Per the RFC6749 section 10.5 [0] the authorization codes can be used only once. Later knowing if an authorization code has already been used or not will be used to revoke all access tokens and refresh tokens created with it in case of a compromision (i.e. when a an auth code is reused). 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_d>&scope=demo&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. The auth code should be marked has already used in the DB and it cannot be reused to get another access token. This is part of story #14542: have OAuth2 flow [0] https://tools.ietf.org/html/rfc6749#section-10.5 Change-Id: Id023e8674631b023896a381a201c5d5c614e9a36

+140 −18

Author

Thomas Gerbet (tgerbet) 2020-03-11 16:16

Committer

Thomas Gerbet (tgerbet) 2020-03-11 17:37

Hash 3f59dbb8f92af13dc3d39134fa4262927fbf0a5f

Parent 7d2428bc96dfc3b5865dab0ab91d0c40792e6c24

Reference git #tuleap/stable/3f59dbb8f92af13dc3d39134fa4262927fbf0a5f