Authentication

Personal Credentials

We have already used username and password

Users can create Personal Access Tokens

• Used instead of password for git operations
• Used to access the API (more later)

Users can add SSH public keys

• Used for git operations

Permissions inherited from user

Hands-On

1. Create a personal access token
2. (Optionally) Clone a repository using the PAT instead of the password

Group and Project Credentials 1/2

Group and Project Credentials 2/2

Scoped to group

Group Deploy Tokens (read only)

Group Access Tokens (configurable)

Scoped to project

Project Access Tokens (configurable)

Project Deploy Token (read-only)

Project Deploy SSH Key (read-write)

Hands-On

1. Create a project deploy token
2. (Optionally) Use it to clone the repository

Caveats 1/

Token creation can be tricky

Role defines the permission level

Scope specified available “features”, e.g.

• (read_)?api
• (read|write)_repository
• create_runner (more later)

Expiration defines how long

Example

Role: Developer

Scope: read_repository

User can pull but not push

Caveats 2/2

Deploy keys belong to a user who can be blocked gitlab-org/gitlab#35779

Find and fix deploy keys using Ruby code in rails console

DeployKeysProject.with_write_access.find_each do |deploy_key_mapping|
  project = deploy_key_mapping.project
  deploy_key = deploy_key_mapping.deploy_key
  user = deploy_key.user

  access_checker = Gitlab::DeployKeyAccess.new(deploy_key, container: project)
  can_push = access_checker.can_do_action?(:push_code)
  can_push_to_default = access_checker.can_push_for_ref?(project.repository.root_ref)

  next if access_checker.allowed? && can_push && can_push_to_default

  puts "Deploy key: #{deploy_key.id}, Project: #{project.full_path}, Can push?: " + (can_push ? 'YES' : 'NO') +
       ", Can push to default branch #{project.repository.root_ref}?: " + (can_push_to_default ? 'YES' : 'NO') +
       ", User: #{user.username}, User ID: #{user.id}, User state: #{user.state}"
end

Comparison

• (1) Username and password can be used to retrieve a personal access token
• (2) Group only
• (3) Project only
• (4) API only
• (5) Can be used for multiple accounts and on multiple systems
• (6) Acceptable for automation to avoid many project credentials