Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add gitlab scope documentation #267

Open
wants to merge 2 commits into
base: master
from

Conversation

Projects
None yet
1 participant
@DentonGentry
Copy link

commented May 25, 2019

No description provided.

DentonGentry added some commits May 25, 2019

Add scope documentation for GitLab.
If no scope is specified it appears that gitlab.com defaults to
'api', which grants complete read/write access to the API
including all groups and projects. That... is a lot.

Setting the scope to 'read_user' works in my TLJH installation.
Before setting the scope in TLJH, authentication would fail
unless I'd granted api permission in my gitlab.com OAuth
server application.

After limiting the scope which my TLJH client requests, I can
remove the api permission from my gitlab.com OAuth server
application and authentication succeeds.

It may be appropriate to make read_user scope be the default in
oauthenticator/gitlab.py. Github appears to default to a much
more limited and read-only set of permissions if no specific
scope is requested, leaving the scope unset on github is
reasonable. Leaving the scope unset on Gitlab seems less
reasonable.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.