Authentication — Tokens, Scopes, and Identity

Day 2 Lab

1. List your auth options: OAuth (your IdP issues the token) vs. a Glean-issued API token.
2. Decide scope: user-scoped (acts as one person, honors their permissions) vs. global (acts across the instance).
3. Pick the least-privilege option that still meets the need — prefer user-scoped so per-user permissions are preserved.
4. Note the gotcha: a global token bypasses per-user ACLs, so results are not filtered by who is asking.

Working Example: User-Scoped vs. Global

A user-scoped token carries the end user's identity, so Glean filters every result through that user's permissions. A global token does not — use it only for server-side work that legitimately needs cross-user reach. Verified against authentication.

import os
from glean import Glean

# Least privilege: act AS a specific user. Glean enforces THEIR permissions,
# so the same query returns only what that user is allowed to see.
user_client = Glean(
    instance=os.environ["GLEAN_INSTANCE"],
    api_token=os.environ["GLEAN_API_TOKEN"],
    actas_user=os.environ["END_USER_EMAIL"],   # impersonate within allowed scope
)

# Global scope: omit the user. This bypasses per-user ACL filtering —
# reserve it for trusted server-side jobs, never for end-user-facing queries.
global_client = Glean(
    instance=os.environ["GLEAN_INSTANCE"],
    api_token=os.environ["GLEAN_GLOBAL_TOKEN"],
)

Default to user-scoped. Reach for a global token only when the task truly needs cross-user reach, and gate it behind your own authorization. Verified against authentication.