ALICE does not use delegated credentials, they only use their authz token which is embedded in the URL. For ALICE you need to disable the SSS enforcement on the FST side: EOS_FST_NO_SSS_ENFORCEMENT="1"
and this allows TPC transfers between your instance and any other instance.
For other use-cases, yes the redirection endpoint can be a round-robin alias. Yes, you can install the PSS gateways on the FSTs if you want and indeed the pss.origin needs to point to the MGM node.
Hello @esindril & EOS community,
I’m also in the need to support “XRootD TPC with delegated credentials” (I think) for CMS for RUCIO transfers
I’m currently running EOS 5.2.22 in production.
but for the line 8 of your script : if [[ ! "${a}" =~ x?root* ]]; then
I don’t understand the ${a}, I would expect a test on arguments, like $1 of $2 ?
Just for double check : With a PSS endpoint, does I still need EOS_FST_NO_SSS_ENFORCEMENT=1 on my FSTs ?
Denis
You are absolutely right, this script can be dramatically simplified, plus there is still an issue with the fact that is does not report the error in case one happens. Therefore, I would recommend the following script:
#! /usr/bin/env bash
export XRD_STREAMTIMEOUT=600
if [[ $(/usr/bin/xrdcp --version 2>&1 | grep -oP "v\K(\d)") -ge 5 ]]; then
/usr/bin/xrdcp $@
else
dst='root://'$XRDXROOTD_ORIGIN'/'$2
/usr/bin/xrdcp --server $1 $dst
fi
Yes, if you have the PSS endpoint in place you can remove the SSS env variable from the FST configuration.
Thanks Elvin,
I can share the script that worked for me, based on yours.
It adds the xrootd servername origin before the path of the destination i.e.the last argument of the script)
#! /usr/bin/env bash
export XRD_STREAMTIMEOUT=600
if [[ ! "${@: -1}" =~ x?root* ]]; then
set -- "${@:1:$#-1}" "xroot://${XRDXROOTD_ORIGIN}/${@: -1}"
fi
/usr/bin/xrdcp $@
EXITCODE=$?
if [[ ${EXITCODE} -ne 0 ]]; then
/usr/bin/logger -t xrootd-third-party-copy.sh "FAILED script arguments : $@"
/usr/bin/logger -t xrootd-third-party-copy.sh "FAILED xrootd-tpc transfer [${EXITCODE}]: env $(env | grep ^XRD | tr '\n' ' ') /usr/bin/xrdcp $1 $dst"
fi
Actually, after discussing with you I had a look at our gateways and realized that some clients depending on their version of the xrootd client that they are using were failing. Therefore, we had another look at the script and improved it. This script will now be shipped as part of vanilla XRootD and can handle TPC for both simple XRootD servers (used as a destination) but also for PSS XRootD servers.
I paste it here and maybe you can give it a try. I hope it works well for you and therefore you won’t need to maintain your own special script:
#!/bin/bash
OPTS=("${@:1:$#-2}")
shift $(($# - 2))
SRC=$1
DST=$2
if [[ -n "${XRDXROOTD_ORIGIN}" ]]; then
DST="root://${XRDXROOTD_ORIGIN}/${DST}"
fi
xrdcp --server "${OPTS[@]}" "${SRC}" "${DST}"
STATUS=$?
if [[ ${STATUS} -ne 0 ]]; then
logger -p err -t xrdcp-tpc "transfer: xrdcp --server ${OPTS[*]} ${SRC} ${DST} FAILED [exit code: ${STATUS}]"
fi
exit ${STATUS}