Skip to content
This repository has been archived by the owner on May 17, 2024. It is now read-only.

Add support for JWT tokens #40

Closed
uniqueg opened this issue Sep 23, 2019 · 2 comments · Fixed by #42
Closed

Add support for JWT tokens #40

uniqueg opened this issue Sep 23, 2019 · 2 comments · Fixed by #42
Assignees
Milestone

Comments

@uniqueg
Copy link
Member

uniqueg commented Sep 23, 2019

Is your feature request related to a problem? Please describe.

In a production setting, TES and DRS service instances are very likely going to require specific permissions for the services to be used. Apart from security, services may make use of user information to provide specific offers/rates etc. that, in the future, TEStribute could make use of. In accordance with discussions withing ELIXIR and GA4GH, the GA4GH Cloud API services are likely going to use/support token-based authorization via JSON Web Tokens (JWT). TEStribute should thus support the parsing and validation of JWTs and attach validated tokens to its service calls to DRS and TES instances.

Describe the solution you'd like
A JWT parser and validator (either by UserInfo endpoint or via the identity provider's public key sets) is already implemented, and its use can be configured via the app config. If required, an unauthorized call to the TEStribute API service will result in a 401/Unauthorized response. If validated, JWTs should be attached to service calls to DRS and TES (consider #39). Moreover, a corresponding parameter should be available in the CLI (#30).

Describe alternatives you've considered
Currently not considered.

Additional context
N/A

@uniqueg uniqueg added the medium label Sep 23, 2019
@uniqueg uniqueg added this to the release 0.1.0 milestone Sep 23, 2019
@uniqueg
Copy link
Member Author

uniqueg commented Sep 26, 2019

The TES and DRS clients need to consume the JWT and decorate outbound calls with it when it is provided.

That should be possible with something like this:

http_client.set_api_key(
    host=None,
    api_key=f"Bearer {jwt}",
    param_name="Authorization",
    param_in="header"
)

given that jwt is the parameter at which the clients accept the token from the caller when instantiating the client like so (for DRS-cli):

client = drs_client.Client(
    swagger_path="https//path.to/swagger.json",
    jwt="ThEt0kEn"
)

@uniqueg
Copy link
Member Author

uniqueg commented Sep 26, 2019

The necessary code changes to the TES and DRS clients have been made and tested in elixir-cloud-aai/TES-cli/pull/13 and elixir-cloud-aai/DRS-cli-legacy/pull/8, respectively.

@uniqueg uniqueg self-assigned this Sep 26, 2019
uniqueg added a commit that referenced this issue Nov 1, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant