summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
1b606b2)
Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>
# The API server receives the username and password, authenticates them with the upstream provider (such as LDAP or PAM), and responds with the @api_client_authorization@ object for the new API token.
# The web application receives the authorization token in the response and uses it to access the API server on the user's behalf.
# The API server receives the username and password, authenticates them with the upstream provider (such as LDAP or PAM), and responds with the @api_client_authorization@ object for the new API token.
# The web application receives the authorization token in the response and uses it to access the API server on the user's behalf.
+h3. Using an OpenID Connect access token
+
+On a cluster that uses OpenID Connect or Google as a login provider, or defers to a LoginCluster that does so, clients may present an access token instead of an Arvados API token.
+# The client obtains an access token from the OpenID Connect provider via some method outside of Arvados.
+# The client presents the access token with an Arvados API request (e.g., request header @Authorization: Bearer xxxxaccesstokenxxxx@).
+# The API server uses the provider's UserInfo endpoint to validate the presented token.
+# If the token is valid, it is cached in the Arvados database and accepted in subsequent API calls for the next 10 minutes.
+
h3. Diagram
!{{site.baseurl}}/images/Session_Establishment.svg!
h3. Diagram
!{{site.baseurl}}/images/Session_Establishment.svg!