[go: up one dir, main page]

In admin, prevent ability to create impersonation token for internal user

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

From https://gitlab.com/gitlab-org/manage/import-and-integrate/discussions/-/issues/112#note_2076937556:

As an admin, I can go to the instance settings > Users and I'll see the placeholder users appear in the list. While the possibility to impersonate a placeholder user is deactivated/disabled, there's an option to create an Impersonation Token.

image

Although the API appears to deny internal users https://gitlab.com/gitlab-org/manage/import-and-integrate/discussions/-/issues/112#note_2077999694 we should remove the ability to create an impersonation tokens for internal users as a defence in depth measure.

Edited by 🤖 GitLab Bot 🤖