Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Origin Authfile and Scitokens file to only accept Authorized Caches #1719

Open
turetske opened this issue Nov 8, 2024 · 1 comment
Assignees
Labels
origin Issue relating to the origin component
Milestone

Comments

@turetske
Copy link
Collaborator

turetske commented Nov 8, 2024

When a cache tries to get information from an origin after being redirected there from a Director. It needs to include and pass a 'cacheToken' to the origin.

The origin then needs to use this tokens in to authorize access to the origin.

Basically, for all capabilities (with one notable exception described below), the origin should require a cache token as well as any other issued token to access data.

For example: public reads access will need to be in the scitokens file behind the cache token, whereas writes access will require both the cache token AND the the normal access tokens.

The one major exception is if the origin allows direct reads. In which case reads will be allowed by anyone with access.

@turetske turetske added the origin Issue relating to the origin component label Nov 8, 2024
@turetske turetske self-assigned this Nov 8, 2024
@turetske
Copy link
Collaborator Author

turetske commented Nov 8, 2024

Note, this will require multiple token support to be in xrd scitokens and tokens to be issued for a cache before it can be implemented.

@turetske turetske added this to the v7.13.0 milestone Dec 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
origin Issue relating to the origin component
Projects
None yet
Development

No branches or pull requests

1 participant