1388543 - Be ready to use OIDC scopes to control what Taskcluster scopes are issued

Status: RESOLVED FIXED

(Taskcluster :: Services, enhancement)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

I would like to have the option, someday, of issuing only a limited set of scopes.  OIDC has a way of asking for specific kinds of access to an API (also called "scopes" but completely different).  I'm not sure how we will map OIDC scopes to Taskcluster scopes, but let's prepare for that day by requiring an OIDC scope to get full TC credentials.  Then apps using that scope can continue to operate in a world where we start to limit access.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Scope setup requests:

RITM0055485
RITM0055484

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

IAM scope requests are still pending..

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Still pending.  I sent a reminder email to kang et al.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

OK, this is up and running.  It appears the version of the lock we are using now displays only the scope names, not the descriptions.  It also doesn't say 'scope xyz for Taskcluster-Login', it just says 'xyz'.  So I think we need something a little more explicit, maybe `taskcluster:full-access`.  Then later we can define some more limited scopes.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

We are ready now and for the forseeable future -- have the scope 'full-user-credentials'.  I will add code to login to require that scope.

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster-login/pull/55

Comment 7

[[github robot]]

Commits pushed to master at https://github.com/taskcluster/taskcluster-login

https://github.com/taskcluster/taskcluster-login/commit/c08cba1199d591d3443de59d399ff98603d48c9d
Bug 1388543 - reject requests without scope full-user-credentials

https://github.com/taskcluster/taskcluster-login/commit/87900b4d877029971927a30661024d63791c9fb5
Merge pull request #55 from djmitche/bug1388543

Bug 1388543 - reject requests without scope full-user-credentials

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

I was missing a `!` in that last commit, but it's fixed and verified now.