GitLab OpenID scope

[almereyda]

When using this with a GitLab application that has the openid scope configured, the gitlab provider requests an api scope. This also happens when -scope="openid" is set.

For securing least priviledge, it could be nice to only request an openid scope from the GitLab OpenID Connect application.

[ploxiln]

see #36

Is "openid" always a usable and better choice than "api" when using the GitLab provider?

[almereyda]

A token for the openid scope will provide access to the same user login and its details, but will not inherit all read/write admin priviledges from an api authorization. Following the principle of least priviledge, this is to be preffered.

The documentation also states to use openid when intending to use OpenID Connect (OIDC):

• https://docs.gitlab.com/ce/api/oauth2.html
• https://docs.gitlab.com/ee/integration/oauth_provider.html
• https://docs.gitlab.com/ee/integration/openid_connect_provider.html

[ploxiln]

Right, so, I don't see the "openid" scope listed at https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html#limiting-scopes-of-a-personal-access-token and it's only mentioned in a single place in https://docs.gitlab.com/ee/integration/openid_connect_provider.html#enabling-openid-connect-for-oauth-applications and it's not clear to me that it is appropriate for the oauth2_proxy purpose and allows access to group membership.

Anyway, I've updated #36 to use the "openid" scope. Can you build that PR and validate that it works for your setup?

[almereyda]

Will try, thanks.

…

On Mon, 29 Apr 2019 at 19:26, Pierce Lopez ***@***.***> wrote: Right, so, I don't see the "openid" scope listed at https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html#limiting-scopes-of-a-personal-access-token and it's only mentioned in a single place in https://docs.gitlab.com/ee/integration/openid_connect_provider.html#enabling-openid-connect-for-oauth-applications and it's not clear to me that it is appropriate for the oauth2_proxy purpose and allows access to group membership. Anyway, I've updated #36 <#36> to use the "openid" scope. Can you build that PR and validate that it works for your setup? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#35 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAMRV7CFIHOP5UHORQHT6FDPS4VT7ANCNFSM4HH7CGMQ> .

[ploxiln]

Any news about how "openid" scope works for you?

I'm inclined to go back to "api" scope by default (when groups are specified) but with the fix of allowing to override that with the command-line option. This would be a smaller behavior change, and if a few different users report that overriding scope to "openid" works, that change can be made separately in a later release.

A GitLab group PR in the other fork also uses the "api" scope for groups: https://github.com/pusher/oauth2_proxy/pull/137/files#diff-83fab261d52ee47763d81d669a7b7b74R107