betodealmeida commented on PR #43309: URL: https://github.com/apache/superset/pull/43309#issuecomment-5371579716
I think in general OAuth2 is always better than a service account. With a service account, the `subject` field lowers permissions, so if you forget to enable user impersonation everything continues to work and people get access to everything in the org. But with OAuth2 you start with zero perms and the personal token raises permissions, so if you forget to enable user impersonation things break and users can't access anything. One breaks silently and with a big blast radius; the other breaks loudly and has zero blast radius. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
