Hi Prasun,
It has been a while since we configured our Hiroshima Tier-2 site, so I might have forgotten some small details, but I hope this helps 
We checked our configuration.
This is our eos_env file.
eos_env
[root@grid04 sysconfig]# cat eos_env
# Make sure that EOS-xrootd libs can be directly found
LD_LIBRARY_PATH=/opt/eos/xrootd/lib64
# Should we run with another limit on the core file size other than the default?
DAEMON_COREFILE_LIMIT=unlimited
# Preload jemalloc
LD_PRELOAD=/usr/lib64/libjemalloc.so
# Disable the KRB5 replay cache
KRB5RCACHETYPE=none
EOS_FST_POSIX_FALLOCATE=1
# What roles should the xroot daemon run for. For each role you can overwrite the default options using a dedicate sysconfig file e.g. /etc/sysconfig/xrd.<role>.
# The role based mechanism allows for multiple xrd's running with different options to be controlled via the same systemd script
#-------------------------------------------------------------------------------
# EOS roles - Systemd Services
#-------------------------------------------------------------------------------
XRD_ROLES="mq mgm"
#-------------------------------------------------------------------------------
# EOS Configuration
#-------------------------------------------------------------------------------
# The fully qualified hostname of current MGM
EOS_MGM_HOST='eos.aligrid.hiroshima-u.ac.jp'
# The fully qualified hostname of target MGM
# EOS_MGM_HOST_TARGET="grid05.aligrid.hiroshima-u.ac.jp"
# The EOS instance name N.B.! It MUST start with "eos" and then some alphanumeric characters
# This is important since there are some special files and directories created inside the /eos/<instance_name> subtree
# indispensable for the proper functioning of the instance.
EOS_INSTANCE_NAME='eoshu'
# The EOS configuration to load after daemon start
EOS_AUTOLOAD_CONFIG=default
# The EOS broker URL ; FOR FST USAGE USE THE FQDN OF THE MQ!!!!!
#20250805
EOS_BROKER_URL="root://eos.aligrid.hiroshima-u.ac.jp:1097//eos/"
#EOS_BROKER_URL="root://localhost:1097//eos/"
# The EOS host geo location tag used to sort hosts into geographical (rack) locations
# !!! REQUIRED !!! list of ":" separated tokens of up to 8 chars
EOS_GEOTAG="HU::ALICE"
# The fully qualified hostname of MGM master1
EOS_MGM_MASTER1='eos.aligrid.hiroshima-u.ac.jp'
# The fully qualified hostname of MGM master2
EOS_MGM_MASTER2='eos.aligrid.hiroshima-u.ac.jp'
# The alias which selects master 1 or 2
EOS_MGM_ALIAS='eos.aligrid.hiroshima-u.ac.jp'
# In HA mode, presence of this env enables the redirection of the read traffic from the slaves to the master
# EOS_HA_REDIRECT_READS=1
# The mail notification in case of fail-over
EOS_MAIL_CC="matsumoto@quark.hiroshima-u.ac.jp"
EOS_NOTIFY="mail -s $(date +%s)-$(hostname)-eos-notify $EOS_MAIL_CC"
# Enable core dumps initiated internally
#EOS_CORE_DUMP
# Disable shutdown/signal handlers for debugging
#EOS_NO_SHUTDOWN
# Enable coverage report signal handler
#EOS_COVERAGE_REPORT
# Enable QoS support
#EOS_ENABLE_QOS=""
# Allow UTF-8 path names excluding only CR,LF
#EOS_UTF8=""
# Add secondary group information from database/LDAP (set to 1 to enable)
#EOS_SECONDARY_GROUPS=0
# Do subtree accounting on directories (set to 1 to enable)
EOS_NS_ACCOUNTING=1
# Do sync time propagation (set to 1 to enable)
#EOS_SYNCTIME_ACCOUNTING=0
# Use std::shared_timed_mutex for the RWMutex implementation - uncomment to enable.
EOS_USE_SHARED_MUTEX=1
# By default statvfs reports the total space if the path deepness is < 4; If you want to report only quota accouting you can define
# EOS_MGM_STATVFS_ONLY_QUOTA=1
# If you only want to report the space acacounting you can define
# EOS_MGM_STATVFS_ONLY_SPACE=1
# If variable defined then enable the use of xrootd connection pool
# i.e. create/share different physical connections for transfers to the same destination xrootd server. By default this is disabled.
# This applies both in context of the MGM server when it comes to TPC jobs and also on the FST server for FST to FST transfers.
# EOS_XRD_USE_CONNECTION_POOL=1
# When xrootd connection pool is enabled, one can control the maximum number of physical connection that can be established with the destination server.
# The min value is 1 and the max 1024. By default this 1024.
# EOS_XRD_CONNECTION_POOL_SIZE=64
EOS_USE_MQ_ON_QDB=1
#-------------------------------------------------------------------------------
# FST Configuration
#-------------------------------------------------------------------------------
# Disable 'sss' enforcement to allow generic TPC
EOS_FST_NO_SSS_ENFORCEMENT=1
# Network interface to monitor (default eth0)
EOS_FST_NETWORK_INTERFACE="ens1f0np0"
# Specify in seconds how often FSTs should query for new delete operations
EOS_FST_DELETE_QUERY_INTERVAL=300
# Disable fast boot and always do a full resync when a fs is booting (default off)
# EOS_FST_NO_FAST_BOOT=0
# If variable defined then enable the use of xrootd connection pool i.e. create/share different physical connections for queries done from the FST
# to the MGM in the CallManager method. By default this is disabled.
# EOS_FST_CALL_MANAGER_XRD_POOL=1
# If CallManager xrootd connection pool is enabled one can set the maxium size of the pool of connections.
# The min value is 1, the max value is 32. By default the value is 10.
# EOS_FST_CALL_MANAGER_XRD_POOL_SIZE=16
# If variable defined use asynchronous (double-buffered) reading in TPCs - By default it is undefined = disabled
# EOS_FST_TPC_READASYNC=1
# Modify the TPC key validity which by default is 120 seconds
# EOS_FST_TPC_KEY_VALIDITY_SEC=120
# Control the asynchronous callback on close, if undefined or 0 then disabled, else if 1 then enabled.
# EOS_FST_ASYNC_CLOSE=0
# When asynchronous callback on close is enabled, one can use the following env variable to control
# the minimum size of files for which this gets triggered. If not specified then the values is 0 bytes.
# EOS_FST_ASYNC_CLOSE_MIN_SIZE_BYTES=0
# Enable internal stacktrace printing in the logs - this is useful especially for container environments where abrtd is not running
# EOS_FST_ENABLE_STACKTRACE=1
# Enable async writes between replicas - this can improve the performance for FSTs with long latency.
# EOS_FST_REPLICA_ASYNC_WRITE=1
# If this variable is present then deletion requests coming from the Fsck engine are actually
# performed as a move on the file system mount in a special directory called .eosdeletions. By default disabled.
# EOS_FST_FSCK_DELETE_BY_MOVE=1
# This variable overwrites the FST hostname in MGM redirection - use it when the internal name is different from the external name
# EOS_FST_ALIAS=""
# This variable overwrites the FST port in MGM redirection - use it when the internal name is different from the external name
# EOS_FST_PORT_ALIAS=1094
# Enable XrdIo read-ahead functionality. By default disabled ie. 0.
# EOS_FST_XRDIO_READAHEAD=0
# Force disable XrdIo read-ahead even if this is enabled by using the above env variable or through the fst.readahead opaque information.
# By default disabled ie. 0 This can be useful in case read-ahead needs to be disabled instance wide.
# EOS_FST_XRDIO_READAHEAD_FORCE_DISABLE=0
# In case XrdIo read-ahead is enabled this can control the number of blocks that are pre-fetched. By default this is set to 2.
# EOS_FST_XRDIO_READAHEAD_BLOCKS=2
# In case XrdIo read-ahead is enabled this controls the block size of requests that are pre-fetched. By default this is set to 1024*1024 (1MB).
# EOS_FST_XRDIO_READAHEAD_BLOCK_SIZE=1024*1024
# XFS filesystems will use file allocation, other filesystems like EXT4 and BTRFS will not use fallocation
# unless the following variable is defined (the value is not considered)
#-------------------------------------------------------------------------------
# GRPC Configuration
#-------------------------------------------------------------------------------
# GRPC port - set to 0 toi disable GRPC
# EOS_MGM_GRPC_PORT=50051
# GRPC security - define to enable SSL server
# EOS_MGM_GRPC_SSL_CERT
# EOS_MGM_GRPC_SSL_KEY
# EOS_MGM_GRPC_SSL_CA
#-------------------------------------------------------------------------------
# REST API dedicated GRPC service
#-------------------------------------------------------------------------------
# Enable the REST API support. The effect of this env variable depends if the code has been built with grpc-gateway (eos-grpc-gateway) support or not.
# To have a fully functional REST API both conditions (built-in support and env variable set to 1) need to be satisfied. Disabled by default i.e. 0.
EOS_MGM_ENABLE_REST_API=1
# Set the port for the internal GRPC server handling the REST API requests. Default value is 500054.
EOS_MGM_REST_GRPC_PORT=50054
#-------------------------------------------------------------------------------
# FUSEX Configuration
#-------------------------------------------------------------------------------
# Listener port of the ZMQ server used by FUSEx)
# EOS_MGM_FUSEX_PORT=1100
# Maximum number of 'listable' children
# EOS_MGM_FUSEX_MAX_CHILDREN=32768
#-------------------------------------------------------------------------------
# QuarkDB Configuration
#-------------------------------------------------------------------------------
EOS_USE_QDB_MASTER=1
#-------------------------------------------------------------------------------
# MGM TTY Console Broadcast Configuration
#-------------------------------------------------------------------------------
# define the log file where you want to grep
EOS_TTY_BROADCAST_LISTEN_LOGFILE="/var/log/eos/mgm/xrdlog.mgm"
# define the log file regex you want to broad cast to all consoles
EOS_TTY_BROACAST_EGREP="\"CRIT|ALERT|EMERG|PROGRESS\""
#-------------------------------------------------------------------------------
# MGM Namespace Preset Size - this can safe memory for large namespaces if you know an upper limit for the namespace size
#-------------------------------------------------------------------------------
# EOS_NS_DIR_SIZE=1000000
# EOS_NS_FILE_SIZE=1000000
# ------------------------------------------------------------------
# MGM Boot options
# ------------------------------------------------------------------
# uncomment to avoid mmaping a changelog file
# EOS_NS_BOOT_NOMMAP
# uncomment to speed up the scanning phase skipping CRC32 computation
EOS_NS_BOOT_NOCRC32=1
# uncomment to allow a multi-threaded boot process using maximum number of cores available
EOS_NS_BOOT_PARALLEL=1
# ------------------------------------------------------------------
# MGM FUSE configuration
# ------------------------------------------------------------------
# uncomment to change the minimum needed size available to create a new file
# EOS_MGM_FUSE_BOOKING_SIZE = 5368709120
# ------------------------------------------------------------------
# MGM 'xrdfs query space' configuration
# ------------------------------------------------------------------
# uncoment to set the EOS space name to be used by 'xrdfs query space' commands that do not explicitly specify an EOS space name
EOS_MGM_STATVFS_DEFAULT_SPACE="default"
# ------------------------------------------------------------------
# MGM Directory Listing Cache configuration
# set to 0 to disable listing cache for 'xrdfs ls' and 'eos ls', or a number with the number of dirs to cache
# EOS_MGM_LISTING_CACHE=1024
# ------------------------------------------------------------------
# MGM OIDC configuration
# ------------------------------------------------------------------
# by default the sub field is mapped from OIDC tokens
# EOS_MGM_OIDC_MAP_FIELD=sub
# by default (undefined) the server certificate and hostname are verified, to skip this, define
# EOS_MGM_OIDC_INSECURE=1
# ------------------------------------------------------------------
# MGM token generation configuration
# ------------------------------------------------------------------
# by default the token generation key is derived from an sss key
# EOS_MGM_TOKEN_KEYFILE=/etc/eos/token.key
# ------------------------------------------------------------------
# MGM Device Tracking
# ------------------------------------------------------------------
# change the interval at which the MGM takes out compressed JSON S.M.A.R.T info and publishes them
EOS_MGM_DEVICES_PUBLISHING_INTERVAL=900
# ------------------------------------------------------------------
# MGM SciToken Cache
# ------------------------------------------------------------------
XDG_CACHE_HOME=/var/tmp/
We also ran some tests from our MGM serve.
[root@grid04 ~]# eos root://localhost whoami
Virtual Identity: uid=0 (0,2,3,65534) gid=0 (0,2,4,65534) [authz:sss] sudo* host=localhost domain=localdomain
[root@grid04 ~]# eos root://eos.aligrid.hiroshima-u.ac.jp whoami
Virtual Identity: uid=2 (2,65534) gid=2 (2,65534) [authz:sss] sudo* host=grid04.aligrid.hiroshima-u.ac.jp domain=aligrid.hiroshima-u.ac.jp
Next, We ran whoami to your eoskolkata server from Hiroshima.
[root@grid04 ~]# eos root://eoskolkata.tier2-kol.res.in whoami
Virtual Identity: uid=10367 (10367,65534) gid=1395 (1395) [authz:unix] host=grid04.aligrid.hiroshima-u.ac.jp domain=aligrid.hiroshima-u.ac.jp
You successfully recognized us as aliprod.
Could you check eos vid ls and /var/log/eos/mgm/xrdlog.mgm?
This is the eos vid ls output of our site.
[root@grid04 ~]# eos vid ls
https:"<pwd>":gid => root
https:"<pwd>":uid => root
publicaccesslevel: => 1024
sss:"<pwd>":gid => root
sss:"<pwd>":uid => root
sudoer => uids(daemon)
tokensudo => always
unix:"<pwd>":gid => alice
unix:"<pwd>":uid => aliprod
Hope this helps you solve the issue.
Cheers,
Takuma
Our xrd.cf.mgm is here.
xrd.cf.mgm
[root@grid04 etc]# cat xrd.cf.mgm
###########################################################
set myName = ALICE::Hiroshima::EOS
all.sitename ALICE::Hiroshima::EOS
###########################################################
xrootd.fslib libXrdEosMgm.so
xrootd.seclib libXrdSec.so
xrootd.async off nosf
xrootd.chksum adler32
###########################################################
xrd.sched mint 8 maxt 256 idle 60
xrd.timeout hail 30 idle 300 kill 20 read 20
###########################################################
# caused this line?
all.export / nolock
all.role manager
###########################################################
xrd.port 1094
###########################################################
oss.fdlimit * max
###########################################################
# UNIX authentication
sec.protocol unix
# SSS authentication
sec.protocol sss -c /etc/eos.keytab -s /etc/eos.keytab
sec.protbind localhost.localdomain sss unix
sec.protbind localhost sss unix
sec.protbind * only sss unix
# for debug
xrd.trace all
ofs.trace all
mgmofs.trace all
acc.trace all
###########################################################
mgmofs.fs /
mgmofs.targetport 1095
mgmofs.centraldrain true
mgmofs.authlib /usr/lib64/libXrdAliceTokenAcc.so
mgmofs.authorize 1
alicetokenacc.multiprocess 32
alicetokenacc.truncateprefix /eos/hu/alice
alicetokenacc.noauthzhost localhost
#alicetokenacc.noauthzhost localhost.localdomain
# VOBOX
alicetokenacc.noauthzhost grid01.aligrid.hiroshima-u.ac.jp
# MGMs
#alicetokenacc.noauthzhost grid04.aligrid.hiroshima-u.ac.jp
#alicetokenacc.noauthzhost grid05.aligrid.hiroshima-u.ac.jp
#alicetokenacc.noauthzhost grid06.aligrid.hiroshima-u.ac.jp
# FSTs
#alicetokenacc.noauthzhost nfs11.aligrid.hiroshima-u.ac.jp
#alicetokenacc.noauthzhost nfs12.aligrid.hiroshima-u.ac.jp
#alicetokenacc.noauthzhost nfs13.aligrid.hiroshima-u.ac.jp
###########################################################
#mgmofs.trace all debug
# this URL can be overwritten by EOS_BROKER_URL defined in /etc/sysconfig/eos
mgmofs.broker root://eos.aligrid.hiroshima-u.ac.jp:1097//eos/
# this name can be overwritten by EOS_INSTANCE_NAME defined in /etc/sysconfig/eos
mgmofs.instance eoshu
# configuration, namespace , transfer and authentication export directory
mgmofs.configdir /var/eos/config
mgmofs.metalog /var/eos/md
mgmofs.txdir /var/eos/tx
mgmofs.authdir /var/eos/auth
mgmofs.archivedir /var/eos/archive
mgmofs.qosdir /var/eos/qos
# report store path
mgmofs.reportstorepath /var/eos/report
# this defines the default config to load
mgmofs.autoloadconfig default
mgmofs.autosaveconfig true
# QoS configuration file
# mgmofs.qoscfg /var/eos/qos/qos.conf
###########################################################
# Config Engine Configuration
mgmofs.cfgtype quarkdb
# this has to be defined if we have a failover configuration via alias - can be overwritten by EOS_MGM_ALIAS in /etc/sysconfig/eos
mgmofs.alias eos.aligrid.hiroshima-u.ac.jp
###########################################################
# Set the FST gateway host and port
# mgmofs.fstgw someproxy.cern.ch:3001
#-------------------------------------------------------------------------------
# Configuration for the authentication plugin EosAuth
#-------------------------------------------------------------------------------
# Set the number of authentication worker threads running on the MGM
mgmofs.auththreads 16
# Set the front end port number for incoming authentication requests
#mgmofs.authport 15555
# By default we listen only on localhost connections - set to 0 if you want to allow remote access
#mgmofs.authlocal 1
#-------------------------------------------------------------------------------
# Set the namespace plugin implementation
#-------------------------------------------------------------------------------
mgmofs.nslib /usr/lib64/libEosNsQuarkdb.so
# Quarkdb custer configuration used for the namespace
mgmofs.qdbcluster grid04.aligrid.hiroshima-u.ac.jp:7777 grid05.aligrid.hiroshima-u.ac.jp:7777 grid06.aligrid.hiroshima-u.ac.jp:7777
mgmofs.qdbpassword_file /etc/quarkdb.pass
#-------------------------------------------------------------------------------
# Configuration for the MGM workflow engine
#-------------------------------------------------------------------------------
# The SSI protocol buffer endpoint for notification messages from "proto" workflow actions
#mgmofs.protowfendpoint HOSTNAME.2NDLEVEL.TOPLEVEL:10955
#mgmofs.protowfresource /SSI_RESOURCE
# Use gRPC?
# mgmofs.protowfusegrpc true
if exec xrootd
xrd.protocol XrdHttp:8443 libXrdHttp.so
http.exthandler EosMgmHttp libEosMgmHttp.so eos::mgm::http::redirect-to-https=1
http.trace false
# host cert required !!!
http.exthandler xrdtpc libXrdHttpTPC.so
xrd.tls /etc/grid-security/hostcert.pem /etc/grid-security/hostkey.pem
xrd.tlsca certdir /etc/grid-security/certificates/
# X509 Stuff
# http.secxtractor libXrdVoms.so
# http.gridmap /etc/grid-security/grid-mapfile
# Macaroons
# mgmofs.macaroonslib libXrdMacaroons.so libXrdAccSciTokens.so
# macaroons.secretkey /etc/eos.macaroon.secret
# macaroons.trace all
fi
xrootd.monitor all flush 60s window 30s dest files info user grid01.aligrid.hiroshima-u.ac.jp:9930