Authentication

Personal Credentials

We have already used username and password

Users can create Personal Access Tokens

• Used instead of password for git operations
• Used to access the API (more later)

Users can add SSH public keys

• Used for git operations

Permissions inherited from user

Hands-On

1. Create a personal access token
2. Clone a repository using the PAT instead of the password

Group and Project Credentials

Scoped to group

Group Deploy Tokens (read only)

Group Access Tokens (configurable)

Scoped to project

Project Access Tokens (configurable)

Project Deploy Token (read-only)

Project Deploy SSH Key (read-write)

Hands-On

1. Create a project deploy token
2. Use it to clone the repository

Caveats 1/

Token creation can be tricky

Role defines the permission level

Scope specified available “features”, e.g.

• (read_)?api
• (read|write)_repository
• create_runner (more later)

Expiration defines how long

Example

Role: Developer

Scope: read_repository

User can pull but not push

Caveats 2/2

Deploy keys belong to a user who can be blocked gitlab-org/gitlab#35779

Find and fix deploy keys using Ruby code in rails console

DeployKeysProject.with_write_access.find_each do |deploy_key_mapping|
  project = deploy_key_mapping.project
  deploy_key = deploy_key_mapping.deploy_key
  user = deploy_key.user

  access_checker = Gitlab::DeployKeyAccess.new(deploy_key, container: project)
  can_push = access_checker.can_do_action?(:push_code)
  can_push_to_default = access_checker.can_push_for_ref?(project.repository.root_ref)

  next if access_checker.allowed? && can_push && can_push_to_default

  puts "Deploy key: #{deploy_key.id}, Project: #{project.full_path}, Can push?: " + (can_push ? 'YES' : 'NO') +
       ", Can push to default branch #{project.repository.root_ref}?: " + (can_push_to_default ? 'YES' : 'NO') +
       ", User: #{user.username}, User ID: #{user.id}, User state: #{user.state}"
end

Comparison

• (1) Username and password can be used to retrieve a personal access token
• (2) Group only
• (3) Project only
• (4) API only
• (5) Can be used for multiple accounts and on multiple systems
• (6) Acceptable for automation to avoid many project credentials