Research: Janus — Roche’s OIDC/OAuth2 Identity Provider

1. What is Janus?

Janus is an OIDC/OAuth2 Identity Provider for Roche applications. It provides a standardised authentication layer backed by existing Roche infrastructure:

Your App → Janus (Amazon Cognito) → Roche PingFederate → Roche Active Directory

In simple terms: Janus provides an OIDC/OAuth2 interface to Roche’s AD, by way of PingFederate. It is described as “a very thin wrapper around existing Roche infrastructure.” The user’s credentials never reach Janus or your application — PingFederate handles the actual authentication against Active Directory.

Janus’s unique value beyond standard OIDC is AWS IAM integration: after authentication, apps can exchange the id_token for AWS STS credentials, giving every Roche employee their own personal IAM Role.

Slack: #help-auth

2. Architecture

3. Tokens and Lifecycle

The id_token includes Roche-specific claims:

• preferred_username — Roche unix ID
• manager_username — manager’s unix ID
• department, cost_center
• groups — AD groups (filtered by groupRegex in app config)

JWT schema v2 returns groups as a proper JSON array instead of a stringified array.

4. Supported OAuth2 Flows

5. App Client Registration (GitOps)

Integration is GitOps-based — create a YAML file in the janus/janus repo:

# app-clients/{environment}/your-app.yml
version: 2
app:
    id: xred-eln-my-integration
    name: My Integration
    contacts:
        - xred-dev@roche.com
    client:
        flows:
            - type: authorizationCodeGrant
              secret: false
              scopes: [openid, profile, email]
              urls:
                  login:
                      - http://localhost:8000/callback
                      - https://xred-eln-my-integration-api.minerva.sandbox.pcloud.roche.com/callback
                  logout:
                      - http://localhost:8000/logout

Submit an MR to main. After merge, the CI pipeline provisions the Cognito app client and generates credentials (Client ID and optional Client Secret).

To get commit access: self-subscribe to the CIDM group GLOJANUS_selfservice.

6. Environments

OIDC discovery: https://app.{domain}/.well-known/openid-configuration

7. AWS IAM Integration

After OIDC authentication, apps can exchange the id_token for AWS STS credentials via the /sts endpoint:

• Every Roche employee gets their own personal IAM Role (arn:aws:iam::ACCOUNT:role/janus/username)
• Only the authenticated employee can assume their own role
• The role has tags matching the employee’s Roche profile
• Returns AccessKeyId, SecretKey, SessionToken, Expiration
• Enables native AWS toolkit compatibility (AWS CLI, boto3, AWS Java SDK)

Authorisation is handled by AWS IAM policies defined in the app client YAML under user.permissions, which can be conditional on CIDM group membership.

8. Token Exchange (RFC 8693)

Janus supports token exchange at POST /exchange/token:

Configured on the target app via an exchange block in the YAML.

9. SDKs

Testing SDKs for SSO testing with Playwright: janus-python-playwright, janus-js-playwright, janus-java-playwright.

SDKs are published to Roche Artifactory (VPN required) and the GitLab package registry (no VPN, needs auth token).

10. CLIs

After janus login, credentials are stored in ~/.janus/credentials and ~/.aws/credentials, giving native AWS toolkit access from the terminal.

11. API Endpoints

12. Example Integrations

Working examples exist for: JavaScript, Angular, VueJS, SvelteKit, FastAPI, Flask, Django, Spring Boot, RShiny, Go. Each has a dedicated documentation page on the Janus docs site .

13. Alternatives at Roche

14. Relevance to xRED ELN

External Actions (Apps layer)

The xRED Apps layer uses Janus for the Roche identity leg of the dual OAuth flow (see ADR-002). When a scientist clicks an External Action in Signals:

1. Browser redirects to the xRED app
2. App initiates Janus OAuth (Authorization Code Grant + PKCE)
3. User authenticates via Roche SSO (PingFederate)
4. Janus issues id_token + access_token
5. App stores tokens in ElastiCache (see ADR-003)
6. The Roche access_token is used as Bearer token for calls to internal systems

Machine-to-machine (Lookups, Jobs)

For backend services that need to call internal Roche APIs without user context, Janus’s Client Credentials flow provides machine-to-machine authentication. No user interaction required — the service authenticates with its Client ID and Secret.

App Registration

Each xRED integration that requires Roche authentication needs a Janus app client YAML in the janus/janus repo. This should be part of the integration onboarding checklist. Use the beta environment (auth-tst.gene.com) for DEV/UAT and stable (auth.gene.com) for PROD.