Hi Andy,

I checked out the stable 5.4 branch from GH and built, this was not an rpm.   And I was experiencing the same issue as our users.

On the other hand, if I check out master from GH, it builds and the libraries are there.   So evidently something more needs to be done for the stable branch to get the SciTokens library ...

I think this is important because evidently the experiment that built the client for its users did the same thing ... built without the SciTokens library.

Thanks, Al
________________________________________________
Albert L. Rossi
Senior Software Developer
Scientific Computing Division, Scientific Data Services, Distributed Data Development
WH 566
Fermi National Accelerator Laboratory
Batavia, IL 60510
(630) 840-3023

From: [log in to unmask] <[log in to unmask]> on behalf of Andrew Hanushevsky <[log in to unmask]>
Sent: Thursday, February 16, 2023 7:53 PM
To: [log in to unmask] <[log in to unmask]>
Cc: Dmitry O Litvintsev <[log in to unmask]>
Subject: Re: 5.4.3 and tokens
 
Right, if you don't have the SciTokens library then we can't build ztn.
However an rpm install should have it even though it might not be ble to
be used because of the missing libraries. Obviously, the libraries are
there because copying ztn over still works. Likely you don't have the
devel package installed (i.e. no /usr/include/scitokens) which disables
building all of that.

Andy


On Fri, 17 Feb 2023, Albert Rossi wrote:

> Final point.
>
> I was trying to figure out how to activate the BUILD_SCITOKENS flag.   Haven't been able to yet.
>
> But if I simply copy the missing library from the master build into the 5.4.3 installation, it works.
>
>
> [arossi@fndcatemp1 ~]$ xrdcp54 -f xroots://fndcatemp2.fnal.gov:1095//pnfs/fs/usr/fermilab/users/arossi/tape/data_1b /dev/null
> [1B/1B][100%][==================================================][1B/s]
>
> -Al
>
>
> ________________________________________________
> Albert L. Rossi
> Senior Software Developer
> Scientific Computing Division, Scientific Data Services, Distributed Data Development
> WH 566
> Fermi National Accelerator Laboratory
> Batavia, IL 60510
> (630) 840-3023
>
> ________________________________
> From: [log in to unmask] <[log in to unmask]> on behalf of Albert Rossi <[log in to unmask]>
> Sent: Thursday, February 16, 2023 6:11 PM
> To: Albert Rossi <[log in to unmask]>; [log in to unmask] <[log in to unmask]>
> Cc: Dmitry O Litvintsev <[log in to unmask]>
> Subject: Re: 5.4.3 and tokens
>
> (The reason we ask is because we have some users with 5.4.3 who were trying to do token authentication and were failing with this error.)
>
>
> ________________________________________________
> Albert L. Rossi
> Senior Software Developer
> Scientific Computing Division, Scientific Data Services, Distributed Data Development
> WH 566
> Fermi National Accelerator Laboratory
> Batavia, IL 60510
> (630) 840-3023
>
> ________________________________
> From: Albert Rossi <[log in to unmask]>
> Sent: Thursday, February 16, 2023 6:10 PM
> To: Albert Rossi <[log in to unmask]>; [log in to unmask] <[log in to unmask]>
> Cc: Dmitry O Litvintsev <[log in to unmask]>
> Subject: Re: 5.4.3 and tokens
>
> Andy,
>
> from our diagnosis, it would seem that the 5.4 stable (5.4.3) branch is missing the dynamic library in the lib64 directory.
>
> I see no libXrdSecztn-5.so there.
>
> Do you need to do something special to build this?
>
> Thanks, Al
>
> ________________________________________________
> Albert L. Rossi
> Senior Software Developer
> Scientific Computing Division, Scientific Data Services, Distributed Data Development
> WH 566
> Fermi National Accelerator Laboratory
> Batavia, IL 60510
> (630) 840-3023
>
> ________________________________
> From: [log in to unmask] <[log in to unmask]> on behalf of Albert Rossi <[log in to unmask]>
> Sent: Thursday, February 16, 2023 12:34 PM
> To: [log in to unmask] <[log in to unmask]>
> Cc: Dmitry O Litvintsev <[log in to unmask]>
> Subject: 5.4.3 and tokens
>
> Hello again (Andy),
>
> A new question.
>
> When I try to use the 5.4.3 client, I get the following error:
>
> [arossi@fndcatemp1 ~]$ xrdcp54 -f xroot://fndcatemp2.fnal.gov:1094//pnfs/fs/usr/fermilab/users/arossi/tape/data_1b /dev/null
> Plugin version SecClnt v5.4.3 is incompatible with secztn v5.5.1 (must be <= 5.4.x) in sec.protocol libXrdSecztn-5.so
> [1B/1B][100%][==================================================][0B/s]
>
> debug log (relevant lines):
>
> [2023-02-16 12:18:30.220151 -0600][Debug  ][XRootDTransport   ] [fndcatemp2.fnal.gov:1094.0] kXR_protocol successful (type: manager [], protocol version 500)
>
> [2023-02-16 12:18:30.220416 -0600][Debug  ][XRootDTransport   ] [fndcatemp2.fnal.gov:1094.0] Sending out kXR_login request, username: arossi, cgi: xrd.cc=us&xrd.tz=-6&xrd.appname=xrdcp&xrd.info=&xrd.hostname=fndcatemp1.fnal.gov&xrd.rn=v5.4.3, dual-stack: false, private IPv4: false, private IPv6: false
>
> [2023-02-16 12:18:30.220455 -0600][Debug  ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] TLS hand-shake exchange.
>
> [2023-02-16 12:18:30.231664 -0600][Debug  ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] TLS hand-shake exchange.
>
> [2023-02-16 12:18:30.236217 -0600][Debug  ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] TLS hand-shake exchange.
>
> [2023-02-16 12:18:30.236454 -0600][Info   ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] TLS hand-shake done.
>
> [2023-02-16 12:18:30.236564 -0600][Dump   ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] Wrote a message:  (0x50000be0), 118 bytes
>
> [2023-02-16 12:18:30.257334 -0600][Dump   ][XRootDTransport   ] [msg: 0x5003e290] Expecting 70 bytes of message body
>
> [2023-02-16 12:18:30.257384 -0600][Dump   ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] Received message header, size: 8
>
> [2023-02-16 12:18:30.257407 -0600][Dump   ][AsyncSock         ] [fndcatemp2.fnal.gov:1094.0] Received a message of 78 bytes
>
> [2023-02-16 12:18:30.257433 -0600][Debug  ][XRootDTransport   ] [fndcatemp2.fnal.gov:1094.0] Logged in, session: 3764e358bab6a3b2a07c00a87cd61c95
>
> [2023-02-16 12:18:30.257450 -0600][Debug  ][XRootDTransport   ] [fndcatemp2.fnal.gov:1094.0] Authentication is required: &P=ztn,0:4096:&P=gsi,v:10400,c:ssl,ca:f5f0dfc2&P=unix
>
> [2023-02-16 12:18:30.257476 -0600][Debug  ][XRootDTransport   ] [fndcatemp2.fnal.gov:1094.0] Sending authentication data
>
> Plugin version SecClnt v5.4.3 is incompatible with secztn v5.5.1 (must be <= 5.4.x) in sec.protocol libXrdSecztn-5.so
>
>
>
> master of course (that's my client wrapper xrdcp5x) works fine, of course:
>
> [arossi@fndcatemp1 ~]$ xrdcp5x -f xroot://fndcatemp2.fnal.gov:1094//pnfs/fs/usr/fermilab/users/arossi/tape/data_1b /dev/null
> [1B/1B][100%][==================================================][0B/s]
>
>
> Is dCache not doing something we should be here?
>
> Thanks,
>
> Al
> ________________________________________________
> Albert L. Rossi
> Senior Software Developer
> Scientific Computing Division, Scientific Data Services, Distributed Data Development
> WH 566
> Fermi National Accelerator Laboratory
> Batavia, IL 60510
> (630) 840-3023
>
>
> ________________________________
>
> Use REPLY-ALL to reply to list
>
> To unsubscribe from the XROOTD-L list, click the following link:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwIBAg&c=gRgGjJ3BkIsb5y6s49QqsA&r=60rQ0HHqHmEY1P6VSdyuTQ&m=oRqyauVXeX44j-rgqqc4PVZQYnzzGDxNzO_p0CmIY8492ciIj3atsNBefOxSjd1M&s=EGvjR5-LRzGhpYGtDT91NCib72FjfzRIN9pWNDCtzV8&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwMFAw&c=gRgGjJ3BkIsb5y6s49QqsA&r=60rQ0HHqHmEY1P6VSdyuTQ&m=0gwuw63frxwIKC7BofRYgZjZBJzJDjmColi1CJg1rHEW37tnPTVAzORqb3dqyPp3&s=4PSCp7BtPNYBmR3_lBU4pK5Gsl8vTA8ByWWlPKSN98Q&e=>
>
> ________________________________
>
> Use REPLY-ALL to reply to list
>
> To unsubscribe from the XROOTD-L list, click the following link:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwIBAg&c=gRgGjJ3BkIsb5y6s49QqsA&r=60rQ0HHqHmEY1P6VSdyuTQ&m=oRqyauVXeX44j-rgqqc4PVZQYnzzGDxNzO_p0CmIY8492ciIj3atsNBefOxSjd1M&s=EGvjR5-LRzGhpYGtDT91NCib72FjfzRIN9pWNDCtzV8&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwMFAg&c=gRgGjJ3BkIsb5y6s49QqsA&r=60rQ0HHqHmEY1P6VSdyuTQ&m=qlsJ2bPlJxXltOT4mlLGPdHndUd9lJqQ2wcseMbIgJgP3Thw_dH2Rw0Q47COTYyK&s=CbBl2X-dJ1Uvsgreb1nH0ckvuMw89_S6m8qpXpdg9SQ&e=>
>
> ########################################################################
> Use REPLY-ALL to reply to list
>
> To unsubscribe from the XROOTD-L list, click the following link:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwIBAg&c=gRgGjJ3BkIsb5y6s49QqsA&r=60rQ0HHqHmEY1P6VSdyuTQ&m=oRqyauVXeX44j-rgqqc4PVZQYnzzGDxNzO_p0CmIY8492ciIj3atsNBefOxSjd1M&s=EGvjR5-LRzGhpYGtDT91NCib72FjfzRIN9pWNDCtzV8&e=
>

########################################################################
Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-L list, click the following link:
https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwIBAg&c=gRgGjJ3BkIsb5y6s49QqsA&r=60rQ0HHqHmEY1P6VSdyuTQ&m=oRqyauVXeX44j-rgqqc4PVZQYnzzGDxNzO_p0CmIY8492ciIj3atsNBefOxSjd1M&s=EGvjR5-LRzGhpYGtDT91NCib72FjfzRIN9pWNDCtzV8&e=

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-L list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1