 |
 |
Dear,
I nee help to deploy http plugin for xrootd servers. The xrootd version we are runnin right now is xrootd-server-5.1.1-1.
For sec.protocol we are using xrootd-voms-pluging and works fine.
But with the http/macaroons pluging we have some troubles, that is the config file:
if exec xrootd
xrd.protocol http:1094 /usr/lib64/libXrdHttp.so
http.secxtractor libXrdHttpVOMS.so
http.cadir /etc/grid-security/certificates/
http.cert /etc/grid-security/xrd/xrdcert.pem
http.key /etc/grid-security/xrd/xrdkey.pem
http.exthandler xrdtpc libXrdHttpTPC.so
http.exthandler xrdmacaroons libXrdMacaroons.so
http.desthttps yes
http.trace all
macaroons.secretkey /etc/xrootd/macaroon-secret
#macaroons.onmissing allow
macaroons.trace all
ofs.authlib libXrdMacaroons.so
http.listingdeny yes
http.staticpreload http://static/robots.txt /etc/xrootd/robots.txt
http.header2cgi Authorization authz
fi
With this conf, i always get the same result using my cert:
(Davix::HttpRequest) Error: HTTP 403 : Permission refused
my user seems to be mapped to "locsices" user but the http group seems not to be enought :
210520 14:34:49 21556 anon.0:76@login1 sysXrdHttp: Extracting auth info.
http Protocol 'gsi'
http Name 'locsices'
http Host '[::ffff:10.10.150.1]'
http Vorg 'cms cms'
http Role 'NULL NULL'
http Grps '/cms /cms/escms'
authfile allow the group /escms to write:
t writecmsdata /store/temp/ a
g /escms readcmsdata writecmsdata
210520 14:48:34 21178 locsices.320:43@login1 XrootdResponse: sending err 3010: Unable to create /store/temp/stor.davix.06
davix-put.log
xrootd-clustered.log
; permission denied
and macaroon-init doesn't work too:
macaroon-init https://pool09.ifca.es//store 60 DOWNLOAD,UPLOAD
Failed to retrieve macaroon: Macaroon request failed: Could not connect to server
(if #macaroons.onmissing allow is enable we can read/write without any restriction even without a valid proxy)
complete xrootd conf file and error log output are attached.
Any advise is welcomed, Regards, I
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
Use REPLY-ALL to reply to list
To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1