Support Oauth2 Client Credentials Grant Type

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Add OAuth2 Client Credentials Grant Type Support

Background

GitLab currently supports various OAuth2 grant types but lacks support for the Client Credentials grant type, which is essential for secure Machine-to-Machine (M2M) communication.

Current Limitations

1. Group/Project Access Tokens

   • Requires manual out-of-band rotation process

2. Resource Owner OAuth2 Grant

   • Requires creating additional GitLab accounts
   • Results in unnecessary license usage
   • Machine accounts are subject to user requirements (password policies, MFA)

Proposed Solution

Implement OAuth2 Client Credentials grant type support by:

1. Leveraging existing Applications feature in GitLab
2. Adding Client Credentials grant type support as specified in OAuth2 RFC

Benefits

• Improved security for M2M communication
• Reduced attack surface area (tokens not sent with every request)
• Natural pre-authorization process through existing application scope selection
• No extraneous user accounts required
• Better suited for first-party trusted applications

Technical Details

• Integration with existing OAuth2 implementation
• Support for Client ID and Secret management
• Utilize current Applications interface for scope management
• Maintain compatibility with existing OAuth2 grant types

References

• Current GitLab OAuth2 Documentation
• OAuth2 RFC - Client Credentials Grant