pnfsmanager: Fix permission check on root directory

Addresses an issue in which listing the root directory through
FTP fails with a null pointer exception.

The problem has previously been fixed on master, however the
merge to 2.2 was incomplete due to code difference between
the two branches.

Target: 2.2
Request: 2.2
Require-book: no
Require-notes: yes
Ticket: http://rt.dcache.org/Ticket/Display.html?id=7757
Merge pull request #1 from dCache/fix/parent-check

pnfsmanager: Fix permission check on root directory
gplazma: Remove internal principals from reply

Addresses compatibilty issues between 2.2 head nodes and 1.9.12 pools.

Some plugins, like the kpwd plugin, do not fit well into gPlazma 2's
architecture. The kpwd file plays the role of all four steps of a
gPlazma login and the plugin must do tricks to pass information from
one phase to the next. It does this by injecting a KpwdPrincipal that
holds the kpwd record.

Unfortunately, this principal escapes gPlazma and is passed along to
other dCache components as part of the Subject. Besides exposing
plugin specific internal principals, and making the subject unnecessarily
larger, this poses a compatbility problems with 1.9.12 pools - these
pools do not have the means to deserialize the internal KpwdPrincipal.

This patch solves the problem by removing all non-public principals
before constructing the gPlazma reply.

Target: 2.2
Require-notes: yes
Require-book: no
Patch: http://rb.dcache.org/r/5487/
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Merge pull request #3 from dCache/fix/2.2/gplazma-internal-principals

gplazma: Remove internal principals from reply
pool: Resolve 'no such provider: BC' error in SRM 3rd party copy

Addresses an issue in which third party srm copy transfers failed
with a "no such provider: BC" error in pools. The problem is a
regression introduced in dCache 2.2.9.

JGlobus and other code on-demand loads the bouncy castle provider
automatically. If the pool is loaded together with such
components, the error does not occur. However on its own, there
may be no code that loads bouncy castle and thus the third party
copy fails.

Target: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5499/
pool: Don't claim a restore was successfull when it failed

Addresses the issue that the pool logs "File successfully
restored from tape" no matter whether the restore was
successful or not.

Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5485/
Merge pull request #5 from dCache/fix/2.2/load-bc-provider

pool: Resolve 'no such provider: BC' error in SRM 3rd party copy
Merge pull request #6 from dCache/fix/2.2/dont_claim_success_on_failed_restore

pool: Don't claim a restore was successfull when it failed
billing: add flag to turn plotting on/off; fix SQL for migration scripts

module: dcache services billing

When running the liquibase changesets on the billing database from 1.9.12+, there may be interference from the plotting thread which runs in a separate thread and already begins to execute queries on non-existent views.  This might actually cause the creation of the additional triggers to hang inside of the liquibase thread.

This version of billing never added the ability to turn plot generation on or off.  We add that capability here, and recommend that plots be turned off when running the upgraded dCache for the first time.

It also came to my attention that a patch fixing some typos in the migration scripts provided in shared/migration was never merged to this branch, so I have included those fixes as well (see http://rb.dcache.org/r/4389, trunk@17253).

Target: 2.2
Patch: http://rb.dcache.org/r/5500/
Merge-req: http://rt.dcache.org/Ticket/Display.html?id=7784
Require-book: no
Require-notes: yes
Acked-by: Tigran

RELEASE NOTES:  Adds ability, via the "generatePlots" property (found in later versions), to turn plotting off or on (on by default).  This is recommended when running the first time, since the plotting thread may interfere with the liquibase migration.  The sql migration scripts (in shared/migration) also had a some typographical problems which have been corrected.

Tested on testbed.
Merge pull request #9 from alrossi/2.2

billing: add flag to turn plotting on/off; fix SQL for migration scripts
cleaner: Fix null pointer exception in 'hsms attached to pool' command

Addresses a null pointer exception in the cleaner.

Ticket: http://rt.dcache.org/Ticket/Display.html?id=7769
Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5493/
gplazma2-jaas: add principal mutator plugin

JAAS plug in can be configured to use any jaas login module. As a
result we may get principas which can't be handles by gplazma. New
MutatorPlugin allows to convert some principals to supported equivalents.

in gplazma.conf:
auth jaas
...
map optional mutator gplazma.mutator.accept=org.apache.activemq.jaas.UserPrincipal gplazma.mutator.produce=username
map sufficient nsswitch
...

The supported output types:
   dn
   name
   username
   kerberos
   fqan

Ticket: #7763
Acked-by: Paul Millar
Target: trunk, 2.6, 2.2
Require-book: yes
Require-notes: yes
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Merge pull request #11 from gbehrmann/fix/2.2/rb5493

cleaner: Fix null pointer exception in 'hsms attached to pool' command
all: Avoid error when hostkey is not readable to user

The dcache script checks the format of the hostkey whenever it is invoked.
Since read-access to the hostkey should be restricted, the dcache script will
generate an error whenever the script is invoked by somebody without
read-access to the hostkey.

This patch resolves the problem.

(there is a related question about whether the check should be run for
commands like 'dcache status', but we can discuss that another day)

Release notes: In a section about the dcache script, describe that we
fixed a bug that caused 'grep: /etc/grid-security/hostkey.pem: Permission
denied' to be printed.

Target: trunk
Request: 2.2
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/4476/
Merge pull request #12 from gbehrmann/fix/2.2/fix_unreadable_hostkey

all: Avoid error when hostkey is not readable to user
jaas: fix java6 compatibility
Merge remote-tracking branch 'upstream/2.2' into 2.2
DN principal fix.
eliminated static call.
SRM: don't talk to SpaceManager when disabled

There is a configuration value describing whether or not space-manager
is enabled.  Currently, SRM sends messages to space-manager even when
space-manager is disabled.  Because of this, sites are required to run
space-manager, even when it is disabled.

This patch alters the SRM so that if space-manager is disabled then not
communication with space-manager is attempted.  Under this circumstance,
SRM will report any space-token information for srmLs operations and
space-specific operations will fail with a friendly error message.

Conflicts:
	modules/dcache/src/main/java/diskCacheV111/srm/dcache/Storage.java
	modules/dcache/src/main/resources/diskCacheV111/srm/srm.xml
	skel/share/services/srm.batch