You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
When pelican origin token create is run, there is a large chance for typos to occur when writing out fields that are always the same or standardized. And if done slightly incorrectly, it can take a bit to realize that the token was generated incorrectly. I'd like to reduce the potential for typos by realizing bunch of fields that are always going to be the same and known by pelican such as audience always being https://wlcg.cern.ch/jwt/v1/any.
Also, rather than scopes being needed to be typed out properly (e.g. storage.read:/ storage.modify:/) it would be nice for them to be some sort of flag that can be read out.
Describe the solution you'd like
I'd like it to become something like pelican origin token create --sub <subject> --scope read --scope modify --lifetime <lifetime> --private-key <pkey location>
to be equivalent to: pelican origin token create --audience "https://wlcg.cern.ch/jwt/v1/any" --issuer <origin-address> --sub <subject> --scope "storage.read:/ storage.modify:/" --claim wlcg.ver=1.0 --lifetime <lifetime> --private-key <pkey location>
So the audience is a default, as is the claim. The issuer can be inferred by knowing the localhost and the origin.port. Scope should be created from the scope arguments rather than being typed out.
Additional context
This may just be an extra command (maybe just internal for our own testing) as well:
So may pelican origin token create standard ... or something else.
The text was updated successfully, but these errors were encountered:
Pelican Service:
Is your feature request related to a problem? Please describe.
When
pelican origin token create
is run, there is a large chance for typos to occur when writing out fields that are always the same or standardized. And if done slightly incorrectly, it can take a bit to realize that the token was generated incorrectly. I'd like to reduce the potential for typos by realizing bunch of fields that are always going to be the same and known by pelican such asaudience
always beinghttps://wlcg.cern.ch/jwt/v1/any
.Also, rather than scopes being needed to be typed out properly (e.g.
storage.read:/ storage.modify:/
) it would be nice for them to be some sort of flag that can be read out.Describe the solution you'd like
I'd like it to become something like
pelican origin token create --sub <subject> --scope read --scope modify --lifetime <lifetime> --private-key <pkey location>
to be equivalent to:
pelican origin token create --audience "https://wlcg.cern.ch/jwt/v1/any" --issuer <origin-address> --sub <subject> --scope "storage.read:/ storage.modify:/" --claim wlcg.ver=1.0 --lifetime <lifetime> --private-key <pkey location>
So the
audience
is a default, as is theclaim
. The issuer can be inferred by knowing thelocalhost
and theorigin.port
. Scope should be created from thescope
arguments rather than being typed out.Additional context
This may just be an extra command (maybe just internal for our own testing) as well:
So may
pelican origin token create standard ...
or something else.The text was updated successfully, but these errors were encountered: