Skip to content

Disable PAT creation when FIPS is enabled

Drew Blessing requested to merge dblessing_disallow_pat_creation_fips into master

What does this MR do and why?

Describe in detail what your merge request does and why.

Part 2 of #351350 (closed). Part 1 MR was !97299 (merged).

This MR prevents the creation of new Personal Access Tokens, Project Access Tokens, Group Access Tokens, and Impersonation Tokens and removes the relevant navigation items.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Non-FIPS FIPS-mode enabled Note
Screen_Shot_2022-10-03_at_9.19.53_AM Screen_Shot_2022-10-03_at_9.30.05_AM User profile: 'Access Tokens' is removed from navigation and URL produces 404
Screen_Shot_2022-10-03_at_9.21.34_AM Screen_Shot_2022-10-03_at_9.30.19_AM Admin area -> User -> Impersonation Tokens: Tab is removed and URL produces 404
Screen_Shot_2022-10-03_at_9.22.39_AM Screen_Shot_2022-10-03_at_9.29.55_AM Group settings: 'Access Tokens' is removed from navigation and URL produces 404
Screen_Shot_2022-10-03_at_9.23.45_AM Screen_Shot_2022-10-03_at_9.29.37_AM Project settings: 'Access Tokens' is removed from navigation and URL produces 404

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. Enable FIPS mode in GDK: FIPS_MODE=1 gdk restart
  2. Navigate to the locations mentioned in the screenshots table.
  3. Observe that the menu items are not available.
  4. You may also manually navigate to a relevant URL and note that it 404's.

URL examples:

  • <group>/<project>/-/settings/access_tokens
  • groups/<group>/-/settings/access_tokens
  • /-/profile/personal_access_tokens
  • /admin/users/<username>/impersonation_tokens.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Drew Blessing

Merge request reports