authentication github org clarification

[choldgraf]

closes #684

@rsignell-usgs what do you think?

[betatim]

Merged, if we need to we can make a new PR to adjust things further.

[rsignell-usgs]

@choldgraf , this clarification is good, but I'm wondering why were were getting 403 errors when people's group status was set to private, as we did have auth.scopes set to read.org.

I'm raising this issue here: #687

Does this statement:

Changing auth.scopes will not change the scope for existing OAuth tokens, you must invalidate them.

mean that the JuptyerHub oath app client secret needs to be reset or user tokens revoked on github?

[minrk]

the JuptyerHub oath app client secret needs to be reset or user tokens revoked on github?

Yes, the tokens must be revoked. I believe GitHub has a "revoke all tokens" button for a given oauth application. That's probably what you want.

[choldgraf]

hmmm, that's a good question. Could you open a new issue and copy/paste the message above so we don't lose track of it? (since this issue is closed)