Configuring token-based authentication

Using a JSON web token (JWT), your Virtual Warehouse client user can sign on to your Virtual Warehouse for a period of time instead of entering single-sign on (SSO) credentials every time your user wants to run a query.

JWT authentication does not involve a user name and password. You do not have to provide any secrets (passwords) to the server, such as a Virtual Warehouse. Instead, JWT tokens, generated by a third party, which is Apache Knox in Cloudera Data Platform, issues a JWT token. Knox can sign the token through asymmetric key cryptography, and the JWT token carries the signature. You can use the token as a bearer token, essentially a password, for accessing the Virtual Warehouse. The Virtual Warehouse needs only a public key stored in a JSON blob called a JSON Web Key Set (JWKS).

Following the procedure below, you acquire a token and set the lifespan of that token (cannot be revoked until expiration). Tokens can be shared.