I did that kind of thing several years ago as a test. It was a legitimate concern.
<br>

<br>
In principle, a server should check with $X509_VOMS_DIR to verify that a X509 proxy with VOMS attribute atlas:/atlas/Role=production is signed by &quot;atlas&quot; VOMS server, and VO group &quot;/atlas/xyz&quot; matches VO name &quot;atlas&quot;.
<br>

<br>
--
<br>
Wei Yang  |  <a href="/cgi-bin/wa?LOGON=A3%3Dind1906%26L%3DXROOTD-DEV%26E%3Dquoted-printable%26P%3D575812%26B%3D----%253D%253D_mimepart_5d09ca76b2adb_3e133faad70cd96c332640%26T%3Dtext%252Fhtml%3B%2520charset%3DUTF-8%26pending%3D" target="_parent" >[log in to unmask]</a>  |  650-926-3338
<br>

<br>
________________________________________
<br>
From: Oliver Freyermuth &lt;<a href="/cgi-bin/wa?LOGON=A3%3Dind1906%26L%3DXROOTD-DEV%26E%3Dquoted-printable%26P%3D575812%26B%3D----%253D%253D_mimepart_5d09ca76b2adb_3e133faad70cd96c332640%26T%3Dtext%252Fhtml%3B%2520charset%3DUTF-8%26pending%3D" target="_parent" >[log in to unmask]</a>&gt;
<br>
Sent: Tuesday, June 18, 2019 10:01 PM
<br>
To: xrootd/xrootd
<br>
Cc: Subscribed
<br>
Subject: Re: [xrootd/xrootd] Bad mapping of VOMS extensions using XrdSecgsiVOMSFun (#1006)
<br>

<br>
The group information indeed can be multi-valued (space separated).
<br>

<br>
I understand. But does that mean that
<br>

<br>
= atlprod o atlas g /atlas r production
<br>

<br>

<br>

<br>
would match a hypothetical proxy with production role for VO CMS and role &quot;NULL&quot; for VO ATLAS (and group /ATLAS)?
<br>
That very example is from the xrootd docs, by the way (but without the group part) 😉.
<br>
At least, using &quot;o&quot; here instead of &quot;g&quot; would ensure it is not a CMS user with an ATLAS group.
<br>
But do I understand correctly that it&#39;s not the &quot;triple&quot; of VO, Group and Role which is matched?
<br>

<br>
With respect to having a very old version in the WLCG repo: I&#39;m not the right person for that. I can only point at what OSG has available (which isn&#39;t affected by the issues described above).
<br>

<br>
Ok, I will contact the WLCG repo admins on this then. At least it&#39;s good to know a working version exists, thanks for pointing me to it - maybe they can add it to the repo.
<br>

<br>
The doc unfortunately have a little typo. Option &quot;grpopt&quot; (not &quot;groupopt&quot;) can be used to make selection
<br>

<br>
Thanks for the hint!
<br>
We don&#39;t have any service using lcmaps yet, so right now vomsxrd is the easiest solution for us.
<br>

<br>
—
<br>
You are receiving this because you are subscribed to this thread.
<br>
Reply to this email directly, view it on GitHub&lt;https://github.com/xrootd/xrootd/issues/1006?email_source=notifications&amp;email_token=ABHVGAYTC7ZRV24ZXADZUDTP3G4THA5CNFSM4HZFJLZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYAWB5I#issuecomment-503406837&gt;, or mute the thread&lt;https://github.com/notifications/unsubscribe-auth/ABHVGA6DQT72NVOVX5LRLHLP3G4THANCNFSM4HZFJLZQ&gt;.
<br>


<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you commented.<br />Reply to this email directly, <a href="https://github.com/xrootd/xrootd/issues/1006?email_source=notifications&amp;email_token=AA7NRDU456QVIXADMJ5ZT2TP3HA7NA5CNFSM4HZFJLZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYAX2WQ#issuecomment-503414106">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AA7NRDQ637UVLRHMXNEK37DP3HA7NANCNFSM4HZFJLZQ">mute the thread</a>.<img src="https://github.com/notifications/beacon/AA7NRDTSQFIP2MJNTCR44WDP3HA7NA5CNFSM4HZFJLZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYAX2WQ.gif" height="1" width="1" alt="" /></p>
<!cript type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/xrootd/xrootd/issues/1006?email_source=notifications\u0026email_token=AA7NRDU456QVIXADMJ5ZT2TP3HA7NA5CNFSM4HZFJLZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYAX2WQ#issuecomment-503414106",
"url": "https://github.com/xrootd/xrootd/issues/1006?email_source=notifications\u0026email_token=AA7NRDU456QVIXADMJ5ZT2TP3HA7NA5CNFSM4HZFJLZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYAX2WQ#issuecomment-503414106",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script><br>
<hr>
<p align="left">
Use REPLY-ALL to reply to list</p>
<p align="center">To unsubscribe from the XROOTD-DEV list, click the following link:<br>
<a href="https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1" target="_blank">https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1</a>
</p>