diff options
| author | Robert Speicher <robert@gitlab.com> | 2016-08-19 02:00:54 +0300 |
|---|---|---|
| committer | Ruben Davila <rdavila84@gmail.com> | 2016-08-19 02:55:57 +0300 |
| commit | 220755f52ad6e3fdfa43c62e0a4a4051721246dc (patch) | |
| tree | af4ae1457212df827dc142fef4f1f0877be69888 /doc | |
| parent | 0ff39331a2fa486ea53968aa85e763d6c1b2c5dd (diff) | |
Merge branch '2fa-api-check' into 'master'
2FA checks for API workflows
## What does this MR do?
It adds a check to the API `/session` endpoint that will deny authentication requests to users that have 2FA enabled. In the error message it will instruct them to use a Personal Access Token instead.
It adds a check to the `/oauth/token` endpoint, when `grant_type: 'password'` is used, so that no OAuth2 access token can be generated if the user has 2FA enabled. This endpoint should not be used by OAuth applications, anyway. OAuth apps should follow the flow of redirecting the user to GitLab, where 2FA access restrictions apply and logging them in there. Once successfully authenticated, the OAuth token is passed to the client.
## Why was this MR needed?
No 2FA check on API endpoints.
## What are the relevant issue numbers?
Fixes #2979
See merge request !5820
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/api/oauth2.md | 2 | ||||
| -rw-r--r-- | doc/api/session.md | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/doc/api/oauth2.md b/doc/api/oauth2.md index 16ef79617c0..0b0fc39ec7e 100644 --- a/doc/api/oauth2.md +++ b/doc/api/oauth2.md @@ -90,7 +90,7 @@ curl --header "Authorization: Bearer OAUTH-TOKEN" https://localhost:3000/api/v3/ ## Deprecation Notice -1. Starting in GitLab 9.0, the Resource Owner Password Credentials will be *disabled* for users with two-factor authentication turned on. +1. Starting in GitLab 8.11, the Resource Owner Password Credentials has been *disabled* for users with two-factor authentication turned on. 2. These users can access the API using [personal access tokens] instead. --- diff --git a/doc/api/session.md b/doc/api/session.md index 9076c48b899..f776424023e 100644 --- a/doc/api/session.md +++ b/doc/api/session.md @@ -2,7 +2,7 @@ ## Deprecation Notice -1. Starting in GitLab 9.0, this feature will be *disabled* for users with two-factor authentication turned on. +1. Starting in GitLab 8.11, this feature has been *disabled* for users with two-factor authentication turned on. 2. These users can access the API using [personal access tokens] instead. --- |