This contribution introduces a minimal verification when requesting a new access token. An authorization code must be provided but for now this authorization code is hardcoded and can be used multiple times. This is one part of the full implementation of RFC6749 section 4.1.3 [0]. The only valid hardcoded authorization code is: 'tlp-oauth2-ac1-1.6161616161616161616161616161616161616161616161616161616161616161'. To test, you need to: 1. Create a new OAuth2 app in a project administration 2. Access the access token endpoint, '<client_id>', '<client_secret>' and '<authorization_code>' must be replaced: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&code=<authorization_code> \ https://tuleap.example.com/oauth2/token This is part of story #14542: have OAuth2 flow [0] https://tools.ietf.org/html/rfc6749#section-4.1.3 Change-Id: I06b2d7e3b7554815a8f234e2e2ee1e93e7288f8c

+398 −16

Author

Thomas Gerbet (tgerbet) 2020-03-02 13:39

Committer

Thomas Gerbet (tgerbet) 2020-03-02 15:13

Hash f17076d72ec53dded33fb10d029b33ae400afb4f

Parent 05c3c19d0f652f61bcbdd40d623c2d406aa0fc98

Reference git #tuleap/stable/f17076d72ec53dded33fb10d029b33ae400afb4f