vault-github: user is not part of required org about modules

[bpmct]

cc @matifali

[matifali]

Hi @kleberbaum as per Vault docs, this works with any valid GitHub access tokens.
see:

Any valid GitHub access token with the read:org scope for any user belonging to the Vault-configured organization can be used for authentication. If such a token is stolen from a third party service, and the attacker is able to make network calls to Vault, they will be able to log in as the user that generated the access token.

If the GitHub team is part of an organization with SSO enabled, the user will need to authorize the personal access token. Failing to do so for SSO users will result in the personal access token not providing identity information. The token issued by the auth method will only be assigned the default policy.

There is no special configuration needed at Vault or Coder's end. And you can create a GitHub app/OAuth app with scope read:org and configure Coder to use this as external auth,

CODER_EXTERNAL_AUTH_0_ID=primary-github
CODER_EXTERNAL_AUTH_0_TYPE=github
CODER_EXTERNAL_AUTH_0_CLIENT_ID=xxxxxx
CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx

Then setup vault with GitHub auth using this guide.

I have verefied in my setop and I am able to to auth using the app token e.g ghu_XXXXXXX....

[matifali]

@kleberbaum I think you are missing part 3 and 4 of this guide to map users to teams and assign an appropriate vault policy.

[matifali]

Closing in favour of #175