<!-- This issue template can be used as a great starting point for feature requests. The section "Release notes" can be used as a summary of the feature and is also required if you want to have your release post blog MR auto generated using the release post item generator: https://about.gitlab.com/handbook/marketing/blog/release-posts/#release-post-item-generator. The remaining sections are the backbone for every feature in GitLab. The goal of this template is brevity for quick/smaller iterations. For a more thorough list of considerations for larger features or feature sets, you can leverage the detailed [feature proposal](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Feature%20proposal%20-%20detailed.md). --> ### Release notes GitLab SCIM tokens will be prefixed with `glsoat-` to enable secret detection if this credential is leaked. ### Context GitLab has been adding prefixes to many of its authentication tokens, see https://gitlab.com/groups/gitlab-org/-/epics/8923+ and https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/482+ We should prefix SCIM tokens. - An instance can have a SCIM token, and each EE Group can have one. - There are group level SCIM endpoints, internal Group SCIM endpoints, and internal instance level SCIM endpoints. - https://docs.gitlab.com/ee/api/scim.html - _"The GitLab SCIM API manages SCIM identities within groups and provides the /groups/:groups_id/scim/identities and /groups/:groups_id/scim/:uid endpoints. The base URL is <http|https>://<GitLab host>/api/v4."_ - https://docs.gitlab.com/ee/development/internal_api/index.html#group-scim-api - _"The group SCIM API partially implements the RFC7644 protocol. This API provides the /groups/:group_path/Users and /groups/:group_path/Users/:id endpoints. The base URL is <http|https>://<GitLab host>/api/scim/v2"_ - https://docs.gitlab.com/ee/development/internal_api/index.html#instance-scim-api - _"This API provides the /application/Users and /application/Users/:id endpoints. The base URL is <http|https>://<GitLab host>/api/scim/v2."_ So updating the model to have a prefix would cover all three of those endpoints. ### Problem to solve - SCIM tokens live indefinitely - SCIM tokens are used to authorize requests against the GitLab API - If leaked, SCIM tokens allow read and update of users which can, for example, lead to account takeover. (Update the user's email from `original` to `attacker@example.com`, do a password reset, and you're in). - SCIM tokens are 20 random characters, so are difficult to detect ### Proposal - [ ] Decide on a prefix, e.g. `glsoat-`, for the `ScimOauthAccessToken#token` authentication field - I validated none of GitLab's existing prefixes use this; `gloas` is similar though. - The current value is `Devise.friendly_token` which is `[a-zA-Z0-9-_]{20}`: - any downstream systems (i.e. not GitLab) accepting those characters should be able to accept `glsoat-`; - the only thing that _might_ break is if something downstream expects only 20 chars, whereas it'll now be 27 total. - [ ] Consider whether group SCIM tokens should have a different prefix to instance SCIM tokens - [ ] Follow the pattern established when updating other tokens - https://gitlab.com/groups/gitlab-org/-/epics/8923#tokens-without-prefix - https://docs.gitlab.com/ee/development/secure_coding_guidelines.html#token-prefixes **Downstream systems** - https://help.trelica.com/hc/en-us/articles/7739222824733-GitLab - https://jumpcloud.com/support/integrate-with-gitlab#configuring-the-identity-management-integration - Likely many others, integrating with our SCIM APIs ### Intended users <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later. Personas are described at https://about.gitlab.com/handbook/product/personas/ * [Parker (Product Manager)](https://about.gitlab.com/handbook/product/personas/#parker-product-manager) * [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/product/personas/#delaney-development-team-lead) * [Presley (Product Designer)](https://about.gitlab.com/handbook/product/personas/#presley-product-designer) * [Sasha (Software Developer)](https://about.gitlab.com/handbook/product/personas/#sasha-software-developer) * [Priyanka (Platform Engineer)](https://about.gitlab.com/handbook/product/personas/#priyanka-platform-engineer) * [Sidney (Systems Administrator)](https://about.gitlab.com/handbook/product/personas/#sidney-systems-administrator) * [Rachel (Release Manager)](https://about.gitlab.com/handbook/product/personas/#rachel-release-manager) * [Simone (Software Engineer in Test)](https://about.gitlab.com/handbook/product/personas/#simone-software-engineer-in-test) * [Allison (Application Ops)](https://about.gitlab.com/handbook/product/personas/#allison-application-ops) * [Ingrid (Infrastructure Operator)](https://about.gitlab.com/handbook/product/personas/#ingrid-infrastructure-operator) * [Dakota (Application Development Director)](https://about.gitlab.com/handbook/product/personas/#dakota-application-development-director) * [Dana (Data Analyst)](https://about.gitlab.com/handbook/product/personas/#dana-data-analyst) * [Eddie (Content Editor)](https://about.gitlab.com/handbook/product/personas/#eddie-content-editor) * [Amy (Application Security Engineer)](https://about.gitlab.com/handbook/product/personas/#amy-application-security-engineer) * [Isaac (Infrastructure Engineer)](https://about.gitlab.com/handbook/product/personas/#isaac-infrastructure-security-engineer) * [Alex (Security Operations Engineer)](https://about.gitlab.com/handbook/product/personas/#alex-security-operations-engineer) * [Cameron (Compliance Manager)](https://about.gitlab.com/handbook/product/personas/#cameron-compliance-manager) --> ### Feature Usage Metrics <!-- How are you going to track usage of this feature? Think about user behavior and their interaction with the product. What indicates someone is getting value from it? Explore (../../doc/development/internal_analytics/internal_event_instrumentation/quick_start.md) for a guide. --> ### Does this feature require an audit event? <!--- Checkout these docs to know more https://docs.gitlab.com/ee/development/audit_event_guide/#what-are-audit-events https://docs.gitlab.com/ee/administration/audit_events.html ---> <!-- Label reminders Use the following resources to find the appropriate labels: - Use only one tier label choosing the lowest tier this is intended for - https://gitlab.com/gitlab-org/gitlab/-/labels - https://about.gitlab.com/handbook/product/categories/features/ --> <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->