[DEV] Implement token based auth to SMD

[cjh1]

Currently JWT based auth to the PCS API is implemented, however, currently down stream requests to SMD do not use JWTs. This was/is waiting on the tokensmith functionality to settle, so we can use a consistent approach across all services.

[cjh1]

@rainest @synackd I raised this issue to track this.

[synackd]

@alexlovelltroy @davidallendj What is the state of tokensmith? Is it being used with SMD/BSS yet and/or is it ready to be used here?

[alexlovelltroy]

Not yet. Unfortunately, I think our best bet is to copy the BSS auth stuff until tokensmith has more robust testing

[cjh1]

So basically this file? It seems that you configure BSS with its own OAuth client for SMD requests?

[alexlovelltroy]

I think so. At least that's where I would start

[cjh1]

Looking at the code its not clear how the OAuth client gets setup. It seems like a new client is created here, but it doesn't look like the client is initialized with a id or secret?

[rainest]

Looks like maybe through https://github.com/OpenCHAMI/bss/blob/e8a51f1f0947df97b4fab2b87d8b69cd36e27e9d/cmd/boot-script-service/main.go#L458-L469 and https://github.com/OpenCHAMI/bss/blob/e8a51f1f0947df97b4fab2b87d8b69cd36e27e9d/cmd/boot-script-service/main.go#L485 ?

Doesn't look like BSS makes use of the OAuthClient class or its methods currently.

[cjh1]

Looks like maybe through https://github.com/OpenCHAMI/bss/blob/e8a51f1f0947df97b4fab2b87d8b69cd36e27e9d/cmd/boot-script-service/main.go#L458-L469

I believe this for validating incoming JWTs rather than using them for upstream services. However, maybe it just forwards on the existing JWT ....