Skip to content

Configuration of auth method in cta-admin-grpc

Let's discuss how we want to specify which authentication method will be used by cta-admin-grpc : JWT (case for scripts) or Kerberos (case for operators)?

The XRootD/SSI way

Currently, the XRootD/SSI implementation chooses this based on environment variables, specifically XrdSecPROTOCOL. It is the XRootD/SSI framework that checks the value of this env variable and chooses to use the corresponding authentication method.

On the client side, if for example SSS is to be used, then we are required do the following:

export XrdSecPROTOCOL=sss
export XrdSecSSSKT=/etc/cta/eos.sss.keytab
cta-admin tape ls

and if Kerberos is to be used, then do:

kinit user@REALM
export XrdSecPROTOCOL=krb5
cta-admin tape ls

The gRPC way - what we need to discuss

I propose to mirror what XRootD/SSI does and use environment variables as well. Something like CTA_ADMIN_GRPC_AUTH_METHOD:

  1. For JWT:
export CTA_ADMIN_GRPC_AUTH_METHOD=jwt
cta-admin tape ls
  1. For Kerberos:
kinit user@REALM
export CTA_ADMIN_GRPC_AUTH_METHOD=krb5
cta-admin tape ls

And, perhaps, if nothing is specified, we can use one of the two as the default?

Edited by Konstantina Skovola