[xrd_ssi] CTA Frontend loads both SSI+OFS plugins

continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xrootd-cta.cfg

-# Load the plugin XrdCtaOfs
-xrootd.fslib libXrdCtaOfs.so
+# Load the CTA SSI and OFS plugins
+xrootd.fslib libXrdSsi.so libXrdCtaOfs.so
+
+# Specify which paths should be routed to the OFS plugin
+#
+# The "old" cta command will continue to use OFS. The "new" eoscta_stub and
+# cta_admin binaries use SSI.
+#
+# Y3Rh is the Base64 encoding of cta, so this string appears at the beginning
+# of all cta admin commands
+ssi.fspath /Y3Rh
+# L3Vzci9iaW4vY3Rh is Base64 encoding of /usr/bin/cta which appears at the
+# beginning of commands called from the EOS WFE bash script
+ssi.fspath /L3Vzci9iaW4vY3Rh
+
+# Load the SSI module
+ssi.svclib libXrdSsiCta.so
 
 # Use the security module
 xrootd.seclib libXrdSec.so
@@ -14,8 +29,16 @@ sec.protocol unix
 #sec.protbind * only sss
 sec.protbind 172.17.0* only unix
 
-# Allow copying from absolute paths
-all.export /
+# Export the SSI resource
+all.export /ctafrontend nolock r/w
+
+# Export the OFS resources, specified in ssi.fspath above.
+#
+# There can be more than one of these; anything that starts with the prefix
+# will go to the the underlying file system. Note that this prefix cannot be
+# a substring of '/ctafrontend', so it is not possible to simply export '/'.
+all.export /Y3Rh
+all.export /L3Vzci9iaW4vY3Rh
 
 # Turn off asynchronous i/o
 xrootd.async off

xroot_plugins/xrootd-cta.cfg

 # Load the CTA SSI and OFS plugins
-xrootd.fslib libXrdCtaOfs.so
-#xrootd.fslib libXrdSsi.so libXrdCtaOfs.so
+xrootd.fslib libXrdSsi.so libXrdCtaOfs.so
 
-# Specify which paths are handled by the OFS plugin
+# Specify which paths should be routed to the OFS plugin
+#
+# The "old" cta command will continue to use OFS. The "new" eoscta_stub and
+# cta_admin binaries use SSI.
 #
 # Y3Rh is the Base64 encoding of cta, so this string appears at the beginning
 # of all cta admin commands
 ssi.fspath /Y3Rh
+# L3Vzci9iaW4vY3Rh is Base64 encoding of /usr/bin/cta which appears at the
+# beginning of commands called from the EOS WFE bash script
+ssi.fspath /L3Vzci9iaW4vY3Rh
 
 # Load the SSI module
 ssi.svclib libXrdSsiCta.so
@@ -23,27 +28,16 @@ sec.protocol sss -s /var/spool/xrootd/.xrd/sss.keytab -c /tmp/sss.keytab
 sec.protbind * only sss
 sec.protbind tpsrv* only krb5
 
-# Allow copying from absolute paths
-all.export /
-
-#################################################################
-#
-# TO ACTIVATE SSI:
-# 1. Change the xrootd.fslib line above to include the SSI plugin
-# 2. Remove all.export line above
-# 3. Uncomment all.export lines below
-#
-#################################################################
-
 # Export the SSI resource
-#all.export /ctafrontend nolock r/w
+all.export /ctafrontend nolock r/w
 
 # Export the OFS resource, specified in ssi.fspath above.
 #
 # There can be more than one of these; anything that starts with the prefix
 # will go to the the underlying file system. Note that this prefix cannot be
 # a substring of '/ctafrontend', so it is not possible to simply export '/'.
-#all.export /Y3Rh
+all.export /Y3Rh
+all.export /L3Vzci9iaW4vY3Rh
 
 # Turn off asynchronous i/o
 xrootd.async off