pnfsmanager: Fix permission check on root directory

Addresses an issue in which listing the root directory through
FTP fails with a null pointer exception.

The problem has previously been fixed on master, however the
merge to 2.2 was incomplete due to code difference between
the two branches.

Target: 2.2
Request: 2.2
Require-book: no
Require-notes: yes
Ticket: http://rt.dcache.org/Ticket/Display.html?id=7757
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
gplazma: Remove internal principals from reply

Addresses compatibilty issues between 2.2 head nodes and 1.9.12 pools.

Some plugins, like the kpwd plugin, do not fit well into gPlazma 2's
architecture. The kpwd file plays the role of all four steps of a
gPlazma login and the plugin must do tricks to pass information from
one phase to the next. It does this by injecting a KpwdPrincipal that
holds the kpwd record.

Unfortunately, this principal escapes gPlazma and is passed along to
other dCache components as part of the Subject. Besides exposing
plugin specific internal principals, and making the subject unnecessarily
larger, this poses a compatbility problems with 1.9.12 pools - these
pools do not have the means to deserialize the internal KpwdPrincipal.

This patch solves the problem by removing all non-public principals
before constructing the gPlazma reply.

Target: 2.2
Require-notes: yes
Require-book: no
Patch: http://rb.dcache.org/r/5487/
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
pool: Don't claim a restore was successfull when it failed

Addresses the issue that the pool logs "File successfully
restored from tape" no matter whether the restore was
successful or not.

Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5485/
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
billing: add flag to turn plotting on/off; fix SQL for migration scripts

module: dcache services billing

When running the liquibase changesets on the billing database from 1.9.12+, there may be interference from the plotting thread which runs in a separate thread and already begins to execute queries on non-existent views.  This might actually cause the creation of the additional triggers to hang inside of the liquibase thread.

This version of billing never added the ability to turn plot generation on or off.  We add that capability here, and recommend that plots be turned off when running the upgraded dCache for the first time.

It also came to my attention that a patch fixing some typos in the migration scripts provided in shared/migration was never merged to this branch, so I have included those fixes as well (see http://rb.dcache.org/r/4389, trunk@17253).

Target: 2.2
Patch: http://rb.dcache.org/r/5500/
Merge-req: http://rt.dcache.org/Ticket/Display.html?id=7784
Require-book: no
Require-notes: yes
Acked-by: Tigran

RELEASE NOTES:  Adds ability, via the "generatePlots" property (found in later versions), to turn plotting off or on (on by default).  This is recommended when running the first time, since the plotting thread may interfere with the liquibase migration.  The sql migration scripts (in shared/migration) also had a some typographical problems which have been corrected.

Tested on testbed.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
cleaner: Fix null pointer exception in 'hsms attached to pool' command

Addresses a null pointer exception in the cleaner.

Ticket: http://rt.dcache.org/Ticket/Display.html?id=7769
Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5493/
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
gplazma2-jaas: add principal mutator plugin

JAAS plug in can be configured to use any jaas login module. As a
result we may get principas which can't be handles by gplazma. New
MutatorPlugin allows to convert some principals to supported equivalents.

in gplazma.conf:
auth jaas
...
map optional mutator gplazma.mutator.accept=org.apache.activemq.jaas.UserPrincipal gplazma.mutator.produce=username
map sufficient nsswitch
...

The supported output types:
   dn
   name
   username
   kerberos
   fqan

Ticket: #7763
Acked-by: Paul Millar
Target: trunk, 2.6, 2.2
Require-book: yes
Require-notes: yes
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
jaas: fix java6 compatibility

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
all: Avoid error when hostkey is not readable to user

The dcache script checks the format of the hostkey whenever it is invoked.
Since read-access to the hostkey should be restricted, the dcache script will
generate an error whenever the script is invoked by somebody without
read-access to the hostkey.

This patch resolves the problem.

(there is a related question about whether the check should be run for
commands like 'dcache status', but we can discuss that another day)

Release notes: In a section about the dcache script, describe that we
fixed a bug that caused 'grep: /etc/grid-security/hostkey.pem: Permission
denied' to be printed.

Target: trunk
Request: 2.2
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/4476/
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>