Arvados

20123-access-token-doc @ 65ceeadb232fd4e5646e7ade0f1d9713af65aafc

I struggled a bit with this explanation. Better suggestions welcome.

Arvados can also be configured to accept provider-issued access tokens as Arvados API tokens. This can be useful for integrating third party applications.

Check the OpenIDConnect section in the default config file for more details and configuration options.

As an aside, wouldn't it be nice if we could link to a specific section of the default config file?

This is the part about accepting access tokens.

        # Accept an OIDC access token as an API token if the OIDC                                  
        # provider's UserInfo endpoint accepts it.                               
        #                                                                              
        # AcceptAccessTokenScope should also be used when enabling       
        # this feature.                                                 
        AcceptAccessToken: false

        # Before accepting an OIDC access token as an API token, first                                         
        # check that it is a JWT whose "scope" value includes this                                                        
        # value. Example: "https://zzzzz.example.com/" (your Arvados                                                        
        # API endpoint).                                                                                                   
        #                                                                                                               
        # If this value is empty and AcceptAccessToken is true, all                                      
        # access tokens will be accepted regardless of scope,                      
        # including non-JWT tokens. This is not recommended.                                                            
        AcceptAccessTokenScope: ""