WLCG AuthZ Call

Thursday Aug 13, 2026, 4:00 PM → 5:00 PM Europe/Zurich

Notes:

Previous Actions:

•  

Proposed agenda:

• TBC - in email

 

Zoom meeting:

Link below, in the videoconference section. Please ensure you are signed in to Indico to see the meeting password!

Next Meeting: 

• Aug 27

token-exchange-wlcg-authz.pdf

Present: Anders, Angela, Anil (JLab) Federica, Jeff, Maarten (notes), Matt, Petr, Stephan

Notes:

The main topic of the meeting concerns the matter described in the presentation attached to the agenda. Anil first introduces himself: he is a staff scientist working at Jefferson Lab, supporting several experiments for which he looked into getting FTS transfers to work that are submitted by Rucio using tokens from CILogon. He then ran into and debugged the issue described in the presentation. In the desired workflow, the FTS exchanges each short-lived access token received from Rucio for a new access token plus refresh token, such that it can keep refreshing the access token for as long as needed. The FTS code involved has been made to work with IAM, whose replies to the exchange requests turned out to violate the RFC that describes such workflows. IAM development team lead Enrico agrees that IAM will need to change and do things correctly, which also implies that the FTS code will have to be adjusted. He already prepared a corresponding PR for IAM.

Maarten observes that it looks possible for the FTS code to keep supporting what is currently in production, while also supporting the correct behavior, because the CILogon and IAM responses have different type fields that can drive different code paths. FTS development team lead Mihai already replied in a SNow ticket opened by Anil that the matter will be looked into for FTS4, while the FTS3 code will not be fixed for this. In the meantime, the experiments concerned should be fine with a workaround, viz. using access tokens with 6-hour lifetimes during which most transfers should normally succeed, while Rucio will resubmit the ones that ran out of time. Federica adds that this matter will be further discussed at the IAM Workshop and Hackathon from Aug 31 through Sep 3.

The experiments concerned could be early adopters of FTS4 when it can be deployed beyond CERN. Petr points out it is already in such a good shape that most ATLAS disk-to-disk traffic is handled by FTS4. About 1/3 is using tokens, configured manually; the remainder will be done through automation in the near future. He has even tested the first tape operations with tokens between the dCache instances at KIT and Prague, and plans to report on these and other matters at the XRootD and FTS workshop, Sep 14-18.

Petr also points out that experiments could temporarily switch back to X509 / VOMS if that would allow the transition to the correct token exchange behavior to proceed more conveniently. He also intends to present ATLAS requests at the IAM Workshop. Anders expects that a preliminary timetable will be posted by the middle of next week.

Dave points out there may be other usage of the token exchange workflow as it is currently implemented by IAM. HTVault use cases should not be concerned, because they would only use token exchange for downgrading scopes. Federica replies that all instances at CNAF and other sites should be checked. Anders can do that at CERN.

Finally, the date currently marked for the next meeting, Sep 10, happens to be a CERN holiday; we will see if the meeting will be held anyway, canceled, or postponed.