10.19.56](/uploads/e912abedd5b1d07d7185cee9f204c5ff/Screenshot_2016-05-03_10.19.56.png)
![Screenshot_2016-05-03_10.20.04](/uploads/9350d5c98823d1f3d4e59517dfb8910a/Screenshot_2016-05-03_10.20.04.png)
![Screenshot_2016-05-03_10.31.15](/uploads/84473dc263e0643311a39006e649035f/Screenshot_2016-05-03_10.31.15.png)
![Screenshot_2016-05-03_10.31.22](/uploads/13ce43e0d7a565000af29984667eeb08/Screenshot_2016-05-03_10.31.22.png)
![Screenshot_2016-05-03_10.31.37](/uploads/b90fbb40dbf9bbd73af324f48ffdc948/Screenshot_2016-05-03_10.31.37.png)
![Screenshot_2016-05-03_10.36.48](/uploads/41a0fbc493c6fefeafd922b3ddf2a25e/Screenshot_2016-05-03_10.36.48.png)

See merge request !3905
2016-06-06 09:40:49 +00:00
app Add a U2F-specific audit log entry after logging in. 2016-06-06 12:50:31 +05:30
bin Use 'exec' in Unicorn and Sidekiq launch scripts 2016-04-28 12:11:08 +02:00
builds
config Implement U2F registration. 2016-06-06 12:50:31 +05:30
db Add a U2fRegistrations table/model. 2016-06-06 12:50:31 +05:30
doc Add documentation for U2F registration & authentication. 2016-06-06 12:50:31 +05:30
docker Update Docker Hub links. 2016-05-07 13:29:24 +09:00
features Ensure we are clicking a visible dropdown 2016-06-03 17:11:41 -05:00
fixtures/emojis fix emoji aliases not showing in autocomplete 2016-04-09 13:29:37 +01:00
generator_templates/active_record/migration Move generator templates to generator_templates/ 2016-05-19 14:58:35 -05:00
lib Add a U2fRegistrations table/model. 2016-06-06 12:50:31 +05:30
log
public Disallow search engines from indexing uploads from a GitLab project. 2016-05-16 15:04:14 -05:00
scripts Fix prepare build execution in docker environment 2016-04-19 11:57:10 +02:00
shared Add .gitkeep 2016-05-17 09:41:47 -05:00
spec Add feature specs covering U2F registration and authentication. 2016-06-06 12:50:31 +05:30
tmp Remove tmp/.gitkeep 2015-10-04 13:49:48 +00:00
vendor Implement U2F registration. 2016-06-06 12:50:31 +05:30
.csscomb.json Fixes last remaining lints and enables scss-lint test for GitLab CI. 2016-03-22 15:01:31 -06:00
.flayignore Add flay: tool to find duplicate code 2015-11-11 16:29:00 +01:00
.foreman
.gitattributes
.gitignore Use absolute paths wherever is possible for .gitignore entries. 2016-05-29 16:55:25 -05:00
.gitlab-ci.yml Add db:migrate task to CI 2016-04-21 10:52:25 -07:00
.hound.yml
.pkgr.yml
.rspec
.rubocop.yml Merge branch 'rubocop/enable-ambiguous-operator-rubocop-lint' into 'master' 2016-06-05 19:08:56 +00:00
.ruby-version revert back to ruby 2.1 - use 2.1.8 2016-02-19 17:19:57 +01:00
.scss-lint.yml Merge branch 'scss-url-linters' into 'master' 2016-04-28 19:59:53 +00:00
.simplecov
.teatro.yml
.vagrant_enabled Cache project build count. Closes #18032 2016-06-02 11:10:57 -04:00
CHANGELOG Add the U2F feature to the CHANGELOG 2016-06-06 12:50:31 +05:30
config.ru Increase Unicorn memory limits to 300-350 2016-01-20 11:52:01 +01:00
CONTRIBUTING.md Merge branch 'fix-design-link-in-contributing' into 'master' 2016-06-04 12:32:12 +00:00
doc_styleguide.md Move doc_styleguide in the development directory 2016-01-12 11:57:42 +01:00
docker-compose.yml Update docker guide and add docker-compose.yml 2015-09-30 14:24:39 +02:00
Gemfile Update the browser gem. 2016-06-06 12:50:31 +05:30
Gemfile.lock Update the browser gem. 2016-06-06 12:50:31 +05:30
GITLAB_SHELL_VERSION Use gitlab-shell 3.0.0 2016-05-23 11:14:25 +02:00
GITLAB_WORKHORSE_VERSION Use gitlab-workhorse 0.7.4 2016-05-27 13:06:02 +02:00
LICENSE Update copyright notice to 2016 [ci skip] 2016-01-03 18:28:52 +05:30
MAINTENANCE.md
PROCESS.md Merge branch 'patch-1' into 'master' 2016-04-26 14:45:58 +00:00
Procfile Remove duplication in Procfile 2016-01-14 15:08:22 +01:00
Rakefile Include relative url configuration in rake tasks 2016-02-29 21:17:48 +01:00
README.md Remove Coveralls and Semaphore badges. [ci skip] 2016-05-31 09:16:04 -06:00
VERSION Its time for 8.9 2016-05-23 20:51:42 +02:00

GitLab

build status Code Climate

Canonical source

The source of GitLab Community Edition is hosted on GitLab.com and there are mirrors to make contributing as easy as possible.

Open source software to collaborate on code

To see how GitLab looks please see the features page on our website.

  • Manage Git repositories with fine grained access controls that keep your code secure
  • Perform code reviews and enhance collaboration with merge requests
  • Each project can also have an issue tracker and a wiki
  • Used by more than 100,000 organizations, GitLab is the most popular solution to manage Git repositories on-premises
  • Completely free and open source (MIT Expat license)
  • Powered by Ruby on Rails

Hiring

We're hiring developers, support people, and production engineers all the time, please see our jobs page.

Editions

There are two editions of GitLab:

  • GitLab Community Edition (CE) is available freely under the MIT Expat license.
  • GitLab Enterprise Edition (EE) includes extra features that are more useful for organizations with more than 100 users. To use EE and get official support please become a subscriber.

Website

On about.gitlab.com you can find more information about:

Requirements

Please see the requirements documentation for system requirements and more information about the supported operating systems.

Installation

The recommended way to install GitLab is with the Omnibus packages on our package server. Compared to an installation from source, this is faster and less error prone. Just select your operating system, download the respective package (Debian or RPM) and install it using the system's package manager.

There are various other options to install GitLab, please refer to the installation page on the GitLab website for more information.

You can access a new installation with the login root and password 5iveL!fe, after login you are required to set a unique password.

Install a development environment

To work on GitLab itself, we recommend setting up your development environment with the GitLab Development Kit. If you do not use the GitLab Development Kit you need to install and setup all the dependencies yourself, this is a lot of work and error prone. One small thing you also have to do when installing it yourself is to copy the example development unicorn configuration file:

cp config/unicorn.rb.example.development config/unicorn.rb

Instructions on how to start GitLab and how to run the tests can be found in the development section of the GitLab Development Kit.

Software stack

GitLab is a Ruby on Rails application that runs on the following software:

  • Ubuntu/Debian/CentOS/RHEL
  • Ruby (MRI) 2.1
  • Git 2.7.4+
  • Redis 2.8+
  • MySQL or PostgreSQL

For more information please see the architecture documentation.

Third-party applications

There are a lot of third-party applications integrating with GitLab. These include GUI Git clients, mobile applications and API wrappers for various languages.

GitLab release cycle

For more information about the release process see the release documentation.

Upgrading

For upgrading information please see our update page.

Documentation

All documentation can be found on doc.gitlab.com/ce/.

Getting help

Please see Getting help for GitLab on our website for the many options to get help.

Is it any good?

Yes

Is it awesome?

Thanks for asking this question Joshua. These people seem to like it.