Local JWT vs External OAuth2: Balancing Simplicity and Revocation Control
0 reputation · 27 Jul 2020, 06:45 UTC
Local JWT vs External OAuth2
Goal: Determine the most appropriate authentication strategy for Gazebo’s web interface, ensuring efficient token lifetime management while preserving least‑privilege access.
Constraints: The current implementation uses JSON Web Tokens (JWT) that include an "exp" claim but lack a built‑in revocation endpoint. An alternative is to integrate an external OAuth2 provider, which offers centralized revocation and single‑sign‑on but requires additional configuration and plugin development.
Uncertainty: Documentation does not recommend a definitive approach for production deployments, leaving the choice between simplicity (local JWT) and enhanced control (OAuth2) unresolved.
What are the trade‑offs between maintaining a simple local JWT system that rejects expired tokens versus adopting an OAuth2 flow that supports token revocation and centralized credential management? Does Gazebo provide any mechanism for revoking JWTs in newer releases, or must a custom revocation endpoint be added? Should least‑privilege role definitions be enforced at the JWT level or only through ROS 2 Security (DDS‑SAS) when using OAuth2?
gazebo