Permanently enables enforce_abilities_check_for_dependency_proxy
What does this MR do and why?
Dependency proxy authentication now enforces scope checks
https://docs.gitlab.com/update/deprecations/#dependency-proxy-token-scope-enforcement
Changelog: changed
References
- Related to issue #426887 (closed)
- Deprecation notice: https://docs.gitlab.com/update/deprecations/#dependency-proxy-token-scope-enforcement
- Rollout issue: #521193 (closed)
How to set up and validate locally
- Have a group and a user with access to that group ready, e.g. group 33 (Flightjs) and
rootuser on GDK - Personal access tokens, group access tokens, and group deploy tokens with the required scopes -
apiorread_registry+write_registryshould be able to login - Personal access tokens, group access tokens and group deploy tokens without the required scopes - e.g.
read_registryonly - should get a HTTP 403 response
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Radamanthus Batnag