Hi Jim, I am 100% with you. We should prioritize the web workflow first. Sorry about the terminology "none-community users" :-). We should come up with proper/sensible terminology since I came up with these terms in a hurry.
Thank you. Best Regards Thejaka On Mon, Mar 4, 2019 at 12:09 PM Basney, Jim <[email protected]> wrote: > Hi, > > I agree that Custos should support access token based authorization for > none-community users, but I think we should prioritize support for > web-based flows for token delegation (i.e., OAuth) rather than manual > copy-and-paste of token codes. GitHub supports both: copy-and-paste > "personal access tokens" [1] and OAuth delegation of access tokens [2]. Box > [3], DropBox [4], and Google Drive [5] also support OAuth access tokens > tokens. > > In other words, I envision a "share a Box/DropBox/GoogleDrive folder" > button in Custos that does the following: > 1. Redirects the user to Box/DropBox/Google using OAuth to get an access > token. ("Do you want to share your Google Drive folder with Custos? Custos > wants the ability to read and write files.") > 2. Allows the user to share that token with other Custos users. ("Choose > the Custos user(s)/group(s) that you want to share this folder with.") > > In this vision, users don't need to actually see the access tokens. > > By the way, I had to go back to meeting notes to remind myself that > "none-community users" are "Users without proper authentication credentials > but authorize to use credentials of a user who has credentials to a > resource." In other words, if I understand correctly, in the above > scenario, these users have a Custos login but don't need to have a > Box/DropBox/Google login. :) > > Regards, > Jim > > [1] > https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line > [2] https://developer.github.com/apps/building-oauth-apps/ > [3] https://developer.box.com/docs/setting-up-an-oauth-app > [4] https://www.dropbox.com/developers/reference/oauth-guide > [5] https://developers.google.com/drive/api/v3/about-auth > ________________________________________ > From: Thejaka Amila J Kanewala <[email protected]> > Sent: Saturday, March 2, 2019 11:34 AM > To: [email protected] > Subject: Custos-Feature: Access token based authorisation for > none-community users > > Hello, > > We should support access token based authorization to access to resources > in Custos for none-community users. This is similar to GitHub access token > authorization -- > > https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line > . > > So I see the following use cases: > 1. Community user generating an access token with defined scopes and > handing it over to none-community user and none-community user can use that > token to do operations in the scope. > 2. None-community user requesting an access token from a community user by > stating the scopes and community user granting that request. > > Thoughts welcome. > > Thanks > Thejaka > > -- > Best Regards, > Thejaka Amila Kanewala, PhD > https://github.com/thejkane/agm > -- Best Regards, Thejaka Amila Kanewala, PhD https://github.com/thejkane/agm
