We have a bunch of secrets with tokens that need rotation on a regular basis, and we've been trying to automate the rotation process to reduce the occurrence of mistakes from manual rotation.
Our DockerHub organization also happens to use SSO for all members.
As of September 16, 2024, this route requires a personal access token (PAT) instead of a password if your organization has SSO enforced.
So we must use PATs for accessing the API, okay, got it.
I went and implemented DockerHub personal access token rotation and was surprised when I ran into the error mentioned by #2438 since it appears the API documentation still has not been updated. But, as described by #2438, when authenticating with a PAT, the create-new-access-token endpoint is not usable, even if the user's PAT has repo:admin scope.
Would it be possible to add a new scope like token:renew or something to allow us to create a new PAT with the same scope as the currently-authenticated one when calling the API? Otherwise, it appears we cannot implement automated PAT rotation.
We have a bunch of secrets with tokens that need rotation on a regular basis, and we've been trying to automate the rotation process to reduce the occurrence of mistakes from manual rotation.
Our DockerHub organization also happens to use SSO for all members.
So we must use PATs for accessing the API, okay, got it.
I went and implemented DockerHub personal access token rotation and was surprised when I ran into the error mentioned by #2438 since it appears the API documentation still has not been updated. But, as described by #2438, when authenticating with a PAT, the create-new-access-token endpoint is not usable, even if the user's PAT has
repo:adminscope.Would it be possible to add a new scope like
token:renewor something to allow us to create a new PAT with the same scope as the currently-authenticated one when calling the API? Otherwise, it appears we cannot implement automated PAT rotation.