About RAL setup, old xroot version and XrdSecGSIDELEGPROXY variable

[chaen]

LHCb observed jobs at RAL with pilot spitting lines like

secgsi: proxy delegation forbidden when trusting DNS to resolve 'eoslhcb.cern.ch'!

That is reported here: https://ggus.eu/?mode=ticket_info&ticket_id=160597

After debugging, it turns out to be due to an environment variable XrdSecGSISRVNAMES set by RAL to allow their Echo system to work with old xroot versions which do not have support for SAN certificates.

The reason why we are hitting this code path is because the variable XrdSecGSIDELEGPROXY is set on the DIRAC side. This was done (#5217) in order to allow dirac-dms-lfn-replicate to perform TPC between two xroot endpoints.

So here we have multiple options:

• Live with the warning (fine with me)
• Remove the XrdSecGSIDELEGPROXY variable, as xroot TPC is not supposed to be a thing anymore (go https !)
• Set XrdSecGSIDELEGPROXY only on client and servers but not on the jobs (no mechanism for that at the moment)

Opinions ?

[marianne013]

Hey, what are you saying about my code ???
I have the horrible feeling this might still be in use by T2K.

[chaen]

Nothing about the code itself ;-)
Could you check with T2K ?

[marianne013]

This does not look good:
https://ggus.eu/index.php?mode=ticket_info&ticket_id=158926
Maybe you could ignore the warnings for now ?

[chaen]

You could try to change it all to HTTPs :-)

But indeed, we will probably ignore.
There's another option I had not considered, which was to set this environment variable later in the call (when actually doing the copy, and not instantiating the class). I'll have a look at that