Fermilab’s Transition to Token Authentication

Fermilab is the first High Energy Physics institution to transition from X.509 user certificates to authentication tokens in production systems. All the experiments that Fermilab hosts are now using JSON Web Token (JWT) access tokens in their grid jobs. The tokens are defined using the WLCG Common JWT Profile. Many software components have been either created or updated for this transition, and the changes to those components are described. Most of the software is available to others as open source. There have been some glitches and learning curve issues but in general the system has been performing well and is being improved as operational problems are addressed.