Feature #17468

[controller] Skip repetitive OIDC UserInfo calls if access token validates as an ID token

Added by Tom Clegg 6 months ago. Updated 3 months ago.

Status:
New
Priority:
Normal
Assigned To:
-
Category:
-
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Story points:
1.0

Description

When we accept an OIDC access token in lieu of an Arvados token for an API call, if the OIDC provider is configured to issue access tokens that are signed JWTs with email/name/exp values, the call we make to the UserInfo API is redundant.

We should check whether the incoming token is a JWT, passes validation, and has the exp/name/email claims we need, and if so
  • skip the call to UserInfo
  • when caching the token in memory/postgres, use the token's embedded expiry time instead of our default TTL

Related issues

Related to Arvados - Feature #16669: Accept OpenID Connect access tokenResolved09/24/2020

History

#1 Updated by Tom Clegg 6 months ago

#2 Updated by Tom Clegg 6 months ago

  • Description updated (diff)

#3 Updated by Tom Clegg 6 months ago

  • Story points set to 1.0

#4 Updated by Peter Amstutz 3 months ago

  • Target version deleted (Arvados Future Sprints)

Also available in: Atom PDF