Using shared secret for JWTs sent to Credentials API

This change brings the Credentials API calls in line with those of other services. The change also makes it easier for the future switch to an asymmetric signing key.

LEARNER-629

openedx/core/djangoapps/credentials/utils.py

@@ -1,15 +1,28 @@
 """Helper functions for working with Credentials."""
 from __future__ import unicode_literals
+
 import logging
 
+from django.conf import settings
+from edx_rest_api_client.client import EdxRestApiClient
+
 from openedx.core.djangoapps.catalog.utils import get_programs
 from openedx.core.djangoapps.credentials.models import CredentialsApiConfig
 from openedx.core.lib.edx_api_utils import get_edx_api_data
-
+from openedx.core.lib.token_utils import JwtBuilder
 
 log = logging.getLogger(__name__)
 
 
+def get_credentials_api_client(user):
+    """ Returns an authenticated Credentials API client. """
+
+    scopes = ['email', 'profile']
+    expires_in = settings.OAUTH_ID_TOKEN_EXPIRATION
+    jwt = JwtBuilder(user).build_token(scopes, expires_in)
+    return EdxRestApiClient(CredentialsApiConfig.current().internal_api_url, jwt=jwt)
+
+
 def get_credentials(user, program_uuid=None):
     """
     Given a user, get credentials earned from the credentials service.
@@ -35,9 +48,10 @@ def get_credentials(user, program_uuid=None):
     # want to see them displayed immediately.
     use_cache = credential_configuration.is_cache_enabled and not user.is_staff
     cache_key = credential_configuration.CACHE_KEY + '.' + user.username if use_cache else None
+    api = get_credentials_api_client(user)
 
     return get_edx_api_data(
-        credential_configuration, user, 'credentials', querystring=querystring, cache_key=cache_key
+        credential_configuration, 'credentials', api=api, querystring=querystring, cache_key=cache_key
     )