Repository navigation
Explain that client credentials cannot publish to SSO accounts - #868
Conversation
|
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified Files
|
| ## Unreleased | ||
|
|
||
| - Publishing to a Posit Connect Cloud account that requires single sign-on (SSO) with | ||
| service account credentials now explains that SSO blocks the publish, instead of |
There was a problem hiding this comment.
It seems like that's how we refer to these client credentials in rsconnect-python ("service account credential") 🤔 for example,
Lines 57 to 59 in e6cdd5f
But I think the term is a bit misleading, since these credentials act as the user who created them. I'll change the new wording to "client credentials" and update the existing references in a follow-up
There was a problem hiding this comment.
I'll merge #869 into this branch if you agree with the idea 🙂
* docs: call Connect Cloud client ID and secret client credentials * docs: drop changelog entry for the client credentials wording
…dentials-error # Conflicts: # docs/CHANGELOG.md
karawoo
left a comment
karawoo
left a comment
There was a problem hiding this comment.
Should we support this for content migrate-to-connect-cloud also?
that's a good call, thanks! We should, and I'll create a follow-up PR for that. |
Intent
When an account requires single sign-on (SSO), Posit Connect Cloud does not grant publish permission to tokens without a recent SSO login. Client credentials tokens never have one. Publishing with client credentials to such an account now reports this, instead of a generic missing-permission error. The check uses the
sso_enabledandrolefields thatGET /v1/accountsalready returns.Type of Change
Approach
When an account is visible but lacks
content:create, and the saved credential is a service account (client ID and secret),ConnectCloudClient._publishablecheckssso_enabledand whetherroleis owner, admin, or publisher. If both hold, it raises an error saying the account requires SSO. Other cases keep the existing message.ConnectCloudAccountgains the optionalroleandsso_enabledkeys.Automated Tests
Added a test in
tests/test_connect_cloud.py: a service account on an SSO account with the publisher role gets the SSO message; the viewer role keeps the existing message; an interactive login does not get the service-account message.Directions for Reviewers
Run
uv run --group test pytest -q tests/test_connect_cloud.py.Checklist
rsconnect-python-tests-at-nightworkflow in Connect against this feature branch.