Add support for tokens requested via oidc-agent.

[bbockelm]

Example invocation:

./bin/smoke-test.sh -o WLCG-XFER -t wlcg https://red-gridftp1.unl.edu:1094/user/dteam

(assuming that you have already run oidc-add WLCG-XFER)

[bbockelm]

Ok, I am done hacking for the day! Ready for review...

[paulmillar]

I'm happy with the patch as-is.

I've made a few commands. There are no show-stoppers, but would appreciate it if you could check the comments.

[paulmillar]

[Unfortunately, githib doesn't allow me to make this comment any earlier]

I think the patch should define WLCG_THIRDPARTY_PRIVATE_URL and WLCG_THIRDPARTY_UPLOAD_BASE_URL (as with dteam, escape and atlas VOs), and update the code to use these default values if the client configures smoke-test to use the wlcg VO.

[bbockelm]

Hi @paulmillar -

Finally started to look at this and I noticed that something appears to be misconfigured on the prometheus side.

This works:

voms-proxy-init -voms dteam
curl --verbose --connect-timeout 60 -D /tmp/tmp.CNpXBTEwRC \
   -s -f -L  --capath /etc/grid-security/certificates -H 'X-No-Delegate: true' \
   --cacert /tmp/x509up_u1221 -E /tmp/x509up_u1221 -H 'Credential: none' \
   -m30 -X POST -H 'Content-Type: application/macaroon-request' \
   -d '{"caveats": ["activity:DOWNLOAD"], "validity": "PT30M"}' -o/tmp/tmp.FbihlmyRjK \
   https://prometheus.desy.de:2443/VOs/dteam/private-file

This doesn't work:

voms-proxy-init -voms wlcg
curl --verbose --connect-timeout 60 -D /tmp/tmp.CNpXBTEwRC \
   -s -f -L  --capath /etc/grid-security/certificates -H 'X-No-Delegate: true' \
   --cacert /tmp/x509up_u1221 -E /tmp/x509up_u1221 -H 'Credential: none' \
   -m30 -X POST -H 'Content-Type: application/macaroon-request' \
   -d '{"caveats": ["activity:DOWNLOAD"], "validity": "PT30M"}' -o/tmp/tmp.FbihlmyRjK \
   https://prometheus.desy.de:2443/VOs/wlcg/private-file

Only difference is replacing the dteam string with wlcg. Access with DAVIX clients appears OK, so I think X.509 auth is working overall -- but perhaps just an issue with the macaroon generation?

[paulmillar]

Yes, indeed. The problem was that prometheus was missing the .lsc file for the WLCG VOMS server.

I've installed the missing file, so the problem should be fixed now.

Could you give it another go?

[bbockelm]

Ok, I think I got the comments addressed - except for this issue (I think) with the WLCG VO requesting macaroons noted above.