search

DUNE / data-mgmt-ops

3 stars 3 forks source link

Jobs with both tokens and proxies use tokens first to write to dCache #276

Closed StevenCTimm closed 1 year ago

StevenCTimm commented 1 year ago

Seeing an incident where user was denied to write to /pnfs/persistent/users area, it appears that token auth took precedence over x.509 proxy auth and the dune storage token scope doesn't allow to write to anywhere in persistent by default.

dCache admins are figuring out what to do about this, they may shift back to a multiple door system on xrootd where 1094/1096 are unauthenticated and 1097 is for token access.

StevenCTimm commented 1 year ago

This has now been fixed at least for the moment. Old xrootd v4 or less has to use a different port going forward. They got rid of the xrootds protocol.