Certificate Authentication

[cwchristerw]

Feature Description

I think it would be great if Gitea had a feature to login with certificates.

I would use like this:

1. Issue device identity (x509) certificates to every server with Hashicorp Vault.
2. I would automatically login/register in to Gitea with device identity certificate using Ansible.
3. Adding device identity (ssh) to that specific account to use it with git command.

Important

• Auto create account during first login.
• Multiple x509 certificate authentication sources.
• Allow using API with x509 certificate.
• Use common name as username
• No email address
• User visibility to private as default

Screenshots

No response

[cwchristerw]

In addition it would need to support using request header as client cert from reverse proxy. Similar to hashicorp/vault#17272

[cwchristerw]

It would be nice also to be able to login with TLS certificate when using https and git protocol.

[techknowlogick]

somewhat related: Gitea has support for SSH certificates, and I use vault to manage the certificates to clone and push. I have seen others use a reverse proxy for the behaviour you are looking for in this ticket if you want to achieve this right now.