Seeking more details on non-support for GoCD personal access tokens

[dlethin]

It seems that we can not create access tokens when using the this plugin:

Creation of access token is not supported by the plugin cd.go.authorization.google.

That seems to be mentioned in the GoCD Release notes for 19.2.0:

Google Oauth plugin is upgraded to use authorization extension v2 however it does not have support for access token based API authentication.

Is this a limitation because the functionality has not been written in this particular plugin implementation yet, a limitation specific due to google oauth API or policy, or a limitation in external GoCD authorization implementations in general?

Is there any recommended workaround for this? Is there any recommended way for our users authenticating with this plugin to be able to make authenticated requests to the go server API? Using personal access bearer tokens sounded like an ideal solution.

Thanks in advance

Doug

[vrushaliwaykole]

Hi Doug,

As part of authorization endpoint 2.0, a plugin needs to provide a is-valid-user implementation for access token-based authentication to work.

In case of authentication via plugins, GoCD does not hold any information about the user. That information remains with the application providing authentication (LDAP, OAuth, etc).

When a user attempts to authenticate with an access token, GoCD can identify the user (by looking up the token in GoCD's database) but GoCD is dependent on the is-valid-user endpoint to check if the user is still authenticated/authorized.

At the time we implemented the Google OAuth plugin, the Google API was unable to answer if a user with a given login name is valid or not. If this has changed recently, someone should be able to provide a is-valid-user implementation to add this capability.