search

microsoft / team-explorer-everywhere

Team Explorer Everywhere Plugin for Eclipse
Other
303 stars 96 forks source link

TEE 14.0.4+: Auto-revoke previously active PATs before auto-creating a new one #93

Open ramoas opened 8 years ago

ramoas commented 8 years ago

@yacaovsnc , @AlexRukhlin , as we discussed via email (during course of Issue #85 ), if you're still going to automatically create a Personal Access Token (PAT) for TEE 14.0.4+, then, ideally, TEE would auto-revoke any previously active PATs before auto-creating a new one. Thus, a user would never have to manually revoke any orphaned, unexpired ones.

Because a PAT cannot be retrieved from the server after creation, the PAT name (or some other kind of metadata) would have to be sufficient to make the determination of which PATs can be safely auto-revoked. If the PAT name is the only piece of metadata available, then a reliable naming convention must be chosen as part of Issue #92.

Of course, this assumes that there's never a valid use case for multiple unexpired PATs for TEE. One potential important test case to think through: running multiple instances of Eclipse simultaneously from the same machine against the same VSTS account with the same Microsoft account. The Eclipse / TFS workspaces might be the only difference.

davidstaheli commented 8 years ago

Thanks for this, ramoas. Considering in next batch of authentication improvements...