Feature #11153

[API] create_token script should allow operator to provide token scopes and opaque comment

Added by Tom Clegg about 4 years ago. Updated over 3 years ago.

Assigned To:
Target version:
Start date:
Due date:
% Done:


Estimated time:
Story points:



Currently the install guide relies on the script/create_superuser_token.rb program in the apiserver package to generate superuser tokens for services like keep-balance and crunch-dispatch-slurm.

This program has some shortcomings:
  • There is no way to specify scopes to limit token powers. Both keep-balance and crunch-dispatch-slurm should be using scoped tokens (e.g., they shouldn't be able to delete collections or create users).
  • There is no way to attach a comment to a token, e.g., to note its intended use.

Proposed solution

Add a comment text column to the api_client_authorizations table and ApiClientAuthorization API responses.

Create a new script script/create_token.rb that takes options
  • --user=zzzzz-tpzed-000000000000000 to specify uuid of target user (default = root)
  • --role=keep-balance to set scopes suitable for keep-balance (see "data manager token" example in source:services/api/test/fixtures/api_client_authorizations.yml)
  • --role=crunch-dispatch to set scopes suitable for crunch-dispatch (details TBD?)
  • --comment="unparsed text" to set comment
  • --reuse to reuse an existing unexpired token with the specified user/scopes/comment, if one exists (if not, create a new one)
  • --token=string to specify the new token (if the given token already exists, confirm that it matches the specified scopes/comment/user)
  • (future?) --expires-at=timestamp to set expiry time

The existing script/create_superuser_token.rb program should continue to work, using the new generic code under the hood (IOW it follows the same code path as script/create_token.rb --reuse [--token=X])

Update install docs accordingly.


#1 Updated by Tom Clegg about 4 years ago

  • Description updated (diff)
  • Category set to Deployment

#2 Updated by Tom Morris over 3 years ago

  • Target version set to Arvados Future Sprints

Also available in: Atom PDF