[go: up one dir, main page]

Skip to content

In admin, prevent ability to create impersonation token for internal user

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

From https://gitlab.com/gitlab-org/manage/import-and-integrate/discussions/-/issues/112#note_2076937556:

As an admin, I can go to the instance settings > Users and I'll see the placeholder users appear in the list. While the possibility to impersonate a placeholder user is deactivated/disabled, there's an option to create an Impersonation Token.

image

Although the API appears to deny internal users https://gitlab.com/gitlab-org/manage/import-and-integrate/discussions/-/issues/112#note_2077999694 we should remove the ability to create an impersonation tokens for internal users as a defence in depth measure.

Edited by 🤖 GitLab Bot 🤖