Hi,
I agree that Custos should support access token based authorization for
none-community users, but I think we should prioritize support for web-based
flows for token delegation (i.e., OAuth) rather than manual copy-and-paste of
token codes. GitHub supports both: copy-and-paste "personal access tokens" [1]
and OAuth delegation of access tokens [2]. Box [3], DropBox [4], and Google
Drive [5] also support OAuth access tokens tokens.
In other words, I envision a "share a Box/DropBox/GoogleDrive folder" button in
Custos that does the following:
1. Redirects the user to Box/DropBox/Google using OAuth to get an access token.
("Do you want to share your Google Drive folder with Custos? Custos wants the
ability to read and write files.")
2. Allows the user to share that token with other Custos users. ("Choose the
Custos user(s)/group(s) that you want to share this folder with.")
In this vision, users don't need to actually see the access tokens.
By the way, I had to go back to meeting notes to remind myself that
"none-community users" are "Users without proper authentication credentials but
authorize to use credentials of a user who has credentials to a resource." In
other words, if I understand correctly, in the above scenario, these users have
a Custos login but don't need to have a Box/DropBox/Google login. :)
Regards,
Jim
[1]
https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line
[2] https://developer.github.com/apps/building-oauth-apps/
[3] https://developer.box.com/docs/setting-up-an-oauth-app
[4] https://www.dropbox.com/developers/reference/oauth-guide
[5] https://developers.google.com/drive/api/v3/about-auth
________________________________________
From: Thejaka Amila J Kanewala <[email protected]>
Sent: Saturday, March 2, 2019 11:34 AM
To: [email protected]
Subject: Custos-Feature: Access token based authorisation for none-community
users
Hello,
We should support access token based authorization to access to resources
in Custos for none-community users. This is similar to GitHub access token
authorization --
https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line
.
So I see the following use cases:
1. Community user generating an access token with defined scopes and
handing it over to none-community user and none-community user can use that
token to do operations in the scope.
2. None-community user requesting an access token from a community user by
stating the scopes and community user granting that request.
Thoughts welcome.
Thanks
Thejaka
--
Best Regards,
Thejaka Amila Kanewala, PhD
https://github.com/thejkane/agm
