From 63a21e19f0624020e3b137fb507407575eae3b00 Mon Sep 17 00:00:00 2001
From: Sergey Yakubov <sergey.yakubov@desy.de>
Date: Wed, 10 Mar 2021 14:59:11 +0100
Subject: [PATCH] update asapo cli and tests

---
 CMakeModules/prepare_asapo.cmake              |  1 +
 .../src/asapo_tools/cli/command_test.go       |  3 +-
 asapo_tools/src/asapo_tools/cli/token.go      | 98 +++++++++++++++----
 asapo_tools/src/asapo_tools/cli/token_test.go | 47 +++++++--
 asapo_tools/src/asapo_tools/main/asapo.go     |  4 +
 .../src/asapo_tools/mocks/mock_client.go      | 13 +++
 .../asapo_tools/rest_client/rest_client.go    |  9 ++
 .../asapo_authorizer/server/issue_token.go    |  2 +-
 examples/pipeline/in_to_out/check_linux.sh    |  3 +-
 examples/pipeline/in_to_out/check_windows.bat |  2 +-
 .../pipeline/in_to_out_python/check_linux.sh  |  3 +-
 .../in_to_out_python/check_windows.bat        |  2 +-
 .../request_handler_authorize.cpp             |  2 +-
 .../broker/check_monitoring/check_linux.sh    |  3 +-
 .../automatic/broker/get_last/check_linux.sh  |  2 +-
 .../broker/get_last/check_windows.bat         |  4 +-
 .../automatic/broker/get_meta/check_linux.sh  |  2 +-
 .../broker/get_meta/check_windows.bat         |  4 +-
 .../automatic/broker/get_next/check_linux.sh  |  2 +-
 .../broker/get_next/check_windows.bat         |  3 +-
 .../consumer_python_memleak/check_linux.sh    |  3 +-
 .../check_windows.bat                         |  2 +-
 .../rest_api/check_linux.sh                   |  4 +-
 .../rest_api/check_windows.bat                |  2 +-
 .../send_recv_streams/check_linux.sh          |  4 +-
 .../send_recv_streams/check_windows.bat       |  2 +-
 .../send_recv_streams/send_recv_streams.cpp   |  2 +-
 .../send_recv_streams_python/check_linux.sh   |  2 +-
 .../check_windows.bat                         |  3 +-
 .../full_chain/simple_chain/check_linux.sh    |  4 +-
 .../full_chain/simple_chain/check_windows.bat |  7 +-
 .../simple_chain_dataset/check_linux.sh       |  3 +-
 .../simple_chain_dataset/check_windows.bat    |  7 +-
 .../simple_chain_filegen/check_linux.sh       |  3 +-
 .../simple_chain_filegen/check_windows.bat    |  8 +-
 .../check_linux.sh                            |  4 +-
 .../check_windows.bat                         |  8 +-
 .../check_linux.sh                            |  2 +-
 .../check_windows.bat                         |  8 +-
 .../check_linux.sh                            |  3 +-
 .../check_windows.bat                         |  8 +-
 .../check_linux.sh                            |  4 +-
 .../check_windows.bat                         |  8 +-
 .../simple_chain_metadata/check_linux.sh      |  4 +-
 .../simple_chain_metadata/check_windows.bat   |  6 +-
 .../simple_chain_raw/check_linux.sh           |  3 +-
 .../simple_chain_raw/check_windows.bat        |  9 +-
 .../check_linux.sh                            |  4 +-
 .../check_windows.bat                         |  9 +-
 .../full_chain/two_beamlines/check_linux.sh   |  5 +-
 .../two_beamlines/check_windows.bat           | 12 ++-
 .../full_chain/two_streams/check_linux.sh     |  3 +-
 .../full_chain/two_streams/check_windows.bat  |  5 +-
 .../broker_mongo_restart/check_linux.sh       |  4 +-
 .../services_restart/check_linux.sh           |  3 +-
 tests/automatic/producer/aai/check_linux.sh   |  3 +-
 .../automatic/producer/aai/check_windows.bat  |  3 +-
 tests/automatic/settings/admin_token.key      |  1 +
 58 files changed, 264 insertions(+), 120 deletions(-)
 create mode 100644 asapo_tools/src/asapo_tools/mocks/mock_client.go
 create mode 100644 asapo_tools/src/asapo_tools/rest_client/rest_client.go
 create mode 100644 tests/automatic/settings/admin_token.key

diff --git a/CMakeModules/prepare_asapo.cmake b/CMakeModules/prepare_asapo.cmake
index f97d3bf0e..7ef66d96f 100644
--- a/CMakeModules/prepare_asapo.cmake
+++ b/CMakeModules/prepare_asapo.cmake
@@ -50,6 +50,7 @@ function(prepare_asapo)
     configure_file(${CMAKE_SOURCE_DIR}/tests/automatic/settings/broker_settings.json.tpl broker.json.tpl COPYONLY)
     configure_file(${CMAKE_SOURCE_DIR}/tests/automatic/settings/file_transfer_settings.json.tpl file_transfer.json.tpl COPYONLY)
     configure_file(${CMAKE_SOURCE_DIR}/tests/automatic/settings/auth_secret.key auth_secret.key COPYONLY)
+    configure_file(${CMAKE_SOURCE_DIR}/tests/automatic/settings/admin_token.key admin_token.key COPYONLY)
     configure_file(${CMAKE_SOURCE_DIR}/tests/automatic/settings/auth_secret_admin.key auth_secret_admin.key COPYONLY)
     configure_file(${CMAKE_SOURCE_DIR}/tests/automatic/settings/nginx.conf.tpl nginx.conf.tpl COPYONLY)
     configure_file(${CMAKE_SOURCE_DIR}/config/nomad/nginx.nmd.in nginx.nmd @ONLY)
diff --git a/asapo_tools/src/asapo_tools/cli/command_test.go b/asapo_tools/src/asapo_tools/cli/command_test.go
index c4e89f223..358090965 100644
--- a/asapo_tools/src/asapo_tools/cli/command_test.go
+++ b/asapo_tools/src/asapo_tools/cli/command_test.go
@@ -10,7 +10,7 @@ var CommandTests = []struct {
 	cmd    command
 	answer string
 }{
-	{command{"token", []string{"-secret", "secret_file", "beamtime"}}, "secret"},
+	{command{"token", []string{"-secret", "secret_file","-type","read","-endpoint","bla", "beamtime"}}, "secret"},
 	{command{"dummy", []string{"description"}}, "wrong"},
 }
 
@@ -22,7 +22,6 @@ func TestCommand(t *testing.T) {
 		err := DoCommand(test.cmd.name, test.cmd.args)
 		assert.Contains(t, err.Error(), test.answer, "")
 		assert.NotNil(t, err, "Should be error")
-
 	}
 
 }
diff --git a/asapo_tools/src/asapo_tools/cli/token.go b/asapo_tools/src/asapo_tools/cli/token.go
index aaf8f5f0b..28df76fd8 100644
--- a/asapo_tools/src/asapo_tools/cli/token.go
+++ b/asapo_tools/src/asapo_tools/cli/token.go
@@ -1,29 +1,43 @@
 package cli
 
 import (
+	"asapo_common/utils"
+	"asapo_tools/rest_client"
+	"bytes"
+	"encoding/json"
 	"errors"
-	"os"
 	"fmt"
-	"asapo_common/utils"
+	"io"
+	"net/http"
+	"os"
 )
 
 type tokenFlags struct {
-	Name       string
-	SecretFile string
+	Name         string
+	Endpoint     string
+	AccessType   string
+	SecretFile   string
+	TokenDetails bool
 }
 
-func generateToken(id string,secret string) string {
-	hmac := utils.NewHMACAuth(secret)
-	token,err := hmac.GenerateToken(&id)
-
-	if (err!=nil) {
-		fmt.Println(err.Error())
-	}
-	return token
+type tokenRequest struct {
+	Subject    map[string]string
+	DaysValid  int
+	AccessType string
 }
 
+func generateToken(flags tokenFlags, secret string) string {
+	//	hmac := utils.NewHMACAuth(secret)
+	//	token,err := hmac.GenerateToken(&id)
+
+	//	if (err!=nil) {
+	//		fmt.Println(err.Error())
+	//	}
+	//	return token
+	return ""
+}
 
-// GenerateToken generates token for consumers
+// CommandToken receives token from authorization server
 func (cmd *command) CommandToken() error {
 
 	message_string := "Generate token"
@@ -38,21 +52,64 @@ func (cmd *command) CommandToken() error {
 	}
 
 	secret, err := utils.ReadFirstStringFromFile(flags.SecretFile)
-	if err !=nil  {
+	if err != nil {
 		return err
 	}
 
-	fmt.Fprintf(outBuf, "%s\n", generateToken(flags.Name,secret))
+	request := tokenRequest{
+		Subject:    map[string]string{"beamtimeId": flags.Name},
+		DaysValid:  180,
+		AccessType: flags.AccessType,
+	}
+	json_data, _ := json.Marshal(request)
+	path := flags.Endpoint + "/admin/issue"
 
-	return nil
-}
+	req, err := http.NewRequest("POST", path, bytes.NewBuffer(json_data))
+	if err != nil {
+		return err
+	}
+	req.Header.Add("Content-Type", "application/json")
+	req.Header.Add("Authorization", "Bearer "+secret)
 
+	resp, err := rest_client.Client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return errors.New("returned " + resp.Status + ": " + string(body))
+	}
+
+	if flags.TokenDetails {
+		fmt.Fprintf(outBuf, "%s\n", string(body))
+		return nil
+	}
+
+	token := struct {
+		Token string
+	}{}
+
+	err = json.Unmarshal(body, &token)
+	if err == nil {
+		fmt.Fprintf(outBuf, "%s\n", token.Token)
+	}
+	return err
+}
 
 func (cmd *command) parseTokenFlags(message_string string) (tokenFlags, error) {
 
 	var flags tokenFlags
 	flagset := cmd.createDefaultFlagset(message_string, "<token_body>")
 	flagset.StringVar(&flags.SecretFile, "secret", "", "path to file with secret")
+	flagset.StringVar(&flags.AccessType, "type", "", "access type")
+	flagset.StringVar(&flags.Endpoint, "endpoint", "", "asapo endpoint")
+	flagset.BoolVar(&flags.TokenDetails, "token-details", false, "output token details")
 
 	flagset.Parse(cmd.args)
 
@@ -70,6 +127,13 @@ func (cmd *command) parseTokenFlags(message_string string) (tokenFlags, error) {
 		return flags, errors.New("secret file missed ")
 	}
 
+	if flags.Endpoint == "" {
+		return flags, errors.New("endpoint missed ")
+	}
+
+	if flags.AccessType != "read" && flags.AccessType != "write" {
+		return flags, errors.New("incorrect or missed token access type ")
+	}
 
 	return flags, nil
 
diff --git a/asapo_tools/src/asapo_tools/cli/token_test.go b/asapo_tools/src/asapo_tools/cli/token_test.go
index 63415790f..b12027c0f 100644
--- a/asapo_tools/src/asapo_tools/cli/token_test.go
+++ b/asapo_tools/src/asapo_tools/cli/token_test.go
@@ -1,35 +1,64 @@
 package cli
 
 import (
+	"asapo_tools/mocks"
+	"asapo_tools/rest_client"
+	"encoding/json"
+	"fmt"
+	"net/http"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"bytes"
+	"github.com/stretchr/testify/assert"
 	"io/ioutil"
 	"os"
 )
 
 var tokenTests = []struct {
 	cmd      command
-	answer string
+	ok bool
 	msg  string
 }{
-	{command{args: []string{"beamtime_id"}},  "secret", "no secret parameter"},
-	{command{args: []string{"-secret","secret.tmp"}},  "payload", "no file"},
-	{command{args: []string{"-secret","not_existing_file","payload"}},  "not_existing_file", "no file"},
-	{command{args: []string{"-secret","secret.tmp","beamtime_id"}},  "eodk3s5ZXwACLGyVA63MZYcOTWuWE4bceI9Vxl9zejI=", "ok"},
+	{command{args: []string{"beamtime_id"}},  false, "no secret parameter"},
+	{command{args: []string{"-secret","secret.tmp"}},  false, "no file"},
+	{command{args: []string{"-secret","not_existing_file","payload"}},  false, "no file"},
+	{command{args: []string{"-secret","secret.tmp","beamtime_id"}},  false, "type is missing"},
+	{command{args: []string{"-secret","secret.tmp","-type","read","beamtime_id"}},  false, "endpoint is missing"},
+	{command{args: []string{"-secret","secret.tmp","-type","read","-endpoint","endpoint","-token-details","beamtime_id"}},  true, "ok"},
 }
 
 func TestParseTokenFlags(t *testing.T) {
 
 	ioutil.WriteFile("secret.tmp", []byte("secret"), 0644)
 	outBuf = new(bytes.Buffer)
+
+	rest_client.Client = &mocks.MockClient{}
+
+
+	mocks.DoFunc = func(req *http.Request) (*http.Response, error) {
+		json := `{"Token":"blabla","Uri":"`+req.URL.Path+`"}`
+		r := ioutil.NopCloser(bytes.NewReader([]byte(json)))
+
+		return &http.Response{
+			StatusCode: 200,
+			Body:       r,
+		}, nil
+	}
+
 	for _, test := range tokenTests {
 		err := test.cmd.CommandToken()
-		if err == nil {
-			assert.Contains(t, outBuf.(*bytes.Buffer).String(), test.answer, test.msg)
+		if test.ok {
+			assert.Nil(t, err, test.msg)
+			resp := struct {
+				Token string
+				Uri string
+			}{}
+			err := json.Unmarshal(outBuf.(*bytes.Buffer).Bytes(),&resp)
+			fmt.Println(err)
+			assert.Equal(t,  "blabla", resp.Token,test.msg)
+			assert.Equal(t, "endpoint/admin/issue",resp.Uri, test.msg)
 		} else {
-			assert.Contains(t, err.Error(), test.answer, test.msg)
+			assert.NotNil(t, err, test.msg)
 		}
 
 	}
diff --git a/asapo_tools/src/asapo_tools/main/asapo.go b/asapo_tools/src/asapo_tools/main/asapo.go
index 66d5829ec..256dedcac 100644
--- a/asapo_tools/src/asapo_tools/main/asapo.go
+++ b/asapo_tools/src/asapo_tools/main/asapo.go
@@ -1,8 +1,10 @@
 package main
 
 import (
+	"asapo_tools/rest_client"
 	"flag"
 	"fmt"
+	"net/http"
 	"os"
 	"asapo_common/version"
 	"asapo_tools/cli"
@@ -20,6 +22,8 @@ func main() {
 
 	flag.Parse()
 
+	rest_client.Client = &http.Client{}
+
 	if *flHelp || flag.NArg() == 0 {
 		flag.Usage()
 		cli.PrintAllCommands()
diff --git a/asapo_tools/src/asapo_tools/mocks/mock_client.go b/asapo_tools/src/asapo_tools/mocks/mock_client.go
new file mode 100644
index 000000000..0cf47f5ff
--- /dev/null
+++ b/asapo_tools/src/asapo_tools/mocks/mock_client.go
@@ -0,0 +1,13 @@
+package mocks
+
+import "net/http"
+
+type MockClient struct {
+	DoFunc func(req *http.Request) (*http.Response, error)
+}
+
+func (m *MockClient) Do(req *http.Request) (*http.Response, error) {
+	return DoFunc(req)
+}
+
+var DoFunc func(req *http.Request) (*http.Response, error)
diff --git a/asapo_tools/src/asapo_tools/rest_client/rest_client.go b/asapo_tools/src/asapo_tools/rest_client/rest_client.go
new file mode 100644
index 000000000..b303b5938
--- /dev/null
+++ b/asapo_tools/src/asapo_tools/rest_client/rest_client.go
@@ -0,0 +1,9 @@
+package rest_client
+
+import "net/http"
+
+type HTTPClient interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+var Client HTTPClient
diff --git a/authorizer/src/asapo_authorizer/server/issue_token.go b/authorizer/src/asapo_authorizer/server/issue_token.go
index b86888446..53feedb00 100644
--- a/authorizer/src/asapo_authorizer/server/issue_token.go
+++ b/authorizer/src/asapo_authorizer/server/issue_token.go
@@ -27,7 +27,7 @@ func extractUserTokenrequest(r *http.Request) (request authorization.TokenReques
 	}
 
 	if request.AccessType != "read" && request.AccessType != "write" {
-		return request, errors.New("wrong access type " + request.AccessType)
+		return request, errors.New("wrong access type: " + request.AccessType)
 	}
 
 	return request, nil
diff --git a/examples/pipeline/in_to_out/check_linux.sh b/examples/pipeline/in_to_out/check_linux.sh
index 8540d411d..f6d5943a0 100644
--- a/examples/pipeline/in_to_out/check_linux.sh
+++ b/examples/pipeline/in_to_out/check_linux.sh
@@ -10,7 +10,8 @@ indatabase_name=${beamtime_id}_${data_source_in}
 outdatabase_name=${beamtime_id}_${data_source_out}
 outdatabase_name2=${beamtime_id}_${data_source_out2}
 
-token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+#asapo_test read token
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 beamline=test
 receiver_root_folder=/tmp/asapo/receiver/files
diff --git a/examples/pipeline/in_to_out/check_windows.bat b/examples/pipeline/in_to_out/check_windows.bat
index 5b0f9bb51..f464ea5d8 100644
--- a/examples/pipeline/in_to_out/check_windows.bat
+++ b/examples/pipeline/in_to_out/check_windows.bat
@@ -8,7 +8,7 @@ SET indatabase_name=%beamtime_id%_%data_source_in%
 SET outdatabase_name=%beamtime_id%_%data_source_out%
 SET outdatabase_name2=%beamtime_id%_%data_source_out2%
 
-SET token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+SET token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 SET beamline=test
 
diff --git a/examples/pipeline/in_to_out_python/check_linux.sh b/examples/pipeline/in_to_out_python/check_linux.sh
index 444c6ceea..7da5ccf9a 100644
--- a/examples/pipeline/in_to_out_python/check_linux.sh
+++ b/examples/pipeline/in_to_out_python/check_linux.sh
@@ -12,7 +12,8 @@ nthreads=4
 indatabase_name=${beamtime_id}_${data_source_in}
 outdatabase_name=${beamtime_id}_${data_source_out}
 
-token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+#asapo_test read token
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 beamline=test
 receiver_root_folder=/tmp/asapo/receiver/files
diff --git a/examples/pipeline/in_to_out_python/check_windows.bat b/examples/pipeline/in_to_out_python/check_windows.bat
index 3160af194..de9982180 100644
--- a/examples/pipeline/in_to_out_python/check_windows.bat
+++ b/examples/pipeline/in_to_out_python/check_windows.bat
@@ -6,7 +6,7 @@ SET data_source_out=simulation
 SET indatabase_name=%beamtime_id%_%data_source_in%
 SET outdatabase_name=%beamtime_id%_%data_source_out%
 
-SET token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+SET token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 SET beamline=test
 
diff --git a/receiver/src/request_handler/request_handler_authorize.cpp b/receiver/src/request_handler/request_handler_authorize.cpp
index 9904d5844..f3dbfa365 100644
--- a/receiver/src/request_handler/request_handler_authorize.cpp
+++ b/receiver/src/request_handler/request_handler_authorize.cpp
@@ -28,7 +28,7 @@ Error RequestHandlerAuthorize::ErrorFromAuthorizationServerResponse(const Error&
 
 Error CheckAccessType(const std::string& access_type) {
     if (access_type!="write") {
-        return asapo::ReceiverErrorTemplates::kAuthorizationFailure.Generate("wrong access type " + access_type);
+        return asapo::ReceiverErrorTemplates::kAuthorizationFailure.Generate("wrong access type: " + access_type);
     }
     return nullptr;
 }
diff --git a/tests/automatic/broker/check_monitoring/check_linux.sh b/tests/automatic/broker/check_monitoring/check_linux.sh
index caf55e77f..4d532b0d8 100644
--- a/tests/automatic/broker/check_monitoring/check_linux.sh
+++ b/tests/automatic/broker/check_monitoring/check_linux.sh
@@ -16,7 +16,8 @@ Cleanup() {
 ! influx -execute "drop database ${database_name}"
 
 
-token=`$2 token -secret auth_secret.key data`
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU3NjgsImp0aSI6ImMxNGNwbTNpcHQzZGRrbnFwYm9nIiwic3ViIjoiYnRfZGF0YSIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.Jnhmj2i8zUbTzlmRCo6CUkqkD_FdyMxfNj_PztmnN-0
+
 
 $1 -config settings.json &
 
diff --git a/tests/automatic/broker/get_last/check_linux.sh b/tests/automatic/broker/get_last/check_linux.sh
index a721a07b2..c256a650c 100644
--- a/tests/automatic/broker/get_last/check_linux.sh
+++ b/tests/automatic/broker/get_last/check_linux.sh
@@ -16,7 +16,7 @@ Cleanup() {
 echo "db.data_${stream}.insert({"_id":2})" | mongo ${database_name}
 echo "db.data_${stream}.insert({"_id":1})" | mongo ${database_name}
 
-token=`$2 token -secret auth_secret.key data`
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU3NjgsImp0aSI6ImMxNGNwbTNpcHQzZGRrbnFwYm9nIiwic3ViIjoiYnRfZGF0YSIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.Jnhmj2i8zUbTzlmRCo6CUkqkD_FdyMxfNj_PztmnN-0
 
 $1 -config settings.json &
 
diff --git a/tests/automatic/broker/get_last/check_windows.bat b/tests/automatic/broker/get_last/check_windows.bat
index bc2cfdada..badeaea4d 100644
--- a/tests/automatic/broker/get_last/check_windows.bat
+++ b/tests/automatic/broker/get_last/check_windows.bat
@@ -7,8 +7,7 @@ echo db.data_default.insert({"_id":2}) | %mongo_exe% %database_name%  || goto :e
 set full_name="%1"
 set short_name="%~nx1"
 
-"%2" token -secret auth_secret.key data > token
-set /P token=< token
+set token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU3NjgsImp0aSI6ImMxNGNwbTNpcHQzZGRrbnFwYm9nIiwic3ViIjoiYnRfZGF0YSIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.Jnhmj2i8zUbTzlmRCo6CUkqkD_FdyMxfNj_PztmnN-0
 
 start /B "" "%full_name%" -config settings.json
 ping 192.0.2.1 -n 1 -w 1000 > nul
@@ -44,5 +43,4 @@ exit /b 1
 :clean
 Taskkill /IM "%short_name%" /F
 echo db.dropDatabase() | %mongo_exe% %database_name%
-del /f token
 del /f groupid
\ No newline at end of file
diff --git a/tests/automatic/broker/get_meta/check_linux.sh b/tests/automatic/broker/get_meta/check_linux.sh
index 57b2e3335..afa819fbc 100644
--- a/tests/automatic/broker/get_meta/check_linux.sh
+++ b/tests/automatic/broker/get_meta/check_linux.sh
@@ -14,7 +14,7 @@ Cleanup() {
 
 echo 'db.meta.insert({"_id":0,"data":"test"})' | mongo ${database_name}
 
-token=`$2 token -secret auth_secret.key test`
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU5MDEsImp0aSI6ImMxNGNxbmJpcHQzZGY2bDRvNHIwIiwic3ViIjoiYnRfdGVzdCIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.D71Gv2AwSPIEkaeejWXs70sSoQzvKDonrTmtPk2J9AI
 
 $1 -config settings.json &
 
diff --git a/tests/automatic/broker/get_meta/check_windows.bat b/tests/automatic/broker/get_meta/check_windows.bat
index dc39360ad..40a4020e8 100644
--- a/tests/automatic/broker/get_meta/check_windows.bat
+++ b/tests/automatic/broker/get_meta/check_windows.bat
@@ -6,8 +6,7 @@ echo db.meta.insert({"_id":0}) | %mongo_exe% %database_name%  || goto :error
 set full_name="%1"
 set short_name="%~nx1"
 
-"%2" token -secret auth_secret.key data > token
-set /P token=< token
+set token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU5MDEsImp0aSI6ImMxNGNxbmJpcHQzZGY2bDRvNHIwIiwic3ViIjoiYnRfdGVzdCIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.D71Gv2AwSPIEkaeejWXs70sSoQzvKDonrTmtPk2J9AI
 
 start /B "" "%full_name%" -config settings.json
 
@@ -26,5 +25,4 @@ exit /b 1
 :clean
 Taskkill /IM "%short_name%" /F
 echo db.dropDatabase() | %mongo_exe% %database_name%
-del /f token
 del /f groupid
\ No newline at end of file
diff --git a/tests/automatic/broker/get_next/check_linux.sh b/tests/automatic/broker/get_next/check_linux.sh
index 277f78895..fc5e2cd0a 100644
--- a/tests/automatic/broker/get_next/check_linux.sh
+++ b/tests/automatic/broker/get_next/check_linux.sh
@@ -16,7 +16,7 @@ Cleanup() {
 echo "db.data_${stream}.insert({"_id":2})" | mongo ${database_name}
 echo "db.data_${stream}.insert({"_id":1})" | mongo ${database_name}
 
-token=`$2 token -secret auth_secret.key data`
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU5MDEsImp0aSI6ImMxNGNxbmJpcHQzZGY2bDRvNHIwIiwic3ViIjoiYnRfdGVzdCIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.D71Gv2AwSPIEkaeejWXs70sSoQzvKDonrTmtPk2J9AI
 
 $1 -config settings.json &
 
diff --git a/tests/automatic/broker/get_next/check_windows.bat b/tests/automatic/broker/get_next/check_windows.bat
index 0f3962bc4..890861070 100644
--- a/tests/automatic/broker/get_next/check_windows.bat
+++ b/tests/automatic/broker/get_next/check_windows.bat
@@ -7,8 +7,7 @@ echo db.data_default.insert({"_id":2}) | %mongo_exe% %database_name%  || goto :e
 set full_name="%1"
 set short_name="%~nx1"
 
-"%2" token -secret auth_secret.key data > token
-set /P token=< token
+set token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzA5MzU5MDEsImp0aSI6ImMxNGNxbmJpcHQzZGY2bDRvNHIwIiwic3ViIjoiYnRfdGVzdCIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.D71Gv2AwSPIEkaeejWXs70sSoQzvKDonrTmtPk2J9AI
 
 start /B "" "%full_name%" -config settings.json
 
diff --git a/tests/automatic/bug_fixes/consumer_python_memleak/check_linux.sh b/tests/automatic/bug_fixes/consumer_python_memleak/check_linux.sh
index 21f6774fb..4f8e40847 100644
--- a/tests/automatic/bug_fixes/consumer_python_memleak/check_linux.sh
+++ b/tests/automatic/bug_fixes/consumer_python_memleak/check_linux.sh
@@ -6,7 +6,8 @@ trap Cleanup EXIT
 endpoint=127.0.0.1:8400
 path=.
 beamtime_id=asapo_test
-token="IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk="
+#asapo_test read token
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 
 Cleanup() {
diff --git a/tests/automatic/bug_fixes/producer_send_after_restart/check_windows.bat b/tests/automatic/bug_fixes/producer_send_after_restart/check_windows.bat
index c71a4d9fa..5e645c8fb 100644
--- a/tests/automatic/bug_fixes/producer_send_after_restart/check_windows.bat
+++ b/tests/automatic/bug_fixes/producer_send_after_restart/check_windows.bat
@@ -9,7 +9,7 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 set producer_short_name="%~nx1"
 
 
-"%3" token -secret auth_secret.key %beamtime_id% > token
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
 set /P token=< token
 
 set proxy_address="127.0.0.1:8400"
diff --git a/tests/automatic/file_transfer_service/rest_api/check_linux.sh b/tests/automatic/file_transfer_service/rest_api/check_linux.sh
index 04b478d49..4b1a7e4ff 100644
--- a/tests/automatic/file_transfer_service/rest_api/check_linux.sh
+++ b/tests/automatic/file_transfer_service/rest_api/check_linux.sh
@@ -21,7 +21,9 @@ sleep 1
 
 mkdir -p $file_transfer_folder
 
-token=bnCXpOdBV90wU1zybEw1duQNSORuwaKz6oDHqmL35p0= #token for aaa
+ #token for aaa
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhdTFiaXB0M2FzbzNoYzJvZyIsInN1YiI6ImJ0X2FhYSIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.rvtEPZhvqwG91sod6-iBPCMUXWtMQtmFsqpXNv5HvFc
+
 folder_token=`curl --silent --data "{\"Folder\":\"$file_transfer_folder\",\"BeamtimeId\":\"aaa\",\"Token\":\"$token\"}" 127.0.0.1:5007/folder`
 echo $folder_token
 
diff --git a/tests/automatic/file_transfer_service/rest_api/check_windows.bat b/tests/automatic/file_transfer_service/rest_api/check_windows.bat
index 9814125d2..70d3d4c8d 100644
--- a/tests/automatic/file_transfer_service/rest_api/check_windows.bat
+++ b/tests/automatic/file_transfer_service/rest_api/check_windows.bat
@@ -9,7 +9,7 @@ c:\opt\consul\nomad run file_transfer.nmd
 
 ping 192.0.2.1 -n 1 -w 1000 > nul
 
-set token=bnCXpOdBV90wU1zybEw1duQNSORuwaKz6oDHqmL35p0=
+set token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhdTFiaXB0M2FzbzNoYzJvZyIsInN1YiI6ImJ0X2FhYSIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJyZWFkIn19.rvtEPZhvqwG91sod6-iBPCMUXWtMQtmFsqpXNv5HvFc
 
 mkdir %file_transfer_folder%
 
diff --git a/tests/automatic/full_chain/send_recv_streams/check_linux.sh b/tests/automatic/full_chain/send_recv_streams/check_linux.sh
index f7f1f0241..949ac36ed 100644
--- a/tests/automatic/full_chain/send_recv_streams/check_linux.sh
+++ b/tests/automatic/full_chain/send_recv_streams/check_linux.sh
@@ -5,7 +5,9 @@ beamtime_id=asapo_test
 stream_in=detector
 
 indatabase_name=${beamtime_id}_${stream_in}
-token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+
+#asapo_test read token
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 beamline=test
 
diff --git a/tests/automatic/full_chain/send_recv_streams/check_windows.bat b/tests/automatic/full_chain/send_recv_streams/check_windows.bat
index d89ca68c8..c531b5379 100644
--- a/tests/automatic/full_chain/send_recv_streams/check_windows.bat
+++ b/tests/automatic/full_chain/send_recv_streams/check_windows.bat
@@ -4,7 +4,7 @@ SET stream_in=detector
 
 SET indatabase_name=%beamtime_id%_%stream_in%
 
-SET token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+SET token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 SET beamline=test
 
diff --git a/tests/automatic/full_chain/send_recv_streams/send_recv_streams.cpp b/tests/automatic/full_chain/send_recv_streams/send_recv_streams.cpp
index 5f025e5f4..9e1820083 100644
--- a/tests/automatic/full_chain/send_recv_streams/send_recv_streams.cpp
+++ b/tests/automatic/full_chain/send_recv_streams/send_recv_streams.cpp
@@ -75,7 +75,7 @@ ProducerPtr CreateProducer(const Args& args) {
 int main(int argc, char* argv[]) {
     asapo::ExitAfterPrintVersionIfNeeded("GetNext consumer Example", argc, argv);
     Args args;
-    if (argc != 5) {
+    if (argc != 4) {
         std::cout << "Usage: " + std::string{argv[0]}
                   + " <server> <network_type> <beamtime_id> <token>"
                   <<
diff --git a/tests/automatic/full_chain/send_recv_streams_python/check_linux.sh b/tests/automatic/full_chain/send_recv_streams_python/check_linux.sh
index 024acde68..d79f8c1b7 100644
--- a/tests/automatic/full_chain/send_recv_streams_python/check_linux.sh
+++ b/tests/automatic/full_chain/send_recv_streams_python/check_linux.sh
@@ -5,7 +5,7 @@ beamtime_id=asapo_test
 stream_in=detector
 
 indatabase_name=${beamtime_id}_${stream_in}
-token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 
 beamline=test
 
diff --git a/tests/automatic/full_chain/send_recv_streams_python/check_windows.bat b/tests/automatic/full_chain/send_recv_streams_python/check_windows.bat
index 475943c37..333ae0351 100644
--- a/tests/automatic/full_chain/send_recv_streams_python/check_windows.bat
+++ b/tests/automatic/full_chain/send_recv_streams_python/check_windows.bat
@@ -4,8 +4,7 @@ SET stream_in=detector
 
 SET indatabase_name=%beamtime_id%_%stream_in%
 
-SET token=IEfwsWa0GXky2S3MkxJSUHJT1sI8DD5teRdjBUXVRxk=
-
+SET token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhcDQzaXB0M2E0bmNpMDkwMCIsInN1YiI6ImJ0X2FzYXBvX3Rlc3QiLCJFeHRyYUNsYWltcyI6eyJBY2Nlc3NUeXBlIjoicmVhZCJ9fQ.X5Up3PBd81i4X7wUBXGkIrLEVSL-WO9kijDtzOqasgg
 SET beamline=test
 
 SET mongo_exe="c:\Program Files\MongoDB\Server\4.2\bin\mongo.exe"
diff --git a/tests/automatic/full_chain/simple_chain/check_linux.sh b/tests/automatic/full_chain/simple_chain/check_linux.sh
index fcc4a10f0..259b92922 100755
--- a/tests/automatic/full_chain/simple_chain/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain/check_linux.sh
@@ -9,7 +9,6 @@ consumer_bin=$2
 asapo_tool_bin=$3
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -49,6 +48,9 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin localhost:8400 ${beamtime_id} 100 1000 4 0 100
diff --git a/tests/automatic/full_chain/simple_chain/check_windows.bat b/tests/automatic/full_chain/simple_chain/check_windows.bat
index 8ef712f14..aa9fef52b 100644
--- a/tests/automatic/full_chain/simple_chain/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain/check_windows.bat
@@ -5,16 +5,15 @@ SET receiver_root_folder=c:\tmp\asapo\receiver\files
 
 SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\data\%beamtime_id%"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
 REM producer
 mkdir %receiver_folder%
 start /B "" "%1" %proxy_address% %beamtime_id% 100 1000 4 0 100
diff --git a/tests/automatic/full_chain/simple_chain_dataset/check_linux.sh b/tests/automatic/full_chain/simple_chain_dataset/check_linux.sh
index 6972a6ef1..2250eaaa5 100644
--- a/tests/automatic/full_chain/simple_chain_dataset/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_dataset/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -46,6 +45,8 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin localhost:8400 ${beamtime_id} 100 100 4 0 100 5 &
diff --git a/tests/automatic/full_chain/simple_chain_dataset/check_windows.bat b/tests/automatic/full_chain/simple_chain_dataset/check_windows.bat
index 030c045eb..c9da28107 100644
--- a/tests/automatic/full_chain/simple_chain_dataset/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_dataset/check_windows.bat
@@ -4,16 +4,15 @@ SET beamline=test
 SET receiver_root_folder=c:\tmp\asapo\receiver\files
 SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\data\%beamtime_id%"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
 REM producer
 mkdir %receiver_folder%
 start /B "" "%1" %proxy_address% %beamtime_id% 100 100 4 0 100 5
diff --git a/tests/automatic/full_chain/simple_chain_filegen/check_linux.sh b/tests/automatic/full_chain/simple_chain_filegen/check_linux.sh
index 672055868..469211b3e 100644
--- a/tests/automatic/full_chain/simple_chain_filegen/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_filegen/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -47,6 +46,8 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin test.json &
diff --git a/tests/automatic/full_chain/simple_chain_filegen/check_windows.bat b/tests/automatic/full_chain/simple_chain_filegen/check_windows.bat
index 1eeb2fe43..668687af8 100644
--- a/tests/automatic/full_chain/simple_chain_filegen/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_filegen/check_windows.bat
@@ -8,16 +8,16 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 
 set producer_short_name="%~nx1"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
+
 REM producer
 mkdir %receiver_folder%
 mkdir  c:\tmp\asapo\test_in\processed
diff --git a/tests/automatic/full_chain/simple_chain_filegen_batches/check_linux.sh b/tests/automatic/full_chain/simple_chain_filegen_batches/check_linux.sh
index ef67e1cdd..2a12c2a84 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_batches/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_filegen_batches/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -50,6 +49,9 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
+
 mkdir  /tmp/asapo/test_in/processed/test1
 mkdir  /tmp/asapo/test_in/processed/test2
 
diff --git a/tests/automatic/full_chain/simple_chain_filegen_batches/check_windows.bat b/tests/automatic/full_chain/simple_chain_filegen_batches/check_windows.bat
index a8842020e..205f7eb70 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_batches/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_filegen_batches/check_windows.bat
@@ -8,16 +8,16 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 
 set producer_short_name="%~nx1"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
+
 REM producer
 mkdir %receiver_folder%
 mkdir  c:\tmp\asapo\test_in\processed
diff --git a/tests/automatic/full_chain/simple_chain_filegen_multisource/check_linux.sh b/tests/automatic/full_chain/simple_chain_filegen_multisource/check_linux.sh
index 5283a0d68..e7579449e 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_multisource/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_filegen_multisource/check_linux.sh
@@ -9,7 +9,6 @@ consumer_bin=$2
 asapo_tool_bin=$3
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -48,6 +47,7 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
 
 mkdir -p /tmp/asapo/test_in1/processed
 mkdir -p /tmp/asapo/test_in2/processed
diff --git a/tests/automatic/full_chain/simple_chain_filegen_multisource/check_windows.bat b/tests/automatic/full_chain/simple_chain_filegen_multisource/check_windows.bat
index 8ae26ac14..145a026be 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_multisource/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_filegen_multisource/check_windows.bat
@@ -8,16 +8,16 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 
 set producer_short_name="%~nx1"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
+
 mkdir %receiver_folder%
 mkdir  c:\tmp\asapo\test_in1\processed
 mkdir  c:\tmp\asapo\test_in2\processed
diff --git a/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_linux.sh b/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_linux.sh
index b57cbbbad..cc1ffe2ca 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$3 token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -50,6 +49,8 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$3 token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin test.json &
diff --git a/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_windows.bat b/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_windows.bat
index 32754618f..41d412ca6 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_filegen_readdata_cache/check_windows.bat
@@ -8,16 +8,16 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 
 set producer_short_name="%~nx1"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
+
 REM producer
 mkdir %receiver_folder%
 mkdir  c:\tmp\asapo\test_in\processed
diff --git a/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_linux.sh b/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_linux.sh
index 6a571d4d2..b59287d9a 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -50,6 +49,9 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin test.json &
diff --git a/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_windows.bat b/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_windows.bat
index e68b0ca63..387514eea 100644
--- a/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_filegen_readdata_file/check_windows.bat
@@ -8,16 +8,16 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 
 set producer_short_name="%~nx1"
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
+
 REM producer
 mkdir %receiver_folder%
 mkdir  c:\tmp\asapo\test_in\processed
diff --git a/tests/automatic/full_chain/simple_chain_metadata/check_linux.sh b/tests/automatic/full_chain/simple_chain_metadata/check_linux.sh
index d766e7ae9..b5fb650d9 100644
--- a/tests/automatic/full_chain/simple_chain_metadata/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_metadata/check_linux.sh
@@ -9,7 +9,6 @@ consumer_bin=$2
 asapo_tool_bin=$3
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -45,6 +44,9 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin localhost:8400 ${beamtime_id} 100 0 1 0 1000
diff --git a/tests/automatic/full_chain/simple_chain_metadata/check_windows.bat b/tests/automatic/full_chain/simple_chain_metadata/check_windows.bat
index 9dbba7db3..46e734fe5 100644
--- a/tests/automatic/full_chain/simple_chain_metadata/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_metadata/check_windows.bat
@@ -4,15 +4,15 @@ SET beamline=test
 SET receiver_root_folder=c:\tmp\asapo\receiver\files
 SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\data\%beamtime_id%"
 
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
 REM producer
 mkdir %receiver_folder%
 "%1" %proxy_address% %beamtime_id% 100 0 1 0 1000
diff --git a/tests/automatic/full_chain/simple_chain_raw/check_linux.sh b/tests/automatic/full_chain/simple_chain_raw/check_linux.sh
index f56ee8ca5..3c1d99888 100644
--- a/tests/automatic/full_chain/simple_chain_raw/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_raw/check_linux.sh
@@ -5,7 +5,6 @@ set -e
 trap Cleanup EXIT
 
 beamtime_id=11111111
-token=`$3 token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -40,6 +39,8 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$3 token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
 #producer
 $1 localhost:8400 ${beamtime_id} 100 10 4 100 100
 
diff --git a/tests/automatic/full_chain/simple_chain_raw/check_windows.bat b/tests/automatic/full_chain/simple_chain_raw/check_windows.bat
index 8f9eea4aa..f7ff52aa6 100644
--- a/tests/automatic/full_chain/simple_chain_raw/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_raw/check_windows.bat
@@ -6,14 +6,15 @@ mkdir beamline\p07\current
 copy beamtime-metadata* beamline\p07\current\ /y
 copy beamtime-metadata* asap3\petra3\gpfs\p07\2019\data\11111111\ /y
 
-
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+
+set /P token=< token
+
+
 REM producer
 mkdir %receiver_folder%
 start /B "" "%1" %proxy_address% %beamtime_id% 100 10 4 100 100
diff --git a/tests/automatic/full_chain/simple_chain_usermeta_python/check_linux.sh b/tests/automatic/full_chain/simple_chain_usermeta_python/check_linux.sh
index 3023c28f4..bca082f65 100644
--- a/tests/automatic/full_chain/simple_chain_usermeta_python/check_linux.sh
+++ b/tests/automatic/full_chain/simple_chain_usermeta_python/check_linux.sh
@@ -8,7 +8,6 @@ producer_bin=$1
 asapo_tool_bin=$2
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -44,6 +43,9 @@ nomad run broker.nmd
 
 sleep 2
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
+
 echo "Start producer"
 mkdir -p ${receiver_folder}
 $producer_bin localhost:8400 ${beamtime_id} 100 100 1 0 100
diff --git a/tests/automatic/full_chain/simple_chain_usermeta_python/check_windows.bat b/tests/automatic/full_chain/simple_chain_usermeta_python/check_windows.bat
index e68687fa6..f2e9bdcc0 100644
--- a/tests/automatic/full_chain/simple_chain_usermeta_python/check_windows.bat
+++ b/tests/automatic/full_chain/simple_chain_usermeta_python/check_windows.bat
@@ -4,16 +4,17 @@ SET beamline=test
 SET receiver_root_folder=c:\tmp\asapo\receiver\files
 SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\data\%beamtime_id%"
 
-
-"%2" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id%_detector.insert({dummy:1}) | %mongo_exe% %beamtime_id%_detector
 
 call start_services.bat
 
+"%2" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+
+set /P token=< token
+
+
 REM producer
 mkdir %receiver_folder%
 "%1" %proxy_address% %beamtime_id% 100 100 4 0 100
diff --git a/tests/automatic/full_chain/two_beamlines/check_linux.sh b/tests/automatic/full_chain/two_beamlines/check_linux.sh
index f518a57a4..302b83805 100644
--- a/tests/automatic/full_chain/two_beamlines/check_linux.sh
+++ b/tests/automatic/full_chain/two_beamlines/check_linux.sh
@@ -12,10 +12,8 @@ network_type=$4
 data_source=detector
 
 beamtime_id1=asapo_test1
-token1=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id1`
 
 beamtime_id2=asapo_test2
-token2=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id2`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -56,6 +54,9 @@ nomad run broker.nmd
 
 sleep 3
 
+token1=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id1`
+token2=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id2`
+
 echo "Start producers"
 mkdir -p ${receiver_folder1}
 mkdir -p ${receiver_folder2}
diff --git a/tests/automatic/full_chain/two_beamlines/check_windows.bat b/tests/automatic/full_chain/two_beamlines/check_windows.bat
index 1f09a912e..866d25eaf 100644
--- a/tests/automatic/full_chain/two_beamlines/check_windows.bat
+++ b/tests/automatic/full_chain/two_beamlines/check_windows.bat
@@ -13,11 +13,6 @@ SET year=2019
 SET receiver_folder1="%receiver_root_folder%\%facility%\gpfs\%beamline1%\%year%\data\%beamtime_id1%"
 SET receiver_folder2="%receiver_root_folder%\%facility%\gpfs\%beamline2%\%year%\data\%beamtime_id2%"
 
-"%3" token -secret auth_secret.key %beamtime_id1% > token
-set /P token1=< token
-"%3" token -secret auth_secret.key %beamtime_id2% > token
-set /P token2=< token
-
 set proxy_address="127.0.0.1:8400"
 
 echo db.%beamtime_id1%_%data_source%.insert({dummy:1}) | %mongo_exe% %beamtime_id1%_%data_source%
@@ -25,6 +20,13 @@ echo db.%beamtime_id2%_%data_source%.insert({dummy:1}) | %mongo_exe% %beamtime_i
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id1% > token
+set /P token1=< token
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id2% > token
+set /P token2=< token
+
+
+
 REM producer
 mkdir %receiver_folder1%
 mkdir %receiver_folder2%
diff --git a/tests/automatic/full_chain/two_streams/check_linux.sh b/tests/automatic/full_chain/two_streams/check_linux.sh
index fbbe34ab9..cdf4e5921 100644
--- a/tests/automatic/full_chain/two_streams/check_linux.sh
+++ b/tests/automatic/full_chain/two_streams/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 stream1=s1
 stream2=s2
@@ -49,6 +48,8 @@ nomad run broker.nmd
 
 sleep 3
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
 echo "Start producers"
 mkdir -p ${receiver_folder}
 $producer_bin localhost:8400 ${beamtime_id}%${stream1} 100 1000 4 0 100 &
diff --git a/tests/automatic/full_chain/two_streams/check_windows.bat b/tests/automatic/full_chain/two_streams/check_windows.bat
index c2ba213cb..4dc5d912e 100644
--- a/tests/automatic/full_chain/two_streams/check_windows.bat
+++ b/tests/automatic/full_chain/two_streams/check_windows.bat
@@ -7,8 +7,6 @@ SET stream2=s2
 SET receiver_root_folder=c:\tmp\asapo\receiver\files
 SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\data\%beamtime_id%"
 
-"%3" token -secret auth_secret.key %beamtime_id% > token
-set /P token=< token
 
 set proxy_address="127.0.0.1:8400"
 
@@ -17,6 +15,9 @@ echo db.%beamtime_id%_%stream2%.insert({dummy:1}) | %mongo_exe% %beamtime_id%_%s
 
 call start_services.bat
 
+"%3" token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read %beamtime_id% > token
+set /P token=< token
+
 REM producer
 mkdir %receiver_folder%
 start /B "" "%1" %proxy_address% %beamtime_id%%%%stream1% 100 1000 4 0 100
diff --git a/tests/automatic/high_avail/broker_mongo_restart/check_linux.sh b/tests/automatic/high_avail/broker_mongo_restart/check_linux.sh
index 440d88d8a..c8fe078ca 100755
--- a/tests/automatic/high_avail/broker_mongo_restart/check_linux.sh
+++ b/tests/automatic/high_avail/broker_mongo_restart/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$4
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -81,6 +80,9 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
+
 echo "db.${beamtime_id}_detector.insert({dummy:1})" | mongo --port 27016 ${beamtime_id}_detector
 
 
diff --git a/tests/automatic/high_avail/services_restart/check_linux.sh b/tests/automatic/high_avail/services_restart/check_linux.sh
index 8020cb72c..d01713f90 100644
--- a/tests/automatic/high_avail/services_restart/check_linux.sh
+++ b/tests/automatic/high_avail/services_restart/check_linux.sh
@@ -10,7 +10,6 @@ asapo_tool_bin=$3
 network_type=$7
 
 beamtime_id=asapo_test
-token=`$asapo_tool_bin token -secret auth_secret.key $beamtime_id`
 
 monitor_database_name=db_test
 proxy_address=127.0.0.1:8400
@@ -45,6 +44,8 @@ nomad run broker.nmd
 
 sleep 1
 
+token=`$asapo_tool_bin token -endpoint http://localhost:8400/asapo-authorizer -secret admin_token.key -type read $beamtime_id`
+
 echo "db.${beamtime_id}_detector.insert({dummy:1})" | mongo  ${beamtime_id}_detector
 
 echo "Start producer"
diff --git a/tests/automatic/producer/aai/check_linux.sh b/tests/automatic/producer/aai/check_linux.sh
index eb3b7492f..db89820bd 100644
--- a/tests/automatic/producer/aai/check_linux.sh
+++ b/tests/automatic/producer/aai/check_linux.sh
@@ -13,8 +13,7 @@ facility=test_facility
 year=2019
 receiver_folder=${receiver_root_folder}/${facility}/gpfs/${beamline}/${year}/data/${beamtime_id}
 receiver_folder2=${receiver_root_folder}/${facility}/gpfs/${beamline}/${year}/data/${beamtime_id2}
-token=-pZmisCNjAbjT2gFBKs3OB2kNOU79SNsfHud0bV8gS4= # for bl_p07
-
+token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhbHRyaXB0MzltZTRqcXB0ZyIsInN1YiI6ImJsX3AwNyIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJ3cml0ZSJ9fQ._yy0E42cOGMv81GDj3WKZJlF8mBmjKtHNDPnN5NTxvk # write token for bl_p07
 
 Cleanup() {
 	echo cleanup
diff --git a/tests/automatic/producer/aai/check_windows.bat b/tests/automatic/producer/aai/check_windows.bat
index a115afb6a..3b07ae577 100644
--- a/tests/automatic/producer/aai/check_windows.bat
+++ b/tests/automatic/producer/aai/check_windows.bat
@@ -8,7 +8,8 @@ SET receiver_folder="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\d
 SET receiver_folder2="%receiver_root_folder%\test_facility\gpfs\%beamline%\2019\data\%beamtime_id2%"
 SET dbname=%beamtime_id%_%data_source%
 SET dbname2=%beamtime_id2%_%data_source%
-SET token=-pZmisCNjAbjT2gFBKs3OB2kNOU79SNsfHud0bV8gS4=
+SET token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRhbHRyaXB0MzltZTRqcXB0ZyIsInN1YiI6ImJsX3AwNyIsIkV4dHJhQ2xhaW1zIjp7IkFjY2Vzc1R5cGUiOiJ3cml0ZSJ9fQ._yy0E42cOGMv81GDj3WKZJlF8mBmjKtHNDPnN5NTxvk
+
 
 echo db.%dbname%.insert({dummy:1})" | %mongo_exe% %dbname%
 
diff --git a/tests/automatic/settings/admin_token.key b/tests/automatic/settings/admin_token.key
new file mode 100644
index 000000000..cdbaeda52
--- /dev/null
+++ b/tests/automatic/settings/admin_token.key
@@ -0,0 +1 @@
+eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJjMTRjNm5iaXB0M2JubW1ycjRmMCIsInN1YiI6ImFkbWluIiwiRXh0cmFDbGFpbXMiOnsiQWNjZXNzVHlwZSI6ImNyZWF0ZSJ9fQ.VMSX2Bnb-BRYWoe4T5AmMFn_vBZs69iKG1YOl0kQycI
\ No newline at end of file
-- 
GitLab