Part of story #14542: have OAuth2 flow To test (if app force the usage of PKCE you need to add the required parameters to the following instructions): 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&scope=offline_access&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. Revoke the refresh token you received at step 2: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'token=<refresh_token> \ https://tuleap.example.com/oauth2/token/revoke 6. The refresh token, its associated authorization code and the access token returned by the same request should be revoked. They should no longer be usable. Change-Id: Id79b79bb01c82355863bbc60fe24dad9e91353ef

+677 −180

Author

Joris MASSON (jmasson) 2020-03-23 18:07

Committer

Joris MASSON (jmasson) 2020-03-24 16:18

Hash 05c34a2eeecafc33544a574b809453ef0bfa4ea3

Parent 48f6b9f28203db1492b0f513515204c471ba4691

Reference git #tuleap/stable/05c34a2eeecafc33544a574b809453ef0bfa4ea3