GitHub App Authentication

[jgmitchell257]

Does DependencyTrack support GitHub App Authentication for integrating with GitHub Advisories? I reviewed the documentation for using a GitHub Personal Access Token, but this seems less than ideal in an environment with multiple developers and contractors.

[nscuro]

[...] but this seems less than ideal in an environment with multiple developers and contractors.

Can you elaborate on the specific concerns here, and how app authentication would alleviate them?

[jgmitchell257]

My apologies if I misunderstand the differences between and the purposes of the different authentication methods, but App Authentication is the app authenticating as itself while personal tokens serve a similar authentication purpose but are controlled by the user.

I have a contractor that wants to deploy DependencyTrack (good) but it requires a personal token to configure the GitHub Advisories integration. If that contractor creates and uses their own personal token for this purpose and then leaves, deletes or modifies the token, or something else, we have to remember to change/update the personal token the contractor used. I understand the overall security risk is minimal based on the permissions granted to the PAT, but it is a management risk. Using a token from any user that could leave the organization at any time introduces risk.

Wouldn't using App Authentication resolve this by allowing the app, DependencyTrack, to authenticate as "itself" and not as the user?

According to GitHub's GraphQL documentation, the preferred method for an organization to authenticate is to use a GitHub App. This installation is for an organization and not personal use.