[9.0] fix: useLegacyAdapter should check the VO

src/DIRAC/ConfigurationSystem/Client/PathFinder.py

@@ -248,17 +248,35 @@ def getServiceURLs(system, service=None, setup=False, failover=False):
     return resList
 
 
-def useLegacyAdapter(system, service=None) -> bool:
+def useLegacyAdapter(system, service=None, useCertificates=None) -> bool:
     """Should DiracX be used for this service via the legacy adapter mechanism
 
     :param str system: system name or full name e.g.: Framework/ProxyManager
     :param str service: service name, like 'ProxyManager'.
 
     :return: bool -- True if DiracX should be used
     """
+    from DIRAC.Core.Security.ProxyInfo import getProxyInfo
+
+    # Check if DiracX is enabled for this service
     system, service = divideFullName(system, service)
     value = gConfigurationData.extractOptionFromCFG(f"/DiracX/LegacyClientEnabled/{system}/{service}")
-    return (value or "no").lower() in ("y", "yes", "true", "1")
+    if (value or "no").lower() not in ("y", "yes", "true", "1"):
+        return False
+
+    # Check if we are using a server certificate: in this case we cannot use DiracX
+    if useCertificates is None:
+        useCertificates = gConfigurationData.useServerCertificate()
+    if useCertificates:
+        return False
+
+    # We are using a proxy: check if DiracX is enabled for this VO
+    result = getProxyInfo()
+    if not result["OK"]:
+        return False
+    value = gConfigurationData.extractOptionFromCFG(f"/Registry/Groups/{result['Value']['group']}/VO")
+
+    return value not in getDisabledDiracxVOs()
 
 
 def getServiceURL(system, service=None, setup=False):

src/DIRAC/Core/Security/DiracX.py

@@ -75,7 +75,7 @@ def DiracXClient() -> _DiracClient:
     proxyLocation = getDefaultProxyLocation()
     diracxToken = diracxTokenFromPEM(proxyLocation)
     if not diracxToken:
-        raise ValueError(f"No dirax token in the proxy file {proxyLocation}")
+        raise ValueError(f"No diracx token in the proxy file {proxyLocation}")
 
     with NamedTemporaryFile(mode="wt") as token_file:
         token_file.write(json.dumps(diracxToken))

src/DIRAC/Core/Tornado/Client/ClientSelector.py

@@ -66,7 +66,7 @@ def ClientSelector(disetClient, *args, **kwargs):  # We use same interface as RP
         # If we are not already given a URL, resolve it
         if serviceName.startswith(("http", "dip")):
             completeUrl = serviceName
-        elif useLegacyAdapter(serviceName):
+        elif useLegacyAdapter(serviceName, useCertificates=kwargs.get("useCertificates")):
             sLog.debug(f"Using legacy adapter for service {serviceName}")
             if diracxClient is None:
                 raise NotImplementedError(