At some point, I was also interested in this. But at this moment I don't think we can use Macaroon token in xroot protocol.

On the other hard, Xrootd TPC's rendezvous token is a similar concept to the Macaroon token though it is generated by a different mechanism. Is there a specific use case you are looking for that is not available in the rendezvous token but may be available in Macaroon token ?

​--
Wei​

________________________________________
From: Marcus Lee <[log in to unmask]>
Sent: Wednesday, February 22, 2023 9:51 AM
To: Hanushevsky, Andrew Bohdan
Cc: Yang, Wei; [log in to unmask]
Subject: Re: Bearer tokens for the root protocol

What I am trying to do is configure xrootd such that when you do tpc over the root protocol it uses a macaroon token for authentication between the two endpoints similar to what happens over the http protocol when you use the libXrdMacaroons library. Does this functionality exist, and if so how can I configure xrootd to do this?


Thanks,

________________________________
From: Andrew Hanushevsky <[log in to unmask]>
Sent: Tuesday, February 21, 2023 6:28:40 PM
To: Marcus Lee
Cc: Yang, Wei; [log in to unmask]
Subject: Re: Bearer tokens for the root protocol

Well, not really. A rendezvous token is a special token used strictly for
TPC transfers so a macaroon would not be considered a rendezvous token.
That doesn't mean you can't use a Macaroon but you would have to supply it
in one of the headers for http or on the url for xroot. It's actually
immaterial whether or not gsi is used here.

On Tue, 21 Feb 2023, Marcus Lee wrote:

>
> Is it possible for the rendezvous token to be a macaroons token while using gsi for authentication between the client and the server?
>
>
> ________________________________
> From: Yang, Wei <[log in to unmask]>
> Sent: Wednesday, February 15, 2023 4:32:51 PM
> To: Marcus Lee; [log in to unmask]
> Subject: Re: Bearer tokens for the root protocol
>
> Hi Marcus,
>
> The short answer is yes. In Xrootd TPC (TPC via root protocol), there are two scenarios. They should be transparent to users:
>
> 1. if x509 authentication is used, we delegate the x509 proxy to the destination, which then pull the data from source
> 2. if other authentication methods are used, the client helps to establish a rendezvous token (a shared secret) exchange with both ends, to facilitate the transfer.
>
> in 1) the x09 security itself helps securing the delegation of x509 proxy. in 2), the rendezvous token exchange depends on the transport layer. So only when both ends use TLS (roots, available in 5.3.x+ I believe) can this process be secured.
>
> So with bearer token (ZTN), it should work but you need to make sure both end use TLS.
>
> --
> Wei
>
> ________________________________________
> From: [log in to unmask] <[log in to unmask]> on behalf of Marcus Lee <[log in to unmask]>
> Sent: Wednesday, February 15, 2023 1:00 PM
> To: [log in to unmask]
> Subject: Bearer tokens for the root protocol
>
> Hello,
>
>
> I am wondering if XRootD TPC supports authentication methods other than delegated x509 for the root protocol such as bearer tokens for example?
>
>
> I know for https you can load more libraries with http.exthandler such as macroons or scitokens library, but is there anything similar for root?
>
>
> Thanks
>
> ________________________________
>
> Use REPLY-ALL to reply to list
>
> To unsubscribe from the XROOTD-L list, click the following link:
> https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1
>
> ########################################################################
> Use REPLY-ALL to reply to list
>
> To unsubscribe from the XROOTD-L list, click the following link:
> https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1
>


########################################################################
Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-L list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1