add minimal apptokens feature #767
Conversation
butonic
force-pushed
the
apptokens
branch
2 times, most recently
from
f29421f
to
b42d79d
Compare
Signed-off-by: Jörn Friedrich Dreyer <[email protected]>
There was a problem hiding this comment.
Are app tokens a production ready product feature nowadays?
And if so, what's the reasoning behind this:
For security reasons, bearer tokens can only be generated by the admin on the CLI, token generation via the web api is not enabled.
Why would we do a hardcoded change of the oCIS product default in AUTH_APP_SKIP_USER_GROUPS_IN_TOKEN ?
Why does this service need another PVC? Even if it was to store data, shouldn't it use either the micro store interface or the storage-system storage!?
Partly. Enabling external services to use the graph api requires a token that does not need human interaction. @tbsbdr @dragotin how do we continue with this? @wkloucek is there a way to mark a feature as experimental?
I'll revert that
🤔 hm, good point. The only implementation currently writes to disk. I'll look into a store backed implementation. |
No, the oCIS chart is intended for production installations only. (with a few exceptions like IDP, IDM, NATS service. Therefore we issue scary warnings in https://github.com/owncloud/ocis-charts/blob/main/charts/ocis/templates/NOTES.txt if you use the builtin ones.) But in general I'd like to keep out experimental stuff, since the NOTE: we recently even removed the basic auth service because it is obviously not production ready. |
|
From owncloud/ocis#10292 I understood that it's not yet production ready!? Therefore setting to draft state. |
Fixes #707
This PR adds a minimal app tokens feature:
External services can use the bearer tokens to make requests on external endpoints, eg. to create storage spaces and manage space membership.
For security reasons, bearer tokens can only be generated by the admin on the CLI, token generation via the web api is not enabled.
Use this only for services under your control. The generated tokens are not scoped and can execute any actions permitted by the associated user.
Allow users to generate app tokens for other clients is tracked in Personal token for API access in third-party tools ocis#7711