Allow resource service prefix for scopes to enable AWS cognito generated OIDC tokens

[raj76]

Hello,
Implementing custom scopes via AWS cognito is forcing us to add a resource name prefix to the scope name.
e.g. wlcg/storage.read:/foo/bar instead of storage.read:/foo/bar
I would like to request that a feature that will read and discard the resource name prefix while processing the scopes.
Thank You.

[DrDaveD]

That would be a violation of the WLCG Common JWT Profile. Maybe you'll need to find a different token issuer.

[raj76]

I don't have the luxury of choosing the token issuer. I wish I did.
Is there any solution that I can use as a oidc proxy and add custom scopes?

[DrDaveD]

I think the kind of proxy you have in mind would essentially be considered a token issuer, because it would have to re-sign the tokens.

It might be best to discuss your issue with the WLCG Authorization Working Group because they're the ones who have defined the standard.

[bbockelm]

@raj76 - what's driving this use case?

As @DrDaveD mentions, this would effectively be a separate token profile from the existing one (which I'm not necessarily opposed to -- the library supports 4 already). That means the produced tokens would not work with any endpoints configured to accept WLCG tokens, for example. To prevent confusion, we'd probably want to rename things to avoid the word "wlcg" in such a case.

One approach might be to utilize an issuer like OA4MP (either run your own or the CILogon group contracts out operations). OA4MP is designed to integrate with an existing IAM setup but provide highly customizable tokens based on the authentication from the SSO. You'd be able to leverage your own, existing SSO but then issue tokens according to whichever profile you desire.