Skip to content

feat: Adding JWT support alongside X509 auth #248

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: devel
Choose a base branch
from

Conversation

Robin-Van-de-Merghel
Copy link
Contributor

Added BaseConnectedRequest to support multiple auth mecanism. Derived from it are two classes:

  • TokenBasedRequest
  • X509BasedRequest

You can use either of these.

The code still work as previously with a X509 authentification, using X509BasedRequest, see here

Later, we can transition to a TokenBasedRequest. For that, we'll need to replace the X509_USER_PROXY env variable with a JWT_USER or something similar.

@Robin-Van-de-Merghel Robin-Van-de-Merghel force-pushed the adding-jwt-support branch 3 times, most recently from f8b83fd to f555e36 Compare March 19, 2025 09:43
@Robin-Van-de-Merghel
Copy link
Contributor Author

I am still testing the code. Need changes.

@aldbr
Copy link
Contributor

aldbr commented Mar 26, 2025

(You need to fix the conflicts with pilotTools)

@Robin-Van-de-Merghel Robin-Van-de-Merghel force-pushed the adding-jwt-support branch 2 times, most recently from 627581b to f9df3d6 Compare March 26, 2025 08:54
@Robin-Van-de-Merghel
Copy link
Contributor Author

Robin-Van-de-Merghel commented Mar 26, 2025

Improved it so we can just change a parameter in sendMessage to support jwt and x509.

I would like a discussion about storing the JWT:

  • an env with directly the encoded token
  • an env with a path to the token (as for certs)
  • a string parameter in the function, that sendMessage receives from RemoteLogger that himself has from the pilotConfig

For now I've chosen the first choice, tell me if you think it is right.

@Robin-Van-de-Merghel
Copy link
Contributor Author

[Issue with python 2]

@Robin-Van-de-Merghel Robin-Van-de-Merghel force-pushed the adding-jwt-support branch 2 times, most recently from 4707c2e to 404ca41 Compare April 2, 2025 13:22
@Robin-Van-de-Merghel
Copy link
Contributor Author

Is there other changes to do?

@Robin-Van-de-Merghel
Copy link
Contributor Author

Better with a command than a function that retrieves the JWT. Uses dirac pilot-login <ref> <secret> defined in this PR of DiracX.

@Robin-Van-de-Merghel
Copy link
Contributor Author

Needs an update to match DiracX's PR.

@Robin-Van-de-Merghel
Copy link
Contributor Author

TODO: self.pilotStamp = os.environ.get("DIRAC_PILOT_STAMP", self.pp.pilotUUID)

@Robin-Van-de-Merghel
Copy link
Contributor Author

Needs a small update to be up to date with the DiracX PR

Copy link
Contributor Author

@Robin-Van-de-Merghel Robin-Van-de-Merghel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: BaseRequest etc. isn't used yet for logs because it will be deprecated in the next PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants