Enable GitHub request for read:user scope in production which allows to see if the user has 2FA enabled

mozilla-iam / iam-project-backlog

DEPRECATED - Archived. Formerly an issue tracker for the IAM project

Mozilla Public License 2.0

2 stars 2 forks source link

Enable GitHub request for read:user scope in production which allows to see if the user has 2FA enabled #141

Closed gdestuynder closed 7 years ago

gdestuynder commented 7 years ago

When enabled this will prompt the users using github for a new authorization: read-only access to your private profile. It needs to be enabled before we can require MFA for GitHub accounts

gdestuynder commented 7 years ago

@gene1wood @hmitsch @m-branson

This is a user-impacting change (GitHub users will see a new request for authorization), so looking for some comments - though I'd vote to just do it.

If you're curious how it looks like just login with github to https://social-ldap-pwless.testrp.security.allizom.org/

mbransn commented 7 years ago

@gdestuynder The impact was light and much as expected, I'm good with implementing.

andrewkrug commented 7 years ago

@gdestuynder how many users do we have that don't have MFA in our ORG?

hmitsch commented 7 years ago

@gdestuynder I'd also go for it. Maybe a short notice on the Slack #announcements channel to inform people about the user-impacting change?

gdestuynder commented 7 years ago

and/or to the iam public mailinglist i'd say

hmitsch commented 7 years ago

@gdestuynder ha, excellent point ... what is the "IAM Public Mailinglist" at this point?

I currently know of these lists:

iam-dev@mozilla.com: Some kind of internal (?) mailing list? By the way, I think we wanted to transition this one to Discourse. Could be an opportunity to merge it with the item mentioned below.
iam@mozilla-community.org: Discourse powered, public list.
iam+internal@mozilla-community.org: Discourse powered list, restricted to people on https://mozillians.org/group/iam-project/
mozilla.dev.identity (Note: I am admin)

gdestuynder commented 7 years ago

it looks like we could merge many of these iam-dev @mozilla.com can redirect to iam+internal@mozilla-community.org mozilla.dev.identity could go to iam@mozilla-community.org or does it have to stay separated?

hmitsch commented 7 years ago

Sorry for hijacking the conversation. I created a separate issue for mailing lists (#149).

gdestuynder commented 7 years ago

lets depend this on #149 and I'll switch over when #149 is closed/done

gdestuynder commented 7 years ago

communication sent to iam@mozilla-community.org

gdestuynder commented 7 years ago

The change has been made (timestamp: this comment)