Skip to content

Allow Service accounts to work with GraphQL

Aboobacker MK requested to merge service_account_graphql into master

What does this MR do and why?

Allow personal access tokens created from service accounts to access GraphQL endpoints.

Fixes #436553 (closed)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. Create a service account
  2. Create an access token with that service account
  3. Make an GraphQL API call with that token

validation script


# frozen_string_literal: true

require 'bundler/inline'

gemfile do
  source 'https://rubygems.org'
  gem 'gitlab_client'
end
PAT = '<admin PAT>'
group_id = 33
client = GitlabClient::Rest.new(host: 'https://gdk.test:3000', private_token: PAT)

response = client.post(path: "api/v4/groups/#{group_id}/service_accounts", data: {})
service_ac_id = response.body['id']


response = client.post(path: "api/v4/groups/#{group_id}/service_accounts/#{service_ac_id}/personal_access_tokens",
                       data: { name: 'service_accounts_token', scopes: ['api'] })

service_at =  response.body['token']

query = 'query { issues(assigneeUsernames: ["root"], state: opened) { nodes { title, webUrl } } }'

response = GitlabClient::Graphql.new(host: 'https://gdk.test:3000',private_token: service_at).call(query:)

puts response
Edited by Aboobacker MK

Merge request reports