Bug #13368

[API] Add "authorizations" table

Added by Tom Clegg over 3 years ago. Updated almost 2 years ago.

Assigned To:
Target version:
Start date:
Due date:
% Done:


Estimated time:
Story points:


The login process needs to unambiguously map an authentication result ("caller authenticated as ") to a user account ("issue a token for zzzzz-tpzed-exampleuseruuid"). In the general case this is a many-to-many relationship. Currently the "identity_url" field in the users table only permits a one-to-one mapping.

A separate table should express the many-to-many relationship in order to support these situations:
  • a person has multiple Google accounts, all of which should provide access to the same Arvados account
  • a person can access multiple Arvados accounts without making additional Google accounts.
"authorizations" table:
  • uuid
  • user_uuid
  • method -- google, ldap, etc.
  • authenticator_id -- an identifier unique to this method
  • unique (user_uuid, method, authenticator_id)

Initially method will always be SSO provider (method="proxy", authenticator_id="https://sso.example.com/user/$sso_provided_uuid"?). When authentication mechanisms are implemented in Arvados proper, they will get their own methods.

Related issues

Related to Arvados - Feature #12626: [API] Merge user accounts (redirect=true case)Resolved05/03/2018


#1 Updated by Tom Clegg over 3 years ago

  • Description updated (diff)

#2 Updated by Tom Clegg over 3 years ago

  • Related to Feature #12626: [API] Merge user accounts (redirect=true case) added

#3 Updated by Tom Morris over 3 years ago

  • Target version set to To Be Groomed

#4 Updated by Peter Amstutz almost 2 years ago

  • Target version deleted (To Be Groomed)
  • Status changed from New to Closed

Also available in: Atom PDF