adding support for SciTokens https://scitokens.org/

[ag012]

No description provided.

[jbasney]

Thanks @ag012! I submitted a corresponding XSEDE activity for this feature at https://software.xsede.org/display/xci-694.

[jbasney]

The scitokens-cpp package can be built from source (https://github.com/scitokens/scitokens-cpp) or RPMs are available from OSG (https://opensciencegrid.org/docs/common/yum/) and soon from EPEL (https://src.fedoraproject.org/rpms/scitokens-cpp).

[jbasney]

I think the audience (aud) is the hostname of the SSH server, based on the gethostname() call in scitoken_verify().

[ag012]

What is auth_method? Is it already split by space?
auth_method is a member of config. config is a struct preprocessed in config.c

Probably just need this to be "break", since it will break out of the loop right to the goto statement.
Thanks for the comment. I've change that to break.

[ag012]

Note that rewrite _cmd_login 78f9c13 added a non-optional configuration field and it should be mentioned outside of the scitokens section in readme

[rpwagner]

Thanks @ag012! I submitted a corresponding XSEDE activity for this feature at https://software.xsede.org/display/xci-694.

@jbasney this may be both overly pedantic and not be the right place to discuss this, but on the XSEDE activity the term "proprietary" seems inappropriate for Globus Auth OAuth 2.0 Tokens. They're opaque bearer tokens based on IETF RFC 7662. Opaque is not the same as proprietary.

[jbasney]

@jbasney this may be both overly pedantic and not be the right place to discuss this, but on the XSEDE activity the term "proprietary" seems inappropriate for Globus Auth OAuth 2.0 Tokens. They're opaque bearer tokens based on IETF RFC 7662. Opaque is not the same as proprietary.

I'm happy to be corrected. It's my understanding that only tokens issued by globus.org are currently accepted by oauth-ssh, but I agree it should be possible to support any issuers of opaque bearer tokens that comply with RFC 7662 by adding a few new oauth-ssh configuration options. I opened issue #70 for it. In that case, I'd agree the term "proprietary" would no longer be appropriate.

In any case, I removed "proprietary" from the description at https://software.xsede.org/display/xci-694.

[rpwagner]

Thanks, Jim. I'll contribute to #70. Well, participate, at least.

[JasonAlt]

If this is ready approved and ready for merge, it'll need the 'draft' flag changed.

[jbasney]

Who can remove the draft flag? Here's what I see: