1

Changesets originating by my build server are marked with the access token used for that. Despite the fact that this doesn't fit into the column width it is just hard to read. I suggest showing the description of the access token instead for better readability.

flag

1 Answer

3

Just to clarify: the pusher does indeed show the description of the access token used. Are you looking at the committer?

We didn't intend for access tokens to be used as the committer name. Just the authentication name. The ui.username for a repository can be anything; here at Fog Creek, we set it to Mortar <thecisystem@fogcreek.com>. We then have it authenticate using an access token.

While substituting the description of an access token for the committer is a reasonable request, committing as an access token is a serious security vulnerability, since it gives anyone with access to your repository either global read or (worse) write permission. So this is almost assuredly not what you want to do.

That said, we'll add support for showing the description of an access token, rather than its GUID, in a later release of Kiln. Just understand that you still have serious security problems if you're using access tokens this way.

link|flag
I added a screenshot. However, I'm wondering why my name appears in the Push line. – Uwe Raabe Aug 14 2011 at 21:59
Would it be better to set the [ui]username to something meaningful and only set the [auth]kiln.username to the access token? – Uwe Raabe Aug 14 2011 at 22:19
That's what we intended, yes. For example, our internal CI tool is called Mortar, so we have [ui]username=Mortar, but its auth username is the GUID. Your request is reasonable; we just didn't think of people doing that. It ends up being a classic case of, "Super-simple request, annoying to implement," so it'll land in a future Kiln, but it'll probably be awhile. – Benjamin Pollack Aug 15 2011 at 20:40
I'd note, too, you probably don't want your GUIDs in the username anyway, since that amounts to giving global write access to anyone who can read your history. – Benjamin Pollack Aug 15 2011 at 20:40
Regarding to this security issue: is it safe to delete an already used access token and replace it with another one? – Uwe Raabe Aug 16 2011 at 7:12

Your Answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.