Http.desthttps has no effect — HTTP redirect to FST still uses plain HTTP despite TLS working and directive accepted

1

Environment:

  • EOS_SERVER_VERSION: 5.4.3, EOS_SERVER_RELEASE: 1
  • XRootD version: 5.9.4
  • OS: AlmaLinux 10
  • Topology: 3 MGMs + 4 FSTs

Problem:
Clients that follow HTTP redirects (rclone, curl with security checks enabled) receive a redirect URL from the MGM to the FST using http:// instead of https://, even though:

  1. TLS works correctly on the FST (confirmed via openssl s_client -connect fst02-eos.inpe.br:8443 -brief — full TLSv1.3 handshake, valid certificate)
  2. xrd.tls is configured identically on the MGM and all FSTs, pointing to the same valid certificates under /etc/grid-security/daemon/
  3. http.desthttps yes was added to both /etc/xrd.cf.mgm and /etc/xrd.cf.fst on all FSTs, with the respective services restarted after the change (confirmed in the logs: =====> http.desthttps yes with no parsing warning)

Observed behavior:

rclone copyto eos:/wander/sample.txt /local/dest.txt -P --multi-thread-streams 0

ERROR: failed to open source object: Get "http://fst02-eos.inpe.br:8443/eos/inpe/wander/sample.txt?encURI=...": 
refusing to follow HTTPS to HTTP redirect: would send credentials in cleartext

What has already been ruled out:

  • Not a firewall/network issue (WebDAV port 8448 is already externally opened and working for direct requests to the MGM)
  • Not a wrong-leader issue (eos ns confirms is_master=true on the host where the config was applied)
  • Not an unrecognized-parameter parsing error (logs confirm the directive was read with no warning)

Question:
Is there an additional directive required (perhaps at the EosFstHttp plugin level, or a specific XRootD HTTP TPC redirect flag) for the MGM to generate FST redirect URLs as https:// instead of http://? http.desthttps appears to be insufficient on this version, or there may be an undocumented configuration prerequisite.

Tks
Wander

2

Hi Wander,

You need to use the following option in the /etc/xrd.cf.mgm config file:

http.exthandler EosMgmHttp libEosMgmHttp.so eos::mgm::http::redirect-to-https=1

We might consider making this the default in the future.

Cheers,
Elvin

3

Hey Elvin,

Thank you!
It works.
Actually this is part of our effort to offer the WebDAV to Mac users.
The connection and browsing via Cyberduck or any other WebDAV tools are working fine, but downloads and uploads fail for different reasons. But this is another story..
Thanks again!

Cheers,
Wander