Bug Fix for allowed issuers

This is a bug fix for features discovered when testing on EL8.

• Fix vector resize for new el8 behavior #30
• Fix allowed issuers when sending them to JWT deserialize #31

Update library version to depend on XRootD version

Merge pull request #28 from ddavila0/patch-2

Fix versioning and change requirements to allow RCs

Security Update

This release fixes a security issue when parsing scitokens.

Summary:

The xrootd-scitokens plugin v1.1.0 (and earlier) contains an authorization logic error that permits both read and write access to files when the user’s token authorizes only read or write permission.

Impact:

An authorized user with a valid token granting read access to files also obtains write access to those files (and vice versa). The impact does not apply to typical xrootd-scitokens deployment scenarios: (a) read-only filesystems (e.g., accessing caches) or (b) where both read and write permissions are granted for all generated tokens (e.g., OSG-Connect).

Recommendation:

Update to xrootd-scitokens plugin v1.2 (or later) and restart of xrootd is recommended.

Passthrough of Scitokens Auth

If the scitokens authorization fails, pass through the credentials to the next method in the chain (if there is one).

Rewrite for SciTokens C API

In this release, we switched the SciTokens integration from the Python API to with the SciTokens C API.

Flexible Authorization Handling

In this release, we significantly improve the authorization handling with the following three features:

• base_path can now take a comma-separated list of paths, allowing a single issuer to cover multiple parts of the filesystem namespace.
• restricted_path was introduced. This option restricts the paths the issuer is allowed to issue authorizations for within its base area(s). It is intended to ease the migrations to a SciTokens-based setup for existing storages where multiple groups share a same base area.
• default_user was introduced. This provides the ability to set the username in the credential for requests that pass the scitokens authorization. It allows the sysadmin to map the filesystem access of an issuer to a specific Unix username.