From f71b7cfa88d0615e583d605a7cb46ed3a1879591 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Pansanel?= Date: Thu, 17 Sep 2026 11:30:53 +0200 Subject: [PATCH] voms: fix FQAN parsing for root /vo group (cherry picked from commit 8dca32a9bdd511dbd17f8804c48dc8960638b83f) Signed-off-by: Tigran Mkrtchyan --- .../main/java/org/dcache/gplazma/plugins/VomsPlugin.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java b/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java index e43e9456975..0390736fe61 100644 --- a/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java +++ b/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java @@ -103,9 +103,11 @@ public void authenticate(Set publicCredentials, String voName = attr.getVO(); for (String fqan : attr.getFQANs()) { - // fqan must start with vo name, e.g. for atlas must start with '/atlas/' + // fqan must match the VO root or start with it, + // e.g. '/atlas' or '/atlas/...' // See https://ogf.org/documents/GFD.182.pdf p.6 ยง3.4.1.2 - if (!fqan.startsWith('/' + voName + '/')) { + String voRoot = "/" + voName; + if (!fqan.equals(voRoot) && !fqan.startsWith(voRoot + '/')) { continue; }