Fossil Forum
Post: Configuring Repository Settings via CLI
Hello all,
I'm working on a little project that hosts and manages a multitude of Fossil repos behind a webserver that handles authentication and authorization among providing other services using a single-sign on-type scheme. To accomplish this, I run Fossil as a CGI program, behind the webserver hosting the "outer" service where auth is handled using a more standard web auth setup, and pass REMOTE_USER among other variables. I synchronize user accounts and capabilities in from the service by simply executing Fossil with the desired changes, e.g. fossil user new ..., fossil user capabilities ..., etc. So far, my implementation of this is mostly working out well. Since the expected usage will be relatively light, I'm not terribly worried about the massive overhead of spinning up a process per every request... yet. I was originally considering using Active Directory for auth, but decided against it. Given it's just a project for a few friends, it simply didn't make sense to bring all of that complexity in.
Additionally, since the outer web service uses cookies and logins that a Fossil CLI won't be able to understand, users will be able to generate repo-scoped user/passwords (effectively tokens) that they can then use in the CLI. When the webserver detects a CLI client connecting, it will request use of HTTP basic authentication, from what I've read the Fossil CLI client can handle this, then translate that to REMOTE_USER to the Fossil CGI backend all the same.
This is all based on my research from some prior conversations attempting to accomplish similar ideas, such as "Fossil external (LDAP) authentication", linked from "LDAP Support", as well as the mail thread "JSON authentication: meshing with the cookie mechanism".
There are a few details I'm struggling with however, and I was hoping that I could get some help with the following:
- Is there a way to configure repository settings such as Admin -> Access -> Settings -> "Allow REMOTE_USER authentication" using the CLI? I cannot find it directly specified in a command, and it doesn't seem to even be included in fossil configuration from what I can tell.
- Alternatively, is there a way to enable REMOTE_USER auth from the CGI script, environment variables, etc?
- Is there a nice way to change some of the other repository settings, such as Project Name, Project Description, Index Page, etc via the CLI? These are at least possible through fossil configuration, but this feels rather janky.
- Speaking of fossil configuration, I don't quite understand the format of the input file. When I try exporting config, I find that the file contains lines like config /config 48, what purpose does this serve, and what is the meaning of the 48? The actual important info always seems to follow on the next line down.
Thank you in advance for any insights you can provide.
Hello all,
I'm working on a little project that hosts and manages a multitude of Fossil repos behind a webserver that handles authentication and authorization among providing other services using a single-sign on-type scheme. To accomplish this, I run Fossil as a CGI program, behind the webserver hosting the "outer" service where auth is handled using a more standard web auth setup, and pass REMOTE_USER among other variables. I synchronize user accounts and capabilities in from the service by simply executing Fossil with the desired changes, e.g. fossil user new ..., fossil user capabilities ..., etc. So far, my implementation of this is mostly working out well. Since the expected usage will be relatively light, I'm not terribly worried about the massive overhead of spinning up a process per every request... yet. I was originally considering using Active Directory for auth, but decided against it. Given it's just a project for a few friends, it simply didn't make sense to bring all of that complexity in.
Additionally, since the outer web service uses cookies and logins that a Fossil CLI won't be able to understand, users will be able to generate repo-scoped user/passwords (effectively tokens) that they can then use in the CLI. When the webserver detects a CLI client connecting, it will request use of HTTP basic authentication, from what I've read the Fossil CLI client can handle this, then translate that to REMOTE_USER to the Fossil CGI backend all the same.
This is all based on my research from some prior conversations attempting to accomplish similar ideas, such as "Fossil external (LDAP) authentication", linked from "LDAP Support", as well as the mail thread "JSON authentication: meshing with the cookie mechanism".
There are a few details I'm struggling with however, and I was hoping that I could get some help with the following:
- Is there a way to configure repository settings such as Admin -> Access -> "Allow REMOTE_USER authentication" using the CLI? I cannot find it directly specified in a command, and it doesn't seem to even be included in fossil configuration from what I can tell.
- Alternatively, is there a way to enable REMOTE_USER auth from the CGI script, environment variables, etc?
- Is there a nice way to change some of the other repository settings, such as Project Name, Project Description, Index Page, etc via the CLI? These are at least possible through fossil configuration, but this feels rather janky.
- Speaking of fossil configuration, I don't quite understand the format of the input file. When I try exporting config, I find that the file contains lines like config /config 48, what purpose does this serve, and what is the meaning of the 48? The actual important info always seems to follow on the next line down.
Thank you in advance for any insights you can provide.
Hello all,
I'm trying to host Fossil repos behind CGI with some automation, with external auth passed in via REMOTE_USER.
I was hoping that I could get some help with the following:
- Is there a way to configure repository settings such as Admin -> Access -> "Allow REMOTE_USER authentication" using the CLI? I cannot find it directly specified in a command, and it doesn't seem to even be included in fossil configuration from what I can tell.
- Alternatively, is there a way to enable REMOTE_USER auth from the CGI script, environment variables, etc?
- Is there a nice way to change some of the other repository settings, such as Project Name, Project Description, Index Page, etc via the CLI? These are at least possible through fossil configuration, but this feels rather janky.
- Speaking of fossil configuration, I don't quite understand the format of the input file. When I try exporting config, I find that the file contains lines like config /config 48, what purpose does this serve, and what is the meaning of the 48? The actual important info always seems to follow on the next line down.
Thank you.
(edited to remove unnecessary detail, please let me know if there's a better place to ask this instead)
the file contains lines like config /config 48, what purpose does this serve, and what is the meaning of the 48?
i don't have answers to the others off hand beyond to suggest seeing for the full list of CLI-configurable settings, but the 48 there means that that piece of the configuration is the 48 bytes which follow the newline after the 48.
Thanks for the reply.
That makes sense, I'm not sure how I didn't notice that it correlated with the length. Thank you!
I bit the bullet and tried to decipher some of the code, and from what I can tell, enabling REMOTE_USER happens via the database config entry remote_user_ok, which I couldn't find any way to configure other than the web interface and direct SQL manipulation, as found in the Forcing Use of Fossil's RBAC over SSH document. There may well be an alternative I've missed though, if so please let me know.
I've run into a few places now where the existing tooling just isn't up to my task at hand, so I guess directly interacting with the database is something I'll need to get used to sooner or later. I'm glad that at least with Fossil, it's understandable SQL!
Right. The remote_user_ok setting is just an entry in the CONFIG table. You can add or change or delete it using ordinary SQL. In order to give the "fossil setting" command access, we need to add a new comment to the source code to identify and document that setting. Search the source code for "SETTING:" and you will find lots of examples of how to do that.