DXCDT-597: Don't require all scopes for client credentials auth #917
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
willvedd
commented
Nov 20, 2023
| @@ -116,6 +116,29 @@ func WaitUntilUserLogsIn(ctx context.Context, httpClient *http.Client, state Sta | |||
| } | |||
| } | |||
|
|
|||
| var RequiredScopes = []string{ | |||
There was a problem hiding this comment.
IMO, doesn't make sense to have these scopes as a standalone file. Decided to pull-in to the auth.go file.
sergiught
approved these changes
Nov 21, 2023
|
Confirmed again that this works as expected; no other logic needs to be modified. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🔧 Changes
As noted by #556, when authenticating to the CLI with client credentials, it is necessary for that client to have a set of required scopes. Doing so ensures that the CLI has full functionality out-the-box, however, this precludes the CLI from adhering to principle of least privilege. As the original Github issue notes, the CLI can be used in automation for specific cases and users should be able to provision only the scopes for those cases.
📚 References
Related Github issue: #556
🔬 Testing
Manual verification; no testing framework in place to test token exchange.
📝 Checklist