srm: Ensure forward and backward compatibility of SRM third party copy

Addresses compatibility issues with previous 2.2 pools. If not
all components are upgraded to this release at the same time,
SRM MUST be upgraded before any other component can be upgraded.
This version is not compatible with versions of dCache before
2.2.9. Any components older than 2.2.9 MUST be upgraded.

After upgrading to JGlobus 2, we have to remove code that would
send internal globus credentials to older components unable to
deserialize the classes.

Target: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5495/
[fix] Add serialVersionUID field to legacy principals

After migrating to JGlobus 2, we added the old principals from
JGlobus 1 to ensure compatibility with older pools. For reasons
unknown to me, the serial version UID of the SimplePrincipal
class did not match the UID of the class shipped with JGlobus 1.
This prevent dCache 2.5/2.6 from working with dCache pool 2.2,
2.3 and 2.4.

Target: trunk
Request: 2.5
Request: 2.2
Require-book: no
Require-notes: yes
Acked-by: Paul Millar <paul.millar@desy.de>
Acked-by Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5496/
Fix several logging related issues

Addresses logging problems in which log output from libraries
were not logged through the logging system used by dCache.

- Suppress import of log4j and commons-logging
- Use new version of logback for testing too
- Use SLF4J extension for liquibase
- Adjust default log level for liquibase

Target: trunk
Require-notes: yes
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5085/
Committed: master@39cec783d0a9fcfc7984109de8c58991aeb6ebff
Merge pull request #8 from dCache/fix/2.2-sha2/direct_logging_to_slf4j

Fix several logging related issues
pnfsmanager: Fix permission check on root directory

Addresses an issue in which listing the root directory through
FTP fails with a null pointer exception.

The problem has previously been fixed on master, however the
merge to 2.2 was incomplete due to code difference between
the two branches.

Target: 2.2
Request: 2.2
Require-book: no
Require-notes: yes
Ticket: http://rt.dcache.org/Ticket/Display.html?id=7757
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
gplazma: Remove internal principals from reply

Addresses compatibilty issues between 2.2 head nodes and 1.9.12 pools.

Some plugins, like the kpwd plugin, do not fit well into gPlazma 2's
architecture. The kpwd file plays the role of all four steps of a
gPlazma login and the plugin must do tricks to pass information from
one phase to the next. It does this by injecting a KpwdPrincipal that
holds the kpwd record.

Unfortunately, this principal escapes gPlazma and is passed along to
other dCache components as part of the Subject. Besides exposing
plugin specific internal principals, and making the subject unnecessarily
larger, this poses a compatbility problems with 1.9.12 pools - these
pools do not have the means to deserialize the internal KpwdPrincipal.

This patch solves the problem by removing all non-public principals
before constructing the gPlazma reply.

Target: 2.2
Require-notes: yes
Require-book: no
Patch: http://rb.dcache.org/r/5487/
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
pool: Don't claim a restore was successfull when it failed

Addresses the issue that the pool logs "File successfully
restored from tape" no matter whether the restore was
successful or not.

Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5485/
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
billing: add flag to turn plotting on/off; fix SQL for migration scripts

module: dcache services billing

When running the liquibase changesets on the billing database from 1.9.12+, there may be interference from the plotting thread which runs in a separate thread and already begins to execute queries on non-existent views.  This might actually cause the creation of the additional triggers to hang inside of the liquibase thread.

This version of billing never added the ability to turn plot generation on or off.  We add that capability here, and recommend that plots be turned off when running the upgraded dCache for the first time.

It also came to my attention that a patch fixing some typos in the migration scripts provided in shared/migration was never merged to this branch, so I have included those fixes as well (see http://rb.dcache.org/r/4389, trunk@17253).

Target: 2.2
Patch: http://rb.dcache.org/r/5500/
Merge-req: http://rt.dcache.org/Ticket/Display.html?id=7784
Require-book: no
Require-notes: yes
Acked-by: Tigran

RELEASE NOTES:  Adds ability, via the "generatePlots" property (found in later versions), to turn plotting off or on (on by default).  This is recommended when running the first time, since the plotting thread may interfere with the liquibase migration.  The sql migration scripts (in shared/migration) also had a some typographical problems which have been corrected.

Tested on testbed.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
cleaner: Fix null pointer exception in 'hsms attached to pool' command

Addresses a null pointer exception in the cleaner.

Ticket: http://rt.dcache.org/Ticket/Display.html?id=7769
Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5493/
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
gplazma2-jaas: add principal mutator plugin

JAAS plug in can be configured to use any jaas login module. As a
result we may get principas which can't be handles by gplazma. New
MutatorPlugin allows to convert some principals to supported equivalents.

in gplazma.conf:
auth jaas
...
map optional mutator gplazma.mutator.accept=org.apache.activemq.jaas.UserPrincipal gplazma.mutator.produce=username
map sufficient nsswitch
...

The supported output types:
   dn
   name
   username
   kerberos
   fqan

Ticket: #7763
Acked-by: Paul Millar
Target: trunk, 2.6, 2.2
Require-book: yes
Require-notes: yes
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
jaas: fix java6 compatibility

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
all: Avoid error when hostkey is not readable to user

The dcache script checks the format of the hostkey whenever it is invoked.
Since read-access to the hostkey should be restricted, the dcache script will
generate an error whenever the script is invoked by somebody without
read-access to the hostkey.

This patch resolves the problem.

(there is a related question about whether the check should be run for
commands like 'dcache status', but we can discuss that another day)

Release notes: In a section about the dcache script, describe that we
fixed a bug that caused 'grep: /etc/grid-security/hostkey.pem: Permission
denied' to be printed.

Target: trunk
Request: 2.2
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/4476/
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>