Arvados

Previously, in order for a token to work at a remote cluster, it had to include "GET /arvados/v1/users/current" in scopes.

Now it also has to include "GET /arvados/v1/api_client_authorizations/current".

This allows the remote cluster to obey its scopes and expiry time.

The new behavior only takes effect when both the token-checking cluster and the token-issuing cluster have been upgraded.

17610-remote-token-scopes @ 89fa46a357a5d5fc39721a3ddbe8e857a101eeef -- developer-run-tests: #2448

Tom Clegg wrote:

Previously, in order for a token to work at a remote cluster, it had to include "GET /arvados/v1/users/current" in scopes.

Now it also has to include "GET /arvados/v1/api_client_authorizations/current".

This allows the remote cluster to obey its scopes and expiry time.

The new behavior only takes effect when both the token-checking cluster and the token-issuing cluster have been upgraded.

17610-remote-token-scopes @ 89fa46a357a5d5fc39721a3ddbe8e857a101eeef -- developer-run-tests: #2448

Thanks, this LGTM!