Bug #17610: [API] Federated token scopes are not obeyed if scopes include "GET .../users/current" - Arvados

Bug #17610

[API] Federated token scopes are not obeyed if scopes include "GET .../users/current"

Added by Tom Clegg 7 months ago. Updated 7 months ago.

Status:

Resolved

Priority:

Normal

Assigned To:

Tom Clegg

Category:

Target version:

2021-05-12 sprint

Start date:

05/03/2021

Due date:

% Done:

100%

Estimated time:

(Total: 0.00 h)

Story points:

Release:

Arvados 2.2.0

Release relationship:

Auto

Subtasks

Related issues

Associated revisions

Revision 6e8530d7
Added by Tom Clegg 7 months ago

Merge branch '17610-remote-token-scopes'

fixes #17610

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

History

#1 Updated by Tom Clegg 7 months ago

Target version set to 2021-05-12 sprint
Assigned To set to Tom Clegg
Status changed from New to In Progress

#2 Updated by Tom Clegg 7 months ago

Previously, in order for a token to work at a remote cluster, it had to include "GET /arvados/v1/users/current" in scopes.

Now it also has to include "GET /arvados/v1/api_client_authorizations/current".

This allows the remote cluster to obey its scopes and expiry time.

The new behavior only takes effect when both the token-checking cluster and the token-issuing cluster have been upgraded.

17610-remote-token-scopes @ 89fa46a357a5d5fc39721a3ddbe8e857a101eeef -- https://ci.arvados.org/view/Developer/job/developer-run-tests/2448/

#3 Updated by Ward Vandewege 7 months ago

Blocks Story #17512: Release Arvados 2.2 added

#4 Updated by Ward Vandewege 7 months ago

Tom Clegg wrote:

Previously, in order for a token to work at a remote cluster, it had to include "GET /arvados/v1/users/current" in scopes.

Now it also has to include "GET /arvados/v1/api_client_authorizations/current".

This allows the remote cluster to obey its scopes and expiry time.

The new behavior only takes effect when both the token-checking cluster and the token-issuing cluster have been upgraded.

17610-remote-token-scopes @ 89fa46a357a5d5fc39721a3ddbe8e857a101eeef -- https://ci.arvados.org/view/Developer/job/developer-run-tests/2448/

Thanks, this LGTM!