[Server] Add XrdSecoauth2 bearer JWT authentication and xrdtoken utility.

Add sec.protocol oauth2 for TLS-only OAuth2/OIDC bearer authentication,
shared JWT validation in libXrdUtils, HTTPS bearer integration, client
token pickup, and the xrdtoken helper for obtaining tokens from common
providers.

Plugin (libXrdSecoauth2, src/XrdSecoauth2/):
- Validate RS256 JWTs with multi-issuer JWKS discovery, audience and expiry
  policy, validated-token cache, and optional on-disk JWKS cache
- Map identity from configurable claims; populate XrdSecEntity role, grps,
  and extension attributes from JWT claims and issuer path options
- Client getCredentials() reads BEARER_TOKEN, BEARER_TOKEN_FILE,
  XDG_RUNTIME_DIR/bt_u<uid>, and /tmp/bt_u<uid>

Shared library (src/XrdOAuth2/, built into libXrdUtils):
- XrdOAuth2: JWT parsing and verification, INI config, issuer policies,
  and C++20 helpers for oauth2 credential framing and entity fields
- Avoid std::format (unavailable on older libstdc++ in CI); use portable
  string concatenation instead
- makeCredentials() allocates with malloc() to match XrdSecBuffer::free()
  (new[]/free mismatch caused heap corruption on Linux/glibc)

HTTP (http.oauth2):
- Optional or required bearer authentication on HTTPS via the security
  framework; re-authenticate when the Authorization token changes
- Reuse a single XrdSecService with xrootd via shared process environment

Initialization:
- InitSecProtocol is idempotent so oauth2 globals initialize once when both
  xrootd and HTTP load sec.protocol oauth2 in the same process

JWT validation hardening (src/XrdOAuth2/):
- Rate-limit and condition forced JWKS refresh on signature failure (only
  for an unknown kid, with a per-issuer cooldown) to remove a DoS
  amplification vector; add a short-TTL negative-token cache
- Single-flight config reload so a config change cannot fan out into
  concurrent parse and JWKS-fetch storms on the auth hot path
- Sanitize the resolved identity before it becomes XrdSecEntity.name;
  enforce a 2048-bit minimum RSA key size; warn when an issuer has no
  audience configured
- sha256hex fails closed (never falls back to the raw token as a cache key);
  harden JWKS disk cache reads/writes with O_NOFOLLOW + fstat; accept
  float-valued NumericDate claims; clear partial init state on failure

HTTP integration hardening (src/XrdHttp/):
- Bind bearer authentication to the request rather than the connection: the
  same token presented again is accepted without re-validation only while it
  has not yet expired (a pure clock comparison via the recorded token exp,
  exposed cheaply through XrdOAuth2::CachedTokenExpiry), so an expired or
  revoked token cannot be reused for the lifetime of a keep-alive connection
- Require a valid bearer token on every request in require mode; clear the
  previous token's identity and attributes before applying a changed token
  so stale scopes/groups/paths cannot leak (adds XrdSecEntityAttr::Reset)
- Return RFC 6750 WWW-Authenticate challenges on 4xx, reject ambiguous or
  duplicate Authorization credentials with 400, and document preferring the
  Authorization header over the authz query parameter

Tooling and tests:
- utils/xrdtoken: device and PKCE flows for CERN, CERNOIDC, IAM/WLCG,
  Google, and GitHub, with OIDC nonce validation on id_tokens
- 57 unit tests (tests/XrdSec/XrdSecOAuth2.cc), example WLCG IAM config,
  and README
- OAuth2 unit tests link libXrdUtils once and use XrdOAuth2Detail.hh for
  detail:: access (avoids compiling XrdOAuth2.cc twice, which caused
  free(): invalid pointer at process exit on Linux/glibc)

Install libXrdSecoauth2 in Debian and RPM packaging.

Assisted-by: Cursor:Opus-4.8 CursorAI
Assisted-by: Cursor:Composer-2.5 CursorAI

Author: apeters1971

debian/xrootd-plugins.install

@@ -10,3 +10,4 @@
 /usr/lib/*/libXrdSecsss-6.so
 /usr/lib/*/libXrdSecunix-6.so
 /usr/lib/*/libXrdSecztn-6.so
+/usr/lib/*/libXrdSecoauth2-6.so

src/CMakeLists.txt

@@ -53,6 +53,7 @@ add_subdirectory( XrdNet )
 add_subdirectory( XrdSut )
 add_subdirectory( XrdSys )
 add_subdirectory( XrdOuc )
+add_subdirectory( XrdOAuth2 )
 add_subdirectory( XrdTls )
 add_subdirectory( XrdRmc )
 
@@ -63,6 +64,7 @@ add_subdirectory( XrdPosix )
 add_subdirectory( XrdSec )
 add_subdirectory( XrdSecgsi )
 add_subdirectory( XrdSeckrb5 )
+add_subdirectory( XrdSecoauth2 )
 add_subdirectory( XrdSecpwd )
 add_subdirectory( XrdSecsss )
 add_subdirectory( XrdSecunix )

src/XrdHeaders.cmake

@@ -67,6 +67,7 @@ set( XROOTD_PUBLIC_HEADERS
   XrdOuc/XrdOuca2x.hh
   XrdOuc/XrdOucEnum.hh
   XrdOuc/XrdOucCompiler.hh
+  XrdOAuth2/XrdOAuth2.hh
   XrdPosix/XrdPosix.hh
   XrdPosix/XrdPosixCache.hh
   XrdPosix/XrdPosixCallBack.hh

src/XrdHttp/XrdHttpProtocol.cc

@@ -46,6 +46,7 @@
 #include "XrdTls/XrdTlsContext.hh"
 #include "XrdOuc/XrdOucUtils.hh"
 #include "XrdOuc/XrdOucPrivateUtils.hh"
+#include "XrdSec/XrdSecLoadSecurity.hh"
 #include "XrdHttpCors/XrdHttpCors.hh"
 
 #include <charconv>
@@ -119,6 +120,7 @@ XrdScheduler *XrdHttpProtocol::Sched = 0; // System scheduler
 XrdBuffManager *XrdHttpProtocol::BPool = 0; // Buffer manager
 XrdSysError XrdHttpProtocol::eDest = 0; // Error message handler
 XrdSecService *XrdHttpProtocol::CIA = 0; // Authentication Server
+XrdOucEnv     *XrdHttpProtocol::configEnv = 0;
 int XrdHttpProtocol::m_bio_type = 0; // BIO type identifier for our custom BIO.
 BIO_METHOD *XrdHttpProtocol::m_bio_method = NULL; // BIO method constructor.
 char *XrdHttpProtocol::xrd_cslist = nullptr;
@@ -155,6 +157,9 @@ bool xrdctxVer = false;
 
 using namespace XrdHttpProtoInfo;
 
+int XrdHttpProtocol::oauth2HttpMode = 0;
+const char *XrdHttpProtocol::oauth2ConfigFN = nullptr;
+
 /******************************************************************************/
 /*            P r o t o c o l   M a n a g e m e n t   S t a c k s             */
 /******************************************************************************/
@@ -806,6 +811,11 @@ int XrdHttpProtocol::Process(XrdLink *lp) // We ignore the argument here
 
 
 
+  // Bearer OAuth2 authentication over HTTPS (via sec.protocol oauth2 / CIA).
+  if (ishttps && ssldone && oauth2HttpMode && HandleOAuth2Authentication()) {
+    return -1;
+  }
+
   // Now we have everything that is needed to try the login
   // Remember that if there is an exthandler then it has the responsibility
   // for authorization in the paths that it manages
@@ -904,6 +914,8 @@ int XrdHttpProtocol::Stats(char *buff, int blen, int do_sync) {
         eDest.Say("Config http." x " overrides the xrd." y " directive.")
 
 int XrdHttpProtocol::Config(const char *ConfigFN, XrdOucEnv *myEnv) {
+  XrdHttpProtocol::oauth2ConfigFN = ConfigFN;
+  XrdHttpProtocol::configEnv = myEnv;
   XrdOucEnv cfgEnv;
   XrdOucStream Config(&eDest, getenv("XRDINSTANCE"), &cfgEnv, "=====> ");
   std::vector<extHInfo> extHIVec;
@@ -1005,6 +1017,7 @@ int XrdHttpProtocol::Config(const char *ConfigFN, XrdOucEnv *myEnv) {
       else if TS_Xeq("tlsreuse", xtlsreuse);
       else if TS_Xeq("auth", xauth);
       else if TS_Xeq("tlsclientauth", xtlsclientauth);
+      else if TS_Xeq("oauth2", xoauth2);
       else if TS_Xeq("maxdelay", xmaxdelay);
       else {
         eDest.Say("Config warning: ignoring unknown directive '", var, "'.");
@@ -1990,6 +2003,8 @@ void XrdHttpProtocol::Reset() {
   ishttps = false;
   ssldone = false;
 
+  oauth2BearerTokKey.clear();
+  oauth2BearerTokExp = 0;
   Bridge = 0;
   ssl = 0;
   sbio = 0;
@@ -3001,6 +3016,29 @@ int XrdHttpProtocol::xtlsclientauth(XrdOucStream &Config) {
   return 1;
 }
 
+int XrdHttpProtocol::xoauth2(XrdOucStream &Config) {
+  char *val = Config.GetWord();
+  if (!val || !val[0])
+     {eDest.Emsg("Config", "http.oauth2 argument not specified"); return 1;}
+
+  if (!strcmp(val, "on") || !strcmp(val, "optional"))
+     {oauth2HttpMode = 1;
+      return 0;
+     }
+  if (!strcmp(val, "require"))
+     {oauth2HttpMode = 2;
+      return 0;
+     }
+  if (val[0] == '-')
+     {eDest.Emsg("Config", "http.oauth2 inline parameters are not supported;",
+                  "configure OAuth2 via sec.protparm oauth2 and sec.protocol oauth2");
+      return 1;
+     }
+
+  eDest.Emsg("Config", "invalid http.oauth2 parameter -", val);
+  return 1;
+}
+
 int XrdHttpProtocol::xauth(XrdOucStream &Config) {
   char *val = Config.GetWord();
   if(val) {

src/XrdHttp/XrdHttpProtocol.hh

@@ -170,6 +170,10 @@ private:
   /// @return 0 if successful, otherwise error
   int HandleAuthentication(XrdLink* lp);
 
+  /// Validate a Bearer OAuth2 token and populate SecEntity.
+  /// @return 0 if successful or not applicable, otherwise error
+  int HandleOAuth2Authentication();
+
   /// After the SSL handshake, retrieve the VOMS info and the various stuff
   /// that is needed for autorization
   int GetVOMSData(XrdLink *lp);
@@ -229,8 +233,15 @@ private:
   static int xtlsreuse(XrdOucStream &Config);
   static int xauth(XrdOucStream &Config);
   static int xtlsclientauth(XrdOucStream &Config);
+  static int xoauth2(XrdOucStream &Config);
   static int xmaxdelay(XrdOucStream &Config);
 
+  /// 0=disabled, 1=optional bearer OAuth2, 2=require bearer OAuth2
+  static int oauth2HttpMode;
+
+  /// Config file path used to load the security framework for http.oauth2.
+  static const char *oauth2ConfigFN;
+
   static bool isRequiredXtractor; // If true treat secxtractor errors as fatal
   static XrdHttpSecXtractor *secxtractor;
 
@@ -363,6 +374,9 @@ protected:
   static XrdSysError eDest; // Error message handler
   static XrdSecService *CIA; // Authentication Server
 
+  /// Shared process environment passed to Config(); used to reuse security.
+  static XrdOucEnv *configEnv;
+
   /// The link we are bound to
   XrdLink *Link;
 
@@ -376,7 +390,15 @@ protected:
   /// The Bridge that we use to exercise the xrootd internals
   XrdXrootd::Bridge *Bridge;
 
-  
+  /// SHA-256 fingerprint of the validated OAuth2 bearer token on this connection.
+  std::string oauth2BearerTokKey;
+
+  /// Expiry (unix seconds) of the validated OAuth2 bearer token above. While the
+  /// same token is presented and this time has not passed, validation is skipped
+  /// (a pure clock comparison); once it passes the token is re-validated so an
+  /// expired credential cannot be reused for the lifetime of the connection.
+  uint64_t oauth2BearerTokExp = 0;
+
   /// Area for coordinating request and responses to/from the bridge
   /// This also can process HTTP/DAV stuff
   XrdHttpReq CurrentReq;