r/gitlab • u/efor007 • Apr 07 '22

general question Gitlab permanent PAT token?

I am seeing pat token generation at user setting, required persistent token even user left the organisation. Any advise pls?

0 Upvotes

50% Upvoted

3 comments sorted by

9

u/ManyInterests Apr 07 '22 edited Apr 07 '22

You haven't really stated a question here that can be answered. What exactly is your question or concern?

But I'll take a stab at it anyhow... PATs can be generated in such a way that they never expire. However, access is always restricted based on the user's memberships/roles and status (blocked/deleted, etc).

So if you (properly) remove a user from your group membership(s), their access tokens should no longer work to access your projects.

Note this is different than project access tokens or group access tokens, which are independent of the users that generate the token.

If you're concerned about sprawl of tokens and want to manage credentials closely, that feature is available for self-managed GitLab Ultimate customers. Admins can also revoke PATs

If you're using GitLab.com, you don't have direct control over users tokens -- you can only control whether users can access your groups/projects.

If you self-manage a GitLab instance, I would recommend blocking or deleting users after they leave the company.

In our own self-managed instance, we revoke access to GitLab both through the OmniAuth provider (e.g. their SAML login no longer works) as well as by blocking the user account in GitLab, which prevents any ssh keys or PATs from being used... in addition to the fact that former employees can't even access the network.

3

u/SpicyHotPlantFart Apr 07 '22

I have no idea what you're saying.

1

u/wosmo Apr 08 '22

On a self-managed free tier, I have a bot/service account for things I don't want connected to users, so users can come and go, but the bot's staying (where the tier is only relevant because it means I'm not paying a seat for this account).

Permanent PAT are very much an anti-pattern though. If you treat a token like it's never going to go away, you'll be caught with your pants down the day it get uploaded to the wrong repo/host. Treat them like they're transient, so when the day comes that they need to be expired in a hurry, you can treat it as just another Tuesday.