The optional 'scope' paramater is now taken into account when using a refresh token. To test (if app force the usage of PKCE you need to add the required parameters to the following instructions): 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&scope=offline_access%20read:project&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. The response should contain a refresh token. 6. Refresh the access token with the obtained refresh token and a reduced set of scopes: shell> curl -X POST -k -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<cleant_secret>' \ --data 'grant_type=refresh_token&refresh_token=<refresh_token>&scope=read:project' \ https://tuleap-web.tuleap-aio-dev.docker/oauth2/token 7. You should a new access token with the read:project and no refresh token has the scope offline_access has not been set when refreshing the token Part of story #14542: have OAuth2 flow Change-Id: Icfc67217bfe1fbba461bfb4a0ae67b5d7edb17f2

+263 −8

Author

Thomas Gerbet (tgerbet) 2020-03-26 12:16

Committer

Thomas Gerbet (tgerbet) 2020-03-26 12:16

Hash bda090fa6d59985061999cddf480f1ee852b5e44

Parent 0ba97ac0e5d58fe108ce9b5dfd1ae86053aef130

Reference git #tuleap/stable/bda090fa6d59985061999cddf480f1ee852b5e44