Allow deploy tokens and deploy keys with the external authorization
requested to merge 386656-deploy-tokens-stopped-with-external-authentication-after-security-fix into master
What does this MR do and why?
Allow deploy tokens and deploy keys with the external authorization when the external URL is empty. this is to support the using External authorisation feature just for classification labels
Screenshots or screen recordings
How to set up and validate locally
GitLab setup
- Create an admin account
admin01
and a regular useruser01
- Log in as
admin01
- Create a new group called
group01
, take a note of the group ID - Create a new project in the group called
project01
and make sure to check the boxinitialize the repository with README
. Take a note of the project ID - Go to https://gdk.test:3000/groups/group01/-/group_members and invite
user01
as aowner
- Go to https://gdk.test:3000/admin/application_settings/general#js-external-auth-settings to activate `external authentication
- Enable
Allow deploy tokens and deploy keys with external authorisation
checkbox - Keep
Service URL
as empty and aDefault classification label
as anything - The settings will be saved
- Log out
- Login as
user01
and create an access token - Create a deploy token using this access token using the following curl script
curl --request POST \
--header "PRIVATE-TOKEN: <TOKEN>" \
--header "Content-Type: application/json" \
--data '{"name": "My deploy token", "expires_at": "2023-01-01", "username": "token-user", \
"scopes": ["read_repository", "write_package_registry", "read_package_registry", \
"write_registry", "read_registry"]}' \
https://gdk.local:3000/api/v4/groups/group01/deploy_tokens/
- The response will contain a
"token": <DEPLOY-TOKEN>
field. Created in the group where we were just restricted from creating a deploy token in step 3 - Now try to clone
project01
with thepersonal access token
and ensure repo is getting cloned
git clone http://user01:<PERSONAL-TOKEN>[@]gitlab.example.com/group01/project01.git
-->
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #386656 (closed)
Edited by Aboobacker MK