Skip to content

LCGDM-2961 Introduce new TokenId configuration none

Petr Vokac requested to merge vokac/dmlite:remove-client-ip-from-token into develop

DPM provides client IP based security as a part of token that is generated during headnode to disknode redirection. This allows "secure" operations on disknode without using HTTPS, but it can cause issues especially on long distance transfers, because happy-eyeball connection mechanism implemented in recent curl can lead to different client address (IPv4 vs. IPv6) used for communication with headnode/disknode. Since we started to use Bearer tokens all WebDAV transfers must be secured with TLS se we can drop client ip from TokenId and avoid issues with different client IP address.

Default configuration is preserved, because changing default TokenId to none breaks compatibility with existing installation and can be done only once all DPM machines upgrade to the dmlite version that supports "TokenId none".

Merge request reports