diff options
| author | Kamil Trzcinski <ayufan@ayufan.eu> | 2016-07-19 23:33:42 +0200 |
|---|---|---|
| committer | Kamil Trzcinski <ayufan@ayufan.eu> | 2016-07-19 23:33:42 +0200 |
| commit | bf9db45a1dc4d8269fa68dc27dac6667c89ffda8 (patch) | |
| tree | 813d6c8151c156d186cdf4e3420f42260d206434 /doc/api/oauth2.md | |
| parent | 0aedeb5637932fa827e42be7441e9c967049dd1d (diff) | |
| parent | b9ed9d658ad447a64d58b2040849a7cc0e698287 (diff) | |
| download | gitlab-ce-bf9db45a1dc4d8269fa68dc27dac6667c89ffda8.tar.gz | |
Merge remote-tracking branch 'origin/master' into ci-predefined-variables
Diffstat (limited to 'doc/api/oauth2.md')
| -rw-r--r-- | doc/api/oauth2.md | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/doc/api/oauth2.md b/doc/api/oauth2.md index d416a826f79..31902e145f6 100644 --- a/doc/api/oauth2.md +++ b/doc/api/oauth2.md @@ -65,6 +65,13 @@ curl -H "Authorization: Bearer OAUTH-TOKEN" https://localhost:3000/api/v3/user ## Resource Owner Password Credentials +## Deprecation Notice + +1. Starting in GitLab 9.0, the Resource Owner Password Credentials will be *disabled* for users with two-factor authentication turned on. +2. These users can access the API using [personal access tokens] instead. + +--- + In this flow, a token is requested in exchange for the resource owner credentials (username and password). The credentials should only be used when there is a high degree of trust between the resource owner and the client (e.g. the client is part of the device operating system or a highly privileged application), and when other authorization grant types are not @@ -100,3 +107,5 @@ client = OAuth2::Client.new('the_client_id', 'the_client_secret', :site => "http access_token = client.password.get_token('user@example.com', 'sekret') puts access_token.token ``` + +[personal access tokens]: ./README.md#personal-access-tokens |