Authentication

Arrakis servers can require SciToken authentication for some or all operations. The client handles token discovery and injection automatically using igwn-auth-utils.

How It Works

When you create a arrakis.client.Client or arrakis.publish.Publisher, the token parameter controls authentication:

Value	Behaviour
None (default)	Auto-discover a token via igwn-auth-utils. If no token is found, proceed without authentication.
True	Auto-discover a token. Raise an error if no token is found.
False	Disable authentication entirely.
"eyJ..." (string)	Use the given JWT directly as the Bearer token.

Token discovery searches standard IGWN credential locations including the SCITOKEN and SCITOKEN_FILE environment variables, HTCondor credentials, and system-level SciToken discovery.

Reading Data

By default, Client auto-discovers a token. For servers running in publish mode (reads are open), this is a no-op -- the token is simply not required. For servers in full mode, a valid token with arrakis.read:/ scope is required.

import arrakis

# auto-discovers a token if available
client = arrakis.Client()
channels = list(client.find("H1:CAL-.*"))

The top-level convenience functions (arrakis.find(), arrakis.fetch(), arrakis.stream(), etc.) use auto-discovery by default.

To require a token and fail early if none is found:

client = arrakis.Client(token=True)

To explicitly connect without authentication:

client = arrakis.Client(token=False)

Publishing Data

arrakis.publish.Publisher also accepts a token parameter. When auto-discovering, the client searches for a token with arrakis.create scope (rather than arrakis.read).

from arrakis import Publisher

# auto-discovers a token with arrakis.create scope
publisher = Publisher("H1_IMC")
publisher.register()

The token must have arrakis.create:/<publisher_id> scope for the specific publisher ID, or arrakis.create:/ for access to all publisher IDs.

To provide a token explicitly:

publisher = Publisher("H1_IMC", token="eyJ...")

Token Audience

When auto-discovering, the client derives the expected audience from the server URL. A grpc://arrakis.ligo.org:31206 connection URL produces an audience of https://arrakis.ligo.org, matching the IGWN audience convention of https://<fqdn> without port.

Scopes

Arrakis uses the IGWN scope format <service>.<operation>:<path>:

Scope	Purpose
arrakis.read:/	Read access (find, count, describe, stream)
arrakis.create:/<publisher_id>	Create (publish) access for a specific publisher ID
arrakis.create:/	Create access for all publisher IDs

Scopes follow the SciTokens hierarchical path model.

Checking Server Auth Requirements

Use arrakis.api.server_info to check whether a server requires authentication:

import arrakis

info = arrakis.server_info()
print(info["auth"])       # True or False
print(info["auth_mode"])  # "publish", "full", or None

Obtaining Tokens

SciTokens for IGWN services are issued by the CILogon token issuer at https://cilogon.org/igwn. Use htgettoken to obtain a token:

htgettoken --audience https://arrakis.ligo.org --scope arrakis.read:/

The token is stored in a standard location that igwn-auth-utils discovers automatically.