SciTokens Identity Mapping Issue over XRootD

Site Administrators
1

Dear Experts,

We are trying to enable SciTokens support over the XRootD protocol on our EOS MGM setup, but we are encountering an issue with user identity mapping.

Although we have configured SciTokens and enabled ZTN on the EOS side, authenticated client requests are being mapped to nobody (vid.uid=99, vid.gid=99) instead of the intended user. As a result, the requests fail with Operation not permittederrors.

Our environment:

  • EOS Version: 5.1.19
  • XRootD Version: v5.5.5

We added the following configuration to /etc/xrd.cf.mgm:

sec.protocol ztn  -tokenlib /usr/lib64/libXrdAccSciTokens.so
sec.protbind * only krb5 gsi ztn sss unix

mgmofs.macaroonslib /usr/lib64/libXrdMacaroons.so /usr/lib64/libXrdAccSciTokens.so

xrd.tlsca certdir /etc/grid-security/certificates/
xrd.tls /etc/grid-security/daemon/hostcert.pem /etc/grid-security/daemon/hostkey.pem
xrootd.tls capable all

ofs.authlib ++ /usr/lib64/libXrdAccSciTokens.so config=/etc/xrootd/scitokens.cfg
ofs.authlib ++ /usr/lib64/libXrdMacaroons.so

We also enabled ZTN via eos vid enable ztn and configured the following files:

  • /etc/xrootd/scitokens.cfg
  • /etc/xrootd/scitokens.map

We are not sure what configuration or steps we might be missing.
Could anyone please help us identify the issue?

Thank you for your help!

Best Regards,
Yi-Ru

2

Hi Yi-Ru,

First of all, you are running a pretty old version that is know to have severe security issues so before going any deeper on the investigation I would first recommend that you upgrade to EOS 5.4 or 5.5 version.

In EOS we never use the ofs.authlib since this is something needed mostly by vanilla XRootD to do the mapping of the remote clients to local identities. You can find in the attachment an example for the /etc/xrd.cf.mgm file that we use in one of our production instances where we do have ztn configured. I’ve also attached an example for the scitokens.cfg for the CMS instance that we run at CERN.

Let me know if you manage to have the ztn token authentication properly working. If not, I would need more details logs from the MGM to properly understand what is happening.

Cheers,
Elvin

scitokens.cfg.txt (596 Bytes)

xrd.cf.mgm.txt (3.4 KB)

3

Hi Elvin,

Thank you for your suggestions and for sharing the configuration examples.

We are planning to upgrade our EOS version, but in the meantime, we would like to get the token configuration working properly in our production environment.

ZTN token authentication is working, but after investigating the MGM logs further, I found issue related to identity mapping.

For the same SciToken subject, the identity mapping appears to behave differently depending on the operation. Uploads and reads are mapped to the intended user and work successfully. However, delete requests are mapped to nobody (uid=99, gid=99), resulting in an Operation not permitted error.

I have shared the relevant MGM logs and our xrd.cf.mgm configuration here: CERNBox

Could you please advise which configuration settings or parts of the identity-mapping process I should check?

Thanks

Best regards,
Yi-Ru

4

Hi Yi-Ru,

I remember there was an issue in the past with some operations not taking into consideration the token mapped identity. Therefore, my recommendation is to try it out on an updated instance running 5.4.12 or 5.5.4.

Cheers,
Elvin