Open BenGalewsky opened 1 year ago
It looks like we can't get a secret signing key for CERN JWTs - this is the preferred solution to use this library and get the public key https://github.com/scitokens/scitokens/blob/master/src/scitokens/utils/keycache.py#L224-L313
As a user of the Coffea-Casa environment I want to be able to authenticate to ServiceX automatically so I can use the service with no additional setup
Frontend Changes
In the current version of Coffea-Casa, users receive a token in their environment that is issued from the CMS issuer.
The ServiceX client should search for the presence of a bearer token utilizing the WLCG bearer token discovery protocol.
If a token is discovered in step (1), then the token should be provided in the HTTP authorization to ServiceX.
Web Service Changes
On the server side, if a JWT is present in the Authorization header, then:
Assumptions