API authentication without using basic auth about atc

[concourse-bot]

Hi there!

We use Pivotal Tracker to provide visibility into what our team is working on. A story for this issue has been automatically created.

The current status is as follows:

• #111244370 API authentication without using basic auth

This comment, as well as the labels on the issue, will be automatically updated as the status in Tracker changes.

[xoebus]

Yeah, we're thinking about this.

Out of interest, what kind of script would you like to write?

[mmb]

Our original requirement was to send notifications to our PM when a job had failed a certain number of consecutive times.

We were able to get recent build statuses unauthenticated but after #41 that won't work any more.

If there are any features planned for events/notifications that would satisfy our requirements too.

[rainmaker]

@xoebus we have a similar app on CF Release Engineering, which sends us slack notifications when our builds fail. We would also like to have this feature so we can turn off basic auth. I was hoping to use https://developer.github.com/v3/oauth_authorizations/#get-or-create-an-authorization-for-a-specific-app to create a token on behalf of concourse but am open to another solution as well. Will follow this issue to see what happens. Thanks!

[vito]

This will be needed for concourse/concourse#331 - I'm thinking it could just be implemented as CRUD of access tokens via the API. The tokens would have the same permissions as the token used to create them. They could then be embedded in the URL as ?access_token=<token>, to support hooks (the aforementioned issue). It could also be added to Fly as a flag.

[aclevername]

Any update on this? +1

[vito]

Moved to concourse/concourse#1116