Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add gitlab scope documentation #267

Merged
merged 2 commits into from Jun 28, 2019
Merged

Add gitlab scope documentation #267

merged 2 commits into from Jun 28, 2019

Conversation

@DentonGentry
Copy link
Contributor

@DentonGentry DentonGentry commented May 25, 2019

No description provided.

If no scope is specified it appears that gitlab.com defaults to
'api', which grants complete read/write access to the API
including all groups and projects. That... is a lot.

Setting the scope to 'read_user' works in my TLJH installation.
Before setting the scope in TLJH, authentication would fail
unless I'd granted api permission in my gitlab.com OAuth
server application.

After limiting the scope which my TLJH client requests, I can
remove the api permission from my gitlab.com OAuth server
application and authentication succeeds.

It may be appropriate to make read_user scope be the default in
oauthenticator/gitlab.py. Github appears to default to a much
more limited and read-only set of permissions if no specific
scope is requested, leaving the scope unset on github is
reasonable. Leaving the scope unset on Gitlab seems less
reasonable.
@minrk
Copy link
Member

@minrk minrk commented Jun 28, 2019

Excellent, thanks!

@minrk minrk merged commit 04d664e into jupyterhub:master Jun 28, 2019
3 checks passed
3 checks passed
codecov/patch Coverage not affected when comparing 64e3f59...aca9a1b
Details
codecov/project 81.05% (target 0%)
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants