Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Obtain new Access token from Refresh one #11200

Open
vkuznet opened this issue Jul 6, 2022 · 3 comments
Open

Obtain new Access token from Refresh one #11200

vkuznet opened this issue Jul 6, 2022 · 3 comments
Labels
deployment Issue related to deployment of the services New Feature Security Tokens

Comments

@vkuznet
Copy link
Contributor

vkuznet commented Jul 6, 2022

Impact of the new feature
In order to perform any work based on token based authentication we should establish routine procedure to obtain new access token from a given refresh one.

Is your feature request related to a problem? Please describe.
In order to access services or perform any work using token authentication we should periodically obtain access tokens from refresh one.

Describe the solution you'd like
This issue should follow specific solution we need to decide from #11199 Once we decide on specific solution we adopt within WMCore/WMAgents we need to use it, most likely as cronjob, to obtain and store access tokens from given refresh one.

Describe alternatives you've considered

Additional context
#11199 , #10118 , #10939

@vkuznet vkuznet added New Feature deployment Issue related to deployment of the services Tokens Security labels Jul 6, 2022
@amaltaro
Copy link
Contributor

amaltaro commented Jul 6, 2022

Should we put this issue in the context of WMAgent only?
Even though the logic would be the same for central services, it would require developments in different areas and a decent amount of testing.

@vkuznet
Copy link
Contributor Author

vkuznet commented Jul 7, 2022

Alan, you will need to get access token everywhere in WMCore, e.g. when you access CMSWEB, or any other services in a future along with WMAgent activities. I doubt it should be strict to WMA only. Here are some use-case examples:

  • couch replication
  • request from DBS
  • or, even CRAB activities (since it relies on WMCore)
  • ReqMgr2 and Workqueue since they interact with CMSWEB
  • WMAgent
    Basically everything requiring HTTP access in CMS universe.

@amaltaro
Copy link
Contributor

amaltaro commented Jul 7, 2022

Yes, I know. But how we implement, monitor and test these are different (see my previous reply). Deployment also follows a different schedule, that's why I am in favor of separating WMAgent from central services (similar to what was done for CouchDB).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
deployment Issue related to deployment of the services New Feature Security Tokens
Projects
Status: WM Central Services
Development

No branches or pull requests

2 participants