Sure! Here are versions:
```
$ rpm -qa | grep xrootd
xrootd-client-libs-5.5.1-1.el7.x86_64
xrootd-client-5.5.1-1.el7.x86_64
xrootd-multiuser-2.1.2-1.osg36.el7.x86_64
xrootd-server-libs-5.5.1-1.el7.x86_64
xrootd-libs-5.5.1-1.el7.x86_64
xrootd-server-5.5.1-1.el7.x86_64
xrootd-scitokens-5.5.1-1.el7.x86_64
```
and here's a fresh trace, first on the proxy again, then on the origin, less redacted for the sake of simplicity.
(1) proxy:
```
221207 12:24:09 3394611 scitokens_Access: Trying token-based access control
221207 12:24:09 3394611 scitokens_Reconfig: Configuring issuer https://cilogon.org/jlab
221207 12:24:09 3394611 scitokens_Access: Token not found in recent cache; parsing.
221207 12:24:09 3394611 scitokens_Access: New valid token mapped_username=, subject=http://cilogon.org/serverA/users/XXXXXXX, issuer=https://cilogon.org/jlab, authorizations=/gluex:read,dir,stat,create,mkdir,mv,insert,update,chmod,del
221207 12:24:09 3394611 scitokens_Access: Grant authorization based on scopes for operation=stat, path=/gluex/bbb
221207 12:24:09 3394611 scitokens_Access: Request username bhess
221207 12:24:09 3394611 scitokens_Access: Trying token-based access control
221207 12:24:09 3394611 scitokens_Access: Cached token mapped_username=, subject=http://cilogon.org/serverA/users/XXXXXXX, issuer=https://cilogon.org/jlab, authorizations=/gluex:read,dir,stat,create,mkdir,mv,insert,update,chmod,del
221207 12:24:09 3394611 scitokens_Access: Grant authorization based on scopes for operation=create, path=/gluex/bbb
221207 12:24:09 3394611 scitokens_Access: Request username bhess
221207 12:24:09 3394611 ofs_open: bhess.134552:34@ifarm1802 Unable to open /gluex/bbb; permission denied
221207 12:24:09 3394611 bhess.134552:34@ifarm1802 Xrootd_Response: sending err 3010: Unable to open /gluex/bbb; permission denied
221207 12:24:09 3394611 XrootdXeq: bhess.134552:34@ifarm1802 disc 0:00:01
```
(2) Origin, with multiuser:
```
221207 12:24:09 26506 XrdLinkXeq: anon.0:22@dtn2201 connection upgraded to TLSv1.2
221207 12:24:09 26506 XrootdXeq: p0.3394604:22@dtn2201 pub IP46 TLSv1.2 login as xrootd
221207 12:24:09 26506 multiuser_UserSentry: Switching FS uid for user xrootd
221207 12:24:09 26506 multiuser_UserSentry: Switching FS uid for user xrootd
221207 12:24:09 26506 multiuser_UserSentry: Switching FS uid for user xrootd
221207 12:24:09 26506 multiuser_UserSentry: Switching FS uid for user xrootd
221207 12:24:09 26507 XrdLinkXeq: anon.0:25@dtn2201 connection upgraded to TLSv1.2
221207 12:24:09 26507 XrootdXeq: U2.3394604:25@dtn2201 pub IP46 TLSv1.2 login as http://cilogon.org/serverA/users/6772316 via ztn auth for bhess.134552:34@ifarm1802
221207 12:24:09 26507 multiuser_UserSentry: XRootD mapped request to username that does not exist: http://cilogon.org/serverA/users/6772316
221207 12:24:09 26507 multiuser_UserSentry: XRootD mapped request to username that does not exist: http://cilogon.org/serverA/users/6772316
221207 12:24:09 26507 ofs_open: U2.3394604:25@dtn2201 Unable to create /gluex/bbb; permission denied
221207 12:24:09 26507 U2.3394604:25@dtn2201 Xrootd_Response: sending err 3010: Unable to create /gluex/bbb; permission denied
221207 12:24:09 26507 XrdTLS: U2.3394604:25@dtn2201 TLS error rc=0 ec=6 (zero_return) errno=0.
221207 12:24:09 26507 XrootdXeq: U2.3394604:25@dtn2201 disc 0:00:00
221207 12:24:09 26507 multiuser_UserSentry: XRootD mapped request to username that does not exist: http://cilogon.org/serverA/users/XXXXXXX
```
And here's the token with a few redactions:
{
"sub": "http://cilogon.org/serverA/users/XXXXXXX",
"aud": "ANY",
"ver": "scitoken:2.0",
"nbf": 1670424744,
"scope": "read:/gluex/ write:/gluex/",
"iss": "https://cilogon.org/jlab",
"exp": 1670435549,
"iat": 1670424749,
"jti": "https://cilogon.org/oauth2/XXXX?type=accessToken&ts=XXX&version=v2.0&lifetime=10800000",
"cid": "cilogon:/client_id/XXXXX",
"group": "gluex"
}
--
Reply to this email directly or view it on GitHub:
https://github.com/xrootd/xrootd/issues/1851#issuecomment-1341321182
You are receiving this because you are subscribed to this thread.
Message ID: <[log in to unmask]>
########################################################################
Use REPLY-ALL to reply to list
To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1
