Part of story #14542: have OAuth2 flow To test (if app force the usage of PKCE you need to add the required parameters to the following instructions): 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&scope=demo%20project:read&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. Revoke the access token you have just requested: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'token=<access_token> \ https://tuleap.example.com/oauth2/token/revoke 6. The app's authorization codes and access tokens should be revoked and no longer usable. Change-Id: Id83c5adc6019bf84d9f876170ac481eeab5d5df6

+629 −4

Author

Joris MASSON (jmasson) 2020-03-20 16:15

Committer

Joris MASSON (jmasson) 2020-03-23 15:42

Hash 1ff36f63bb0a61f955b8ebb1ebd27b09055daf32

Parent 76201f3cc0c113fb718c44bdcc7aaa5e1d90a9de

Reference git #tuleap/stable/1ff36f63bb0a61f955b8ebb1ebd27b09055daf32