oeph / verdaccio-bitbucket-server

Verdaccio Authentication Plugin for Bitbucket Server

verdaccio-bitbucket-server

Verdaccio Authentication Plugin for Bitbucket Server

Installation

$ npm install -g verdaccio-bitbucket-server

Plugin Configuration

auth:
  bitbucket-server:
    url: "http://your-server:port"
    allow: "Team A, Developer" # optional; default = ""
    roleTypes: [groups, projects] # optional; default = [groups, projects, repos]
    limit: 100 # optional; default = 100
    cache: false # optional; default = { max: 50, maxAge: 1000 * 60 }

allow

The "allow" config can be used to restrict access to Verdaccio based on groups of the user from bitbucket server. In the above example, only users that have the group "Team A" or "Developer" can login.

Default: "" (empty: all groups are allowed to log in)

Hint: This can only be used if the roleTypes config is not used or does include "groups"

roleTypes

The "roleTypes" specifies, which entities are used for the retrieval of user roles.

Default: [groups, projects, repos]

limit

The "limit" config specifies how many entities are fetched from the server, since paging of the responses is currently not supported.

Default: 100

cache

The "cache" config specifies the lru-cache options. The cache is used to cache requests against bitbucket api.

Hint: Caching can be disabled by specifying false.

Default: { max: 50, maxAge: 1000 * 60 }

Package Configuration

package:
  '**':
    access: $authenticated
    publish: $REPO_WRITE
    proxy: npmjs
    bitbucketServer: true

Access rules

General rules:

• $all
• $authenticated

Package rules:

• $REPO_READ
• $REPO_WRITE
• $REPO_ADMIN

The package rules will match the respective rights for the repository.

verdaccio-bitbucket-server's Issues

Groups API returns all the groups, not the ones the user is member

My configuration is:

  bitbucket-server:
    url: http://git.xxx.xxx/
    roleTypes: [groups]
    allow: verdaccio

While making sure the configuration was working in our environment, I noticed that I could login with or without the "verdaccio" group membership. Turns out that making a request to the /rest/api/1.0/groups with my credentials returns also groups that my user isn't member of.

Logged errors should be sanitized

Currently logged error can leak user passwords.

Those values should be replaced by *** or something like that.

Unable to login to in-house hosted bitbucket server

I am unable to login to in-house hosted bitbucket server. I couldn't find any api either in code which does authentication

Cache bitbucket server responses

With auth enabled for access packages, this plugin add a lot of load to bitbucket.

This plugin should cache the responses at least for a configurable amount of time.