Worldwide LHC Computing Grid
Published June 17, 2026 | Version 1.3
Technical note Open

WLCG Common JWT Profiles

Authors/Creators

  • 1. Fermilab
  • 2. Morgridge Institute for Research
  • 3. INFN
  • 4. STFC-RAL
  • 5. Nikhef
  • 6. GRNET
  • 7. CERN
  • 8. DESY
  • 9. ROR icon National Institute for Subatomic Physics
  • 10. ROR icon European Organization for Nuclear Research
  • 11. ROR icon Istituto Nazionale di Fisica Nucleare
  • 12. INFN-CNAF
  • 13. ROR icon Brookhaven National Laboratory
  • 14. ROR icon Czech Technical University in Prague

Description

This document describes how WLCG users may use the available geographically distributed resources without X.509 credentials.  In this model, clients are issued with bearer tokens; these tokens are subsequently used to interact with resources.  The tokens may contain authorization groups and/or capabilities, according to the preference of the Virtual Organisation (VO), applications and relying parties. 

Wherever possible, this document builds on existing standards when describing profiles to support current and anticipated WLCG usage.  In particular, three major technologies are identified as providing the basis for this system: OAuth2 (RFC 6749 & RFC 6750), OpenID Connect and JSON Web Tokens (RFC 7519). Additionally, trust roots are established via OpenID Discovery or OAuth2 Authorization Server Metadata (RFC 8414). This document provides a profile for OAuth2 Access Tokens and OIDC ID Tokens.

Files

WLCG_Common_JWT_Profiles_1.3.pdf

Files (240.0 kB)

Name Size Download all
md5:bdf0710ce0f10a69ce6c3b8913e0735f
240.0 kB Preview Download

Additional details

Software

Repository URL
https://github.com/WLCG-AuthZ-WG/common-jwt-profile/
Programming language
Markdown
Development Status
Active