dCache/dcache — pull request #236 by alrossi (2013-10-16 14:20:46+00:00)
Title: (2.2) javatunnel: add certificate chain to subject

Failing XACML authentication through the gsidcap door.

The issue is that XACML, being both an auth and map plugin, requires the full certificate chain to be in the Subject. The gsi tunnel was

The tunnel now extracts the chain from the GSSCredential object and places it in the public credentials set of the subject.

Testing:

Before the patch, the XACML plugin would fail because it had incomplete information and which it processed in a faulty manner. The error

[DCap-gsi-00-fndca4a-/DC=com/DC=DigiCert-Grid/O=Open Science
Grid/OU=People/CN=Kenneth Herner 1385-133 Login AUTH xacml] mapping
service
https://gums.fnal.gov:8443/gums/services/GUMSXACMLAuthorizationServicePort
returned localId LocalId[] for VomsExtensions[X509Subject='/fermilab',
X509SubjectIssuer='null', fqan='null', primary=false, VO='null',
VOMSSubject='null', VOMSSubjectIssuer='null']

After the patch, the dccp operation succeeds.

Target: 2.2
Patch: http://rb.dcache.org/r/6112/
Require-book: no
Require-notes: yes
Acked-by: Tigran
Committed: df5cb39f86ada65c965a33456cc7fe98e8e62a30

RELEASE NOTES:
Fixes a bug whereby a combination of gsidcap with a VOMS cert and XACML authentication/mapping failed to authorize the user.