1437116 - Change "full-user-credentials" scope to "taskcluster-credentials"

Status: RESOLVED FIXED

(Taskcluster :: Services, defect)

Description

[Hassan Ali (:hassan)]

Attachment: full-user-credentials-prompt

Logging in for the first time in treeherder.mozilla.org or tools.taskcluster.net, you will get a prompt asking permission to access “full-user-credentials”. This is simply asking to access the user's taskcluster credentials but is a little bit scary and misleading. Let's change it to "taskcluster-credentials”.

Dustin suggests doing the following process:
* add the scope to the API (a servicenow request)
* update login to accept either scope
* update tools, treeherder, and docs to reference the new scope
* then after a bit, remove the old scope

Comment 1

[Ed Morley [:emorley]]

Is there a way to grandfather in users who've accepted the old scope name, so they don't get prompted a second time for the new name? If not, then no worries - this will still be a net win - though we'll probably want to tell people prior to switching over Treeherder/tools/... so they don't worry and/or know that this is the last time they'll be asked.

Comment 2

[Hassan Ali (:hassan)]

Users will have to answer the prompt a second time because, in our case, if we want users to have the ability to login during the transition, we will need to create the new scope, adjust the taskcluster login to accept either scopes, then safely delete the `full-credentials` scope after a couple of days. Renaming the scope is probably not the best thing to do here.

Comment 3

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/treeherder/pull/3227

Comment 4

[Hassan Ali (:hassan)]

- Update tc-login: https://github.com/taskcluster/taskcluster-login/pull/77
- Update treeherder: https://github.com/mozilla/treeherder/pull/3227
- Update docs: https://github.com/taskcluster/taskcluster-docs/pull/238
- Update tc-tools: https://github.com/taskcluster/taskcluster-tools/pull/441

Once all of these PR's are merged, we can then safely remove the reference to 'full-user-credentials' from tc-login.

Comment 5

[Hassan Ali (:hassan)]

- Update more docs: https://github.com/taskcluster/taskcluster-login/pull/78

Comment 6

[Hassan Ali (:hassan)]

Comment on attachment 8950938 [details] [review]
Link to GitHub pull-request: https://github.com/mozilla/treeherder/pull/3227

Ed, all PRs outlined in https://bugzilla.mozilla.org/show_bug.cgi?id=1437116#c4 have been merged except https://github.com/mozilla/treeherder/pull/3227. That one is ready to be merged now :)

Comment 7

[Ed Morley [:emorley]]

Comment on attachment 8950938 [details] [review]
Link to GitHub pull-request: https://github.com/mozilla/treeherder/pull/3227

Commented on the PR :-)

Comment 8

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/treeherder/pull/3233

Comment 9

[Hassan Ali (:hassan)]

https://mozilla-releng.net/ seems to be using full-user-credentials as well. Created https://github.com/mozilla-releng/services/pull/887.

Comment 10

[Hassan Ali (:hassan)]

Removed the reference to 'full-user-credentials' from tc-login in https://github.com/taskcluster/taskcluster-login/commit/ecbd1cf1c7ae4c3303343256faf8367763e3fa80.