89030bc3d0
Site administrators relying on OpenID can now enable the PAPE extension, requiring users to reauthenticate with their provider before establishing a new session with the Gerrit server. This resolves issue 521 by allowing a site administrator to set auth.maxOpenIdSessionAge to 0. In this configuration the Google Accounts provider will always prompt for a password, which gives the user a chance to sign-out of Google's account system and sign-in as a different user before they return to the Gerrit installation. Bug: issue 521 Change-Id: I656d6fd31831a71edf15319b6d94503ac93f6f36 Signed-off-by: Shawn O. Pearce <sop@google.com>