SciTokens Identity Mapping Issue over XRootD

Site Administrators
1

Dear Experts,

We are trying to enable SciTokens support over the XRootD protocol on our EOS MGM setup, but we are encountering an issue with user identity mapping.

Although we have configured SciTokens and enabled ZTN on the EOS side, authenticated client requests are being mapped to nobody (vid.uid=99, vid.gid=99) instead of the intended user. As a result, the requests fail with Operation not permittederrors.

Our environment:

  • EOS Version: 5.1.19
  • XRootD Version: v5.5.5

We added the following configuration to /etc/xrd.cf.mgm:

sec.protocol ztn  -tokenlib /usr/lib64/libXrdAccSciTokens.so
sec.protbind * only krb5 gsi ztn sss unix

mgmofs.macaroonslib /usr/lib64/libXrdMacaroons.so /usr/lib64/libXrdAccSciTokens.so

xrd.tlsca certdir /etc/grid-security/certificates/
xrd.tls /etc/grid-security/daemon/hostcert.pem /etc/grid-security/daemon/hostkey.pem
xrootd.tls capable all

ofs.authlib ++ /usr/lib64/libXrdAccSciTokens.so config=/etc/xrootd/scitokens.cfg
ofs.authlib ++ /usr/lib64/libXrdMacaroons.so

We also enabled ZTN via eos vid enable ztn and configured the following files:

  • /etc/xrootd/scitokens.cfg
  • /etc/xrootd/scitokens.map

We are not sure what configuration or steps we might be missing.
Could anyone please help us identify the issue?

Thank you for your help!

Best Regards,
Yi-Ru

2

Hi Yi-Ru,

First of all, you are running a pretty old version that is know to have severe security issues so before going any deeper on the investigation I would first recommend that you upgrade to EOS 5.4 or 5.5 version.

In EOS we never use the ofs.authlib since this is something needed mostly by vanilla XRootD to do the mapping of the remote clients to local identities. You can find in the attachment an example for the /etc/xrd.cf.mgm file that we use in one of our production instances where we do have ztn configured. I’ve also attached an example for the scitokens.cfg for the CMS instance that we run at CERN.

Let me know if you manage to have the ztn token authentication properly working. If not, I would need more details logs from the MGM to properly understand what is happening.

Cheers,
Elvin

scitokens.cfg.txt (596 Bytes)

xrd.cf.mgm.txt (3.4 KB)