GlideinWMS

See branch v37/24561, branched from dcc3a9fce29.

Feedback sent also via email.

Hi Dennis,
a couple of observations:

1. spec file, and all: Should the token directories have more strict permissions so a generic user cannot check the list of tokens?

2.
The sites as configured in the Factory are normally referred to as Entry, not entry point
Is this script only outputting the token to stdout (I see no -token for condor_token_create, so seems so)? The file seems saved in the python code. Could this script do that since it has the file name for checking if already there? Or, probably better, the python code handles the reuse of the cached token if available, so this script does not need to know anything about the directory and file path (and you can eliminate the whole reuse section).

The Frontend user may be different from "frontend". I think other scripts check the owner of /etc/gwms-frontend.xml

# purpose: generates a condor token, specific for Glideins submitted to a Factory Entry (named in the parameter), 
#         for authorizing to join the User collector connected to the Frontend

    echo "usage: $0 entry_name" 
    echo "creates frontend token for entry_name and echos it to stdout" 

See first the note above, you may remove this.
If kept, I'd use a flag, I find it more clear:

REUSE_TOKEN=
if [ -e "$TD/$TOKEN" ]; then
 AGE=$(date -r "$TD/$TOKEN" +%s)
 ONE_HR_AGO=$(( $(date +%s) - 3600 ))
 if [ "$AGE" -gt "$ONE_HR_AGO" ]; then
    REUSE_TOKEN=yes
 fi
fi

if [ -n "${REUSE_TOKEN}" ]; then
 cat "$TD/$TOKEN" 
else

If you use 1/0 then you can use the fact that 0 is true in shell
Or do the action there

if [ -e "$TD/$TOKEN" ]; then
 AGE=$(date -r "$TD/$TOKEN" +%s)
 ONE_HR_AGO=$(( $(date +%s) - 3600 ))
 if [ "$AGE" -gt "$ONE_HR_AGO" ]; then
    # OK to reuse the token
    cat "$TD/$TOKEN" 
    exit
 fi
fi

# create the token, echo it to stdout
sudo /usr/bin/condor_token_create  -lifetime 86400 -key ${KEY} ${AUTH} -identity "${ID}@${HOSTNAME}" 

3. glideinFrontendElement.py

Should the permissions be more strict? Any reason to allow everyone to read?

               if not os.path.exists(tkn_dir):
                   os.mkdir(tkn_dir, 0755)

feedback merged to branch_v3_7