Arvados

h1. Authentication for a multi-cluster workflow

(work in progress)

Scenarios:

| user uuid      | workflow uuid       | cluster running parent workflow  | cluster running child container  ||

| uuuuu          | uuuuu               | uuuuu                            | uuuuu                            |degenerate case (no federation)|

| uuuuu          | wwwww               | uuuuu                            | uuuuu                            |A|

h2. A: Proxy "GET workflow" request on behalf of local user

Cluster uuuuu makes a salted token for cluster wwwww when proxying the client's "GET workflow wwwww-*" request.

Cluster wwwww calls back to cluster uuuuu to verify the salted token.