Upload/download/list files fails with irods setup where provider and consumer are split in two nodes

[fj-morales]

This ticket system is to report bugs and feature requests. For support, visit the help page first.

• If you have trouble connecting to a server or your login credentials are not valid, try to resolve the issue with the assistance of your hosting service provider. Any such ticket will be closed with a resolution of thirdparty.

Describe the bug
I need to connect CyberDuck to an irods setup where the irods provider (icat) and consumer (resource) servers live in two different nodes. When I connect to the provider node with CyberDuck, I can list the files, but upload/downloads of files hosted in the consumer node fail. If I connect directly to the consumer node, authentication succeds but it does not lits any contents and upload/download doesn't work.

I see this critical error on the irods server logs in both cases:

{"log_category":"server","log_level":"critical","log_message":" 0# 0x00007F33E869C06C\n 1# 0x00007F33E703EBF0\n 2# 0x00007F33E7AF4996\n 3# 0x00007F33E7AF4EF7\n 4# 0x00007F33DFDE0BB9\n 5# 0x00007F33DFDE88E5\n 6# 0x00007F33DFDF5522\n 7# 0x00007F33E8305AD3\n 8# 0x00007F33E830595F\n 9# 0x00007F33E82E8338\n10# 0x00007F33E82D69A6\n11# 0x00007F33DFDE94B7\n12# 0x00007F33DFDF56AA\n13# 0x00007F33E830869E\n14# 0x00007F33E83084AA\n15# 0x00007F33E82EAF36\n16# 0x00007F33E82D9E48\n17# 0x00007F33E82B029A\n18# 0x00007F33E82AFE3B\n19# 0x00007F33DFDADD4E\n20# 0x00007F33DFDAD6B5\n21# 0x00007F33DFDAD42C\n22# 0x00007F33E8248F70\n23# 0x00007F33E82477B0\n24# 0x00007F33E86AC4D9\n25# 0x00007F33E86C694A\n26# 0x00007F33E83C132F\n27# 0x00007F33E86D4746\n28# 0x00007F33E86D4D16\n29# 0x00007F33E86D5B36\n30# 0x00007F33E83F20A6\n31# 0x00007F33E85D08E3\n32# 0x00007F33E85D0825\n33# 0x00007F33E84E1D75\n34# 0x00007F33E86CC6BA\n35# 0x00007F33E86CE7B8\n36# 0x000055C0E3D24C07\n37# 0x000055C0E3D22362\n38# 0x000055C0E3D21135\n39# 0x00007F33E70295D0\n40# 0x00007F33E7029680\n41# 0x000055C0E3D1D2E5\n","server_host":"NOTME","server_pid":3250741,"server_timestamp":"2026-06-01T14:54:56.128Z","server_type":"server","server_zone":"NOTME","stacktrace_agent_pid":"3278770","stacktrace_timestamp_epoch_milliseconds":"619","stacktrace_timestamp_epoch_seconds":"1780325695","stacktrace_timestamp_utc":"2026-06-01T14:54:55.619Z"}

Expected behavior
When I connect to either provider or consumer via regular icommands, I can perform any operation successfully. I'm wondering if with CyberDuck the setup I've described is valid.

Desktop (please complete the following information):

• OS: Windows
• Version 9.4.1

[fj-morales]

Found these errors when the upload fails:

2026-06-02 12:59:44,980 [background-6] DEBUG ch.cyberduck.core.threading.BackgroundCallable - Canceled running background task WorkerBackgroundAction{worker=ConcurrentTransferWorker{source=DefaultSessionPool{bookmark=Host{protocol=Profile{parent=irods, vendor=iRODS Consortium, description=iRODS (Integrated Rule-Oriented Data System), image=null}, region='null', port=1247, hostname='xxxxxxxxxxxxxx', credentials=Credentials{user='xxxxxxxxxxxxxxxxxx', password='********', tokens='TemporaryAccessTokens{accessKeyId='', secretAccessKey='', sessionToken='', expiryInMilliseconds=-1}', oauth='OAuthTokens{accessToken='', refreshToken='', idToken='', expiryInMilliseconds=-1}', identity=null, properties={}}, uuid='19696bf4-d006-4d0c-9846-4e6fe9a11dbf', nickname='null', defaultpath='null', workdir=Path{path='xxxxxxxxxxxxxxxxxxx', type=[directory]}, custom=null, labels=null}, idle=1, active=0, waiters=0}, destination=ch.cyberduck.core.pool.SessionPool$DisconnectedSessionPool@721596, pool=java.util.concurrent.ExecutorCompletionService@3a628d1}}
java.lang.Exception
	at ch.cyberduck.core.threading.BackgroundCallable.<init>(BackgroundCallable.java:38)
	at ch.cyberduck.core.threading.DefaultBackgroundExecutor.execute(DefaultBackgroundExecutor.java:72)
	at ch.cyberduck.core.AbstractController.background(AbstractController.java:72)
	at cli.Ch.Cyberduck.Ui.Controller.TransferController.StartTransfer(Unknown Source)
	at cli.Ch.Cyberduck.Ui.Controller.BrowserController.UploadDroppedPath(Unknown Source)
	at cli.Ch.Cyberduck.Ui.Controller.BrowserController.View_BrowserDropped(Unknown Source)
	at cli.Ch.Cyberduck.Ui.Winforms.BrowserForm$ExpandingBrowserDropSink.OnDropped(Unknown Source)
	at cli.BrightIdeasSoftware.SimpleDropSink.TriggerDroppedEvent(Unknown Source)
	at cli.BrightIdeasSoftware.SimpleDropSink.Drop(Unknown Source)
	at cli.BrightIdeasSoftware.ObjectListView.OnDragDrop(Unknown Source)
	at cli.System.Windows.Forms.DropTarget.System.Windows.Forms.UnsafeNativeMethods.IOleDropTarget.OleDrop(Unknown Source)
	at cli.System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(Unknown Source)
	at cli.System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(Unknown Source)
	at cli.System.Windows.Forms.Application$ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(Unknown Source)
	at cli.System.Windows.Forms.Application$ThreadContext.RunMessageLoopInner(Unknown Source)
	at cli.System.Windows.Forms.Application$ThreadContext.RunMessageLoop(Unknown Source)
	at cli.Ch.Cyberduck.Ui.Program.Main(Unknown Source)
Caused by: ch.cyberduck.core.exception.TransferCanceledException: Unknown
	at ch.cyberduck.core.worker.AbstractTransferWorker$3.transferSegment(AbstractTransferWorker.java:471)
	at ch.cyberduck.core.worker.AbstractTransferWorker$3.call(AbstractTransferWorker.java:356)
	at ch.cyberduck.core.worker.AbstractTransferWorker$3.call(AbstractTransferWorker.java:346)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:512)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:625)
	at ch.cyberduck.core.threading.NamedThreadFactory$1.run(NamedThreadFactory.java:57)
	at java.lang.Thread.run(Thread.java:980)
Caused by: ch.cyberduck.core.exception.ConnectionCanceledException: Error
	at ch.cyberduck.core.AbstractExceptionMappingService.wrap(AbstractExceptionMappingService.java:122)
	at ch.cyberduck.core.worker.DefaultExceptionMappingService.map(DefaultExceptionMappingService.java:42)
	at ch.cyberduck.core.irods.IRODSUploadFeature.upload(IRODSUploadFeature.java:263)
	at ch.cyberduck.core.irods.IRODSUploadFeature.upload(IRODSUploadFeature.java:55)
	at ch.cyberduck.core.vault.registry.VaultRegistryUploadFeature.upload(VaultRegistryUploadFeature.java:46)
	at ch.cyberduck.core.transfer.UploadTransfer.transfer(UploadTransfer.java:327)
	at ch.cyberduck.core.worker.AbstractTransferWorker$3.transferSegment(AbstractTransferWorker.java:405)
	... 9 more
Caused by: java.nio.BufferUnderflowException
	at java.nio.Buffer.nextGetIndex(Buffer.java:510)
	at java.nio.HeapByteBuffer.getInt(HeapByteBuffer.java:375)
	at org.irods.irods4j.low_level.network.Network.readMsgHeader_PI(Network.java:55)
	at org.irods.irods4j.low_level.api.IRODSApi.receiveServerResponse(IRODSApi.java:211)
	at org.irods.irods4j.low_level.api.IRODSApi.rcReplicaOpen(IRODSApi.java:664)
	at org.irods.irods4j.high_level.io.IRODSDataObjectStream.openImpl(IRODSDataObjectStream.java:423)
	at org.irods.irods4j.high_level.io.IRODSDataObjectStream.open(IRODSDataObjectStream.java:121)
	at org.irods.irods4j.high_level.io.IRODSDataObjectOutputStream.open(IRODSDataObjectOutputStream.java:162)
	at org.irods.irods4j.high_level.io.IRODSDataObjectOutputStream.<init>(IRODSDataObjectOutputStream.java:69)
	at ch.cyberduck.core.irods.IRODSUploadFeature.upload(IRODSUploadFeature.java:110)
	... 13 more

[dkocher]

@korydraughn That would probably need to fixed upstream?

[korydraughn]

It could be. We're waiting for the user to provide more information so that we can track down the cause.

At this moment, I don't think the issue is in the Cyberduck/iRODS module.

We'll provide an update once we learn more about the situation.

[AliceSLee]

Hey @korydraughn, what's the information you're waiting for from the user side? Perhaps we (at SURF) can help

[korydraughn]

In the google group conversation, @trel asked the following.

Can you capture any more of the logs in the iRODS server? It should never hit that critical error, can you increase the log level?

Have you tried to reproduce this with docker compose?

@fj-morales stated he'd run more tests with extra logging, so we were waiting to see what came out of that.

@AliceSLee @fj-morales Can you describe a minimum setup which reproduces the issue?

• iRODS server version
• Resource details and their hierarchies
• Cyberduck profile configuration

[korydraughn]

I tried to reproduce the bug but failed.

Here's the setup I used.

• Windows Server 2025 running Docker Desktop
• Cyberduck 9.5.0.45237
• https://github.com/irods/irods_demo/tree/9d9df8ad648e78598865da26c00f0782ea2c67ae
  • 2 iRODS 5.0.2 servers with default configurations, each having a storage resource
  • Port mapping for iRODS Provider is 1247:1247
  • Port mapping for iRODS Consumer is 1257:1247
  • The rest of the docker-compose.yml file is unchanged

Using the cyberduckprofile template (no modifications) at https://docs.cyberduck.io/protocols/irods/#connection-profile-template, I was able to list, upload, and download files from each server without any problems. Tested deleting files via the iRODS Consumer and that worked too.

The following worked as well - i.e. triggers a server redirect from the Consumer to the Provider.

• Set the default resource in the cyberduckprofile to demoResc
• Connect to the iRODS Consumer server
• Upload a 9MB file

I have not tried uploading a file through the Provider to the Consumer.

Can you identify any differences between my setup and yours?
Can you post your cyberduckprofile?

[AliceSLee]

Thanks Kory! We'll get back to you shortly with all the details.
Here's UU's irods profile attached that I was trying out (renamed with a .txt extension so it's accepted by github)

Irodsuu.cyberduckprofile.txt

[fj-morales]

We've managed to reproduce the issue with the irods docker testing environment, with the following config:

python stand_it_up.py --project-directory ./projects/rockylinux-9/rockylinux-9-postgres-16 --use-tls --consumer-instance-count 1 -v

and docker composer file (provider listening on 1247; consumer on 1257)

services:
    catalog:
        image: postgres:16
        environment:
            - POSTGRES_PASSWORD=testpassword

    irods-catalog-provider:
        build:
            context: ..
            dockerfile: ${dockerfile}
            args:
                - irods_package_version=${irods_package_version}
        depends_on:
            - catalog
        volumes:
            - shared_volume:/irods_testing_environment_mount_dir
        # The core test suite for iRODS uses SIGHUP to reload the server's configuration often.
        # To keep the iRODS Rule Language from failing and producing RE_UNABLE_TO_READ_SESSION_VAR,
        # we bump the maximum amount of shared memory from 64mb to 100mb. This is required because
        # iRODS 5 can have two Agent Factories running simultaneously (due to the SIGHUP).
        shm_size: 100mb
        ports:
            - "1247:1247"

    irods-catalog-consumer:
        build:
            context: ..
            dockerfile: ${dockerfile}
            args:
                - irods_package_version=${irods_package_version}
        depends_on:
            - irods-catalog-provider
        volumes:
            - shared_volume:/irods_testing_environment_mount_dir
        # The core test suite for iRODS uses SIGHUP to reload the server's configuration often.
        # To keep the iRODS Rule Language from failing and producing RE_UNABLE_TO_READ_SESSION_VAR,
        # we bump the maximum amount of shared memory from 64mb to 100mb. This is required because
        # iRODS 5 can have two Agent Factories running simultaneously (due to the SIGHUP).
        shm_size: 100mb
        ports:
            - "1257:1247"

# This volume is mounted on all test servers for detached mode testing which
# requires a common vault.
volumes:
    shared_volume:

And the duck command:

duck  --profile ~/.duck/irodstest.cyberduckprofile --verbose -u user1 -p test1234 --list irods://localhost/tempZone/home/user1
Login successful…
Unknown. Cannot invoke "ch.cyberduck.core.PathAttributes.getRegion()" because the return value of "ch.cyberduck.core.Path.attributes()" is null.
Disconnecting localhost…

User created with irods native auth:

iadmin mkuser user1 rodsuser

Test files permissions:

ils -LAr /tempZone/home/user1
/tempZone/home/user1:
        ACL - rods#tempZone:own   user1#tempZone:own   
        Inheritance - Disabled
  rods              0 demoResc            5 2026-07-02.09:37 & hehe
        generic    /var/lib/irods/Vault/home/user1/hehe
        ACL - rods#tempZone:own   user1#tempZone:own   
  rods              0 demoResc            5 2026-07-02.09:39 & hehe2
        generic    /var/lib/irods/Vault/home/user1/hehe2
        ACL - rods#tempZone:own   user1#tempZone:own 

[korydraughn]

Hmm, I'm still unable to reproduce this on my development machine (host OS is Ubuntu 22.04). Perhaps I'm missing a step.

What version of the duck CLI are you using? I've tried 9.5.2 (45323) and 9.4.1 (44384). The --list operation worked for both.

If you have the cyberduckprofile you used to reproduce it, please share it.

[fj-morales]

Hi Kory,

These are the details:

duck --version (on ubuntu 24.04)
Cyberduck 9.5.2 (45323). Not registered. Purchase a donation key to support the development of this software.

cyberduck profile:

`

Protocol irods Vendor iRODS Consortium Description iRODS (Integrated Rule-Oriented Data System)

    <key>Hostname Configurable</key>
    <true/>
    <key>Port Configurable</key>
    <true/>

    <key>Default Port</key>
    <string>1257</string>

    <!-- The zone of the iRODS server to connect to. -->
    <!-- For backward compatibility, a root resource can be specified by appending ":<resource>" to the zone. -->
    <!-- The specified resource is only used when uploading files. -->
    <!-- Prefer setting "Destination Resource" under the "Properties" section. -->
    <key>Region</key>
    <string>tempZone</string>

    <!-- The authentication scheme used to establish a connection to an iRODS server. -->
    <!-- Must be set to "native" or "pam_password". "standard" is an alias for "native". -->
    <key>Authorization</key>
    <string>native</string>

    <key>Properties</key>
    <dict>
        <!-- The root resource to target when uploading files. -->
        <!-- DO NOT define this option unless needed. -->
        <!-- This option supersedes any resource defined by "Region". -->
        
        <key>Destination Resource</key>
        <string>irodsResc</string>
        

        <!-- Controls whether deletion of an object permanently removes or moves it into the trash collection. -->
        <key>Delete Objects Permanently</key>
        <string>no</string>

        <!-- The size (in bytes) of a file that must be exceeded before using parallel transfer. -->
        <!-- The value must satisfy the range [1, 2^31-1]. -->
        <key>Parallel Transfer Threshold</key>
        <string>33554432</string>

        <!-- The number of iRODS connections used for parallel transfer of a single file. -->
        <!-- Each transfer will use the specified number of iRODS connections. -->
        <!-- The value must satisfy the range [2, 10]. -->
        <key>Parallel Transfer Connections</key>
        <string>3</string>

        <!-- The buffer size (in bytes) used for parallel transfer of a single file. -->
        <!-- Applies to uploads and downloads. -->
        <!-- The value must satisfy the range [1, 128MB]. -->
        <key>Parallel Transfer Buffer Size</key>
        <string>4194304</string>

        <!-- Secure Communication Options -->

        <!-- Must be set to "CS_NEG_REQUIRE", "CS_NEG_DONT_CARE", or "CS_NEG_REFUSE". -->
        <!-- - CS_NEG_REQUIRE:   Demand TLS be used. -->
        <!-- - CS_NEG_DONT_CARE: Let the server decide if TLS should be used. -->
        <!-- - CS_NEG_REFUSE:    Do not use TLS. -->
        <key>Client Server Negotiation</key>
        <string>CS_NEG_REQUIRE</string>

        <!-- Options which are only used when TLS is active. -->

        <key>Encryption Algorithm</key>
        <string>AES-256-CBC</string>
        <key>Encryption Key Size</key>
        <string>32</string>
        <key>Encryption Salt Size</key>
        <string>8</string>
        <key>Encryption Hash Rounds</key>
        <string>16</string>
    </dict>
</dict>

`

[korydraughn]

Please show the ilsresc output for the irodsResc resource too. Which server does irodsResc belong to (the provider or consumer)?

I see port 1257 is used, meaning you're connecting to the catalog consumer server instead of the provider, correct?

CS_NEG_REQUIRE is set in the cyberduckprofile. What is acPreConnect() set to in /etc/irods/core.re?