Secure identity tokens

Secure identity tokens are an alternative type of login credential you can use in Mediaflux when the human interaction of entering a domain/username/password is inconvenient or impractical. A token is always associated with a proxy user (the account you usually log in to Mediaflux with), and all operations performed using the token will appear to have been performed by the proxy user.

• You can use tokens through one or more Mediaflux access protocols. Valid protocols currently include http, sftp and smb.

• Tokens do not require MFA push notifications when authenticating. This is ideal for long-lived SMB (network share) mounts where it would be impractical to action MFA notifications each time the client reauthenticates with the server.

• Tokens do NOT inherit the permissions of their proxy users - they’re given their own set of permissions which may be more restrictive than those held by the proxy user. This allows compartmentalisation of access, with a user potentially using multiple tokens that each have different access levels if required.

• A token is affected by ACLs as if it was its proxy user, so if your project uses custom ACLs to grant access, all of a user’s tokens will be able to access those same locations.

• Tokens can be further restricted to a specified access application. This is most often used to restrict access to the Mediaflux command line clients.

Some example scenarios where it might be advisable to use a secure identity token:

• You want to access Mediaflux from a shared host in an unattended fashion, for example with a scheduled task on Windows or a cron job on Linux. Storing your university username and password in a configuration file on a shared host may be a security risk; if it were compromised, attackers could access many systems using the stolen credential. A secure identity token compartmentalises this risk.

• You need to automate uploads in an unattended fashion from an instrument PC, but you want to avoid having to accept MFA push notifications each time an upload is commenced. Secure identity tokens support sftp and http (used by the Mediaflux command line clients).

• You need a long lived SMB mount on a server. It is best to use a secure identity token so that MFA push notifications are not sent each time the SMB client re-authenticates with the server. You would not need to update the mount configuration when changing your university password either.

Apply for secure identity tokens from the self serve token portal. See our Requesting tokens guide for more info on using the portal.

When you request a secure identity token, you will receive a code like this one:

P6YdrBcrRTGXYzpLhXdPAjm8iKxqZ8VOvSGFypEtJgDlM2FmOj6IFtKMpBTTWbsMBv5OrwMzyCf7KarCdEyKGrvlc7EqYPRay12474956

This is your token, and is used instead of your username and password.

When using Mediaflux command line clients, you enter the secure identity token in your configuration file. See Configuration file for more information.

When using SFTP or SMB, use the following credentials:

domain: token
username: [your secure token]
password: [leave it blank, or use the token a second time]

All secure identity tokens exist within a special domain, simply called token.

In most instances you can leave the password field blank. If the client you are using does not accept an empty password, you can enter the token a second time or use the word password (all lower-case).