[Tiki-devel] Hybridauth gitlab api permission
Bernard Sfez via TikiWiki-devel <[email protected]>
| Newsgroups | gmane.comp.cms.tiki.devel |
|---|---|
| Message-ID | <[email protected]> |
Hello, As seen in the chat, I tested the hybridauth https://doc.tiki.org/Hybridauth-social-login on master and improved the documentation. I found that for Gitlab login to work, it is required to select the “api" scope at Gitlab: "Grants complete read/write access to the API, including all groups and projects, the container registry, and the package registry.” I really think this is too much and potentially dangerous (or at least a risk that Tiki shouldn’t take upon himself): https://github.com/hybridauth/hybridauth/issues/1206 https://github.com/jupyterhub/oauthenticator/issues/372 Among the list of possible scopes I tried many combinaisons and only when “api” is enable I had the Tiki authentication to work. api Grants complete read/write access to the API, including all groups and projects, the container registry, and the package registry. read_api Grants read access to the API, including all groups and projects, the container registry, and the package registry. read_user Grants read-only access to the authenticated user's profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users. read_repository Grants read-only access to repositories on private projects using Git-over-HTTP or the Repository Files API. write_repository Grants read-write access to repositories on private projects using Git-over-HTTP (not using the API). read_registry Grants read-only access to container registry images on private projects. write_registry Grants write access to container registry images on private projects. read_observability Grants read-only access to GitLab Observability. write_observability Grants write access to GitLab Observability. sudo Grants permission to perform API actions as any user in the system, when authenticated as an admin user. admin_mode Grants permission to perform API actions as an administrator, when Admin Mode is enabled. openid Grants permission to authenticate with GitLab using OpenID Connect. Also gives read-only access to the user's profile and group memberships. profile Grants read-only access to the user's profile data using OpenID Connect. email Grants read-only access to the user's primary email address using OpenID Connect. What people think ? Can we change something about it ? Bernard _______________________________________________ TikiWiki-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel