The Wayback Machine - https://web.archive.org/web/20210803071932/https://github.com/github/docs/issues/1236
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is it possible to migrate an OAuth app to Github app without asking users to re-authenticate? #1236

Open
jgimenez opened this issue Nov 10, 2020 · 7 comments

Comments

@jgimenez
Copy link

@jgimenez jgimenez commented Nov 10, 2020

What article on docs.github.com is affected?

https://docs.github.com/en/free-pro-team@latest/developers/apps/migrating-oauth-apps-to-github-apps

What part(s) of the article would you like to see updated?

  • The migration guide explains how to create a new Github app to replace your old OAuth app
  • It's not clear to me if there's a way to move the users to the new app, so they don't need to re-authenticate (I guess there is not, but I think should be indicated)
  • It's not clear to me whether I should delete the old OAuth app. It's confusing to me, because it says we should encourage users to de-authorize the old app, but if the old app is no longer in use, it would make more sense to me to delete the app, so its credentials can not be abused in any way and all authorizations are revoked.
@welcome
Copy link

@welcome welcome bot commented Nov 10, 2020

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

@lucascosti
Copy link
Contributor

@lucascosti lucascosti commented Dec 10, 2020

👋 @jgimenez 🙂 To answer your main question:

It's not clear to me if there's a way to move the users to the new app, so they don't need to re-authenticate (I guess there is not, but I think should be indicated)

IIUC, no, this isn't possible. The new app is essentially a distinct installation, so it's access must be authenticated by the user.

It's not clear to me whether I should delete the old OAuth app. It's confusing to me, because it says we should encourage users to de-authorize the old app, but if the old app is no longer in use, it would make more sense to me to delete the app, so its credentials can not be abused in any way and all authorizations are revoked.

I think this was originally written implying that some users might still be using the old app. If all your users have transitioned off the old app, or if you're happy to delete the old app even though it might still have active users, then deleting the app makes sense 👍

We can definitely update the doc to be more clear about both these points. I'll open this issue up for anyone to take on 🙂

@prsmahajan
Copy link

@prsmahajan prsmahajan commented Jun 10, 2021

Hi, I would like to work on this issue, can anyone suggest me to get started?

@janiceilene
Copy link
Collaborator

@janiceilene janiceilene commented Jun 11, 2021

👋 @prsmahajan You're welcome to open a PR following the plan outlined in #1236 (comment). Let us know if you have any additional questions!

@prsmahajan
Copy link

@prsmahajan prsmahajan commented Jun 13, 2021

What is the issue @janiceilene ?

@github github deleted a comment Jun 14, 2021
@github github deleted a comment Jun 14, 2021
@github github deleted a comment Jun 14, 2021
@janiceilene
Copy link
Collaborator

@janiceilene janiceilene commented Jun 14, 2021

What is the issue @janiceilene ?

I'm sorry @prsmahajan, I'm not sure what you're question is. If you'd like to work on this issue, you're welcome to open a pull request following the instructions given in this comment.

Please let me know if there's additional information or clarification I can give 💛

@123MwanjeMike
Copy link
Contributor

@123MwanjeMike 123MwanjeMike commented Jul 10, 2021

I think this was originally written implying that some users might still be using the old app. If all your users have transitioned off the old app, or if you're happy to delete the old app even though it might still have active users, then deleting the app makes sense +1

We can definitely update the doc to be more clear about both these points. I'll open this issue up for anyone to take on slightly_smiling_face

I failed to find an issue for the modifications suggested so I opened this issue and made changes in the linked pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment