// project
SciTokens
Federated, capability-based authorization for distributed scientific computing.
SciTokens provides a federated authorization model for distributed scientific computing: instead of identifying who you are at every resource, a job carries a token that states what it is allowed to do.
The companion SciAuth effort focused on adoption — getting these patterns into the software that resource providers actually run, so least-privilege sharing across collaborations becomes the default rather than a project-specific integration.
My contribution is that integration and deployment work: making token-based authorization function in the systems researchers already use — HTCondor job submission and XRootD data access — and helping resource providers turn it on without breaking the workflows already running through them.
Capability-based access is straightforward to specify and unforgiving to retrofit. The engineering is mostly in migration: honoring existing credentials while the token path is proven, then removing the old one.
Technologies
- SciTokens — SciTokens capability-based authorization
- JWT — JSON Web Tokens
- HTCondor — HTCondor high-throughput computing scheduler
- XRootD — XRootD distributed data access framework
- Python