This document is meant for the maintainers of CMR and is considered DRAFT
Technical documentation of the types of tokens that pass thru CMR.
| Token | Source | Usage | Example | Client | Length | Tech Docs | Notes |
|---|---|---|---|---|---|---|---|
| Legacy | Legacy-Services | -H "Echo-Token: <token>" | AF14A97A-A916-B45A-B7C9-31BBB73ECB99 | stable with : | 35? | The creation of legacy Echo Tokens and use of the Echo-Token header are deprecated and scheduled for decommissioning. | |
| "EDL-" Prefixed | EDL | -H "ECHO-Token: <token>:<client>" | EDL-<BASE 64 text 60 long>:<client> | settable with : | 64 | Use of the Echo-Token header are deprecated and scheduled for decommissioning. | |
| Bearer Token | EDL | -H "Authorization: Bearer <token>" | EDL-<BASE 64 text 60 long> | https://tools.ietf.org/html/rfc6750 | |||
| JWT | EDL | -H "Authorization: Bearer <token>" | <Base64-Text>.<Base64-Text>.<Base64-Text> | settable with : | Up to 2k | ||
| LaunchPad | idmax.nasa.gov | -H "Authorization: <token>" | something really long and ugly ; a SAML token | null | 4k | Launchpad Authentication User's Guide |
CMR reads tokens from three places, Authorization header, 'token' parameter, or Echo-Token header. First found is stored in the context as :token (see acl-lib/src/cmr/acl/core.clj). There is very little processing of the token inside of CMR, the value is handed over to legacy services for processing. The one exception is in a few cases where actions are only allowed if the token is a launchpad token.
<urs-token>:<client-id> (on behalf form)
Bearer <urs-token> (assumed client id of cmr-<user-name>)
Launchpad has no client id (null)
URS tokens must have either a Bearer or a client id section.
see Launchpad Authentication User's Guide
Launchpad tokens are passed in as an Echo-Token or Authorization header and do not use either a client separator (":") nor do they use the Bearer marker. Launchpad tokens have no client (null).
curl -H "Authorization: Bearer XXXX" https://cmr.sit.earthdata.nasa.gov/search/collections/ |
legacy-services
cmr.common-app.api.launchpad-token-validation/launchpad_token_validation.clj