17704: Check scope before accepting OIDC access tokens.

[arvados.git] / lib / config / config.default.yml

diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml
index 54deb34da3ad9e004fdce9987ed075cf20a6a89e..d00c7d9ade226cf56f11fedee4c83aa44f01f997 100644 (file)
--- a/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@ -633,6 +633,17 @@ Clusters:
         AuthenticationRequestParameters:
           SAMPLE: ""
 
+        # Accept an OIDC access token as an API token if it is a JWT
+        # whose "scope" value includes this scope. To accept any
+        # access token (even if it's not a JWT), use "*". To disable
+        # this feature, use the empty string "".
+        #
+        # If an incoming token's scope is satisfactory, Arvados
+        # verifies the token is valid by presenting it at the OIDC
+        # provider's UserInfo endpoint. (Signature and expiry are not
+        # checked separately.) Valid tokens are cached for 10 minutes.
+        AcceptAccessTokenScope: ""
+
       PAM:
         # (Experimental) Use PAM to authenticate users.
         Enable: false