Use proper name from registry when requesting federation tokens#2343
Merged
Conversation
…h origin invocation
Previously the code always used the hostname. After we saw errors popping up in production related to failed advertise token verification, I realized we need the registration name, which is always the hostname for Origins, and _sometimes_ the hostname for Caches. When `Xrootd.Sitename` is set in caches, that's the value we should use.
jhiemstrawisc
added
bug
h2zh
approved these changes
May 29, 2025
h2zh
left a comment
h2zh
left a comment
Contributor
There was a problem hiding this comment.
LGTM after patching that log message!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug was that I'd designed this to always use the server's hostname when requesting federation tokens. However, when
Xrootd.Sitenameis set in caches, that's the name that gets registered. This misalignment prevented the Director from validating caches' advertise tokens, which blocked it from handing out the federation tokens.Assigning @h2zh as the reviewer since I know he's currently working on some things related to server names in the Registry -- does this approach look okay to you? Ultimately the value I send to the director's fed token API in the
hostquery parameter needs to match the cache/origin's registered name.