Github Auth Extension

17 files changed, 771 insertions, 32 deletions

diff --git a/.htaccess b/.htaccess
index 5de1c259f..7358461c3 100644
--- a/.htaccess
+++ b/.htaccess
@@ -50,40 +50,40 @@ RewriteRule ^review(.*) page.cgi?id=splinter.html$1 [QSA]
 RewriteRule ^user_?profile(.*) page.cgi?id=user_profile.html$1 [QSA]
 RewriteRule ^request_defer(.*) page.cgi?id=request_defer.html$1 [QSA]
 RewriteRule ^favicon\.ico$ extensions/BMO/web/images/favicon.ico
-RewriteRule ^form[\.:]itrequest$ enter_bug.cgi?product=Infrastructure+\%26+Operations&format=itrequest
-RewriteRule ^form[\.:](mozlist|poweredby|presentation|trademark|recoverykey)$ enter_bug.cgi?product=mozilla.org&format=$1
-RewriteRule ^form[\.:]legal$ enter_bug.cgi?product=Legal&format=legal
-RewriteRule ^form[\.:]recruiting$ enter_bug.cgi?product=Recruiting&format=recruiting
-RewriteRule ^form[\.:]mozpr$ enter_bug.cgi?product=Mozilla+PR&format=mozpr
-RewriteRule ^form[\.:]reps[\.:]mentorship$ enter_bug.cgi?product=Mozilla+Reps&format=mozreps
-RewriteRule ^form[\.:]reps[\.:]budget$ enter_bug.cgi?product=Mozilla+Reps&format=remo-budget
-RewriteRule ^form[\.:]reps[\.:]swag$ enter_bug.cgi?product=Mozilla+Reps&format=remo-swag
-RewriteRule ^form[\.:]reps[\.:]it$ enter_bug.cgi?product=Mozilla+Reps&format=remo-it
-RewriteRule ^form[\.:]reps[\.:]payment$ page.cgi?id=remo-form-payment.html
-RewriteRule ^form[\.:]csa[\.:]discourse$ enter_bug.cgi?product=Infrastructure+\%26\+Operations&format=csa-discourse
-RewriteRule ^form[\.:]employee[\.\-:]incident$ enter_bug.cgi?product=mozilla.org&format=employee-incident
-RewriteRule ^form[\.:]brownbag$ https://air.mozilla.org/requests
-RewriteRule ^form[\.:]finance$ enter_bug.cgi?product=Finance&format=finance
-RewriteRule ^form[\.:]moz[\.\-:]project[\.\-:]review$ enter_bug.cgi?product=mozilla.org&format=moz-project-review
+RewriteRule ^form[\.:]itrequest$ enter_bug.cgi?product=Infrastructure+\%26+Operations&format=itrequest [QSA]
+RewriteRule ^form[\.:](mozlist|poweredby|presentation|trademark|recoverykey)$ enter_bug.cgi?product=mozilla.org&format=$1 [QSA]
+RewriteRule ^form[\.:]legal$ enter_bug.cgi?product=Legal&format=legal [QSA]
+RewriteRule ^form[\.:]recruiting$ enter_bug.cgi?product=Recruiting&format=recruiting [QSA]
+RewriteRule ^form[\.:]mozpr$ enter_bug.cgi?product=Mozilla+PR&format=mozpr [QSA]
+RewriteRule ^form[\.:]reps[\.:]mentorship$ enter_bug.cgi?product=Mozilla+Reps&format=mozreps [QSA]
+RewriteRule ^form[\.:]reps[\.:]budget$ enter_bug.cgi?product=Mozilla+Reps&format=remo-budget [QSA]
+RewriteRule ^form[\.:]reps[\.:]swag$ enter_bug.cgi?product=Mozilla+Reps&format=remo-swag [QSA]
+RewriteRule ^form[\.:]reps[\.:]it$ enter_bug.cgi?product=Mozilla+Reps&format=remo-it [QSA]
+RewriteRule ^form[\.:]reps[\.:]payment$ page.cgi?id=remo-form-payment.html [QSA]
+RewriteRule ^form[\.:]csa[\.:]discourse$ enter_bug.cgi?product=Infrastructure+\%26\+Operations&format=csa-discourse [QSA]
+RewriteRule ^form[\.:]employee[\.\-:]incident$ enter_bug.cgi?product=mozilla.org&format=employee-incident [QSA]
+RewriteRule ^form[\.:]brownbag$ https://air.mozilla.org/requests [QSA]
+RewriteRule ^form[\.:]finance$ enter_bug.cgi?product=Finance&format=finance [QSA]
+RewriteRule ^form[\.:]moz[\.\-:]project[\.\-:]review$ enter_bug.cgi?product=mozilla.org&format=moz-project-review [QSA]
 RewriteRule ^form[\.:]docs?$ enter_bug.cgi?product=Developer+Documentation&format=doc [QSA]
-RewriteRule ^form[\.:]mdn?$ enter_bug.cgi?product=Mozilla+Developer+Network&format=mdn
-RewriteRule ^form[\.:](swag|gear)$ enter_bug.cgi?product=Marketing&format=swag
-RewriteRule ^form[\.:]costume$ enter_bug.cgi?product=Marketing&format=costume
+RewriteRule ^form[\.:]mdn?$ enter_bug.cgi?product=Mozilla+Developer+Network&format=mdn [QSA]
+RewriteRule ^form[\.:](swag|gear)$ enter_bug.cgi?product=Marketing&format=swag [QSA]
+RewriteRule ^form[\.:]costume$ enter_bug.cgi?product=Marketing&format=costume [QSA]
 RewriteRule ^form[\.:](b2g|fxos)[\.\-:](partner|betaprogram|feature) enter_bug.cgi?product=Firefox+OS&format=fxos-$2 [QSA]
-RewriteRule ^form[\.:]ipp$ enter_bug.cgi?product=Internet+Public+Policy&format=ipp
-RewriteRule ^form[\.:]creative$ enter_bug.cgi?product=Marketing&format=creative
-RewriteRule ^form[\.:]user[\.\-:]engagement$ enter_bug.cgi?product=Marketing&format=user-engagement
-RewriteRule ^form[\.:]dev[\.\-:]engagement[\.\-\:]event$ enter_bug.cgi?product=Developer+Engagement&format=dev-engagement-event
-RewriteRule ^form[\.:]mobile[\.\-:]compat$ enter_bug.cgi?product=Tech+Evangelism&format=mobile-compat
-RewriteRule ^form[\.:]web[\.:]bounty$ enter_bug.cgi?product=mozilla.org&format=web-bounty 
-RewriteRule ^form[\.:]automative$ enter_bug.cgi?product=Testing&format=automative
-RewriteRule ^form[\.:]fxos[\.\-:]preload[\.\-:]app$ enter_bug.cgi?product=Marketplace&format=fxos-preload-app
-RewriteRule ^form[\.:]fxos[\.\-:]mcts[\.\-:]waiver$ enter_bug.cgi?product=Firefox+OS&format=fxos-mcts-waiver
-RewriteRule ^form[\.:]comm[\.:]newsletter$ enter_bug.cgi?product=Marketing&format=comm-newsletter
-RewriteRule ^form[\.:]screen[\.:]share[\.:]whitelist$ enter_bug.cgi?product=Firefox&format=screen-share-whitelist
-RewriteRule ^form[\.:]webops[\.\-:]request$ enter_bug.cgi?product=Infrastructure+\%26+Operations&format=webops-request
-RewriteRule ^form[\.:]data[\.\-:]compliance$ enter_bug.cgi?product=Data+Compliance&format=data-compliance
-RewriteRule ^form[\.:]third[\.\-:]party$ enter_bug.cgi?product=Marketing&format=third-party-apps
+RewriteRule ^form[\.:]ipp$ enter_bug.cgi?product=Internet+Public+Policy&format=ipp [QSA]
+RewriteRule ^form[\.:]creative$ enter_bug.cgi?product=Marketing&format=creative [QSA]
+RewriteRule ^form[\.:]user[\.\-:]engagement$ enter_bug.cgi?product=Marketing&format=user-engagement [QSA]
+RewriteRule ^form[\.:]dev[\.\-:]engagement[\.\-\:]event$ enter_bug.cgi?product=Developer+Engagement&format=dev-engagement-event [QSA]
+RewriteRule ^form[\.:]mobile[\.\-:]compat$ enter_bug.cgi?product=Tech+Evangelism&format=mobile-compat [QSA]
+RewriteRule ^form[\.:]web[\.:]bounty$ enter_bug.cgi?product=mozilla.org&format=web-bounty  [QSA]
+RewriteRule ^form[\.:]automative$ enter_bug.cgi?product=Testing&format=automative [QSA]
+RewriteRule ^form[\.:]fxos[\.\-:]preload[\.\-:]app$ enter_bug.cgi?product=Marketplace&format=fxos-preload-app [QSA]
+RewriteRule ^form[\.:]fxos[\.\-:]mcts[\.\-:]waiver$ enter_bug.cgi?product=Firefox+OS&format=fxos-mcts-waiver [QSA]
+RewriteRule ^form[\.:]comm[\.:]newsletter$ enter_bug.cgi?product=Marketing&format=comm-newsletter [QSA]
+RewriteRule ^form[\.:]screen[\.:]share[\.:]whitelist$ enter_bug.cgi?product=Firefox&format=screen-share-whitelist [QSA]
+RewriteRule ^form[\.:]webops[\.\-:]request$ enter_bug.cgi?product=Infrastructure+\%26+Operations&format=webops-request [QSA]
+RewriteRule ^form[\.:]data[\.\-:]compliance$ enter_bug.cgi?product=Data+Compliance&format=data-compliance [QSA]
+RewriteRule ^form[\.:]third[\.\-:]party$ enter_bug.cgi?product=Marketing&format=third-party-apps [QSA]
 RewriteRule ^rest/(.*)$ rest.cgi/$1 [NE]
 RewriteRule ^(?:latest|1\.2|1\.3)/(.*)$ extensions/BzAPI/bin/rest.cgi/$1 [NE]
 RewriteRule ^bzapi/(.*)$ extensions/BzAPI/bin/rest.cgi/$1 [NE]
diff --git a/extensions/GitHubAuth/Config.pm b/extensions/GitHubAuth/Config.pm
new file mode 100644
index 000000000..88186a91e
--- /dev/null
+++ b/extensions/GitHubAuth/Config.pm
@@ -0,0 +1,19 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth;
+
+use 5.10.1;
+use strict;
+
+use constant NAME => 'GitHubAuth';
+
+use constant REQUIRED_MODULES => [];
+
+use constant OPTIONAL_MODULES => [];
+
+__PACKAGE__->NAME;
diff --git a/extensions/GitHubAuth/Extension.pm b/extensions/GitHubAuth/Extension.pm
new file mode 100644
index 000000000..dee927165
--- /dev/null
+++ b/extensions/GitHubAuth/Extension.pm
@@ -0,0 +1,94 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth;
+
+use 5.10.1;
+use strict;
+use parent qw(Bugzilla::Extension);
+
+use Bugzilla::Extension::GitHubAuth::Client;
+use Bugzilla::Extension::GitHubAuth::Util qw(target_uri);
+
+use Bugzilla::Error;
+use Bugzilla::Util qw(trick_taint);
+use List::Util qw(first);
+use URI;
+use URI::QueryParam;
+
+our $VERSION = '0.01';
+
+BEGIN {
+    # Monkey-patch can() on Bugzilla::Auth::Login::CGI so that our own fail_nodata gets called.
+    # Our fail_nodata behaves like CGI's, so this shouldn't be a problem for CGI-based logins.
+
+    *Bugzilla::Auth::Login::CGI::can = sub {
+        my ($stack, $method) = @_;
+
+        return undef if $method eq 'fail_nodata';
+        return $stack->UNIVERSAL::can($method);
+    };
+}
+
+sub install_before_final_checks {
+    Bugzilla::Group->create({
+        name        => 'no-github-auth',
+        description => 'Group containing groups whose members may not use GitHubAuth to log in',
+        isbuggroup  => 0,
+    }) unless Bugzilla::Group->new({ name => 'no-github-auth' });
+}
+
+sub template_before_create {
+    my ($self, $args) = @_;
+
+    return if Bugzilla->user->id && !Bugzilla->cgi->param('logout');
+
+    $args->{config}{VARIABLES}{github_auth} = {
+        login => sub {
+            return Bugzilla::Extension::GitHubAuth::Client->login_uri(target_uri());
+        },
+    };
+}
+
+sub auth_login_methods {
+    my ($self, $args) = @_;
+    my $modules = $args->{'modules'};
+    if (exists $modules->{'GitHubAuth'}) {
+        $modules->{'GitHubAuth'} = 'Bugzilla/Extension/GitHubAuth/Login.pm';
+    }
+}
+
+sub auth_verify_methods {
+    my ($self, $args) = @_;
+    my $modules = $args->{'modules'};
+    if (exists $modules->{'GitHubAuth'}) {
+        $modules->{'GitHubAuth'} = 'Bugzilla/Extension/GitHubAuth/Verify.pm';
+    }
+}
+
+sub config_modify_panels {
+    my ($self, $args) = @_;
+    my $auth_panel_params = $args->{panels}{auth}{params};
+
+    my $user_info_class = first { $_->{name} eq 'user_info_class' } @$auth_panel_params;
+    if ($user_info_class) {
+        push @{ $user_info_class->{choices} }, "GitHubAuth,CGI", "Persona,GitHubAuth,CGI";
+    }
+
+    my $user_verify_class = first { $_->{name} eq 'user_verify_class' } @$auth_panel_params;
+    if ($user_verify_class) {
+        unshift @{ $user_verify_class->{choices} }, "GitHubAuth";
+    }
+}
+
+sub config_add_panels {
+    my ($self, $args) = @_;
+    my $modules = $args->{panel_modules};
+    $modules->{GitHubAuth} = "Bugzilla::Extension::GitHubAuth::Config";
+}
+
+__PACKAGE__->NAME;
diff --git a/extensions/GitHubAuth/lib/Client.pm b/extensions/GitHubAuth/lib/Client.pm
new file mode 100644
index 000000000..896e82eff
--- /dev/null
+++ b/extensions/GitHubAuth/lib/Client.pm
@@ -0,0 +1,146 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth::Client;
+use strict;
+use warnings;
+
+use JSON qw(decode_json);
+use URI;
+use URI::QueryParam;
+use Digest;
+
+use Bugzilla::Extension::GitHubAuth::Client::Error qw(ThrowUserError ThrowCodeError);
+use Bugzilla::Util qw(remote_ip);
+
+use constant DIGEST_HASH => 'SHA1';
+
+use fields qw(user_agent);
+
+use constant {
+    GH_ACCESS_TOKEN_URI => 'https://github.com/login/oauth/access_token',
+    GH_AUTHORIZE_URI    => 'https://github.com/login/oauth/authorize',
+    GH_USER_EMAILS_URI  => 'https://api.github.com/user/emails',
+};
+
+sub new {
+    my ($class, %init) = @_;
+    my $self = $class->fields::new();
+
+    return $self;
+}
+
+sub login_uri {
+    my ($self, $target) = @_;
+
+    $target->query_param(GoAheadAndLogIn => 1);
+    $target->query_param(github_login => 1);
+    $target->query_param_delete('logout');
+
+    my $uri = URI->new(GH_AUTHORIZE_URI);
+
+    $uri->query_form(
+        client_id    => Bugzilla->params->{github_client_id},
+        scope        => 'user:email',
+        state        => $self->get_state($target),
+        redirect_uri => $target,
+    );
+
+    return $uri;
+}
+
+sub get_email_key {
+    my ($class, $email) = @_;
+
+    my $digest = Digest->new(DIGEST_HASH);
+    $digest->add($email);
+    $digest->add(remote_ip());
+    $digest->add(Bugzilla->localconfig->{site_wide_secret});
+    return $digest->hexdigest;
+}
+
+sub get_state {
+    my ($class, $target) = @_;
+    my $sorted_target = $target->clone;
+    $sorted_target->query_form({});
+
+    foreach my $key (sort $target->query_param) {
+        $sorted_target->query_param($key, $target->query_param($key));
+    }
+
+    $sorted_target->query_param_delete("code");
+    $sorted_target->query_param_delete("state");
+    $sorted_target->query_param_delete('github_email_key');
+    $sorted_target->query_param_delete('github_email');
+    $sorted_target->query_param_delete('GoAheadAndLogIn');
+    $sorted_target->query_param_delete('github_login');
+
+    my $digest = Digest->new(DIGEST_HASH);
+    $digest->add($sorted_target->as_string);
+    $digest->add(remote_ip());
+    $digest->add(Bugzilla->localconfig->{site_wide_secret});
+    return $digest->hexdigest;
+}
+
+sub _handle_response {
+    my ($self, $response) = @_;
+    my $data = eval {
+        decode_json($response->content);
+    };
+    if ($@) {
+        ThrowCodeError("github_bad_response", { message => "Unable to parse json response" });
+    }
+
+    unless ($response->is_success) {
+        ThrowCodeError("github_error", { response => $response });
+    }
+    return $data;
+}
+
+sub get_access_token {
+    my ($self, $code) = @_;
+
+    my $response = $self->user_agent->post(
+        GH_ACCESS_TOKEN_URI,
+        { client_id     => Bugzilla->params->{github_client_id},
+          client_secret => Bugzilla->params->{github_client_secret},
+          code          => $code },
+        Accept => 'application/json',
+    );
+    my $data = $self->_handle_response($response);
+    return $data->{access_token} if exists $data->{access_token};
+}
+
+sub get_user_emails {
+    my ($self, $access_token) = @_;
+    my $uri = URI->new(GH_USER_EMAILS_URI);
+    $uri->query_form(access_token => $access_token);
+
+    my $response = $self->user_agent->get($uri, Accept => 'application/json');
+
+    return $self->_handle_response($response);
+}
+
+sub user_agent {
+    my ($self) = @_;
+    $self->{user_agent} //= $self->_build_user_agent;
+
+    return $self->{user_agent};
+}
+
+sub _build_user_agent {
+    my ($self) = @_;
+    my $ua = LWP::UserAgent->new( timeout => 10 );
+
+    if (Bugzilla->params->{proxy_url}) {
+        $ua->proxy('https', Bugzilla->params->{proxy_url});
+    }
+
+    return $ua;
+}
+
+1;
diff --git a/extensions/GitHubAuth/lib/Client/Error.pm b/extensions/GitHubAuth/lib/Client/Error.pm
new file mode 100644
index 000000000..358df6938
--- /dev/null
+++ b/extensions/GitHubAuth/lib/Client/Error.pm
@@ -0,0 +1,53 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth::Client::Error;
+
+use strict;
+use warnings;
+
+use Bugzilla::Error ();
+
+use base qw(Exporter);
+use fields qw(type error vars);
+
+our @EXPORT = qw(ThrowUserError ThrowCodeError);
+our $USE_EXCEPTION_OBJECTS = 0;
+
+sub _new {
+    my ($class, $type, $error, $vars) = @_;
+    my $self = $class->fields::new();
+    $self->{type}  = $type;
+    $self->{error} = $error;
+    $self->{vars}  = $vars // {};
+
+    return $self;
+}
+
+sub type  { $_[0]->{type}  }
+sub error { $_[0]->{error} }
+sub vars  { $_[0]->{vars}  }
+
+sub ThrowUserError {
+    if ($USE_EXCEPTION_OBJECTS) {
+        die __PACKAGE__->_new('user', @_);
+    }
+    else {
+        Bugzilla::Error::ThrowUserError(@_);
+    }
+}
+
+sub ThrowCodeError {
+    if ($USE_EXCEPTION_OBJECTS) {
+        die __PACKAGE__->_new('code', @_);
+    }
+    else {
+        Bugzilla::Error::ThrowCodeError(@_);
+    }
+}
+
+1;
diff --git a/extensions/GitHubAuth/lib/Config.pm b/extensions/GitHubAuth/lib/Config.pm
new file mode 100644
index 000000000..0dc78531b
--- /dev/null
+++ b/extensions/GitHubAuth/lib/Config.pm
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth::Config;
+
+use strict;
+use warnings;
+
+use Bugzilla::Config::Common;
+
+our $sortkey = 1350;
+
+sub get_param_list {
+    my ($class) = @_;
+
+    my @params = (
+        {
+            name    => 'github_client_id',
+            type    => 't',
+            default => '',
+        },
+        {
+            name    => 'github_client_secret',
+            type    => 't',
+            default => '',
+        },
+    );
+
+    return @params;
+}
+
+1;
diff --git a/extensions/GitHubAuth/lib/Login.pm b/extensions/GitHubAuth/lib/Login.pm
new file mode 100644
index 000000000..c83456274
--- /dev/null
+++ b/extensions/GitHubAuth/lib/Login.pm
@@ -0,0 +1,173 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth::Login;
+use strict;
+use warnings;
+use base qw(Bugzilla::Auth::Login);
+use fields qw(github_failure);
+
+use Scalar::Util qw(blessed);
+
+use Bugzilla::Constants qw(AUTH_NODATA AUTH_ERROR USAGE_MODE_BROWSER );
+use Bugzilla::Util qw(trick_taint correct_urlbase);
+use Bugzilla::Extension::GitHubAuth::Client;
+use Bugzilla::Extension::GitHubAuth::Client::Error ();
+use Bugzilla::Extension::GitHubAuth::Util qw(target_uri);
+use Bugzilla::Error;
+
+use constant { requires_verification   => 1,
+               is_automatic            => 1,
+               user_can_create_account => 1 };
+
+sub get_login_info {
+    my ($self) = @_;
+    my $cgi              = Bugzilla->cgi;
+    my $github_login     = $cgi->param('github_login');
+    my $github_email     = $cgi->param('github_email');
+    my $github_email_key = $cgi->param('github_email_key');
+
+    return { failure => AUTH_NODATA } unless $github_login;
+
+    if ($github_email_key && $github_email) {
+        trick_taint($github_email);
+        trick_taint($github_email_key);
+        return $self->_get_login_info_from_email($github_email, $github_email_key);
+    }
+    else {
+       return $self->_get_login_info_from_github();
+    }
+}
+
+sub _get_login_info_from_github {
+    my ($self) = @_;
+    my $cgi      = Bugzilla->cgi;
+    my $template = Bugzilla->template;
+    my $state    = $cgi->param('state');
+    my $code     = $cgi->param('code');
+
+    return { failure => AUTH_ERROR, error => 'github_missing_code' } unless $code;
+    return { failure => AUTH_ERROR, error => 'github_invalid_state' } unless $state;
+
+    trick_taint($code);
+    trick_taint($state);
+
+    my $target = target_uri();
+    my $client = Bugzilla::Extension::GitHubAuth::Client->new;
+    if ($state ne $client->get_state($target)) {
+        return { failure => AUTH_ERROR, error => 'github_invalid_state' };
+    }
+
+    my ($access_token, $emails);
+    eval {
+        # The following variable lets us catch and return (rather than throw) errors
+        # from our github client code, as required by the Auth API.
+        local $Bugzilla::Extension::GitHubAuth::Client::Error::USE_EXCEPTION_OBJECTS = 1;
+        $access_token = $client->get_access_token($code);
+        $emails       = $client->get_user_emails($access_token);
+    };
+    my $e = $@;
+    if (blessed $e && $e->isa('Bugzilla::Extension::GitHubAuth::Client::Error')) {
+        my $key = $e->type eq 'user' ? 'user_error' : 'error';
+        return { failure => AUTH_ERROR, $key => $e->error, details => $e->vars };
+    }
+    elsif ($e) {
+        die $e;
+    }
+
+    my @emails = map { $_->{email} } grep { $_->{verified} } @$emails;
+
+    my $choose_email = sub {
+        my ($email) = @_;
+        my $uri  = $target->clone;
+        my $key = Bugzilla::Extension::GitHubAuth::Client->get_email_key($email);
+        $uri->query_param(github_email => $email);
+        $uri->query_param(github_email_key => $key);
+        return $uri;
+    };
+
+    my @bugzilla_users;
+    my @github_emails;
+    foreach my $email (@emails) {
+        my $user = Bugzilla::User->new({name => $email, cache => 1});
+        if ($user) {
+            push @bugzilla_users, $user;
+        }
+        else {
+            push @github_emails, $email;
+        }
+    }
+    my @allowed_bugzilla_users = grep { not $_->in_group('no-github-auth') } @bugzilla_users;
+
+    if (@allowed_bugzilla_users == 1) {
+        my ($user) = @allowed_bugzilla_users;
+        return { username => $user->login, user_id => $user->id, github_auth => 1 };
+    }
+    elsif (@allowed_bugzilla_users > 1) {
+        $self->{github_failure} = {
+            template => 'account/auth/github-verify-account.html.tmpl',
+            vars     => {
+                bugzilla_users => \@allowed_bugzilla_users,
+                choose_email   => $choose_email,
+            },
+        };
+        return { failure => AUTH_NODATA };
+    }
+    elsif (@allowed_bugzilla_users == 0 && @bugzilla_users > 0 && @github_emails == 0) {
+            return { failure    => AUTH_ERROR,
+                     user_error => 'github_auth_account_too_powerful' };
+    }
+    elsif (@github_emails) {
+        $self->{github_failure} = {
+            template => 'account/auth/github-verify-account.html.tmpl',
+            vars     => {
+                github_emails => \@github_emails,
+                choose_email  => $choose_email,
+            },
+        };
+        return { failure => AUTH_NODATA };
+    }
+    else {
+        return { failure => AUTH_ERROR, user_error => 'github_no_emails' };
+    }
+}
+
+sub _get_login_info_from_email {
+    my ($self, $github_email, $github_email_key) = @_;
+    my $cgi = Bugzilla->cgi;
+
+    my $key = Bugzilla::Extension::GitHubAuth::Client->get_email_key($github_email);
+    unless ($github_email_key eq $key) {
+        return { failure => AUTH_ERROR,
+                 user_error => 'github_invalid_email',
+                 { email => $github_email }};
+    }
+
+    my $user = Bugzilla::User->new({name => $github_email, cache => 1});
+    return { failure    => AUTH_ERROR,
+             user_error => 'github_auth_account_too_powerful' } if $user && $user->in_group('no-github-auth');
+
+    return { username => $github_email, github_auth => 1 };
+}
+
+sub fail_nodata {
+    my ($self) = @_;
+    my $cgi      = Bugzilla->cgi;
+    my $template = Bugzilla->template;
+
+    ThrowUserError('login_required') if Bugzilla->usage_mode != USAGE_MODE_BROWSER;
+
+    my $file = $self->{github_failure}{template} // "account/auth/login.html.tmpl";
+    my $vars = $self->{github_failure}{vars} // { target => $cgi->url(-relative=>1) };
+
+    print $cgi->header();
+    $template->process($file, $vars) or ThrowTemplateError($template->error());
+    exit;
+}
+
+
+1;
diff --git a/extensions/GitHubAuth/lib/Util.pm b/extensions/GitHubAuth/lib/Util.pm
new file mode 100644
index 000000000..bda76a420
--- /dev/null
+++ b/extensions/GitHubAuth/lib/Util.pm
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth::Util;
+
+use strict;
+use warnings;
+
+use Bugzilla::Util qw(correct_urlbase);
+use URI;
+
+use base qw(Exporter);
+our @EXPORT = qw( target_uri );
+
+
+# this is like correct_urlbase() except it returns the *requested* uri, before http url rewrites have been applied.
+# needed to generate github's redirect_uri.
+sub target_uri {
+    my $cgi = Bugzilla->cgi;
+    my $base = URI->new(correct_urlbase());
+    if (my $request_uri = $cgi->request_uri) {
+        $base->path('');
+        $request_uri =~ s!^/+!!;
+        return URI->new($base . "/" . $request_uri);
+    }
+    else {
+        return URI->new(correct_urlbase() . $cgi->url(-relative => 1, query => ));
+    }
+}
+
+1;
diff --git a/extensions/GitHubAuth/lib/Verify.pm b/extensions/GitHubAuth/lib/Verify.pm
new file mode 100644
index 000000000..ee66c8904
--- /dev/null
+++ b/extensions/GitHubAuth/lib/Verify.pm
@@ -0,0 +1,23 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::Extension::GitHubAuth::Verify;
+use strict;
+use warnings;
+use base qw(Bugzilla::Auth::Verify);
+
+use Bugzilla::Constants qw( AUTH_NO_SUCH_USER );
+
+sub check_credentials {
+    my ($self, $login_data) = @_;
+
+    return { failure => AUTH_NO_SUCH_USER } unless $login_data->{github_auth};
+
+    return $login_data;
+}
+
+1;
diff --git a/extensions/GitHubAuth/template/en/default/account/auth/github-verify-account.html.tmpl b/extensions/GitHubAuth/template/en/default/account/auth/github-verify-account.html.tmpl
new file mode 100644
index 000000000..ba528b390
--- /dev/null
+++ b/extensions/GitHubAuth/template/en/default/account/auth/github-verify-account.html.tmpl
@@ -0,0 +1,48 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[%# Input: github_emails, bugzilla_emails.
+  # This template will not be called when bugzilla_emails.size == 1
+  # or when both github_emails.size == 0 && bugzilla_emails.size == 0
+  #%]
+
+[% PROCESS global/variables.none.tmpl %]
+
+[% PROCESS global/header.html.tmpl
+  title = "Choose Account"
+%]
+
+[% IF bugzilla_users %]
+  <h1>Choose Account</h1>
+
+  <p>It seems that more than one [% terms.Bugzilla %] account connected to
+    your GitHub account. You may choose to login by clicking the link below.</p>
+
+  <ul class="bugzilla_emails">
+    [% FOREACH bz_user IN bugzilla_users %]
+      <li><a href="[% choose_email(bz_user.email) FILTER html %]">[% bz_user.email FILTER html %]</a></li>
+    [% END %]
+  </ul>
+[% ELSE %]
+  <h1>Account Not In [% terms.Bugzilla %]</h1>
+
+  [% IF github_emails.size == 1 %]
+    <p>The email '[% github_emails.0 FILTER html %]' was not found in [% terms.Bugzilla %] and will need to be created to log in.</p>
+
+    <a href="[% choose_email(github_emails.0) FILTER html %]">Create Account</a>
+  [% ELSE %]
+  <p>You have multiple email addresses associated with your GitHub account.
+    Which one should be used to create your [% terms.Bugzilla %] account?</p>
+
+    [% FOREACH email IN github_emails %]
+      <li><a href="[% choose_email(email) FILTER html %]">[% email FILTER html %]</a></li>
+    [% END %]
+  [% END %]
+[% END %]
+
+[% PROCESS global/footer.html.tmpl %]
diff --git a/extensions/GitHubAuth/template/en/default/admin/params/githubauth.html.tmpl b/extensions/GitHubAuth/template/en/default/admin/params/githubauth.html.tmpl
new file mode 100644
index 000000000..56f2475c3
--- /dev/null
+++ b/extensions/GitHubAuth/template/en/default/admin/params/githubauth.html.tmpl
@@ -0,0 +1,19 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[%
+   title = "GitHubAuth"
+   desc = "Configure GitHubAuth Authentication"
+%]
+
+[%
+   param_descs = {
+       github_client_id     => "Your GitHub Client ID",
+       github_client_secret => "Your GitHub Client Secret"
+   }
+%]
diff --git a/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl b/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl
new file mode 100644
index 000000000..26eb8d63b
--- /dev/null
+++ b/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl
@@ -0,0 +1,18 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[% IF Param('user_info_class').split(',').contains('GitHubAuth') %]
+  <p>
+    <a href="[% github_auth.login FILTER html %]">
+      <img src="extensions/GitHubAuth/web/images/github_sign_in.png"
+           alt="Sign in with GitHub"
+           title="Sign in with GitHub"
+           width="185" height="25">
+    </a>
+  </p>
+[% END %]
diff --git a/extensions/GitHubAuth/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl b/extensions/GitHubAuth/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl
new file mode 100644
index 000000000..6c4582b70
--- /dev/null
+++ b/extensions/GitHubAuth/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl
@@ -0,0 +1,26 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[% IF Param('user_info_class').split(',').contains('GitHubAuth') %]
+  <script type="text/javascript">
+   YAHOO.util.Event.addListener('login_link[% qs_suffix FILTER js %]','click', function () {
+     var login_link = YAHOO.util.Dom.get('github_mini_login[% qs_suffix FILTER js %]');
+     YAHOO.util.Dom.removeClass(login_link, 'bz_default_hidden');
+   });
+   YAHOO.util.Event.addListener('hide_mini_login[% qs_suffix FILTER js %]','click', function () {
+     var login_link = YAHOO.util.Dom.get('github_mini_login[% qs_suffix FILTER js %]');
+     YAHOO.util.Dom.addClass(login_link, 'bz_default_hidden');
+   });
+  </script>
+  <span id="github_mini_login[% qs_suffix FILTER html %]" class="bz_default_hidden">
+    <a href="[% github_auth.login FILTER html %]">
+      <img src="extensions/GitHubAuth/web/images/sign_in.png" height="22" width="75" align="absmiddle"
+           alt="Sign in with GitHub"
+           title="Sign in with GitHub"></a> or
+  </span>
+[% END %]
diff --git a/extensions/GitHubAuth/template/en/default/hook/global/code-error-errors.html.tmpl b/extensions/GitHubAuth/template/en/default/hook/global/code-error-errors.html.tmpl
new file mode 100644
index 000000000..5f6672e2b
--- /dev/null
+++ b/extensions/GitHubAuth/template/en/default/hook/global/code-error-errors.html.tmpl
@@ -0,0 +1,25 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[% IF error == "github_invalid_state" %]
+  [% title = "Invalid State Parameter" %]
+  An invalid <em>state</em> parameter was passed to the GitHub OAuth2 callback.
+
+[% ELSIF error == "github_missing_code" %]
+  [% title = "Missing GitHub Auth Code" %]
+  Expected a <em>code</em> parameter in the GitHub OAuth2 callback.
+
+[% ELSIF error == "github_bad_response" %]
+  [% title = "Bad Response from GitHub" %]
+  Received unexpected response from GitHub: [% message FILTER html %]
+
+[% ELSIF error == "github_error" %]
+  [% title = "GitHub Error" %]
+  GitHub returned an error: [% response.message FILTER html %]
+
+[% END %]
diff --git a/extensions/GitHubAuth/template/en/default/hook/global/user-error-errors.html.tmpl b/extensions/GitHubAuth/template/en/default/hook/global/user-error-errors.html.tmpl
new file mode 100644
index 000000000..61a08367d
--- /dev/null
+++ b/extensions/GitHubAuth/template/en/default/hook/global/user-error-errors.html.tmpl
@@ -0,0 +1,24 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[% IF error == "github_no_emails" %]
+  Your GitHub account cannot be used because [% terms.Bugzilla %] cannot see any email addresses. Either your GitHub account
+  has no verified email addresses or [% terms.Bugzilla %] is not authorized to see them.
+
+[% ELSIF error == "github_invalid_email" %]
+  Your GitHub account email '[% email FILTER html %]' is not valid.
+
+[% ELSIF error == "github_auth_account_too_powerful" %]
+  [% title = "Account Too Powerful" %]
+  Your account is a member of a group which is not permitted to use GitHub to
+  log in. Please log in with your [% terms.Bugzilla %] username and password.
+  <br><br>
+  (GitHub logins are disabled for accounts which are members of certain
+  particularly sensitive groups, while we gain experience with the technology.)
+
+[% END %]
diff --git a/extensions/GitHubAuth/web/images/github_sign_in.png b/extensions/GitHubAuth/web/images/github_sign_in.png
new file mode 100644
index 000000000..f32356f01
--- /dev/null
+++ b/extensions/GitHubAuth/web/images/github_sign_in.png
diff --git a/extensions/GitHubAuth/web/images/sign_in.png b/extensions/GitHubAuth/web/images/sign_in.png
new file mode 100644
index 000000000..9df6058e5
--- /dev/null
+++ b/extensions/GitHubAuth/web/images/sign_in.png