[Server] Add XrdSecoauth2 bearer JWT authentication and xrdtoken utility.

Add sec.protocol oauth2 for TLS-only OAuth2/OIDC bearer authentication,
shared JWT validation in libXrdUtils, HTTPS bearer integration, client
token pickup, and the xrdtoken helper for obtaining tokens from common
providers.

Plugin (libXrdSecoauth2, src/XrdSecoauth2/):
- Validate RS256 JWTs with multi-issuer JWKS discovery, audience and expiry
  policy, validated-token cache, and optional on-disk JWKS cache
- Map identity from configurable claims; populate XrdSecEntity role, grps,
  and extension attributes from JWT claims and issuer path options
- Client getCredentials() reads BEARER_TOKEN, BEARER_TOKEN_FILE,
  XDG_RUNTIME_DIR/bt_u<uid>, and /tmp/bt_u<uid>

Shared library (src/XrdOAuth2/, built into libXrdUtils):
- XrdOAuth2: JWT parsing and verification, INI config, issuer policies,
  and C++20 helpers for oauth2 credential framing and entity fields

HTTP (http.oauth2):
- Optional or required bearer authentication on HTTPS via the security
  framework; re-authenticate when the Authorization token changes
- Reuse a single XrdSecService with xrootd via shared process environment

Initialization:
- InitSecProtocol is idempotent so oauth2 globals initialize once when both
  xrootd and HTTP load sec.protocol oauth2 in the same process

Tooling and tests:
- utils/xrdtoken: device and PKCE flows for CERN, CERNOIDC, IAM/WLCG,
  Google, and GitHub, with OIDC nonce validation on id_tokens
- 52 unit tests (tests/XrdSec/XrdSecOAuth2.cc), example WLCG IAM config,
  and README

Install libXrdSecoauth2 in Debian and RPM packaging.

Assisted-by: Cursor:Opus-4.8 CursorAI
Assisted-by: Cursor:Composer-2.5 CursorAI

Author: apeters1971

debian/xrootd-plugins.install

@@ -10,3 +10,4 @@
 /usr/lib/*/libXrdSecsss-6.so
 /usr/lib/*/libXrdSecunix-6.so
 /usr/lib/*/libXrdSecztn-6.so
+/usr/lib/*/libXrdSecoauth2-6.so

src/CMakeLists.txt

@@ -53,6 +53,7 @@ add_subdirectory( XrdNet )
 add_subdirectory( XrdSut )
 add_subdirectory( XrdSys )
 add_subdirectory( XrdOuc )
+add_subdirectory( XrdOAuth2 )
 add_subdirectory( XrdTls )
 add_subdirectory( XrdRmc )
 
@@ -63,6 +64,7 @@ add_subdirectory( XrdPosix )
 add_subdirectory( XrdSec )
 add_subdirectory( XrdSecgsi )
 add_subdirectory( XrdSeckrb5 )
+add_subdirectory( XrdSecoauth2 )
 add_subdirectory( XrdSecpwd )
 add_subdirectory( XrdSecsss )
 add_subdirectory( XrdSecunix )

src/XrdHeaders.cmake

@@ -67,6 +67,7 @@ set( XROOTD_PUBLIC_HEADERS
   XrdOuc/XrdOuca2x.hh
   XrdOuc/XrdOucEnum.hh
   XrdOuc/XrdOucCompiler.hh
+  XrdOAuth2/XrdOAuth2.hh
   XrdPosix/XrdPosix.hh
   XrdPosix/XrdPosixCache.hh
   XrdPosix/XrdPosixCallBack.hh

src/XrdHttp/XrdHttpProtocol.cc

@@ -46,6 +46,7 @@
 #include "XrdTls/XrdTlsContext.hh"
 #include "XrdOuc/XrdOucUtils.hh"
 #include "XrdOuc/XrdOucPrivateUtils.hh"
+#include "XrdSec/XrdSecLoadSecurity.hh"
 #include "XrdHttpCors/XrdHttpCors.hh"
 
 #include <charconv>
@@ -119,6 +120,7 @@ XrdScheduler *XrdHttpProtocol::Sched = 0; // System scheduler
 XrdBuffManager *XrdHttpProtocol::BPool = 0; // Buffer manager
 XrdSysError XrdHttpProtocol::eDest = 0; // Error message handler
 XrdSecService *XrdHttpProtocol::CIA = 0; // Authentication Server
+XrdOucEnv     *XrdHttpProtocol::configEnv = 0;
 int XrdHttpProtocol::m_bio_type = 0; // BIO type identifier for our custom BIO.
 BIO_METHOD *XrdHttpProtocol::m_bio_method = NULL; // BIO method constructor.
 char *XrdHttpProtocol::xrd_cslist = nullptr;
@@ -155,6 +157,9 @@ bool xrdctxVer = false;
 
 using namespace XrdHttpProtoInfo;
 
+int XrdHttpProtocol::oauth2HttpMode = 0;
+const char *XrdHttpProtocol::oauth2ConfigFN = nullptr;
+
 /******************************************************************************/
 /*            P r o t o c o l   M a n a g e m e n t   S t a c k s             */
 /******************************************************************************/
@@ -806,6 +811,11 @@ int XrdHttpProtocol::Process(XrdLink *lp) // We ignore the argument here
 
 
 
+  // Bearer OAuth2 authentication over HTTPS (via sec.protocol oauth2 / CIA).
+  if (ishttps && ssldone && oauth2HttpMode && HandleOAuth2Authentication()) {
+    return -1;
+  }
+
   // Now we have everything that is needed to try the login
   // Remember that if there is an exthandler then it has the responsibility
   // for authorization in the paths that it manages
@@ -904,6 +914,8 @@ int XrdHttpProtocol::Stats(char *buff, int blen, int do_sync) {
         eDest.Say("Config http." x " overrides the xrd." y " directive.")
 
 int XrdHttpProtocol::Config(const char *ConfigFN, XrdOucEnv *myEnv) {
+  XrdHttpProtocol::oauth2ConfigFN = ConfigFN;
+  XrdHttpProtocol::configEnv = myEnv;
   XrdOucEnv cfgEnv;
   XrdOucStream Config(&eDest, getenv("XRDINSTANCE"), &cfgEnv, "=====> ");
   std::vector<extHInfo> extHIVec;
@@ -1005,6 +1017,7 @@ int XrdHttpProtocol::Config(const char *ConfigFN, XrdOucEnv *myEnv) {
       else if TS_Xeq("tlsreuse", xtlsreuse);
       else if TS_Xeq("auth", xauth);
       else if TS_Xeq("tlsclientauth", xtlsclientauth);
+      else if TS_Xeq("oauth2", xoauth2);
       else if TS_Xeq("maxdelay", xmaxdelay);
       else {
         eDest.Say("Config warning: ignoring unknown directive '", var, "'.");
@@ -1990,6 +2003,7 @@ void XrdHttpProtocol::Reset() {
   ishttps = false;
   ssldone = false;
 
+  oauth2BearerTokKey.clear();
   Bridge = 0;
   ssl = 0;
   sbio = 0;
@@ -3001,6 +3015,29 @@ int XrdHttpProtocol::xtlsclientauth(XrdOucStream &Config) {
   return 1;
 }
 
+int XrdHttpProtocol::xoauth2(XrdOucStream &Config) {
+  char *val = Config.GetWord();
+  if (!val || !val[0])
+     {eDest.Emsg("Config", "http.oauth2 argument not specified"); return 1;}
+
+  if (!strcmp(val, "on") || !strcmp(val, "optional"))
+     {oauth2HttpMode = 1;
+      return 0;
+     }
+  if (!strcmp(val, "require"))
+     {oauth2HttpMode = 2;
+      return 0;
+     }
+  if (val[0] == '-')
+     {eDest.Emsg("Config", "http.oauth2 inline parameters are not supported;",
+                  "configure OAuth2 via sec.protparm oauth2 and sec.protocol oauth2");
+      return 1;
+     }
+
+  eDest.Emsg("Config", "invalid http.oauth2 parameter -", val);
+  return 1;
+}
+
 int XrdHttpProtocol::xauth(XrdOucStream &Config) {
   char *val = Config.GetWord();
   if(val) {

src/XrdHttp/XrdHttpProtocol.hh

@@ -170,6 +170,10 @@ private:
   /// @return 0 if successful, otherwise error
   int HandleAuthentication(XrdLink* lp);
 
+  /// Validate a Bearer OAuth2 token and populate SecEntity.
+  /// @return 0 if successful or not applicable, otherwise error
+  int HandleOAuth2Authentication();
+
   /// After the SSL handshake, retrieve the VOMS info and the various stuff
   /// that is needed for autorization
   int GetVOMSData(XrdLink *lp);
@@ -229,8 +233,15 @@ private:
   static int xtlsreuse(XrdOucStream &Config);
   static int xauth(XrdOucStream &Config);
   static int xtlsclientauth(XrdOucStream &Config);
+  static int xoauth2(XrdOucStream &Config);
   static int xmaxdelay(XrdOucStream &Config);
 
+  /// 0=disabled, 1=optional bearer OAuth2, 2=require bearer OAuth2
+  static int oauth2HttpMode;
+
+  /// Config file path used to load the security framework for http.oauth2.
+  static const char *oauth2ConfigFN;
+
   static bool isRequiredXtractor; // If true treat secxtractor errors as fatal
   static XrdHttpSecXtractor *secxtractor;
 
@@ -363,6 +374,9 @@ protected:
   static XrdSysError eDest; // Error message handler
   static XrdSecService *CIA; // Authentication Server
 
+  /// Shared process environment passed to Config(); used to reuse security.
+  static XrdOucEnv *configEnv;
+
   /// The link we are bound to
   XrdLink *Link;
 
@@ -376,7 +390,9 @@ protected:
   /// The Bridge that we use to exercise the xrootd internals
   XrdXrootd::Bridge *Bridge;
 
-  
+  /// SHA-256 fingerprint of the validated OAuth2 bearer token on this connection.
+  std::string oauth2BearerTokKey;
+
   /// Area for coordinating request and responses to/from the bridge
   /// This also can process HTTP/DAV stuff
   XrdHttpReq CurrentReq;