diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b933b11a5..6c33e58c7 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,10 +13,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main, 'v[0-9].[0-9].*' ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main, 'v[0-9].[0-9].*' ]
   schedule:
     - cron: '36 11 * * 6'
 
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/pre-commit-linter.yml
similarity index 54%
rename from .github/workflows/golangci-lint.yml
rename to .github/workflows/pre-commit-linter.yml
index 68b3648c5..46a17a24d 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/pre-commit-linter.yml
@@ -1,19 +1,23 @@
-name: golangci-lint
+name: Linter
 on:
   push:
     tags:
-      - '*'
+      - "*"
     branches:
       - master
       - main
   pull_request:
 jobs:
-  golangci:
-    name: lint
+  linter:
+    name: linter
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      # We embed the contents of src/out/* into the resulting binaries
+      - uses: actions/setup-go@v4
+        with:
+          go-version: '1.20'
+          cache: false
+      # We embed the contents of web_ui/frontend/out/* into the resulting binaries
       # That particular directory should contain outputs generated by the
       # npm build.  However, to keep the runtime of the linter as fast as possible,
       # instead of running `npm` here, we simply create a dummy empty file.
@@ -23,9 +27,18 @@ jobs:
       - name: Generate placeholder files
         id: generate-placeholder
         run: |
-          mkdir -p origin_ui/src/out
-          touch origin_ui/src/out/placeholder
-      - name: golangci-lint
+          go generate ./...
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.9"
+
+      # We still run this so that we can get the nice hint of gofmt issues inline
+      - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
           version: latest
+
+      - name: Run pre-commit
+        uses: pre-commit/action@v3.0.0
diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml
index 33e79e6b2..839b1f009 100644
--- a/.github/workflows/publish-container.yml
+++ b/.github/workflows/publish-container.yml
@@ -1,10 +1,12 @@
-
 name: Release, Build, and Push
 
 on:
+  pull_request:
   push:
     tags:
-      - v[0-9]+.[0-9]+.[0-9]+
+      # only build and publish container on v7.0.0 and up
+      - v[7-9]\.[0-9]+\.[0-9]+ # match v7.x.x to v9.x.x
+      - v[1-9][0-9]+\.[0-9]+\.[0-9]+ # match any version higher
     branches:
       - main
   repository_dispatch:
@@ -75,20 +77,23 @@ jobs:
           IFS=,
           echo "::set-output name=taglist::${tag_list[*]}"
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
       - name: Log in to OSG Harbor
         uses: docker/login-action@v2
+        if: github.event_name != 'pull_request'
         with:
           registry: hub.opensciencegrid.org
           username: ${{ secrets.PELICAN_HARBOR_ROBOT_USER }}
           password: ${{ secrets.PELICAN_HARBOR_ROBOT_PASSWORD }}
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
       - name: Build and push Docker images
         uses: docker/build-push-action@v4
         with:
           context: .
           file: ./images/Dockerfile
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: "${{ steps.generate-tag-list.outputs.taglist }}"
+          build-args: |
+            IS_PR_BUILD=${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/publish-dev-container.yml b/.github/workflows/publish-dev-container.yml
new file mode 100644
index 000000000..a09142767
--- /dev/null
+++ b/.github/workflows/publish-dev-container.yml
@@ -0,0 +1,52 @@
+name: Release, Build, and Push Dev Image
+
+on:
+  pull_request:
+  push:
+    tags:
+      # only build and publish container on v7.0.0 and up
+      - v[7-9]\.[0-9]+\.[0-9]+-**
+      - v[1-9][0-9]+\.[0-9]+\.[0-9]+-**
+    branches:
+      - main
+
+jobs:
+  build-dev-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          submodules: "recursive"
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: hub.opensciencegrid.org/pelican_platform/pelican-dev
+          tags: |
+            type=semver,pattern={{version}}
+            type=raw,value=latest-itb
+            type=ref,enable=true,prefix=itb-,suffix=-{{date 'YYYYMMDDHHmmss'}},event=tag
+            type=raw,value=sha-{{sha}}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Log in to OSG Harbor
+        uses: docker/login-action@v2
+        if: github.event_name != 'pull_request'
+        with:
+          registry: hub.opensciencegrid.org
+          username: ${{ secrets.PELICAN_HARBOR_ROBOT_USER }}
+          password: ${{ secrets.PELICAN_HARBOR_ROBOT_PASSWORD }}
+
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/arm64,linux/amd64
+          file: ./images/dev.Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 596b53705..72d3fd32b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,7 +4,9 @@ name: goreleaser
 on:
   push:
     tags:
-      - '*'
+      # only run release on v7.0.0 and up
+      - v[7-9]\.[0-9]+\.[0-9]+
+      - v[1-9][0-9]+\.[0-9]+\.[0-9]+
 
 permissions:
   contents: write
@@ -13,18 +15,30 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
+      - name: Checkout
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Update npm version
+        run: |
+          cd web_ui/frontend
+
+          # Get the current tag and set the package.json version to it
+          npm version ${GITHUB_REF_NAME:1}
+          
+          # Add some verbosity 
+          echo "NPM version is now $(npm version)"
+      - name: Build the website
+        run: |
+          make web-build
+      - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: 1.20
-      -
-        name: Run GoReleaser
+          go-version: "1.20"
+      - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v4
         with:
           # either 'goreleaser' (default) or 'goreleaser-pro'
@@ -35,4 +49,3 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Your GoReleaser Pro key, if you are using the 'goreleaser-pro' distribution
           # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3ad63774b..e2ad81f10 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,34 +1,144 @@
 on: [push, pull_request]
 name: Test
+permissions:
+  pull-requests: write
 jobs:
   test:
     strategy:
       matrix:
         go-version: [1.20.x]
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+      with:
+      # Do fetch depth 0 here because otherwise goreleaser might not work properly:
+      # https://goreleaser.com/ci/actions/?h=tag#workflow
+        fetch-depth: 0
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 20
+    - name: Cache Next.js
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/.npm
+          ${{ github.workspace }}/.next/cache
+        # Generate a new cache whenever packages or source files change.
+        key: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('**/*.js', '**/*.jsx', '**/*.ts', '**/*.tsx', '!**/node_modules/**') }}
+        # If source files changed but packages didn't, rebuild from a prior cache.
+        restore-keys: |
+          ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json') }}-
     - name: Install Go
       uses: actions/setup-go@v4
       with:
         go-version: ${{ matrix.go-version }}
+    - name: Install Mac OS X Dependencies
+      run: ./github_scripts/osx_install.sh
+      if: runner.os == 'macOS'
+    - name: Test OS X
+      if: runner.os == 'macOS'
+      run: |
+        make web-build
+        # Explicitly set XRootD to IPv4-only on Mac OS X to avoid a subtle config bug.
+        export PELICAN_XROOTD_IPV4ONLY=true
+        go test -v -coverpkg=./... -coverprofile=coverage.out -covermode=count ./...
+    - name: Test
+      if: runner.os != 'macOS'
+      run: |
+        make web-build
+        go test ./...
+    - name: Run GoReleaser for Non-Ubuntu
+      uses: goreleaser/goreleaser-action@v4
+      with:
+        # either 'goreleaser' (default) or 'goreleaser-pro'
+        distribution: goreleaser
+        version: latest
+        args: build --single-target --clean --snapshot
+  test-ubuntu:
+    runs-on: ubuntu-latest
+    container:
+      image: hub.opensciencegrid.org/pelican_platform/pelican-dev:latest-itb
+    steps:
     - name: Checkout code
       uses: actions/checkout@v3
+      with:
+        # See above for why fetch depth is 0 here
+        fetch-depth: 0
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 20
+      # Fetch the tags is essential so that goreleaser can build the correct version. Workaround found here:
+      # https://github.com/actions/checkout/issues/290
+    - name: Fetch tags
+      run: |
+        git config --global --add safe.directory /__w/pelican/pelican
+        git fetch --force --tags
+    - name: Cache Next.js
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/.npm
+          ${{ github.workspace }}/.next/cache
+        # Generate a new cache whenever packages or source files change.
+        key: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('**/*.js', '**/*.jsx', '**/*.ts', '**/*.tsx') }}
+        # If source files changed but packages didn't, rebuild from a prior cache.
+        restore-keys: |
+          ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json') }}-
     - name: Test
       run: |
         make web-build
-        go test ./...
-    - name: Run GoReleaser
+        go test -coverpkg=./... -coverprofile=coverage.out -covermode=count ./...
+    - name: Get total code coverage
+      if: github.event_name == 'pull_request'
+      id: cc
+      run: |
+        set -x
+        cc_total=`go tool cover -func=coverage.out | grep total | grep -Eo '[0-9]+\.[0-9]+'`
+        echo "cc_total=$cc_total" >> $GITHUB_OUTPUT
+    - name: Restore base test coverage
+      id: base-coverage
+      if: github.event.pull_request.base.sha != ''
+      uses: actions/cache@v3
+      with:
+        path: |
+          unit-base.txt
+        # Use base sha for PR or new commit hash for master/main push in test result key.
+        key: ${{ runner.os }}-unit-test-coverage-${{ (github.event.pull_request.base.sha != github.event.after) && github.event.pull_request.base.sha || github.event.after }}
+    - name: Run test for base code
+      if: steps.base-coverage.outputs.cache-hit != 'true' && github.event.pull_request.base.sha != ''
+      run: |
+        git config --global --add safe.directory "$GITHUB_WORKSPACE"
+        git fetch origin main ${{ github.event.pull_request.base.sha }}
+        HEAD=$(git rev-parse HEAD)
+        git reset --hard ${{ github.event.pull_request.base.sha }}
+        make web-build
+        go generate ./...
+        go test -coverpkg=./... -coverprofile=base_coverage.out -covermode=count ./...
+        go tool cover -func=base_coverage.out > unit-base.txt
+        git reset --hard $HEAD
+    - name: Get base code coverage value
+      if: github.event_name == 'pull_request'
+      id: cc_b
+      run: |
+        set -x
+        cc_base_total=`grep total ./unit-base.txt | grep -Eo '[0-9]+\.[0-9]+'`
+        echo "cc_base_total=$cc_base_total" >> $GITHUB_OUTPUT
+    - name: Add coverage information to action summary
+      if: github.event_name == 'pull_request'
+      run: echo 'Code coverage ' ${{steps.cc.outputs.cc_total}}'% Prev ' ${{steps.cc_b.outputs.cc_base_total}}'%' >> $GITHUB_STEP_SUMMARY
+    - name: Run GoReleaser for Ubuntu
       uses: goreleaser/goreleaser-action@v4
       with:
         # either 'goreleaser' (default) or 'goreleaser-pro'
         distribution: goreleaser
         version: latest
-        args: build --rm-dist --snapshot
+        args: --clean --snapshot
     - name: Copy files (Ubuntu)
-      if: matrix.os == 'ubuntu-latest'
       run: |
         cp dist/pelican_linux_amd64_v1/pelican ./
     - name: Run Integration Tests
-      if: matrix.os == 'ubuntu-latest'
-      run: ./tests/citests.sh
+      run: ./github_scripts/citests.sh
+    - name: Run End-to-End Tests
+      run: ./github_scripts/get_put_test.sh
diff --git a/.gitignore b/.gitignore
index b0451a4ed..d406791ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 dist/
 README.dev.md
+docs/parameters.json
+local
diff --git a/.golangci.yaml b/.golangci.yaml
index 9bff21f93..2e97cea29 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -2,7 +2,7 @@
 run:
   # Pelican has gotten large enough that the GitHub Action sometimes
   # times out on a cold cache
-  timeout: 2m
+  timeout: 3m
 
 linters:
   enable:
diff --git a/.goreleaser.yml b/.goreleaser.yml
index e681107cc..51735a3f4 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -55,13 +55,13 @@ nfpms:
   - package_name: pelican
     builds:
       - pelican
-    file_name_template: '{{ .PackageName }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    file_name_template: "{{ .ConventionalFileName }}"
     id: pelican
     vendor: OSG Consortium
-    homepage: https://github.com/PelicanProject/pelican
+    homepage: https://github.com/PelicanPlatform/pelican
     maintainer: Brian Bockelman <bbockelman@morgridge.org>
     description: Command-line copy tool for the Open Science Data Federation
-    license: Apache 2.0
+    license: ASL 2.0
     formats:
       - apk
       - deb
@@ -75,14 +75,114 @@ nfpms:
         contents:
           - src: LICENSE
             dst: "/usr/share/doc/{{ .PackageName }}-{{ .Version }}/LICENSE.txt"
+            file_info:
+              mode: 0644
+            type: doc
           - src: README.md
             dst: "/usr/share/doc/{{ .PackageName }}-{{ .Version }}/README.md"
-        file_name_template: >-
-          {{ .PackageName }}-{{ .Version }}-{{ .Release }}.{{ if eq .Arch "amd64" }}x86_64{{ else }}{{ .Arch }}{{ end }}
+            file_info:
+              mode: 0644
+            type: doc
       deb:
-        file_name_template: "{{ .PackageName }}-{{ .Version }}-{{ .Release }}_{{ .Arch }}"
         contents:
           - src: LICENSE
             dst: "/usr/share/doc/{{ .PackageName }}/LICENSE.txt"
+            file_info:
+              mode: 0644
+            type: doc
           - src: README.md
             dst: "/usr/share/doc/{{ .PackageName }}/README.md"
+            file_info:
+              mode: 0644
+            type: doc
+  # end package pelican
+
+  - package_name: pelican-osdf-compat
+    builds: []
+    file_name_template: "{{ .ConventionalFileName }}"
+    id: pelican-osdf-compat
+    vendor: OSG Consortium
+    homepage: https://github.com/PelicanPlatform/pelican
+    maintainer: Brian Bockelman <bbockelman@morgridge.org>
+    description: OSDF compatibility files for Pelican
+    license: ASL 2.0
+    meta: true
+    formats:
+      - apk
+      - deb
+      - rpm
+    # bindir: /usr/bin
+    release: 1
+    section: default
+    priority: extra
+    dependencies:
+      - pelican
+    provides:
+      ## does not work: {{ .Version }} doesn't get substituted in this list
+      # - osdf-client = {{ .Version }}
+      # - stashcp = {{ .Version }}
+      # - condor-stash-plugin = {{ .Version }}
+      - "stashcache-client = 7"
+      - "osdf-client = 7"
+      - "stashcp = 7"
+      - "condor-stash-plugin = 7"
+    overrides:
+      apk:
+        contents:
+          - src: "./pelican"
+            dst: "/usr/bin/osdf"
+            type: symlink
+          - src: "./pelican"
+            dst: "/usr/bin/stashcp"
+            type: symlink
+      rpm:
+        contents:
+          - src: "./pelican"
+            dst: "/usr/bin/osdf"
+            type: symlink
+          - src: "./pelican"
+            dst: "/usr/bin/stashcp"
+            type: symlink
+          - src: "../../bin/pelican"
+            dst: "/usr/libexec/condor/stash_plugin"
+            type: symlink
+          - src: "client/resources/10-stash-plugin.conf"
+            dst: "/etc/condor/config.d/10-stash-plugin.conf"
+            type: config|noreplace
+        replaces:
+          - "stashcache-client < 7"
+          - "osdf-client < 7"
+          - "stashcp < 7"
+          - "condor-stash-plugin < 7"
+        ## rpm specific syntax:
+        ## also does not work: %{version} doesn't get expanded
+        # provides:
+        #   - "osdf-client = %{version}"
+        #   - "stashcp = %{version}"
+        #   - "condor-stash-plugin = %{version}"
+      deb:
+        contents:
+          - src: "./pelican"
+            dst: "/usr/bin/osdf"
+            type: symlink
+          - src: "./pelican"
+            dst: "/usr/bin/stashcp"
+            type: symlink
+          - src: "../../bin/pelican"
+            dst: "/usr/libexec/condor/stash_plugin"
+            type: symlink
+          - src: "client/resources/10-stash-plugin.conf"
+            dst: "/etc/condor/config.d/10-stash-plugin.conf"
+            type: config|noreplace
+        # deb has different syntax
+        provides:
+          - "stashcache-client (= 7)"
+          - "osdf-client (= 7)"
+          - "stashcp (= 7)"
+          - "condor-stash-plugin (= 7)"
+        replaces:
+          - "stashcache-client (<< 7)"
+          - "osdf-client (<< 7)"
+          - "stashcp (<< 7)"
+          - "condor-stash-plugin (<< 7)"
+  # end package pelican-osdf-compet
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..e882b4950
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,17 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v3.2.0
+    hooks:
+    -   id: trailing-whitespace
+    -   id: end-of-file-fixer
+    -   id: check-yaml
+        # Multi-documents are yaml files with multiple --- separating blocks, like
+        # in our docs/parameters.yaml. We need this argument so those parse.
+        args: [--allow-multiple-documents]
+    -   id: check-added-large-files
+-   repo: https://github.com/golangci/golangci-lint
+    rev: v1.55.2
+    hooks:
+    -   id: golangci-lint
diff --git a/Makefile b/Makefile
index b5eb4fe7e..08e423c63 100644
--- a/Makefile
+++ b/Makefile
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -14,38 +14,51 @@
 # limitations under the License.
 #
 
-CONTAINER_TOOL := docker
+USE_DOCKER=0
+
+CONTAINER_TOOL=docker
 
 ifeq ($(OS),Windows_NT)
-    goos := windows
-    ifeq ($(PROCESSOR_ARCHITEW6432),AMD64)
-        goarch := arm64
-    else
-        ifeq ($(PROCESSOR_ARCHITECTURE),AMD64)
-            goarch := arm64
-        endif
-    endif
+	goos := windows
+	ifeq ($(PROCESSOR_ARCHITEW6432),AMD64)
+		goarch := arm64
+	else
+		ifeq ($(PROCESSOR_ARCHITECTURE),AMD64)
+			goarch := arm64
+		endif
+	endif
 else
-    UNAME_S := $(shell uname -s)
-    ifeq ($(UNAME_S),Linux)
-        goos := linux
-    endif
-    ifeq ($(UNAME_S),Darwin)
-        goos := darwin
-    endif
-    UNAME_P := $(shell uname -p)
-    UNAME_M := $(shell uname -m)
+	UNAME_S := $(shell uname -s)
+	ifeq ($(UNAME_S),Linux)
+		goos := linux
+	endif
+	ifeq ($(UNAME_S),Darwin)
+		goos := darwin
+	endif
+	UNAME_P := $(shell uname -p)
+	UNAME_M := $(shell uname -m)
 	ifneq ($(filter arm64%,$(UNAME_M)),)
 		goarch := arm64
 	endif
 endif
 
-WEBSITE_SRC_PATH := origin_ui/src
-WEBSITE_OUT_PATH := origin_ui/src/out
-WEBSITE_CACHE_PATH := origin_ui/src/.next
+WEBSITE_SRC_PATH := web_ui/frontend
+WEBSITE_OUT_PATH := web_ui/frontend/out
+WEBSITE_CACHE_PATH := web_ui/frontend/.next
+WEBSITE_SRC_FILES := $(shell find $(WEBSITE_SRC_PATH)/app -type f) \
+						$(shell find $(WEBSITE_SRC_PATH)/components -type f) \
+						$(shell find $(WEBSITE_SRC_PATH)/helpers -type f) \
+						$(shell find $(WEBSITE_SRC_PATH)/public -type f) \
+						web_ui/frontend/tsconfig.json \
+						web_ui/frontend/next.config.js \
+						web_ui/frontend/package.json \
+						web_ui/frontend/package-lock.json \
+						web_ui/frontend/Dockerfile
+
+WEBSITE_OUT_FILE := $(WEBSITE_OUT_FILES)/index.html
 
 WEBSITE_CLEAN_LIST := $(WEBSITE_OUT_PATH) \
-					  $(WEBSITE_CACHE_PATH)
+						$(WEBSITE_CACHE_PATH)
 
 
 .PHONY: all
@@ -56,21 +69,34 @@ web-clean:
 	@echo CLEAN $(WEBSITE_CLEAN_LIST)
 	@rm -rf $(WEBSITE_CLEAN_LIST)
 
+docs/parameters.json:
+	@echo Creating docs/parameters.json...
+	@touch docs/parameters.json
+
+.PHONY: generate
+generate: docs/parameters.json
+ifeq ($(USE_DOCKER),0)
+	@go generate ./...
+else
+	@$(CONTAINER_TOOL) run --rm -v $(PWD):/code -w /code golang:1.21 go generate ./...
+endif
+
 .PHONY: web-build
-web-build:
+web-build: generate web_ui/frontend/out/index.html
+web_ui/frontend/out/index.html : $(WEBSITE_SRC_FILES)
+ifeq ($(USE_DOCKER),0)
 	@cd $(WEBSITE_SRC_PATH) && npm install && npm run build
+else
+	@cd $(WEBSITE_SRC_PATH) && $(CONTAINER_TOOL) build -t origin-ui . && $(CONTAINER_TOOL) run --rm -v `pwd`:/webapp origin-ui npm run build
+endif
 
 .PHONY: web-serve
 web-serve:
+ifeq ($(USE_DOCKER),0)
 	@cd $(WEBSITE_SRC_PATH) && npm install && npm run dev
-
-.PHONY: web-docker-build
-web-docker-build:
-	cd $(WEBSITE_SRC_PATH) && $(CONTAINER_TOOL) build -t origin-ui . && $(CONTAINER_TOOL) run --rm -v `pwd`:/webapp -it origin-ui npm install && npm run build
-
-.PHONE: web-docker-serve
-web-docker-serve:
-	@cd $(WEBSITE_SRC_PATH) && $(CONTAINER_TOOL) build -t origin-ui . && $(CONTAINER_TOOL) run --rm -v `pwd`:/webapp -p 3000:3000 -it origin-ui npm install && npm run dev
+else
+	@cd $(WEBSITE_SRC_PATH) && $(CONTAINER_TOOL) build -t origin-ui . && $(CONTAINER_TOOL) run --rm -v `pwd`:/webapp -p 3000:3000 origin-ui npm run dev
+endif
 
 
 PELICAN_DIST_PATH := dist
@@ -81,26 +107,19 @@ pelican-clean:
 	@rm -rf $(PELICAN_DIST_PATH)
 
 .PHONY: pelican-build
-pelican-build: web-build
+pelican-build: web_ui/frontend/out/index.html
 	@echo PELICAN BUILD
+ifeq ($(USE_DOCKER),0)
 	@goreleaser --clean --snapshot
-
-# This take awhile to run due to the file mount
-.PHONY: pelican-docker-build
-pelican-docker-build: web-docker-build
-	@echo PELICAN BUILD
+else
 	@$(CONTAINER_TOOL) run -w /app -v $(PWD):/app goreleaser/goreleaser --clean --snapshot
+endif
 
 .PHONY: pelican-serve-test-origin
 pelican-serve-test-origin: pelican-build
 	@echo SERVE TEST ORIGIN
 	@cd $(PELICAN_DIST_PATH)/pelican_$(goos)_$(goarch) && cp pelican osdf && ./osdf origin serve  -f https://osg-htc.org -v /tmp/stash/:/test
 
-.PHONY: pelican-docker-serve-test-origin
-pelican-docker-serve-test-origin:
-	@echo SERVE TEST ORIGIN
-	@$(CONTAINER_TOOL) run --rm -v `pwd`:/webapp -v /tmp/stash:/test -it pelican-server ./osdf-client origin serve  -f https://osg-htc.org -v /test
-
 .PHONY: pelican-build-server-image
 pelican-build-server-image:
 	@echo BUILD SERVER IMAGE
diff --git a/README.md b/README.md
index ce93e13f0..e7776a16d 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,21 @@
 
-Pelican Command Line
-====================
+<h1 align="center">Pelican Command Line</h1>
+
+<p align="center">
+  <img alt="Build Status" src="https://img.shields.io/github/actions/workflow/status/PelicanPlatform/pelican/codeql-analysis.yml?style=for-the-badge">
+  <img alt="License" src="https://img.shields.io/github/license/PelicanPlatform/pelican?style=for-the-badge">
+  <img alt="Release" src="https://img.shields.io/github/v/release/pelicanplatform/pelican?style=for-the-badge">
+  <img alt="Downloads for all releases" src="https://img.shields.io/github/downloads/pelicanplatform/pelican/total?style=for-the-badge">
+</p>
 
 The Pelican command line tool allows one to use a Pelican
 federation as a client and serve datasets through running a
 Pelican origin service.
 
+For more information on Pelican, see the [Pelican Platform page](https://pelicanplatform.org/).
+
+For documentation on using the Pelican Platform, see the [Pelican Platform documentation page](https://docs.pelicanplatform.org/).
+
 Testing and Usage
 -----------------
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..fbc9d1378
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+We currently offer support for the following versions of Pelican:
+
+| Version  | Supported          |
+| -------  | ------------------ |
+| >=v7.0.0 | :white_check_mark: |
+| <v7.0.0  | :x:                |
+
+## Reporting a Vulnerability or Security Issue
+
+We recognize that trust is hard to earn and easy to lose. That's why we take security incidents
+very seriously and strive to answer all concerns in as timely a manner as we are able. When you
+send us a report, we will acknowledge receipt and aim to provide an initial assessment as soon as
+possible. Our team is committed to resolving issues promptly.
+
+If you think you've discovered a security concern in Pelican, or if you become aware of any
+ongoing malicious activity regarding our software, **please let us know immediately** by emailing
+[security@pelicanplatform.org](mailto:security@pelicanplatform.org) with:
+- A description of the concern
+- Any useful information we may need for reproduction/verification
+- Affected systems/software versions
+- Your contact information and whether you're willing to participate in follow-up conversations
+
+Pelican is an open source platform, and we also welcome community bugfixes. If you would like to
+contribute to Pelican, please open a pull request!
diff --git a/cache_ui/advertise.go b/cache_ui/advertise.go
new file mode 100644
index 000000000..afca827c3
--- /dev/null
+++ b/cache_ui/advertise.go
@@ -0,0 +1,46 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package cache_ui
+
+import (
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/server_utils"
+)
+
+type (
+	CacheServer struct {
+		server_utils.NamespaceHolder
+	}
+)
+
+func (server *CacheServer) CreateAdvertisement(name string, originUrl string, originWebUrl string) (director.OriginAdvertise, error) {
+	ad := director.OriginAdvertise{
+		Name:       name,
+		URL:        originUrl,
+		WebURL:     originWebUrl,
+		Namespaces: server.GetNamespaceAds(),
+	}
+
+	return ad, nil
+}
+
+func (server *CacheServer) GetServerType() config.ServerType {
+	return config.CacheType
+}
diff --git a/acquire_token.go b/client/acquire_token.go
similarity index 91%
rename from acquire_token.go
rename to client/acquire_token.go
index 2fa89fdde..00d928733 100644
--- a/acquire_token.go
+++ b/client/acquire_token.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"context"
@@ -34,7 +34,7 @@ import (
 	oauth2_upstream "golang.org/x/oauth2"
 )
 
-func TokenIsAcceptable(jwtSerialized string, osdfPath string, namespace namespaces.Namespace, isWrite bool) bool {
+func TokenIsAcceptable(jwtSerialized string, osdfPath string, namespace namespaces.Namespace, opts config.TokenGenerationOpts) bool {
 	parser := jwt.Parser{SkipClaimsValidation: true}
 	token, _, err := parser.ParseUnverified(jwtSerialized, &jwt.MapClaims{})
 	if err != nil {
@@ -71,7 +71,7 @@ func TokenIsAcceptable(jwtSerialized string, osdfPath string, namespace namespac
 		for _, scope := range strings.Split(scopes, " ") {
 			scope_info := strings.Split(scope, ":")
 			scopeOK := false
-			if isWrite && (scope_info[0] == "storage.modify" || scope_info[0] == "storage.create") {
+			if (opts.Operation == config.TokenWrite || opts.Operation == config.TokenSharedWrite) && (scope_info[0] == "storage.modify" || scope_info[0] == "storage.create") {
 				scopeOK = true
 			} else if scope_info[0] == "storage.read" {
 				scopeOK = true
@@ -84,7 +84,9 @@ func TokenIsAcceptable(jwtSerialized string, osdfPath string, namespace namespac
 				acceptableScope = true
 				break
 			}
-			if strings.HasPrefix(targetResource, scope_info[1]) {
+			// Shared URLs must have exact matches; otherwise, prefix matching is acceptable.
+			if ((opts.Operation == config.TokenSharedWrite || opts.Operation == config.TokenSharedRead) && (targetResource == scope_info[1])) ||
+				strings.HasPrefix(targetResource, scope_info[1]) {
 				acceptableScope = true
 				break
 			}
@@ -111,7 +113,7 @@ func TokenIsExpired(jwtSerialized string) bool {
 }
 
 func RegisterClient(namespace namespaces.Namespace) (*config.PrefixEntry, error) {
-	issuer, err := oauth2.GetIssuerMetadata(*namespace.CredentialGen.Issuer)
+	issuer, err := config.GetIssuerMetadata(*namespace.CredentialGen.Issuer)
 	if err != nil {
 		return nil, err
 	}
@@ -142,7 +144,7 @@ func RegisterClient(namespace namespaces.Namespace) (*config.PrefixEntry, error)
 
 // Given a URL and a piece of the namespace, attempt to acquire a valid
 // token for that URL.
-func AcquireToken(destination *url.URL, namespace namespaces.Namespace, isWrite bool) (string, error) {
+func AcquireToken(destination *url.URL, namespace namespaces.Namespace, opts config.TokenGenerationOpts) (string, error) {
 	log.Debugln("Acquiring a token from configuration and OAuth2")
 
 	if namespace.CredentialGen == nil || namespace.CredentialGen.Strategy == nil {
@@ -208,7 +210,7 @@ func AcquireToken(destination *url.URL, namespace namespaces.Namespace, isWrite
 	var acceptableToken *config.TokenEntry = nil
 	acceptableUnexpiredToken := ""
 	for idx, token := range prefixEntry.Tokens {
-		if !TokenIsAcceptable(token.AccessToken, destination.Path, namespace, isWrite) {
+		if !TokenIsAcceptable(token.AccessToken, destination.Path, namespace, opts) {
 			continue
 		}
 		if acceptableToken == nil {
@@ -234,7 +236,7 @@ func AcquireToken(destination *url.URL, namespace namespaces.Namespace, isWrite
 			RefreshToken: acceptableToken.RefreshToken,
 			Expiry:       time.Unix(0, 0),
 		}
-		issuerInfo, err := oauth2.GetIssuerMetadata(issuer)
+		issuerInfo, err := config.GetIssuerMetadata(issuer)
 		if err == nil {
 			upstreamConfig := oauth2_upstream.Config{
 				ClientID:     prefixEntry.ClientID,
@@ -262,7 +264,7 @@ func AcquireToken(destination *url.URL, namespace namespaces.Namespace, isWrite
 		}
 	}
 
-	token, err := oauth2.AcquireToken(issuer, prefixEntry, namespace.CredentialGen, destination.Path, isWrite)
+	token, err := oauth2.AcquireToken(issuer, prefixEntry, namespace.CredentialGen, destination.Path, opts)
 	if err != nil {
 		return "", err
 	}
diff --git a/client/bearer_auth.go b/client/bearer_auth.go
new file mode 100644
index 000000000..569e86292
--- /dev/null
+++ b/client/bearer_auth.go
@@ -0,0 +1,72 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, University of Nebraska-Lincoln
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package client
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/studio-b12/gowebdav"
+)
+
+// BasicAuth structure holds our credentials, this is the authorizer
+type bearerAuth struct {
+	token string
+}
+
+// BearerAuthenticator is an Authenticator for BearerAuth
+type bearerAuthenticator struct {
+	token string
+}
+
+// NewAuthenticator creates a new BearerAuthenticator
+func (b *bearerAuth) NewAuthenticator(body io.Reader) (gowebdav.Authenticator, io.Reader) {
+	return &bearerAuthenticator{token: b.token}, body
+}
+
+// AddAuthenticator is not needed in this case (but required to have in gowebdav)
+func (b *bearerAuth) AddAuthenticator(key string, fn gowebdav.AuthFactory) {
+	// Not needed for BearerAuth
+}
+
+// Authorize the current request
+func (b *bearerAuthenticator) Authorize(c *http.Client, rq *http.Request, path string) error {
+	rq.Header.Add("Authorization", "Bearer "+b.token) //set the header with the token
+	return nil
+}
+
+// Verify verifies the authentication
+func (b *bearerAuthenticator) Verify(c *http.Client, rs *http.Response, path string) (redo bool, err error) {
+	if rs.StatusCode == 401 {
+		err := fmt.Errorf("Authorize: %s, %v", path, rs.StatusCode)
+		return true, err
+	}
+	return
+}
+
+// Close cleans up all resources
+func (b *bearerAuthenticator) Close() error {
+	return nil
+}
+
+// Clone creates a Copy of itself
+func (b *bearerAuthenticator) Clone() gowebdav.Authenticator {
+	// no copy due to read only access
+	return b
+}
diff --git a/client/bearer_auth_test.go b/client/bearer_auth_test.go
new file mode 100644
index 000000000..a9e4a79de
--- /dev/null
+++ b/client/bearer_auth_test.go
@@ -0,0 +1,77 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, University of Nebraska-Lincoln
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package client
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBearerAuthenticator_Authorize(t *testing.T) {
+	// Set up a test HTTP server
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify that the Authorization header is correct
+		authHeader := r.Header.Get("Authorization")
+		assert.Equal(t, "Bearer some_token_1234_abc", authHeader)
+
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	authenticator := &bearerAuthenticator{token: "some_token_1234_abc"}
+	client := &http.Client{}
+
+	// Create a HTTP request to be authorized
+	request, err := http.NewRequest("GET", server.URL, nil)
+	assert.NoError(t, err)
+	err = authenticator.Authorize(client, request, "/test/path")
+	assert.NoError(t, err)
+
+	// Send the request and verify
+	response, err := client.Do(request)
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusOK, response.StatusCode)
+}
+
+func TestBearerAuthenticator_Verify(t *testing.T) {
+	authenticator := &bearerAuthenticator{token: "some_token_1234_abc"}
+	client := &http.Client{}
+
+	// Create a dummy HTTP response with a 401 status
+	response := &http.Response{
+		StatusCode: http.StatusUnauthorized,
+	}
+
+	// Verify the authentication
+	redo, err := authenticator.Verify(client, response, "/test/path")
+	assert.Error(t, err)
+	assert.True(t, redo, "Expected Verify to return true for 401 Unauthorized")
+
+	// Create a dummy HTTP response with a 200 OK status
+	responseOK := &http.Response{
+		StatusCode: http.StatusOK,
+	}
+
+	// Verify the authentication
+	redo, err = authenticator.Verify(client, responseOK, "/test/path")
+	assert.NoError(t, err)
+	assert.False(t, redo, "Expected Verify to return false for 200 OK")
+}
diff --git a/director.go b/client/director.go
similarity index 75%
rename from director.go
rename to client/director.go
index c30165bfb..41ba9dde9 100644
--- a/director.go
+++ b/client/director.go
@@ -16,20 +16,27 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
+	"encoding/json"
+	"io"
 	"net/http"
 	"net/url"
 	"sort"
 	"strconv"
 	"strings"
 
+	"github.com/pelicanplatform/pelican/config"
 	namespaces "github.com/pelicanplatform/pelican/namespaces"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 )
 
+type directorResponse struct {
+	Error string `json:"error"`
+}
+
 // Simple parser to that takes a "values" string from a header and turns it
 // into a map of key/value pairs
 func HeaderParser(values string) (retMap map[string]string) {
@@ -56,15 +63,17 @@ func HeaderParser(values string) (retMap map[string]string) {
 
 // Given the Director response, create the ordered list of caches
 // and store it as namespace.SortedDirectorCaches
-func CreateNsFromDirectorResp(dirResp *http.Response, namespace *namespaces.Namespace) (err error) {
+func CreateNsFromDirectorResp(dirResp *http.Response) (namespace namespaces.Namespace, err error) {
 	pelicanNamespaceHdr := dirResp.Header.Values("X-Pelican-Namespace")
 	if len(pelicanNamespaceHdr) == 0 {
-		return errors.New("Pelican director did not include mandatory X-Pelican-Namespace header in response")
+		err = errors.New("Pelican director did not include mandatory X-Pelican-Namespace header in response")
+		return
 	}
 	xPelicanNamespace := HeaderParser(pelicanNamespaceHdr[0])
 	namespace.Path = xPelicanNamespace["namespace"]
 	namespace.UseTokenOnRead, _ = strconv.ParseBool(xPelicanNamespace["require-token"])
 	namespace.ReadHTTPS, _ = strconv.ParseBool(xPelicanNamespace["readhttps"])
+	namespace.DirListHost = xPelicanNamespace["collections-url"]
 
 	var xPelicanAuthorization map[string]string
 	if len(dirResp.Header.Values("X-Pelican-Authorization")) > 0 {
@@ -115,13 +124,15 @@ func CreateNsFromDirectorResp(dirResp *http.Response, namespace *namespaces.Name
 	return
 }
 
-func QueryDirector(source string, directorUrl string) (resp *http.Response, err error) {
+// Make a request to the director for a given verb/resource; return the
+// HTTP response object only if a 307 is returned.
+func queryDirector(verb, source, directorUrl string) (resp *http.Response, err error) {
 	resourceUrl := directorUrl + source
 	// Here we use http.Transport to prevent the client from following the director's
 	// redirect. We use the Location url elsewhere (plus we still need to do the token
 	// dance!)
 	var client *http.Client
-	tr := getTransport()
+	tr := config.GetTransport()
 	client = &http.Client{
 		Transport: tr,
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
@@ -129,22 +140,52 @@ func QueryDirector(source string, directorUrl string) (resp *http.Response, err
 		},
 	}
 
-	log.Debugln("Querying OSDF Director at", resourceUrl)
-	resp, err = client.Get(resourceUrl)
-	log.Debugln("Director's response:", resp)
+	req, err := http.NewRequest(verb, resourceUrl, nil)
+	if err != nil {
+		log.Errorln("Failed to create an HTTP request:", err)
+		return nil, err
+	}
+
+	// Include the Client's version as a User-Agent header. The Director will decide
+	// if it supports the version, and provide an error message in the case that it
+	// cannot.
+	userAgent := "pelican-client/" + ObjectClientOptions.Version
+	req.Header.Set("User-Agent", userAgent)
+
+	// Perform the HTTP request
+	resp, err = client.Do(req)
 
 	if err != nil {
-		log.Errorln("Failed to get response from OSDF Director:", err)
+		log.Errorln("Failed to get response from the director:", err)
 		return
 	}
 
 	defer resp.Body.Close()
+	log.Debugln("Director's response:", resp)
+
+	// Check HTTP response -- should be 307 (redirect), else something went wrong
+	body, _ := io.ReadAll(resp.Body)
+
+	// If we get a 404, the director will hopefully tell us why. It might be that the namespace doesn't exist
+	if resp.StatusCode == 404 {
+		return nil, errors.New("404: " + string(body))
+	} else if resp.StatusCode != 307 {
+		var respErr directorResponse
+		if unmarshalErr := json.Unmarshal(body, &respErr); unmarshalErr != nil { // Error creating json
+			return nil, errors.Wrap(unmarshalErr, "Could not unmarshall the director's response")
+		}
+		return resp, errors.Errorf("The director reported an error: %s", respErr.Error)
+	}
+
 	return
 }
 
 func GetCachesFromDirectorResponse(resp *http.Response, needsToken bool) (caches []namespaces.DirectorCache, err error) {
 	// Get the Link header
 	linkHeader := resp.Header.Values("Link")
+	if len(linkHeader) == 0 {
+		return []namespaces.DirectorCache{}, nil
+	}
 
 	for _, linksStr := range strings.Split(linkHeader[0], ",") {
 		links := strings.Split(strings.ReplaceAll(linksStr, " ", ""), ";")
@@ -188,7 +229,7 @@ func GetCachesFromDirectorResponse(resp *http.Response, needsToken bool) (caches
 }
 
 // NewTransferDetails creates the TransferDetails struct with the given cache
-func NewTransferDetailsUsingDirector(cache namespaces.DirectorCache, https bool) []TransferDetails {
+func NewTransferDetailsUsingDirector(cache namespaces.DirectorCache, opts TransferDetailsOptions) []TransferDetails {
 	details := make([]TransferDetails, 0)
 	cacheEndpoint := cache.EndpointUrl
 
@@ -206,22 +247,24 @@ func NewTransferDetailsUsingDirector(cache namespaces.DirectorCache, https bool)
 		cacheURL.Opaque = ""
 	}
 	log.Debugf("Parsed Cache: %s\n", cacheURL.String())
-	if https {
+	if opts.NeedsToken {
 		cacheURL.Scheme = "https"
 		if !HasPort(cacheURL.Host) {
 			// Add port 8444 and 8443
 			cacheURL.Host += ":8444"
 			details = append(details, TransferDetails{
-				Url:   *cacheURL,
-				Proxy: false,
+				Url:        *cacheURL,
+				Proxy:      false,
+				PackOption: opts.PackOption,
 			})
 			// Strip the port off and add 8443
 			cacheURL.Host = cacheURL.Host[:len(cacheURL.Host)-5] + ":8443"
 		}
 		// Whether port is specified or not, add a transfer without proxy
 		details = append(details, TransferDetails{
-			Url:   *cacheURL,
-			Proxy: false,
+			Url:        *cacheURL,
+			Proxy:      false,
+			PackOption: opts.PackOption,
 		})
 	} else {
 		cacheURL.Scheme = "http"
@@ -230,13 +273,15 @@ func NewTransferDetailsUsingDirector(cache namespaces.DirectorCache, https bool)
 		}
 		isProxyEnabled := IsProxyEnabled()
 		details = append(details, TransferDetails{
-			Url:   *cacheURL,
-			Proxy: isProxyEnabled,
+			Url:        *cacheURL,
+			Proxy:      isProxyEnabled,
+			PackOption: opts.PackOption,
 		})
 		if isProxyEnabled && CanDisableProxy() {
 			details = append(details, TransferDetails{
-				Url:   *cacheURL,
-				Proxy: false,
+				Url:        *cacheURL,
+				Proxy:      false,
+				PackOption: opts.PackOption,
 			})
 		}
 	}
diff --git a/director_test.go b/client/director_test.go
similarity index 91%
rename from director_test.go
rename to client/director_test.go
index db5a09ea5..200d0352c 100644
--- a/director_test.go
+++ b/client/director_test.go
@@ -16,17 +16,18 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"bytes"
-	"github.com/stretchr/testify/assert"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	namespaces "github.com/pelicanplatform/pelican/namespaces"
 )
 
@@ -109,8 +110,7 @@ func TestCreateNsFromDirectorResp(t *testing.T) {
 	}
 
 	// Call the function in question
-	var ns namespaces.Namespace
-	err := CreateNsFromDirectorResp(directorResponse, &ns)
+	ns, err := CreateNsFromDirectorResp(directorResponse)
 
 	// Test for expected outputs
 	assert.NoError(t, err, "Error creating Namespace from Director response")
@@ -143,7 +143,8 @@ func TestNewTransferDetailsUsingDirector(t *testing.T) {
 	}
 
 	// Case 1: cache with http
-	transfers := NewTransferDetailsUsingDirector(nonAuthCache, nonAuthCache.AuthedReq)
+
+	transfers := NewTransferDetailsUsingDirector(nonAuthCache, TransferDetailsOptions{nonAuthCache.AuthedReq, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, "my-cache-url:8000", transfers[0].Url.Host)
 	assert.Equal(t, "http", transfers[0].Url.Scheme)
@@ -154,7 +155,7 @@ func TestNewTransferDetailsUsingDirector(t *testing.T) {
 	assert.Equal(t, false, transfers[1].Proxy)
 
 	// Case 2: cache with https
-	transfers = NewTransferDetailsUsingDirector(authCache, authCache.AuthedReq)
+	transfers = NewTransferDetailsUsingDirector(authCache, TransferDetailsOptions{authCache.AuthedReq, ""})
 	assert.Equal(t, 1, len(transfers))
 	assert.Equal(t, "my-cache-url:8443", transfers[0].Url.Host)
 	assert.Equal(t, "https", transfers[0].Url.Scheme)
@@ -162,7 +163,7 @@ func TestNewTransferDetailsUsingDirector(t *testing.T) {
 
 	// Case 3: cache without port with http
 	nonAuthCache.EndpointUrl = "my-cache-url"
-	transfers = NewTransferDetailsUsingDirector(nonAuthCache, nonAuthCache.AuthedReq)
+	transfers = NewTransferDetailsUsingDirector(nonAuthCache, TransferDetailsOptions{nonAuthCache.AuthedReq, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, "my-cache-url:8000", transfers[0].Url.Host)
 	assert.Equal(t, "http", transfers[0].Url.Scheme)
@@ -173,7 +174,7 @@ func TestNewTransferDetailsUsingDirector(t *testing.T) {
 
 	// Case 4. cache without port with https
 	authCache.EndpointUrl = "my-cache-url"
-	transfers = NewTransferDetailsUsingDirector(authCache, authCache.AuthedReq)
+	transfers = NewTransferDetailsUsingDirector(authCache, TransferDetailsOptions{authCache.AuthedReq, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, "my-cache-url:8444", transfers[0].Url.Host)
 	assert.Equal(t, "https", transfers[0].Url.Scheme)
@@ -188,13 +189,13 @@ func TestQueryDirector(t *testing.T) {
 	expectedLocation := "http://redirect.com"
 	handler := func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Location", expectedLocation)
-		w.WriteHeader(http.StatusFound)
+		w.WriteHeader(http.StatusTemporaryRedirect)
 	}
 	server := httptest.NewServer(http.HandlerFunc(handler))
 	defer server.Close()
 
 	// Call QueryDirector with the test server URL and a source path
-	actualResp, err := QueryDirector("/foo/bar", server.URL)
+	actualResp, err := queryDirector("GET", "/foo/bar", server.URL)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -206,7 +207,7 @@ func TestQueryDirector(t *testing.T) {
 	}
 
 	// Check the HTTP status code
-	if actualResp.StatusCode != http.StatusFound {
+	if actualResp.StatusCode != http.StatusTemporaryRedirect {
 		t.Errorf("Expected HTTP status code %d, but got %d", http.StatusFound, actualResp.StatusCode)
 	}
 }
diff --git a/errorAccum.go b/client/errorAccum.go
similarity index 90%
rename from errorAccum.go
rename to client/errorAccum.go
index 4289ffe37..38f58b810 100644
--- a/errorAccum.go
+++ b/client/errorAccum.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"errors"
@@ -25,7 +25,7 @@ import (
 	"sync"
 	"time"
 
-	grab "github.com/cavaliercoder/grab"
+	grab "github.com/opensaucerer/grab/v3"
 )
 
 type TimestampedError struct {
@@ -112,6 +112,18 @@ func IsRetryable(err error) bool {
 		}
 		return true
 	}
+	var hep *HttpErrResp
+	if errors.As(err, &hep) {
+		switch int(hep.Code) {
+		case http.StatusInternalServerError:
+		case http.StatusBadGateway:
+		case http.StatusServiceUnavailable:
+		case http.StatusGatewayTimeout:
+			return true
+		default:
+			return false
+		}
+	}
 	return false
 }
 
diff --git a/errorAccum_test.go b/client/errorAccum_test.go
similarity index 99%
rename from errorAccum_test.go
rename to client/errorAccum_test.go
index 2bc490b22..f623395e1 100644
--- a/errorAccum_test.go
+++ b/client/errorAccum_test.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"errors"
diff --git a/get_best_cache.go b/client/get_best_cache.go
similarity index 99%
rename from get_best_cache.go
rename to client/get_best_cache.go
index 0e65fd699..62d476aa3 100644
--- a/get_best_cache.go
+++ b/client/get_best_cache.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"bytes"
diff --git a/get_stashserver_caches.go b/client/get_stashserver_caches.go
similarity index 99%
rename from get_stashserver_caches.go
rename to client/get_stashserver_caches.go
index c5be8de66..6316912d7 100644
--- a/get_stashserver_caches.go
+++ b/client/get_stashserver_caches.go
@@ -1,4 +1,4 @@
-package pelican
+package client
 
 import (
 	"bytes"
diff --git a/handle_http.go b/client/handle_http.go
similarity index 64%
rename from handle_http.go
rename to client/handle_http.go
index 72935732c..e3973e9d2 100644
--- a/handle_http.go
+++ b/client/handle_http.go
@@ -16,12 +16,10 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"context"
-	"crypto/tls"
-	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -38,27 +36,38 @@ import (
 	"syscall"
 	"time"
 
-	grab "github.com/cavaliercoder/grab"
+	grab "github.com/opensaucerer/grab/v3"
+	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
 	"github.com/studio-b12/gowebdav"
-	"github.com/vbauerster/mpb/v7"
-	"github.com/vbauerster/mpb/v7/decor"
+	"github.com/vbauerster/mpb/v8"
+	"github.com/vbauerster/mpb/v8/decor"
 
-	namespaces "github.com/pelicanplatform/pelican/namespaces"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/namespaces"
+	"github.com/pelicanplatform/pelican/param"
 )
 
-var p = mpb.New()
-
 var (
-	transport     *http.Transport
-	onceTransport sync.Once
+	progressCtrOnce sync.Once
+	progressCtr     *mpb.Progress
 )
 
 type StoppedTransferError struct {
 	Err string
 }
 
+// The progress container object creates several
+// background goroutines.  Instead of creating the object
+// globally, create it on first use.  This avoids having
+// the progress container routines launch in the server.
+func getProgressContainer() *mpb.Progress {
+	progressCtrOnce.Do(func() {
+		progressCtr = mpb.New()
+	})
+	return progressCtr
+}
+
 func (e *StoppedTransferError) Error() string {
 	return e.Err
 }
@@ -112,7 +121,7 @@ func IsProxyEnabled() bool {
 	if _, isSet := os.LookupEnv("http_proxy"); !isSet {
 		return false
 	}
-	if viper.IsSet("DisableHttpProxy") {
+	if param.Client_DisableHttpProxy.GetBool() {
 		return false
 	}
 	return true
@@ -120,7 +129,7 @@ func IsProxyEnabled() bool {
 
 // Determine whether we are allowed to skip the proxy as a fallback
 func CanDisableProxy() bool {
-	return !viper.IsSet("DisableProxyFallback")
+	return !param.Client_DisableProxyFallback.GetBool()
 }
 
 // ConnectionSetupError is an error that is returned when a connection to the remote server fails
@@ -163,13 +172,16 @@ type TransferDetails struct {
 
 	// Proxy specifies if a proxy should be used
 	Proxy bool
+
+	// Specifies the pack option in the transfer URL
+	PackOption string
 }
 
 // NewTransferDetails creates the TransferDetails struct with the given cache
-func NewTransferDetails(cache namespaces.Cache, https bool) []TransferDetails {
+func NewTransferDetails(cache namespaces.Cache, opts TransferDetailsOptions) []TransferDetails {
 	details := make([]TransferDetails, 0)
 	var cacheEndpoint string
-	if https {
+	if opts.NeedsToken {
 		cacheEndpoint = cache.AuthEndpoint
 	} else {
 		cacheEndpoint = cache.Endpoint
@@ -189,22 +201,24 @@ func NewTransferDetails(cache namespaces.Cache, https bool) []TransferDetails {
 		cacheURL.Opaque = ""
 	}
 	log.Debugf("Parsed Cache: %s\n", cacheURL.String())
-	if https {
+	if opts.NeedsToken {
 		cacheURL.Scheme = "https"
 		if !HasPort(cacheURL.Host) {
 			// Add port 8444 and 8443
 			cacheURL.Host += ":8444"
 			details = append(details, TransferDetails{
-				Url:   *cacheURL,
-				Proxy: false,
+				Url:        *cacheURL,
+				Proxy:      false,
+				PackOption: opts.PackOption,
 			})
 			// Strip the port off and add 8443
 			cacheURL.Host = cacheURL.Host[:len(cacheURL.Host)-5] + ":8443"
 		}
 		// Whether port is specified or not, add a transfer without proxy
 		details = append(details, TransferDetails{
-			Url:   *cacheURL,
-			Proxy: false,
+			Url:        *cacheURL,
+			Proxy:      false,
+			PackOption: opts.PackOption,
 		})
 	} else {
 		cacheURL.Scheme = "http"
@@ -213,13 +227,15 @@ func NewTransferDetails(cache namespaces.Cache, https bool) []TransferDetails {
 		}
 		isProxyEnabled := IsProxyEnabled()
 		details = append(details, TransferDetails{
-			Url:   *cacheURL,
-			Proxy: isProxyEnabled,
+			Url:        *cacheURL,
+			Proxy:      isProxyEnabled,
+			PackOption: opts.PackOption,
 		})
 		if isProxyEnabled && CanDisableProxy() {
 			details = append(details, TransferDetails{
-				Url:   *cacheURL,
-				Proxy: false,
+				Url:        *cacheURL,
+				Proxy:      false,
+				PackOption: opts.PackOption,
 			})
 		}
 	}
@@ -232,18 +248,23 @@ type TransferResults struct {
 	Downloaded int64
 }
 
+type TransferDetailsOptions struct {
+	NeedsToken bool
+	PackOption string
+}
+
 type CacheInterface interface{}
 
-func GenerateTransferDetailsUsingCache(cache CacheInterface, needsToken bool) []TransferDetails {
+func GenerateTransferDetailsUsingCache(cache CacheInterface, opts TransferDetailsOptions) []TransferDetails {
 	if directorCache, ok := cache.(namespaces.DirectorCache); ok {
-		return NewTransferDetailsUsingDirector(directorCache, needsToken)
+		return NewTransferDetailsUsingDirector(directorCache, opts)
 	} else if cache, ok := cache.(namespaces.Cache); ok {
-		return NewTransferDetails(cache, needsToken)
+		return NewTransferDetails(cache, opts)
 	}
 	return nil
 }
 
-func download_http(source string, destination string, payload *payloadStruct, namespace namespaces.Namespace, recursive bool, tokenName string, OSDFDirectorUrl string) (bytesTransferred int64, err error) {
+func download_http(sourceUrl *url.URL, destination string, payload *payloadStruct, namespace namespaces.Namespace, recursive bool, tokenName string) (bytesTransferred int64, err error) {
 
 	// First, create a handler for any panics that occur
 	defer func() {
@@ -258,12 +279,16 @@ func download_http(source string, destination string, payload *payloadStruct, na
 		}
 	}()
 
-	// Generate the downloadUrl
+	packOption := sourceUrl.Query().Get("pack")
+	if packOption != "" {
+		log.Debugln("Will use unpack option value", packOption)
+	}
+	sourceUrl = &url.URL{Path: sourceUrl.Path}
+
 	var token string
 	if namespace.UseTokenOnRead {
 		var err error
-		sourceUrl := url.URL{Path: source}
-		token, err = getToken(&sourceUrl, namespace, false, tokenName)
+		token, err = getToken(sourceUrl, namespace, false, tokenName)
 		if err != nil {
 			log.Errorln("Failed to get token though required to read from this namespace:", err)
 			return 0, err
@@ -273,24 +298,12 @@ func download_http(source string, destination string, payload *payloadStruct, na
 	// Check the env var "USE_OSDF_DIRECTOR" and decide if ordered caches should come from director
 	var transfers []TransferDetails
 	var files []string
-	var closestNamespaceCaches []CacheInterface
-	if OSDFDirectorUrl != "" {
-		log.Debugln("Using OSDF Director at ", OSDFDirectorUrl)
-		closestNamespaceCaches = make([]CacheInterface, len(namespace.SortedDirectorCaches))
-		for i, v := range namespace.SortedDirectorCaches {
-			closestNamespaceCaches[i] = v
-		}
-	} else {
-		tmpCaches, err := GetCachesFromNamespace(namespace)
-		if err != nil {
-			log.Errorln("Failed to get namespaced caches (treated as non-fatal):", err)
-		}
-
-		closestNamespaceCaches = make([]CacheInterface, len(tmpCaches))
-		for i, v := range tmpCaches {
-			closestNamespaceCaches[i] = v
-		}
+	directorUrl := param.Federation_DirectorUrl.GetString()
+	closestNamespaceCaches, err := GetCachesFromNamespace(namespace, directorUrl != "")
+	if err != nil {
+		log.Errorln("Failed to get namespaced caches (treated as non-fatal):", err)
 	}
+
 	log.Debugln("Matched caches:", closestNamespaceCaches)
 
 	// Make sure we only try as many caches as we have
@@ -299,23 +312,26 @@ func download_http(source string, destination string, payload *payloadStruct, na
 		cachesToTry = len(closestNamespaceCaches)
 	}
 	log.Debugln("Trying the caches:", closestNamespaceCaches[:cachesToTry])
-	downloadUrl := url.URL{Path: source}
 
 	if recursive {
 		var err error
-		files, err = walkDavDir(&downloadUrl, token, namespace)
+		files, err = walkDavDir(sourceUrl, namespace, token, "", false)
 		if err != nil {
 			log.Errorln("Error from walkDavDir", err)
 			return 0, err
 		}
 	} else {
-		files = append(files, source)
+		files = append(files, sourceUrl.Path)
 	}
 
 	for _, cache := range closestNamespaceCaches[:cachesToTry] {
 		// Parse the cache URL
 		log.Debugln("Cache:", cache)
-		transfers = append(transfers, GenerateTransferDetailsUsingCache(cache, namespace.ReadHTTPS || namespace.UseTokenOnRead)...)
+		td := TransferDetailsOptions{
+			NeedsToken: namespace.ReadHTTPS || namespace.UseTokenOnRead,
+			PackOption: packOption,
+		}
+		transfers = append(transfers, GenerateTransferDetailsUsingCache(cache, td)...)
 	}
 
 	if len(transfers) > 0 {
@@ -331,10 +347,13 @@ func download_http(source string, destination string, payload *payloadStruct, na
 	results := make(chan TransferResults, len(files))
 	//tf := TransferFiles{files: files}
 
+	if ObjectClientOptions.Recursive && ObjectClientOptions.ProgressBars {
+		log.SetOutput(getProgressContainer())
+	}
 	// Start the workers
 	for i := 1; i <= 5; i++ {
 		wg.Add(1)
-		go startDownloadWorker(source, destination, token, transfers, &wg, workChan, results)
+		go startDownloadWorker(sourceUrl.Path, destination, token, transfers, &wg, workChan, results)
 	}
 
 	// For each file, send it to the worker
@@ -361,7 +380,11 @@ func download_http(source string, destination string, payload *payloadStruct, na
 			downloadError = errors.New("failed to get outputs from one of the transfers")
 		}
 	}
-
+	// Make sure to close the progressContainer after all download complete
+	if ObjectClientOptions.Recursive && ObjectClientOptions.ProgressBars {
+		getProgressContainer().Wait()
+		log.SetOutput(os.Stdout)
+	}
 	return downloaded, downloadError
 
 }
@@ -444,58 +467,40 @@ func parseTransferStatus(status string) (int, string) {
 	return statusCode, strings.TrimSpace(parts[1])
 }
 
-func setupTransport() *http.Transport {
-	//Getting timeouts and other information from defaults.yaml
-	maxIdleConns := viper.GetInt("Transport.MaxIdleIcons")
-	idleConnTimeout := viper.GetDuration("Transport.IdleConnTimeout")
-	transportTLSHandshakeTimeout := viper.GetDuration("Transport.TLSHandshakeTimeout")
-	expectContinueTimeout := viper.GetDuration("Transport.ExpectContinueTimeout")
-	responseHeaderTimeout := viper.GetDuration("Transport.ResponseHeaderTimeout")
-
-	transportDialerTimeout := viper.GetDuration("Transport.Dialer.Timeout")
-	transportKeepAlive := viper.GetDuration("Transport.Dialer.KeepAlive")
-
-	//Set up the transport
-	return &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:   transportDialerTimeout,
-			KeepAlive: transportKeepAlive,
-		}).DialContext,
-		MaxIdleConns:          maxIdleConns,
-		IdleConnTimeout:       idleConnTimeout,
-		TLSHandshakeTimeout:   transportTLSHandshakeTimeout,
-		ExpectContinueTimeout: expectContinueTimeout,
-		ResponseHeaderTimeout: responseHeaderTimeout,
-	}
-}
-
-// function to get/setup the transport (only once)
-func getTransport() *http.Transport {
-	onceTransport.Do(func() {
-		transport = setupTransport()
-		if viper.GetBool("TLSSkipVerify") {
-			transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
-		}
-	})
-	return transport
-}
-
 // DownloadHTTP - Perform the actual download of the file
 func DownloadHTTP(transfer TransferDetails, dest string, token string) (int64, error) {
 
 	// Create the client, request, and context
 	client := grab.NewClient()
-	transport := getTransport()
+	transport := config.GetTransport()
 	if !transfer.Proxy {
 		transport.Proxy = nil
 	}
-	client.HTTPClient.Transport = transport
+	httpClient, ok := client.HTTPClient.(*http.Client)
+	if !ok {
+		return 0, errors.New("Internal error: implementation is not a http.Client type")
+	}
+	httpClient.Transport = transport
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	log.Debugln("Transfer URL String:", transfer.Url.String())
-	req, _ := grab.NewRequest(dest, transfer.Url.String())
+	var req *grab.Request
+	var err error
+	var unpacker *autoUnpacker
+	if transfer.PackOption != "" {
+		behavior, err := GetBehavior(transfer.PackOption)
+		if err != nil {
+			return 0, err
+		}
+		unpacker = newAutoUnpacker(dest, behavior)
+		if req, err = grab.NewRequestToWriter(unpacker, transfer.Url.String()); err != nil {
+			return 0, errors.Wrap(err, "Failed to create new download request")
+		}
+	} else if req, err = grab.NewRequest(dest, transfer.Url.String()); err != nil {
+		return 0, errors.Wrap(err, "Failed to create new download request")
+	}
+
 	if token != "" {
 		req.HTTPRequest.Header.Set("Authorization", "Bearer "+token)
 	}
@@ -511,8 +516,7 @@ func DownloadHTTP(transfer TransferDetails, dest string, token string) (int64, e
 	// Progress ticker
 	progressTicker := time.NewTicker(500 * time.Millisecond)
 	defer progressTicker.Stop()
-
-	downloadLimit := viper.GetInt("MinimumDownloadSPeed")
+	downloadLimit := param.Client_MinimumDownloadSpeed.GetInt()
 
 	// If we are doing a recursive, decrease the download limit by the number of likely workers ~5
 	if ObjectClientOptions.Recursive {
@@ -534,28 +538,47 @@ func DownloadHTTP(transfer TransferDetails, dest string, token string) (int64, e
 		}
 	}
 
+	// Size of the download
+	contentLength := resp.Size()
+	// Do a head request for content length if resp.Size is unknown
+	if contentLength <= 0 && ObjectClientOptions.ProgressBars {
+		headClient := &http.Client{Transport: config.GetTransport()}
+		headRequest, _ := http.NewRequest("HEAD", transfer.Url.String(), nil)
+		headResponse, err := headClient.Do(headRequest)
+		if err != nil {
+			log.Errorln("Could not successfully get response for HEAD request")
+			return 0, errors.Wrap(err, "Could not determine the size of the remote object")
+		}
+		defer headResponse.Body.Close()
+		contentLengthStr := headResponse.Header.Get("Content-Length")
+		contentLength, err = strconv.ParseInt(contentLengthStr, 10, 64)
+		if err != nil {
+			log.Errorln("problem converting content-length to an int", err)
+			contentLength = resp.Size()
+		}
+	}
+
 	var progressBar *mpb.Bar
 	if ObjectClientOptions.ProgressBars {
-		progressBar = p.AddBar(0,
+		progressBar = getProgressContainer().AddBar(0,
 			mpb.PrependDecorators(
 				decor.Name(filename, decor.WCSyncSpaceR),
 				decor.CountersKibiByte("% .2f / % .2f"),
 			),
 			mpb.AppendDecorators(
-				decor.EwmaETA(decor.ET_STYLE_GO, 90),
-				decor.Name(" ] "),
-				decor.EwmaSpeed(decor.UnitKiB, "% .2f", 20),
+				decor.OnComplete(decor.EwmaETA(decor.ET_STYLE_GO, 90), ""),
+				decor.OnComplete(decor.Name(" ] "), ""),
+				decor.OnComplete(decor.EwmaSpeed(decor.SizeB1024(0), "% .2f", 5), "Done!"),
 			),
 		)
 	}
 
-	stoppedTransferTimeout := viper.GetInt64("StoppedTransferTimeout")
-	slowTransferRampupTime := viper.GetInt64("SlowTransferRampupTime")
-	slowTransferWindow := viper.GetInt64("SlowTransferWindow")
+	stoppedTransferTimeout := int64(param.Client_StoppedTransferTimeout.GetInt())
+	slowTransferRampupTime := int64(param.Client_SlowTransferRampupTime.GetInt())
+	slowTransferWindow := int64(param.Client_SlowTransferWindow.GetInt())
 	var previousCompletedBytes int64 = 0
-	var previousCompletedTime = time.Now()
 	var startBelowLimit int64 = 0
-
+	var previousCompletedTime = time.Now()
 	var noProgressStartTime time.Time
 	var lastBytesComplete int64
 	// Loop of the download
@@ -564,23 +587,28 @@ Loop:
 		select {
 		case <-progressTicker.C:
 			if ObjectClientOptions.ProgressBars {
-				progressBar.SetTotal(resp.Size, false)
+				progressBar.SetTotal(contentLength, false)
 				currentCompletedBytes := resp.BytesComplete()
-				progressBar.IncrInt64(currentCompletedBytes - previousCompletedBytes)
+				bytesDelta := currentCompletedBytes - previousCompletedBytes
 				previousCompletedBytes = currentCompletedBytes
 				currentCompletedTime := time.Now()
-				progressBar.DecoratorEwmaUpdate(currentCompletedTime.Sub(previousCompletedTime))
+				timeElapsed := currentCompletedTime.Sub(previousCompletedTime)
+				progressBar.EwmaIncrInt64(bytesDelta, timeElapsed)
 				previousCompletedTime = currentCompletedTime
 			}
 
 		case <-t.C:
-
+			// Check that progress is being made and that it is not too slow
 			if resp.BytesComplete() == lastBytesComplete {
 				if noProgressStartTime.IsZero() {
 					noProgressStartTime = time.Now()
 				} else if time.Since(noProgressStartTime) > time.Duration(stoppedTransferTimeout)*time.Second {
 					errMsg := "No progress for more than " + time.Since(noProgressStartTime).Truncate(time.Millisecond).String()
 					log.Errorln(errMsg)
+					if ObjectClientOptions.ProgressBars {
+						progressBar.Abort(true)
+						progressBar.Wait()
+					}
 					return 5, &StoppedTransferError{
 						Err: errMsg,
 					}
@@ -596,7 +624,12 @@ Loop:
 				if resp.Duration() < time.Second*time.Duration(slowTransferRampupTime) {
 					continue
 				} else if startBelowLimit == 0 {
-					log.Warnln("Download speed of ", resp.BytesPerSecond(), "bytes/s", " is below the limit of", downloadLimit, "bytes/s")
+					warning := []byte("Warning! Downloading too slow...\n")
+					status, err := getProgressContainer().Write(warning)
+					if err != nil {
+						log.Errorln("Problem displaying slow message", err, status)
+						continue
+					}
 					startBelowLimit = time.Now().Unix()
 					continue
 				} else if (time.Now().Unix() - startBelowLimit) < slowTransferWindow {
@@ -606,29 +639,17 @@ Loop:
 				// The download is below the threshold for more than `SlowTransferWindow` seconds, cancel the download
 				cancel()
 				if ObjectClientOptions.ProgressBars {
-					var cancelledProgressBar = p.AddBar(0,
-						mpb.BarQueueAfter(progressBar, true),
-						mpb.BarFillerClearOnComplete(),
-						mpb.PrependDecorators(
-							decor.Name(filename, decor.WC{W: len(filename) + 1, C: decor.DidentRight}),
-							decor.OnComplete(decor.Name(filename, decor.WCSyncSpaceR), "cancelled, too slow!"),
-							decor.OnComplete(decor.EwmaETA(decor.ET_STYLE_MMSS, 0, decor.WCSyncWidth), ""),
-						),
-						mpb.AppendDecorators(
-							decor.OnComplete(decor.Percentage(decor.WC{W: 5}), ""),
-						),
-					)
-					progressBar.SetTotal(resp.Size, true)
-					cancelledProgressBar.SetTotal(resp.Size, true)
+					progressBar.Abort(true)
+					progressBar.Wait()
 				}
 
-				log.Errorln("Download speed of ", resp.BytesPerSecond(), "bytes/s", " is below the limit of", downloadLimit, "bytes/s")
+				log.Errorln("Cancelled: Download speed of ", resp.BytesPerSecond(), "bytes/s", " is below the limit of", downloadLimit, "bytes/s")
 
 				return 0, &SlowTransferError{
 					BytesTransferred: resp.BytesComplete(),
 					BytesPerSecond:   int64(resp.BytesPerSecond()),
 					Duration:         resp.Duration(),
-					BytesTotal:       resp.Size,
+					BytesTotal:       contentLength,
 				}
 
 			} else {
@@ -640,31 +661,26 @@ Loop:
 			// download is complete
 			if ObjectClientOptions.ProgressBars {
 				downloadError := resp.Err()
-				completeMsg := "done!"
 				if downloadError != nil {
-					completeMsg = downloadError.Error()
+					log.Errorln(downloadError.Error())
+					progressBar.Abort(true)
+					progressBar.Wait()
+				} else {
+					progressBar.SetTotal(contentLength, true)
+					// call wait here for the bar to complete and flush
+					// If recursive, we still want to use container so keep it open
+					if ObjectClientOptions.Recursive {
+						progressBar.Wait()
+					} else { // Otherwise just close it
+						getProgressContainer().Wait()
+					}
 				}
-				var doneProgressBar = p.AddBar(resp.Size,
-					mpb.BarQueueAfter(progressBar, true),
-					mpb.BarFillerClearOnComplete(),
-					mpb.PrependDecorators(
-						decor.Name(filename, decor.WC{W: len(filename) + 1, C: decor.DidentRight}),
-						decor.OnComplete(decor.Name(filename, decor.WCSyncSpaceR), completeMsg),
-						decor.OnComplete(decor.EwmaETA(decor.ET_STYLE_MMSS, 0, decor.WCSyncWidth), ""),
-					),
-					mpb.AppendDecorators(
-						decor.OnComplete(decor.Percentage(decor.WC{W: 5}), ""),
-					),
-				)
-
-				progressBar.SetTotal(resp.Size, true)
-				doneProgressBar.SetTotal(resp.Size, true)
 			}
 			break Loop
 		}
 	}
 	//fmt.Printf("\nDownload saved to", resp.Filename)
-	err := resp.Err()
+	err = resp.Err()
 	if err != nil {
 		// Connection errors
 		if errors.Is(err, syscall.ECONNREFUSED) ||
@@ -689,83 +705,173 @@ Loop:
 	// prior attempt.
 	if resp.HTTPResponse.StatusCode != 200 && resp.HTTPResponse.StatusCode != 206 {
 		log.Debugln("Got failure status code:", resp.HTTPResponse.StatusCode)
-		return 0, errors.New("failure status code")
+		return 0, &HttpErrResp{resp.HTTPResponse.StatusCode, fmt.Sprintf("Request failed (HTTP status %d): %s",
+			resp.HTTPResponse.StatusCode, resp.Err().Error())}
 	}
+
+	if unpacker != nil {
+		unpacker.Close()
+		if err := unpacker.Error(); err != nil {
+			return 0, err
+		}
+	}
+
 	log.Debugln("HTTP Transfer was successful")
 	return resp.BytesComplete(), nil
 }
 
+type Sizer interface {
+	Size() int64
+	BytesComplete() int64
+}
+
+type ConstantSizer struct {
+	size int64
+	read atomic.Int64
+}
+
+func (cs *ConstantSizer) Size() int64 {
+	return cs.size
+}
+
+func (cs *ConstantSizer) BytesComplete() int64 {
+	return cs.read.Load()
+}
+
 // ProgressReader wraps the io.Reader to get progress
 // Adapted from https://stackoverflow.com/questions/26050380/go-tracking-post-request-progress
 type ProgressReader struct {
-	file   *os.File
-	read   int64
-	size   int64
+	reader io.ReadCloser
+	sizer  Sizer
 	closed chan bool
 }
 
 // Read implements the common read function for io.Reader
 func (pr *ProgressReader) Read(p []byte) (n int, err error) {
-	n, err = pr.file.Read(p)
-	atomic.AddInt64(&pr.read, int64(n))
+	n, err = pr.reader.Read(p)
+	if cs, ok := pr.sizer.(*ConstantSizer); ok {
+		cs.read.Add(int64(n))
+	}
 	return n, err
 }
 
 // Close implments the close function of io.Closer
 func (pr *ProgressReader) Close() error {
-	err := pr.file.Close()
+	err := pr.reader.Close()
 	// Also, send the closed channel a message
 	pr.closed <- true
 	return err
 }
 
-// UploadFile Uploads a file using HTTP
-func UploadFile(src string, dest *url.URL, token string, namespace namespaces.Namespace) (int64, error) {
+func (pr *ProgressReader) BytesComplete() int64 {
+	return pr.sizer.BytesComplete()
+}
 
-	log.Debugln("In UploadFile")
-	log.Debugln("Dest", dest.String())
-	// Try opening the file to send
-	file, err := os.Open(src)
+func (pr *ProgressReader) Size() int64 {
+	return pr.sizer.Size()
+}
+
+// Recursively uploads a directory with all files and nested dirs, keeping file structure on server side
+func UploadDirectory(src string, dest *url.URL, token string, namespace namespaces.Namespace) (int64, error) {
+	var files []string
+	var amountDownloaded int64
+	srcUrl := url.URL{Path: src}
+	// Get the list of files as well as make any directories on the server end
+	files, err := walkDavDir(&srcUrl, namespace, token, dest.Path, true)
 	if err != nil {
-		log.Errorln("Error opening local file:", err)
 		return 0, err
 	}
+
+	if ObjectClientOptions.ProgressBars {
+		log.SetOutput(getProgressContainer())
+	}
+	// Upload all of our files within the proper directories
+	for _, file := range files {
+		tempDest := url.URL{}
+		tempDest.Path, err = url.JoinPath(dest.Path, file)
+		if err != nil {
+			return 0, err
+		}
+		downloaded, err := UploadFile(file, &tempDest, token, namespace)
+		if err != nil {
+			return 0, err
+		}
+		amountDownloaded += downloaded
+	}
+	// Close progress bar container
+	if ObjectClientOptions.ProgressBars {
+		getProgressContainer().Wait()
+		log.SetOutput(os.Stdout)
+	}
+	return amountDownloaded, err
+}
+
+// UploadFile Uploads a file using HTTP
+func UploadFile(src string, origDest *url.URL, token string, namespace namespaces.Namespace) (int64, error) {
+
+	log.Debugln("In UploadFile")
+	log.Debugln("Dest", origDest.String())
+
 	// Stat the file to get the size (for progress bar)
-	fileInfo, err := file.Stat()
+	fileInfo, err := os.Stat(src)
 	if err != nil {
-		log.Errorln("Error stating local file ", src, ":", err)
+		log.Errorln("Error checking local file ", src, ":", err)
 		return 0, err
 	}
+
+	var ioreader io.ReadCloser
+	var sizer Sizer
+	pack := origDest.Query().Get("pack")
+	nonZeroSize := true
+	if pack != "" {
+		if !fileInfo.IsDir() {
+			return 0, errors.Errorf("Upload with pack=%v only works when input (%v) is a directory", pack, src)
+		}
+		behavior, err := GetBehavior(pack)
+		if err != nil {
+			return 0, err
+		}
+		if behavior == autoBehavior {
+			behavior = defaultBehavior
+		}
+		ap := newAutoPacker(src, behavior)
+		ioreader = ap
+		sizer = ap
+	} else {
+		// Try opening the file to send
+		file, err := os.Open(src)
+		if err != nil {
+			log.Errorln("Error opening local file:", err)
+			return 0, err
+		}
+		ioreader = file
+		sizer = &ConstantSizer{size: fileInfo.Size()}
+		nonZeroSize = fileInfo.Size() > 0
+	}
+
 	// Parse the writeback host as a URL
 	writebackhostUrl, err := url.Parse(namespace.WriteBackHost)
 	if err != nil {
 		return 0, err
 	}
-	dest.Host = writebackhostUrl.Host
-	dest.Scheme = "https"
 
-	// Check if the destination is a directory
-	isDestDir, err := IsDir(dest, token, namespace)
-	if err != nil {
-		log.Warnln("Received an error from checking if dest was a directory.  Going to continue as if there was no error")
-	}
-	if isDestDir {
-		// Set the destination as the basename of the source
-		dest.Path = path.Join(dest.Path, path.Base(src))
-		log.Debugln("Destination", dest.Path, "is a directory")
+	dest := &url.URL{
+		Host:   writebackhostUrl.Host,
+		Scheme: "https",
+		Path:   origDest.Path,
 	}
 
 	// Create the wrapped reader and send it to the request
 	closed := make(chan bool, 1)
 	errorChan := make(chan error, 1)
 	responseChan := make(chan *http.Response)
-	reader := &ProgressReader{file, 0, fileInfo.Size(), closed}
+	reader := &ProgressReader{ioreader, sizer, closed}
 	putContext, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	log.Debugln("Full destination URL:", dest.String())
 	var request *http.Request
 	// For files that are 0 length, we need to send a PUT request with an nil body
-	if fileInfo.Size() > 0 {
+	if nonZeroSize {
 		request, err = http.NewRequestWithContext(putContext, "PUT", dest.String(), reader)
 	} else {
 		request, err = http.NewRequestWithContext(putContext, "PUT", dest.String(), http.NoBody)
@@ -774,7 +880,6 @@ func UploadFile(src string, dest *url.URL, token string, namespace namespaces.Na
 		log.Errorln("Error creating request:", err)
 		return 0, err
 	}
-	request.ContentLength = fileInfo.Size()
 	// Set the authorization header
 	request.Header.Set("Authorization", "Bearer "+token)
 	var lastKnownWritten int64
@@ -783,13 +888,51 @@ func UploadFile(src string, dest *url.URL, token string, namespace namespaces.Na
 	go doPut(request, responseChan, errorChan)
 	var lastError error = nil
 
+	var progressBar *mpb.Bar
+	if ObjectClientOptions.ProgressBars {
+		progressBar = getProgressContainer().AddBar(0,
+			mpb.PrependDecorators(
+				decor.Name(src, decor.WCSyncSpaceR),
+				decor.CountersKibiByte("% .2f / % .2f"),
+			),
+			mpb.AppendDecorators(
+				decor.OnComplete(decor.EwmaETA(decor.ET_STYLE_GO, 90), ""),
+				decor.OnComplete(decor.Name(" ] "), ""),
+				decor.OnComplete(decor.EwmaSpeed(decor.SizeB1024(0), "% .2f", 5), "Done!"),
+			),
+		)
+		// Shutdown progress bar at the end of the function
+		defer func() {
+			if lastError == nil {
+				progressBar.SetTotal(reader.Size(), true)
+			} else {
+				progressBar.Abort(true)
+			}
+			// If it is recursive, we need to reuse the mpb instance. Closed later
+			if ObjectClientOptions.Recursive {
+				progressBar.Wait()
+			} else { // If not recursive, go ahead and close it
+				getProgressContainer().Wait()
+			}
+		}()
+	}
+	tickerDuration := 500 * time.Millisecond
+	progressTicker := time.NewTicker(tickerDuration)
+	defer progressTicker.Stop()
+
 	// Do the select on a ticker, and the writeChan
 Loop:
 	for {
 		select {
+		case <-progressTicker.C:
+			if progressBar != nil {
+				progressBar.SetTotal(reader.Size(), false)
+				progressBar.EwmaSetCurrent(reader.BytesComplete(), tickerDuration)
+			}
+
 		case <-t.C:
 			// If we are not making any progress, if we haven't written 1MB in the last 5 seconds
-			currentRead := atomic.LoadInt64(&reader.read)
+			currentRead := reader.BytesComplete()
 			log.Debugln("Current read:", currentRead)
 			log.Debugln("Last known written:", lastKnownWritten)
 			if lastKnownWritten < currentRead {
@@ -808,7 +951,8 @@ Loop:
 		case response := <-responseChan:
 			if response.StatusCode != 200 {
 				log.Errorln("Got failure status code:", response.StatusCode)
-				lastError = errors.New("failure status code")
+				lastError = &HttpErrResp{response.StatusCode, fmt.Sprintf("Request failed (HTTP status %d)",
+					response.StatusCode)}
 				break Loop
 			}
 			break Loop
@@ -824,15 +968,15 @@ Loop:
 	if fileInfo.Size() == 0 {
 		return 0, lastError
 	} else {
-		return atomic.LoadInt64(&reader.read), lastError
+		log.Debugln("Uploaded bytes:", reader.BytesComplete())
+		return reader.BytesComplete(), lastError
 	}
 
 }
 
-var UploadClient = &http.Client{Transport: getTransport()}
-
 // Actually perform the Put request to the server
 func doPut(request *http.Request, responseChan chan<- *http.Response, errorChan chan<- error) {
+	var UploadClient = &http.Client{Transport: config.GetTransport()}
 	client := UploadClient
 	dump, _ := httputil.DumpRequestOut(request, false)
 	log.Debugf("Dumping request: %s", dump)
@@ -859,57 +1003,7 @@ func doPut(request *http.Request, responseChan chan<- *http.Response, errorChan
 
 }
 
-func IsDir(dirUrl *url.URL, token string, namespace namespaces.Namespace) (bool, error) {
-	connectUrl := url.URL{}
-	if namespace.DirListHost != "" {
-		// Parse the dir list host
-		dirListURL, err := url.Parse(namespace.DirListHost)
-		if err != nil {
-			log.Errorln("Failed to parse dirlisthost from namespaces into URL:", err)
-			return false, err
-		}
-		connectUrl = *dirListURL
-
-	} else {
-		log.Errorln("Host for directory listings is unknown")
-		return false, errors.New("Host for directory listings is unknown")
-	}
-
-	c := gowebdav.NewClient(connectUrl.String(), "", "")
-	//c.SetHeader("Authorization", "Bearer "+token)
-
-	// The path can have special characters in it like '#' and '?', so we have to collect
-	// the path parts and join them together
-	finalPath := dirUrl.Path
-	if dirUrl.RawQuery != "" {
-		finalPath += "?" + dirUrl.RawQuery
-	}
-	if dirUrl.Fragment != "" {
-		finalPath += "#" + dirUrl.Fragment
-	}
-	log.Debugln("Final webdav checked path:", finalPath)
-	info, err := c.Stat(finalPath)
-	if err != nil {
-		log.Debugln("Failed to ReadDir:", err, "for URL:", dirUrl.String())
-		return false, err
-	}
-	log.Debugln("Got isDir response:", info.IsDir())
-	return info.IsDir(), nil
-
-}
-
-func walkDavDir(url *url.URL, token string, namespace namespaces.Namespace) ([]string, error) {
-
-	// First, check if the url is a directory
-	isDir, err := IsDir(url, token, namespace)
-	if err != nil {
-		log.Errorln("Failed to check if path", url.Path, " is directory:", err)
-		return nil, err
-	}
-	if !isDir {
-		log.Errorln("Path ", url.Path, " is not a directory.")
-		return nil, errors.New("path " + url.Path + " is not a directory")
-	}
+func walkDavDir(url *url.URL, namespace namespaces.Namespace, token string, destPath string, upload bool) ([]string, error) {
 
 	// Create the client to walk the filesystem
 	rootUrl := *url
@@ -927,18 +1021,58 @@ func walkDavDir(url *url.URL, token string, namespace namespaces.Namespace) ([]s
 		return nil, errors.New("Host for directory listings is unknown")
 	}
 	log.Debugln("Dir list host: ", rootUrl.String())
-	c := gowebdav.NewClient(rootUrl.String(), "", "")
+
+	auth := &bearerAuth{token: token}
+	c := gowebdav.NewAuthClient(rootUrl.String(), auth)
 
 	// XRootD does not like keep alives and kills things, so turn them off.
-	transport = getTransport()
+	transport := config.GetTransport()
 	c.SetTransport(transport)
-
-	files, err := walkDir(url.Path, c)
+	var files []string
+	var err error
+	if upload {
+		files, err = walkDirUpload(url.Path, c, destPath)
+	} else {
+		files, err = walkDir(url.Path, c)
+	}
 	log.Debugln("Found files:", files)
 	return files, err
 
 }
 
+// For uploads, we want to make directories on the server end
+func walkDirUpload(path string, client *gowebdav.Client, destPath string) ([]string, error) {
+	// List of files to return
+	var files []string
+	// Whenever this function is called, we should create a new dir on the server side for uploads
+	err := client.Mkdir(destPath+path, 0755)
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("Creating directory: %s", destPath+path)
+
+	// Get our list of files
+	infos, err := os.ReadDir(path)
+	if err != nil {
+		return nil, err
+	}
+	for _, info := range infos {
+		newPath := path + "/" + info.Name()
+		if info.IsDir() {
+			// Recursively call this function to create any nested dir's as well as list their files
+			returnedFiles, err := walkDirUpload(newPath, client, destPath)
+			if err != nil {
+				return nil, err
+			}
+			files = append(files, returnedFiles...)
+		} else {
+			// It is a normal file
+			files = append(files, newPath)
+		}
+	}
+	return files, err
+}
+
 func walkDir(path string, client *gowebdav.Client) ([]string, error) {
 	var files []string
 	log.Debugln("Reading directory: ", path)
@@ -982,7 +1116,7 @@ func StatHttp(dest *url.URL, namespace namespaces.Namespace) (uint64, error) {
 
 	var resp *http.Response
 	for {
-		transport := getTransport()
+		transport := config.GetTransport()
 		if disableProxy {
 			log.Debugln("Performing HEAD (without proxy)", dest.String())
 			transport.Proxy = nil
diff --git a/handle_http_test.go b/client/handle_http_test.go
similarity index 59%
rename from handle_http_test.go
rename to client/handle_http_test.go
index e889dfb26..91282ac86 100644
--- a/handle_http_test.go
+++ b/client/handle_http_test.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 /***************************************************************
  *
  * Copyright (C) 2023, University of Nebraska-Lincoln
@@ -16,10 +18,15 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -31,11 +38,21 @@ import (
 	"testing"
 	"time"
 
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/launchers"
 	"github.com/pelicanplatform/pelican/namespaces"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/test_utils"
 )
 
 func TestMain(m *testing.M) {
@@ -72,7 +89,7 @@ func TestNewTransferDetails(t *testing.T) {
 		Endpoint:     "cache.edu:8000",
 		Resource:     "Cache",
 	}
-	transfers := NewTransferDetails(testCache, false)
+	transfers := NewTransferDetails(testCache, TransferDetailsOptions{false, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, "cache.edu:8000", transfers[0].Url.Host)
 	assert.Equal(t, "http", transfers[0].Url.Scheme)
@@ -82,7 +99,7 @@ func TestNewTransferDetails(t *testing.T) {
 	assert.Equal(t, false, transfers[1].Proxy)
 
 	// Case 2: cache with https
-	transfers = NewTransferDetails(testCache, true)
+	transfers = NewTransferDetails(testCache, TransferDetailsOptions{true, ""})
 	assert.Equal(t, 1, len(transfers))
 	assert.Equal(t, "cache.edu:8443", transfers[0].Url.Host)
 	assert.Equal(t, "https", transfers[0].Url.Scheme)
@@ -90,7 +107,7 @@ func TestNewTransferDetails(t *testing.T) {
 
 	testCache.Endpoint = "cache.edu"
 	// Case 3: cache without port with http
-	transfers = NewTransferDetails(testCache, false)
+	transfers = NewTransferDetails(testCache, TransferDetailsOptions{false, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, "cache.edu:8000", transfers[0].Url.Host)
 	assert.Equal(t, "http", transfers[0].Url.Scheme)
@@ -101,7 +118,7 @@ func TestNewTransferDetails(t *testing.T) {
 
 	// Case 4. cache without port with https
 	testCache.AuthEndpoint = "cache.edu"
-	transfers = NewTransferDetails(testCache, true)
+	transfers = NewTransferDetails(testCache, TransferDetailsOptions{true, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, "cache.edu:8444", transfers[0].Url.Host)
 	assert.Equal(t, "https", transfers[0].Url.Scheme)
@@ -122,11 +139,11 @@ func TestNewTransferDetailsEnv(t *testing.T) {
 	os.Setenv("OSG_DISABLE_PROXY_FALLBACK", "")
 	err := config.InitClient()
 	assert.Nil(t, err)
-	transfers := NewTransferDetails(testCache, false)
+	transfers := NewTransferDetails(testCache, TransferDetailsOptions{false, ""})
 	assert.Equal(t, 1, len(transfers))
 	assert.Equal(t, true, transfers[0].Proxy)
 
-	transfers = NewTransferDetails(testCache, true)
+	transfers = NewTransferDetails(testCache, TransferDetailsOptions{true, ""})
 	assert.Equal(t, 1, len(transfers))
 	assert.Equal(t, "https", transfers[0].Url.Scheme)
 	assert.Equal(t, false, transfers[0].Proxy)
@@ -138,8 +155,8 @@ func TestNewTransferDetailsEnv(t *testing.T) {
 
 func TestSlowTransfers(t *testing.T) {
 	// Adjust down some timeouts to speed up the test
-	viper.Set("SlowTransferWindow", 5)
-	viper.Set("SlowTransferRampupTime", 10)
+	viper.Set("Client.SlowTransferWindow", 5)
+	viper.Set("Client.SlowTransferRampupTime", 10)
 
 	channel := make(chan bool)
 	slowDownload := 1024 * 10 // 10 KiB/s < 100 KiB/s
@@ -168,7 +185,7 @@ func TestSlowTransfers(t *testing.T) {
 		Endpoint:     svr.URL,
 		Resource:     "Cache",
 	}
-	transfers := NewTransferDetails(testCache, false)
+	transfers := NewTransferDetails(testCache, TransferDetailsOptions{false, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, svr.URL, transfers[0].Url.String())
 
@@ -201,8 +218,8 @@ func TestSlowTransfers(t *testing.T) {
 // Test stopped transfer
 func TestStoppedTransfer(t *testing.T) {
 	// Adjust down the timeouts
-	viper.Set("StoppedTransferTimeout", 3)
-	viper.Set("SlowTransferRampupTime", 100)
+	viper.Set("Client.StoppedTransferTimeout", 3)
+	viper.Set("Client.SlowTransferRampupTime", 100)
 
 	channel := make(chan bool)
 	svr := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -231,7 +248,7 @@ func TestStoppedTransfer(t *testing.T) {
 		Endpoint:     svr.URL,
 		Resource:     "Cache",
 	}
-	transfers := NewTransferDetails(testCache, false)
+	transfers := NewTransferDetails(testCache, TransferDetailsOptions{false, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, svr.URL, transfers[0].Url.String())
 
@@ -297,7 +314,7 @@ func TestTrailerError(t *testing.T) {
 		Endpoint:     svr.URL,
 		Resource:     "Cache",
 	}
-	transfers := NewTransferDetails(testCache, false)
+	transfers := NewTransferDetails(testCache, TransferDetailsOptions{false, ""})
 	assert.Equal(t, 2, len(transfers))
 	assert.Equal(t, svr.URL, transfers[0].Url.String())
 
@@ -366,47 +383,177 @@ func TestFailedUpload(t *testing.T) {
 	}
 }
 
+func generateFileTestScitoken() (string, error) {
+	// Issuer is whichever server that initiates the test, so it's the server itself
+	issuerUrl := param.Origin_Url.GetString()
+	if issuerUrl == "" { // if empty, then error
+		return "", errors.New("Failed to create token: Invalid iss, Server_ExternalWebUrl is empty")
+	}
+	jti_bytes := make([]byte, 16)
+	if _, err := rand.Read(jti_bytes); err != nil {
+		return "", err
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jti_bytes)
+
+	tok, err := jwt.NewBuilder().
+		Claim("scope", "storage.read:/ storage.modify:/").
+		Claim("wlcg.ver", "1.0").
+		JwtID(jti).
+		Issuer(issuerUrl).
+		Audience([]string{param.Origin_Url.GetString()}).
+		Subject("origin").
+		Expiration(time.Now().Add(time.Minute)).
+		IssuedAt(time.Now()).
+		Build()
+	if err != nil {
+		return "", err
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to load server's issuer key")
+	}
+
+	if err := jwk.AssignKeyID(key); err != nil {
+		return "", errors.Wrap(err, "Failed to assign kid to the token")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", err
+	}
+
+	return string(signed), nil
+}
+
 func TestFullUpload(t *testing.T) {
-	testFileContent := "test file content"
-	ts := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	// Setup our test federation
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
 
-		//t.Logf("%s", dump)
-		assert.Equal(t, "PUT", r.Method, "Not PUT Method")
-		_, err := w.Write([]byte(":)"))
-		assert.NoError(t, err)
-	}))
-	defer ts.Close()
+	viper.Reset()
 
-	// Create the temporary file to upload
-	tempFile, err := os.CreateTemp(t.TempDir(), "test")
-	assert.NoError(t, err, "Error creating temp file")
-	defer os.Remove(tempFile.Name())
-	_, err = tempFile.WriteString(testFileContent)
-	assert.NoError(t, err, "Error writing to temp file")
-	tempFile.Close()
-
-	// Create the namespace (only the write back host is read)
-	testURL, err := url.Parse(ts.URL)
-	assert.NoError(t, err, "Error parsing test URL")
-	testNamespace := namespaces.Namespace{
-		WriteBackHost: "https://" + testURL.Host,
+	modules := config.ServerType(0)
+	modules.Set(config.OriginType)
+	modules.Set(config.DirectorType)
+	modules.Set(config.RegistryType)
+
+	// Create our own temp directory (for some reason t.TempDir() does not play well with xrootd)
+	tmpPathPattern := "XRootD-Test_Origin*"
+	tmpPath, err := os.MkdirTemp("", tmpPathPattern)
+	require.NoError(t, err)
+
+	// Need to set permissions or the xrootd process we spawn won't be able to write PID/UID files
+	permissions := os.FileMode(0755)
+	err = os.Chmod(tmpPath, permissions)
+	require.NoError(t, err)
+
+	viper.Set("ConfigDir", tmpPath)
+
+	// Increase the log level; otherwise, its difficult to debug failures
+	viper.Set("Logging.Level", "Debug")
+	config.InitConfig()
+
+	originDir, err := os.MkdirTemp("", "Origin")
+	assert.NoError(t, err)
+
+	// Change the permissions of the temporary directory
+	permissions = os.FileMode(0777)
+	err = os.Chmod(originDir, permissions)
+	require.NoError(t, err)
+
+	viper.Set("Origin.ExportVolume", originDir+":/test")
+	viper.Set("Origin.Mode", "posix")
+	// Disable functionality we're not using (and is difficult to make work on Mac)
+	viper.Set("Origin.EnableCmsd", false)
+	viper.Set("Origin.EnableMacaroons", false)
+	viper.Set("Origin.EnableVoms", false)
+	viper.Set("Origin.EnableWrite", true)
+	viper.Set("TLSSkipVerify", true)
+	viper.Set("Server.EnableUI", false)
+	viper.Set("Registry.DbLocation", filepath.Join(t.TempDir(), "ns-registry.sqlite"))
+	viper.Set("Xrootd.RunLocation", tmpPath)
+
+	err = config.InitServer(ctx, modules)
+	require.NoError(t, err)
+
+	fedCancel, err := launchers.LaunchModules(ctx, modules)
+	defer fedCancel()
+	if err != nil {
+		log.Errorln("Failure in fedServeInternal:", err)
+		require.NoError(t, err)
 	}
 
-	// Upload the file
-	uploadURL, err := url.Parse("stash:///test/stuff/blah.txt")
-	assert.NoError(t, err, "Error parsing upload URL")
-	// Set the upload client to trust the server
-	UploadClient = ts.Client()
-	uploaded, err := UploadFile(tempFile.Name(), uploadURL, "Bearer test", testNamespace)
-	assert.NoError(t, err, "Error uploading file")
-	assert.Equal(t, int64(len(testFileContent)), uploaded, "Uploaded file size does not match")
-
-	// Upload an osdf file
-	uploadURL, err = url.Parse("osdf:///test/stuff/blah.txt")
-	assert.NoError(t, err, "Error parsing upload URL")
-	// Set the upload client to trust the server
-	UploadClient = ts.Client()
-	uploaded, err = UploadFile(tempFile.Name(), uploadURL, "Bearer test", testNamespace)
-	assert.NoError(t, err, "Error uploading file")
-	assert.Equal(t, int64(len(testFileContent)), uploaded, "Uploaded file size does not match")
+	desiredURL := param.Server_ExternalWebUrl.GetString() + "/.well-known/openid-configuration"
+	err = server_utils.WaitUntilWorking(ctx, "GET", desiredURL, "director", 200)
+	require.NoError(t, err)
+
+	httpc := http.Client{
+		Transport: config.GetTransport(),
+	}
+	resp, err := httpc.Get(desiredURL)
+	require.NoError(t, err)
+
+	assert.Equal(t, resp.StatusCode, http.StatusOK)
+
+	responseBody, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	expectedResponse := struct {
+		JwksUri string `json:"jwks_uri"`
+	}{}
+	err = json.Unmarshal(responseBody, &expectedResponse)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, expectedResponse.JwksUri)
+
+	t.Run("testFullUpload", func(t *testing.T) {
+		testFileContent := "test file content"
+
+		// Create the temporary file to upload
+		tempFile, err := os.CreateTemp(t.TempDir(), "test")
+		assert.NoError(t, err, "Error creating temp file")
+		defer os.Remove(tempFile.Name())
+		_, err = tempFile.WriteString(testFileContent)
+		assert.NoError(t, err, "Error writing to temp file")
+		tempFile.Close()
+
+		// Create a token file
+		token, err := generateFileTestScitoken()
+		assert.NoError(t, err)
+		tempToken, err := os.CreateTemp(t.TempDir(), "token")
+		assert.NoError(t, err, "Error creating temp token file")
+		defer os.Remove(tempToken.Name())
+		_, err = tempToken.WriteString(token)
+		assert.NoError(t, err, "Error writing to temp token file")
+		tempToken.Close()
+		ObjectClientOptions.Token = tempToken.Name()
+
+		// Upload the file
+		tempPath := tempFile.Name()
+		fileName := filepath.Base(tempPath)
+		uploadURL := "stash:///test/" + fileName
+
+		methods := []string{"http"}
+		uploaded, err := DoStashCPSingle(tempFile.Name(), uploadURL, methods, false)
+		assert.NoError(t, err, "Error uploading file")
+		assert.Equal(t, int64(len(testFileContent)), uploaded, "Uploaded file size does not match")
+
+		// Upload an osdf file
+		uploadURL = "osdf:///test/stuff/blah.txt"
+		assert.NoError(t, err, "Error parsing upload URL")
+		uploaded, err = DoStashCPSingle(tempFile.Name(), uploadURL, methods, false)
+		assert.NoError(t, err, "Error uploading file")
+		assert.Equal(t, int64(len(testFileContent)), uploaded, "Uploaded file size does not match")
+	})
+	t.Cleanup(func() {
+		ObjectClientOptions.Token = ""
+		os.RemoveAll(tmpPath)
+		os.RemoveAll(originDir)
+	})
+
+	cancel()
+	fedCancel()
+	assert.NoError(t, egrp.Wait())
+	viper.Reset()
 }
diff --git a/handle_ingest.go b/client/handle_ingest.go
similarity index 99%
rename from handle_ingest.go
rename to client/handle_ingest.go
index d656a70f5..60fc5bbde 100644
--- a/handle_ingest.go
+++ b/client/handle_ingest.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"errors"
diff --git a/main.go b/client/main.go
similarity index 53%
rename from main.go
rename to client/main.go
index 681a1f9e4..e55b96e01 100644
--- a/main.go
+++ b/client/main.go
@@ -16,13 +16,14 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net"
+	"net/http"
 	"net/url"
 	"regexp"
 	"runtime/debug"
@@ -44,12 +45,14 @@ import (
 
 	"github.com/pelicanplatform/pelican/config"
 	"github.com/pelicanplatform/pelican/namespaces"
+	"github.com/pelicanplatform/pelican/param"
 	"github.com/spf13/viper"
 )
 
 type OptionsStruct struct {
 	ProgressBars bool
 	Recursive    bool
+	Plugin       bool
 	Token        string
 	Version      string
 }
@@ -101,14 +104,17 @@ func getTokenName(destination *url.URL) (scheme, tokenName string) {
 }
 
 // Do writeback to stash using SciTokens
-func doWriteBack(source string, destination *url.URL, namespace namespaces.Namespace) (int64, error) {
+func doWriteBack(source string, destination *url.URL, namespace namespaces.Namespace, recursive bool) (int64, error) {
 
 	scitoken_contents, err := getToken(destination, namespace, true, "")
 	if err != nil {
 		return 0, err
 	}
-	return UploadFile(source, destination, scitoken_contents, namespace)
-
+	if recursive {
+		return UploadDirectory(source, destination, scitoken_contents, namespace)
+	} else {
+		return UploadFile(source, destination, scitoken_contents, namespace)
+	}
 }
 
 // getToken returns the token to use for the given destination
@@ -174,32 +180,31 @@ func getToken(destination *url.URL, namespace namespaces.Namespace, isWrite bool
 		}
 
 		// Finally, look in the HTCondor runtime
-		token_filename := "scitokens.use"
-		if len(token_name) > 0 {
-			token_filename = token_name + ".use"
-		}
-		log.Debugln("Looking for token file:", token_filename)
-		if credsDir, isCondorCredsSet := os.LookupEnv("_CONDOR_CREDS"); token_location == "" && isCondorCredsSet {
-			// Token wasn't specified on the command line or environment, try the default scitoken
-			if _, err := os.Stat(filepath.Join(credsDir, token_filename)); err != nil {
-				log.Warningln("Environment variable _CONDOR_CREDS is set, but file being point to does not exist:", err)
-			} else {
-				token_location = filepath.Join(credsDir, token_filename)
-			}
-		}
-		if _, err := os.Stat(".condor_creds/" + token_filename); err == nil && token_location == "" {
-			token_location, _ = filepath.Abs(".condor_creds/" + token_filename)
+		if token_location == "" {
+			token_location = discoverHTCondorToken(token_name)
 		}
+
 		if token_location == "" {
-			value, err := AcquireToken(destination, namespace, isWrite)
-			if err == nil {
-				return value, nil
+			if !ObjectClientOptions.Plugin {
+				opts := config.TokenGenerationOpts{Operation: config.TokenSharedRead}
+				if isWrite {
+					opts.Operation = config.TokenSharedWrite
+				}
+				value, err := AcquireToken(destination, namespace, opts)
+				if err == nil {
+					return value, nil
+				}
+				log.Errorln("Failed to generate a new authorization token for this transfer: ", err)
+				log.Errorln("This transfer requires authorization to complete and no token is available")
+				err = errors.New("failed to find or generate a token as required for " + destination.String())
+				AddError(err)
+				return "", err
+			} else {
+				log.Errorln("Credential is required, but currently mssing")
+				err := errors.New("Credential is required for " + destination.String() + " but is currently missing")
+				AddError(err)
+				return "", err
 			}
-			log.Errorln("Failed to generate a new authorization token for this transfer: ", err)
-			log.Errorln("This transfer requires authorization to complete and no token is available")
-			err = errors.New("failed to find or generate a token as required for " + destination.String())
-			AddError(err)
-			return "", err
 		}
 	}
 
@@ -258,7 +263,7 @@ func CheckOSDF(destination string, methods []string) (remoteSize uint64, err err
 		federationUrl, _ := url.Parse(dest_uri.String())
 		federationUrl.Scheme = "https"
 		federationUrl.Path = ""
-		viper.Set("FederationURL", federationUrl.String())
+		viper.Set("Federation.DiscoveryUrl", federationUrl.String())
 		err = config.DiscoverFederation()
 		if err != nil {
 			return 0, err
@@ -286,6 +291,7 @@ func CheckOSDF(destination string, methods []string) (remoteSize uint64, err err
 	return 0, err
 }
 
+// FIXME: GetCacheHostnames is not director-aware!
 func GetCacheHostnames(testFile string) (urls []string, err error) {
 
 	ns, err := namespaces.MatchNamespace(testFile)
@@ -293,12 +299,16 @@ func GetCacheHostnames(testFile string) (urls []string, err error) {
 		return
 	}
 
-	caches, err := GetCachesFromNamespace(ns)
+	caches, err := GetCachesFromNamespace(ns, false)
 	if err != nil {
 		return
 	}
 
-	for _, cache := range caches {
+	for _, cacheGeneric := range caches {
+		cache, ok := cacheGeneric.(namespaces.Cache)
+		if !ok {
+			continue
+		}
 		url_string := cache.AuthEndpoint
 		host := strings.Split(url_string, ":")[0]
 		urls = append(urls, host)
@@ -307,13 +317,36 @@ func GetCacheHostnames(testFile string) (urls []string, err error) {
 	return
 }
 
-func GetCachesFromNamespace(namespace namespaces.Namespace) (caches []namespaces.Cache, err error) {
+func GetCachesFromNamespace(namespace namespaces.Namespace, useDirector bool) (caches []CacheInterface, err error) {
+
+	// The global cache override is set
+	if CacheOverride {
+		log.Debugf("Using the cache (%s) from the config override\n", NearestCache)
+		cache := namespaces.Cache{
+			Endpoint:     NearestCache,
+			AuthEndpoint: NearestCache,
+			Resource:     NearestCache,
+		}
+		caches = []CacheInterface{cache}
+		return
+	}
 
-	cacheListName := "xroot"
-	if namespace.ReadHTTPS || namespace.UseTokenOnRead {
-		cacheListName = "xroots"
+	if useDirector {
+		log.Debugln("Using the returned sources from the director")
+		caches = make([]CacheInterface, len(namespace.SortedDirectorCaches))
+		for idx, val := range namespace.SortedDirectorCaches {
+			caches[idx] = val
+		}
+		log.Debugln("Matched caches:", caches)
+		return
 	}
+
 	if len(NearestCacheList) == 0 {
+		cacheListName := "xroot"
+		if namespace.ReadHTTPS || namespace.UseTokenOnRead {
+			cacheListName = "xroots"
+		}
+		// FIXME: GetBestCache, for some reason, sets the NearestCacheList global?
 		_, err = GetBestCache(cacheListName)
 		if err != nil {
 			log.Errorln("Failed to get best caches:", err)
@@ -324,18 +357,12 @@ func GetCachesFromNamespace(namespace namespaces.Namespace) (caches []namespaces
 	log.Debugln("Nearest cache list:", NearestCacheList)
 	log.Debugln("Cache list name:", namespace.Caches)
 
-	// The main routine can set a global cache to use
-	if CacheOverride {
-		cache := namespaces.Cache{
-			Endpoint:     NearestCache,
-			AuthEndpoint: NearestCache,
-			Resource:     NearestCache,
-		}
-		caches = []namespaces.Cache{cache}
-	} else {
-		caches = namespace.MatchCaches(NearestCacheList)
+	matchedCaches := namespace.MatchCaches(NearestCacheList)
+	log.Debugln("Matched caches:", matchedCaches)
+	caches = make([]CacheInterface, len(matchedCaches))
+	for idx, val := range matchedCaches {
+		caches[idx] = val
 	}
-	log.Debugln("Matched caches:", caches)
 
 	return
 }
@@ -354,7 +381,308 @@ func correctURLWithUnderscore(sourceFile string) (string, string) {
 	return sourceFile, originalScheme
 }
 
-// Start the transfer, whether read or write back
+func discoverHTCondorToken(tokenName string) string {
+	tokenLocation := ""
+
+	// Tokens with dots in their name may need to have dots converted to underscores.
+	if strings.Contains(tokenName, ".") {
+		underscoreTokenName := strings.ReplaceAll(tokenName, ".", "_")
+		// If we find a token after replacing dots, then we're already done.
+		tokenLocation = discoverHTCondorToken(underscoreTokenName)
+		if tokenLocation != "" {
+			return tokenLocation
+		}
+	}
+
+	tokenFilename := "scitokens.use"
+	if len(tokenName) > 0 {
+		tokenFilename = tokenName + ".use"
+	}
+	log.Debugln("Looking for token file:", tokenFilename)
+	if credsDir, isCondorCredsSet := os.LookupEnv("_CONDOR_CREDS"); tokenLocation == "" && isCondorCredsSet {
+		// Token wasn't specified on the command line or environment, try the default scitoken
+		if _, err := os.Stat(filepath.Join(credsDir, tokenFilename)); err != nil {
+			log.Warningln("Environment variable _CONDOR_CREDS is set, but file being point to does not exist:", err)
+		} else {
+			tokenLocation = filepath.Join(credsDir, tokenFilename)
+		}
+	}
+	if _, err := os.Stat(".condor_creds/" + tokenFilename); err == nil && tokenLocation == "" {
+		tokenLocation, _ = filepath.Abs(".condor_creds/" + tokenFilename)
+	}
+	return tokenLocation
+}
+
+// Retrieve federation namespace information for a given URL.
+// If OSDFDirectorUrl is non-empty, then the namespace information will be pulled from the director;
+// otherwise, it is pulled from topology.
+func getNamespaceInfo(resourcePath, OSDFDirectorUrl string, isPut bool) (ns namespaces.Namespace, err error) {
+	// If we have a director set, go through that for namespace info, otherwise use topology
+	if OSDFDirectorUrl != "" {
+		log.Debugln("Will query director at", OSDFDirectorUrl, "for object", resourcePath)
+		verb := "GET"
+		if isPut {
+			verb = "PUT"
+		}
+		var dirResp *http.Response
+		dirResp, err = queryDirector(verb, resourcePath, OSDFDirectorUrl)
+		if err != nil {
+			if isPut && dirResp != nil && dirResp.StatusCode == 405 {
+				err = errors.New("Error 405: No writeable origins were found")
+				AddError(err)
+				return
+			} else {
+				log.Errorln("Error while querying the Director:", err)
+				AddError(err)
+				return
+			}
+		}
+		ns, err = CreateNsFromDirectorResp(dirResp)
+		if err != nil {
+			AddError(err)
+			return
+		}
+
+		// if we are doing a PUT, we need to get our endpoint from the director
+		if isPut {
+			var writeBackUrl *url.URL
+			location := dirResp.Header.Get("Location")
+			writeBackUrl, err = url.Parse(location)
+			if err != nil {
+				log.Errorf("The director responded with an invalid location (does not parse as URL: %v): %s", err, location)
+				return
+			}
+			ns.WriteBackHost = "https://" + writeBackUrl.Host
+		}
+		return
+	} else {
+		ns, err = namespaces.MatchNamespace(resourcePath)
+		if err != nil {
+			AddError(err)
+			return
+		}
+		return
+	}
+}
+
+/*
+	Start of transfer for pelican object put, gets information from the target destination before doing our HTTP PUT request
+
+localObject: the source file/directory you would like to upload
+remoteDestination: the end location of the upload
+recursive: a boolean indicating if the source is a directory or not
+*/
+func DoPut(localObject string, remoteDestination string, recursive bool) (bytesTransferred int64, err error) {
+	isPut := true
+	// First, create a handler for any panics that occur
+	defer func() {
+		if r := recover(); r != nil {
+			log.Debugln("Panic captured while attempting to perform transfer (DoPut):", r)
+			log.Debugln("Panic caused by the following", string(debug.Stack()))
+			ret := fmt.Sprintf("Unrecoverable error (panic) captured in DoPut: %v", r)
+			err = errors.New(ret)
+			bytesTransferred = 0
+
+			// Attempt to add the panic to the error accumulator
+			AddError(errors.New(ret))
+		}
+	}()
+
+	// Parse the source and destination with URL parse
+	localObjectUrl, err := url.Parse(localObject)
+	if err != nil {
+		log.Errorln("Failed to parse source URL:", err)
+		return 0, err
+	}
+
+	remoteDestination, remoteDestScheme := correctURLWithUnderscore(remoteDestination)
+	remoteDestUrl, err := url.Parse(remoteDestination)
+	if err != nil {
+		log.Errorln("Failed to parse remote destination URL:", err)
+		return 0, err
+	}
+	remoteDestUrl.Scheme = remoteDestScheme
+
+	if remoteDestUrl.Host != "" {
+		if remoteDestUrl.Scheme == "osdf" || remoteDestUrl.Scheme == "stash" {
+			remoteDestUrl.Path, err = url.JoinPath(remoteDestUrl.Host, remoteDestUrl.Path)
+			if err != nil {
+				log.Errorln("Failed to join remote destination url path:", err)
+				return 0, err
+			}
+		} else if remoteDestUrl.Scheme == "pelican" {
+			federationUrl, _ := url.Parse(remoteDestUrl.String())
+			federationUrl.Scheme = "https"
+			federationUrl.Path = ""
+			viper.Set("Federation.DiscoveryUrl", federationUrl.String())
+			err = config.DiscoverFederation()
+			if err != nil {
+				return 0, err
+			}
+		}
+	}
+	remoteDestScheme, _ = getTokenName(remoteDestUrl)
+
+	understoodSchemes := []string{"file", "osdf", "pelican", ""}
+
+	_, foundDest := Find(understoodSchemes, remoteDestScheme)
+	if !foundDest {
+		return 0, fmt.Errorf("Do not understand the destination scheme: %s. Permitted values are %s",
+			remoteDestUrl.Scheme, strings.Join(understoodSchemes, ", "))
+	}
+
+	directorUrl := param.Federation_DirectorUrl.GetString()
+
+	// Get the namespace of the remote filesystem
+	// For write back, it will be the destination
+	if !strings.HasPrefix(remoteDestination, "/") {
+		remoteDestination = strings.TrimPrefix(remoteDestination, remoteDestScheme+"://")
+	}
+	ns, err := getNamespaceInfo(remoteDestination, directorUrl, isPut)
+	if err != nil {
+		log.Errorln(err)
+		return 0, errors.New("Failed to get namespace information from source")
+	}
+	uploadedBytes, err := doWriteBack(localObjectUrl.Path, remoteDestUrl, ns, recursive)
+	AddError(err)
+	return uploadedBytes, err
+
+}
+
+/*
+	Start of transfer for pelican object get, gets information from the target source before doing our HTTP GET request
+
+remoteObject: the source file/directory you would like to upload
+localDestination: the end location of the upload
+recursive: a boolean indicating if the source is a directory or not
+*/
+func DoGet(remoteObject string, localDestination string, recursive bool) (bytesTransferred int64, err error) {
+	isPut := false
+	// First, create a handler for any panics that occur
+	defer func() {
+		if r := recover(); r != nil {
+			log.Debugln("Panic captured while attempting to perform transfer (DoGet):", r)
+			log.Debugln("Panic caused by the following", string(debug.Stack()))
+			ret := fmt.Sprintf("Unrecoverable error (panic) captured in DoGet: %v", r)
+			err = errors.New(ret)
+			bytesTransferred = 0
+
+			// Attempt to add the panic to the error accumulator
+			AddError(errors.New(ret))
+		}
+	}()
+
+	// Parse the source with URL parse
+	remoteObject, remoteObjectScheme := correctURLWithUnderscore(remoteObject)
+	remoteObjectUrl, err := url.Parse(remoteObject)
+	if err != nil {
+		log.Errorln("Failed to parse source URL:", err)
+		return 0, err
+	}
+	remoteObjectUrl.Scheme = remoteObjectScheme
+
+	// If there is a host specified, prepend it to the path in the osdf case
+	if remoteObjectUrl.Host != "" {
+		if remoteObjectUrl.Scheme == "osdf" {
+			remoteObjectUrl.Path, err = url.JoinPath(remoteObjectUrl.Host, remoteObjectUrl.Path)
+			if err != nil {
+				log.Errorln("Failed to join source url path:", err)
+				return 0, err
+			}
+		} else if remoteObjectUrl.Scheme == "pelican" {
+			federationUrl, _ := url.Parse(remoteObjectUrl.String())
+			federationUrl.Scheme = "https"
+			federationUrl.Path = ""
+			viper.Set("Federation.DiscoveryUrl", federationUrl.String())
+			err = config.DiscoverFederation()
+			if err != nil {
+				return 0, err
+			}
+		}
+	}
+
+	remoteObjectScheme, _ = getTokenName(remoteObjectUrl)
+
+	understoodSchemes := []string{"file", "osdf", "pelican", ""}
+
+	_, foundSource := Find(understoodSchemes, remoteObjectScheme)
+	if !foundSource {
+		return 0, fmt.Errorf("Do not understand the source scheme: %s. Permitted values are %s",
+			remoteObjectUrl.Scheme, strings.Join(understoodSchemes, ", "))
+	}
+
+	if remoteObjectScheme == "osdf" || remoteObjectScheme == "pelican" {
+		remoteObject = remoteObjectUrl.Path
+	}
+
+	if string(remoteObject[0]) != "/" {
+		remoteObject = "/" + remoteObject
+	}
+
+	directorUrl := param.Federation_DirectorUrl.GetString()
+
+	ns, err := getNamespaceInfo(remoteObject, directorUrl, isPut)
+	if err != nil {
+		log.Errorln(err)
+		return 0, errors.New("Failed to get namespace information from source")
+	}
+
+	// get absolute path
+	localDestPath, _ := filepath.Abs(localDestination)
+
+	//Check if path exists or if its in a folder
+	if destStat, err := os.Stat(localDestPath); os.IsNotExist(err) {
+		localDestination = localDestPath
+	} else if destStat.IsDir() && remoteObjectUrl.Query().Get("pack") == "" {
+		// If we have an auto-pack request, it's OK for the destination to be a directory
+		// Otherwise, get the base name of the source and append it to the destination dir.
+		remoteObjectFilename := path.Base(remoteObject)
+		localDestination = path.Join(localDestPath, remoteObjectFilename)
+	}
+
+	payload := payloadStruct{}
+	payload.version = version
+
+	//Fill out the payload as much as possible
+	payload.filename = remoteObjectUrl.Path
+
+	parse_job_ad(payload)
+
+	payload.start1 = time.Now().Unix()
+
+	success := false
+
+	_, token_name := getTokenName(remoteObjectUrl)
+
+	var downloaded int64
+	if downloaded, err = download_http(remoteObjectUrl, localDestination, &payload, ns, recursive, token_name); err == nil {
+		success = true
+	}
+
+	payload.end1 = time.Now().Unix()
+
+	payload.timestamp = payload.end1
+	payload.downloadTime = (payload.end1 - payload.start1)
+
+	if success {
+		payload.status = "Success"
+
+		// Get the final size of the download file
+		payload.fileSize = downloaded
+		payload.downloadSize = downloaded
+	} else {
+		log.Error("Http GET failed! Unable to download file.")
+		payload.status = "Fail"
+	}
+
+	if !success {
+		return downloaded, errors.New("failed to download file")
+	} else {
+		return downloaded, nil
+	}
+}
+
+// Start the transfer, whether read or write back. Primarily used for backwards compatibility
 func DoStashCPSingle(sourceFile string, destination string, methods []string, recursive bool) (bytesTransferred int64, err error) {
 
 	// First, create a handler for any panics that occur
@@ -396,7 +724,7 @@ func DoStashCPSingle(sourceFile string, destination string, methods []string, re
 			federationUrl, _ := url.Parse(source_url.String())
 			federationUrl.Scheme = "https"
 			federationUrl.Path = ""
-			viper.Set("FederationURL", federationUrl.String())
+			viper.Set("Federation.DiscoveryUrl", federationUrl.String())
 			err = config.DiscoverFederation()
 			if err != nil {
 				return 0, err
@@ -411,7 +739,7 @@ func DoStashCPSingle(sourceFile string, destination string, methods []string, re
 			federationUrl, _ := url.Parse(dest_url.String())
 			federationUrl.Scheme = "https"
 			federationUrl.Path = ""
-			viper.Set("FederationURL", federationUrl.String())
+			viper.Set("Federation.DiscoveryUrl", federationUrl.String())
 			err = config.DiscoverFederation()
 			if err != nil {
 				return 0, err
@@ -440,13 +768,19 @@ func DoStashCPSingle(sourceFile string, destination string, methods []string, re
 	// For write back, it will be the destination
 	// For read it will be the source.
 
-	if destScheme == "stash" || destScheme == "osdf" || destScheme == "pelican" {
-		log.Debugln("Detected writeback")
-		ns, err := namespaces.MatchNamespace(dest_url.Path)
+	OSDFDirectorUrl := param.Federation_DirectorUrl.GetString()
+	isPut := destScheme == "stash" || destScheme == "osdf" || destScheme == "pelican"
+
+	if isPut {
+		log.Debugln("Detected object write to remote federation object", dest_url.Path)
+		ns, err := getNamespaceInfo(dest_url.Path, OSDFDirectorUrl, isPut)
 		if err != nil {
-			log.Errorln("Failed to get namespace information:", err)
+			log.Errorln(err)
+			return 0, errors.New("Failed to get namespace information from destination")
 		}
-		return doWriteBack(source_url.Path, dest_url, ns)
+		uploadedBytes, err := doWriteBack(source_url.Path, dest_url, ns, recursive)
+		AddError(err)
+		return uploadedBytes, err
 	}
 
 	if dest_url.Scheme == "file" {
@@ -461,28 +795,10 @@ func DoStashCPSingle(sourceFile string, destination string, methods []string, re
 		sourceFile = "/" + sourceFile
 	}
 
-	OSDFDirectorUrl := viper.GetString("DirectorURL")
-	useOSDFDirector := viper.IsSet("DirectorURL")
-
-	var ns namespaces.Namespace
-	if useOSDFDirector {
-		dirResp, err := QueryDirector(sourceFile, OSDFDirectorUrl)
-		if err != nil {
-			log.Errorln("Error while querying the Director:", err)
-			AddError(err)
-			return 0, err
-		}
-		err = CreateNsFromDirectorResp(dirResp, &ns)
-		if err != nil {
-			AddError(err)
-			return 0, err
-		}
-	} else {
-		ns, err = namespaces.MatchNamespace(source_url.Path)
-		if err != nil {
-			AddError(err)
-			return 0, err
-		}
+	ns, err := getNamespaceInfo(sourceFile, OSDFDirectorUrl, isPut)
+	if err != nil {
+		log.Errorln(err)
+		return 0, errors.New("Failed to get namespace information from source")
 	}
 
 	// get absolute path
@@ -491,8 +807,9 @@ func DoStashCPSingle(sourceFile string, destination string, methods []string, re
 	//Check if path exists or if its in a folder
 	if destStat, err := os.Stat(destPath); os.IsNotExist(err) {
 		destination = destPath
-	} else if destStat.IsDir() {
-		// Get the file name of the source
+	} else if destStat.IsDir() && source_url.Query().Get("pack") == "" {
+		// If we have an auto-pack request, it's OK for the destination to be a directory
+		// Otherwise, get the base name of the source and append it to the destination dir.
 		sourceFilename := path.Base(sourceFile)
 		destination = path.Join(destPath, sourceFilename)
 	}
@@ -527,7 +844,7 @@ Loop:
 		switch method {
 		case "http":
 			log.Info("Trying HTTP...")
-			if downloaded, err = download_http(sourceFile, destination, &payload, ns, recursive, token_name, OSDFDirectorUrl); err == nil {
+			if downloaded, err = download_http(source_url, destination, &payload, ns, recursive, token_name); err == nil {
 				success = true
 				break Loop
 			}
@@ -548,17 +865,11 @@ Loop:
 		// Get the final size of the download file
 		payload.fileSize = downloaded
 		payload.downloadSize = downloaded
+		return downloaded, nil
 	} else {
-		log.Error("All methods failed! Unable to download file.")
 		payload.status = "Fail"
+		return downloaded, errors.New("All methods failed! Unable to download file.")
 	}
-
-	if !success {
-		return downloaded, errors.New("failed to download file")
-	} else {
-		return downloaded, nil
-	}
-
 }
 
 // Find takes a slice and looks for an element in it. If found it will
diff --git a/main_test.go b/client/main_test.go
similarity index 77%
rename from main_test.go
rename to client/main_test.go
index 749a0bd53..8c24ae689 100644
--- a/main_test.go
+++ b/client/main_test.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"net"
@@ -60,7 +60,7 @@ func TestGetIps(t *testing.T) {
 func TestGetToken(t *testing.T) {
 
 	// Need a namespace for token acquisition
-	defer os.Unsetenv("PELICAN_TOPOLOGYNAMESPACEURL")
+	defer os.Unsetenv("PELICAN_FEDERATION_TOPOLOGYNAMESPACEURL")
 	os.Setenv("PELICAN_TOPOLOGY_NAMESPACE_URL", "https://topology.opensciencegrid.org/osdf/namespaces")
 	viper.Reset()
 	err := config.InitClient()
@@ -145,6 +145,59 @@ func TestGetToken(t *testing.T) {
 	assert.Equal(t, token_contents, token)
 	os.Unsetenv("_CONDOR_CREDS")
 
+	// _CONDOR_CREDS/renamed_handle1.use via renamed_handle1+osdf:///user/ligo/frames
+	token_contents = "bearer_token_file_contents renamed_handle1.use"
+	tmpFile = []byte(token_contents)
+	tmpDir = t.TempDir()
+	bearer_token_file = filepath.Join(tmpDir, "renamed_handle1.use")
+	err = os.WriteFile(bearer_token_file, tmpFile, 0644)
+	assert.NoError(t, err)
+	os.Setenv("_CONDOR_CREDS", tmpDir)
+	// Use a valid URL, then replace the scheme
+	renamedUrl, err = url.Parse("renamed.handle1+osdf:///user/ligo/frames")
+	renamedUrl.Scheme = "renamed_handle1+osdf"
+	assert.NoError(t, err)
+	renamedNamespace, err = namespaces.MatchNamespace("/user/ligo/frames")
+	assert.NoError(t, err)
+	token, err = getToken(renamedUrl, renamedNamespace, false, "")
+	assert.NoError(t, err)
+	assert.Equal(t, token_contents, token)
+	os.Unsetenv("_CONDOR_CREDS")
+
+	// _CONDOR_CREDS/renamed_handle2.use via renamed.handle2+osdf:///user/ligo/frames
+	token_contents = "bearer_token_file_contents renamed.handle2.use"
+	tmpFile = []byte(token_contents)
+	tmpDir = t.TempDir()
+	bearer_token_file = filepath.Join(tmpDir, "renamed_handle2.use")
+	err = os.WriteFile(bearer_token_file, tmpFile, 0644)
+	assert.NoError(t, err)
+	os.Setenv("_CONDOR_CREDS", tmpDir)
+	renamedUrl, err = url.Parse("renamed.handle2+osdf:///user/ligo/frames")
+	assert.NoError(t, err)
+	renamedNamespace, err = namespaces.MatchNamespace("/user/ligo/frames")
+	assert.NoError(t, err)
+	token, err = getToken(renamedUrl, renamedNamespace, false, "")
+	assert.NoError(t, err)
+	assert.Equal(t, token_contents, token)
+	os.Unsetenv("_CONDOR_CREDS")
+
+	// _CONDOR_CREDS/renamed.handle3.use via renamed.handle3+osdf:///user/ligo/frames
+	token_contents = "bearer_token_file_contents renamed.handle3.use"
+	tmpFile = []byte(token_contents)
+	tmpDir = t.TempDir()
+	bearer_token_file = filepath.Join(tmpDir, "renamed.handle3.use")
+	err = os.WriteFile(bearer_token_file, tmpFile, 0644)
+	assert.NoError(t, err)
+	os.Setenv("_CONDOR_CREDS", tmpDir)
+	renamedUrl, err = url.Parse("renamed.handle3+osdf:///user/ligo/frames")
+	assert.NoError(t, err)
+	renamedNamespace, err = namespaces.MatchNamespace("/user/ligo/frames")
+	assert.NoError(t, err)
+	token, err = getToken(renamedUrl, renamedNamespace, false, "")
+	assert.NoError(t, err)
+	assert.Equal(t, token_contents, token)
+	os.Unsetenv("_CONDOR_CREDS")
+
 	// _CONDOR_CREDS/renamed.use
 	token_contents = "bearer_token_file_contents renamed.use"
 	tmpFile = []byte(token_contents)
@@ -180,6 +233,11 @@ func TestGetToken(t *testing.T) {
 	err = os.Chdir(currentDir)
 	assert.NoError(t, err)
 
+	ObjectClientOptions.Plugin = true
+	_, err = getToken(url, namespace, true, "")
+	assert.EqualError(t, err, "Credential is required for osdf:///user/foo but is currently missing")
+	ObjectClientOptions.Plugin = false
+
 }
 
 // TestGetTokenName tests getTokenName
diff --git a/client/pack_handler.go b/client/pack_handler.go
new file mode 100644
index 000000000..344bab543
--- /dev/null
+++ b/client/pack_handler.go
@@ -0,0 +1,470 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package client
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync/atomic"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+type packerBehavior int
+
+type packedError struct{ Value error }
+
+type atomicError struct {
+	err atomic.Value
+}
+
+type autoUnpacker struct {
+	atomicError
+	Behavior     packerBehavior
+	detectedType packerBehavior
+	destDir      string
+	buffer       bytes.Buffer
+	writer       io.WriteCloser
+}
+
+type autoPacker struct {
+	atomicError
+	Behavior   packerBehavior
+	srcDir     string
+	reader     io.ReadCloser
+	srcDirSize atomic.Int64
+	srcDirDone atomic.Int64
+}
+
+const (
+	autoBehavior packerBehavior = iota
+	tarBehavior
+	tarGZBehavior
+	tarXZBehavior
+	zipBehavior
+
+	defaultBehavior packerBehavior = tarGZBehavior
+)
+
+func newAutoUnpacker(destdir string, behavior packerBehavior) *autoUnpacker {
+	aup := &autoUnpacker{
+		Behavior: behavior,
+		destDir:  destdir,
+	}
+	aup.err.Store(packedError{})
+	if os := runtime.GOOS; os == "windows" {
+		aup.StoreError(errors.New("Auto-unpacking functionality not supported on Windows"))
+	}
+	return aup
+}
+
+func newAutoPacker(srcdir string, behavior packerBehavior) *autoPacker {
+	ap := &autoPacker{
+		Behavior: behavior,
+		srcDir:   srcdir,
+	}
+	ap.err.Store(packedError{})
+	if os := runtime.GOOS; os == "windows" {
+		ap.StoreError(errors.New("Auto-unpacking functionality not supported on Windows"))
+	} else {
+		go ap.calcDirectorySize()
+	}
+	return ap
+}
+
+func GetBehavior(behaviorName string) (packerBehavior, error) {
+	switch behaviorName {
+	case "auto":
+		return autoBehavior, nil
+	case "tar":
+		return tarBehavior, nil
+	case "tar.gz":
+		return tarGZBehavior, nil
+	case "tar.xz":
+		return tarXZBehavior, nil
+	case "zip":
+		return zipBehavior, nil
+	}
+	return autoBehavior, errors.Errorf("Unknown value for 'pack' parameter: %v", behaviorName)
+}
+
+func (aup *atomicError) Error() error {
+	value := aup.err.Load()
+	if err, ok := value.(packedError); ok {
+		return err.Value
+	}
+	return nil
+}
+
+func (aup *atomicError) StoreError(err error) {
+	aup.err.CompareAndSwap(packedError{}, packedError{Value: err})
+}
+
+func (aup *autoUnpacker) detect() (packerBehavior, error) {
+	currentBytes := aup.buffer.Bytes()
+	// gzip streams start with 1F 8B
+	if len(currentBytes) >= 2 && bytes.Equal(currentBytes[0:2], []byte{0x1F, 0x8B}) {
+		return tarGZBehavior, nil
+	}
+	// xz streams start with FD 37 7A 58 5A 00
+	if len(currentBytes) >= 6 && bytes.Equal(currentBytes[0:6], []byte{0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00}) {
+		return tarXZBehavior, nil
+	}
+	// tar files, at offset 257, have bytes 75 73 74 61 72
+	if len(currentBytes) >= (257+5) && bytes.Equal(currentBytes[257:257+5], []byte{0x75, 0x73, 0x74, 0x61, 0x72}) {
+		return tarBehavior, nil
+	}
+	// zip files start with 50 4B 03 04
+	if len(currentBytes) >= 4 && bytes.Equal(currentBytes[0:4], []byte{0x50, 0x4B, 0x03, 0x04}) {
+		return zipBehavior, nil
+	}
+	if len(currentBytes) > (257 + 5) {
+		return autoBehavior, errors.New("Unable to detect pack type")
+	}
+	return autoBehavior, nil
+}
+
+func writeRegFile(path string, mode int64, reader io.Reader) error {
+	fp, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE, fs.FileMode(mode))
+	if err != nil {
+		return err
+	}
+	defer fp.Close()
+	_, err = io.Copy(fp, reader)
+	return err
+}
+
+type autoPackerHelper struct {
+	curFp io.Reader
+	ap    *autoPacker
+}
+
+func (aph *autoPackerHelper) Read(p []byte) (n int, err error) {
+	n, err = aph.curFp.Read(p)
+	aph.ap.srcDirDone.Add(int64(n))
+	return
+}
+
+func (ap *autoPacker) readRegFile(path string, writer io.Writer) error {
+	fp, err := os.OpenFile(path, os.O_RDONLY, 0)
+	if err != nil {
+		return err
+	}
+	aph := &autoPackerHelper{fp, ap}
+	defer fp.Close()
+	_, err = io.Copy(writer, aph)
+	return err
+}
+
+func (ap *autoPacker) calcDirectorySize() {
+	err := filepath.WalkDir(ap.srcDir, func(path string, dent fs.DirEntry, err error) error {
+		if err != nil {
+			log.Warningln("Error when walking source directory to calculate size:", err.Error())
+			return filepath.SkipDir
+		}
+		if dent.Type().IsRegular() {
+			fi, err := dent.Info()
+			if err != nil {
+				log.Warningln("Error when stat'ing file:", err.Error())
+				return nil
+			}
+			ap.srcDirSize.Add(fi.Size())
+		}
+		return nil
+	})
+	if err != nil {
+		log.Warningln("Failure when calculating the source directory size:", err.Error())
+	}
+}
+
+func (ap *autoPacker) Size() int64 {
+	return ap.srcDirSize.Load()
+}
+
+func (ap *autoPacker) BytesComplete() int64 {
+	return ap.srcDirDone.Load()
+}
+
+func (ap *autoPacker) pack(tw *tar.Writer, gz *gzip.Writer, pwriter *io.PipeWriter) {
+	srcPrefix := filepath.Clean(ap.srcDir) + "/"
+	defer pwriter.Close()
+	err := filepath.WalkDir(ap.srcDir, func(path string, dent fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		path = filepath.Clean(path)
+		if !strings.HasPrefix(path, srcPrefix) {
+			return nil
+		}
+		tarName := path[len(srcPrefix):]
+		if tarName == "" || tarName[0] == '/' {
+			return errors.New("Invalid path provided by filepath.Walk")
+		}
+
+		fi, err := dent.Info()
+		if err != nil {
+			return err
+		}
+		link := ""
+		if (fi.Mode() & fs.ModeSymlink) == fs.ModeSymlink {
+			link, err = os.Readlink(path)
+			if err != nil {
+				return err
+			}
+		}
+		hdr, err := tar.FileInfoHeader(fi, link)
+		if err != nil {
+			return err
+		}
+		hdr.Name = tarName
+		if err = tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if fi.Mode().IsRegular() {
+			if err = ap.readRegFile(path, tw); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		ap.StoreError(err)
+		return
+	}
+	if err = tw.Close(); err != nil {
+		ap.StoreError(err)
+		return
+	}
+	if gz != nil {
+		if err = gz.Close(); err != nil {
+			ap.StoreError(err)
+			return
+		}
+	}
+	pwriter.CloseWithError(io.EOF)
+}
+
+func (aup *autoUnpacker) unpack(tr *tar.Reader, preader *io.PipeReader) {
+	log.Debugln("Beginning unpacker of type", aup.Behavior)
+	defer preader.Close()
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			preader.CloseWithError(err)
+			break
+		}
+		if err != nil {
+			aup.StoreError(err)
+			break
+		}
+		destPath := filepath.Join(aup.destDir, hdr.Name)
+		destPath = filepath.Clean(destPath)
+		if !strings.HasPrefix(destPath, aup.destDir) {
+			aup.StoreError(errors.New("Tarfile contains object outside the destination directory"))
+			break
+		}
+		switch hdr.Typeflag {
+		case tar.TypeReg:
+			err = writeRegFile(destPath, hdr.Mode, tr)
+			if err != nil {
+				aup.StoreError(errors.Wrapf(err, "Failure when unpacking file to %v", destPath))
+				return
+			}
+		case tar.TypeLink:
+			targetPath := filepath.Join(aup.destDir, hdr.Linkname)
+			if !strings.HasPrefix(targetPath, aup.destDir) {
+				aup.StoreError(errors.New("Tarfile contains hard link target outside the destination directory"))
+				return
+			}
+			if err = os.Link(targetPath, destPath); err != nil {
+				aup.StoreError(errors.Wrapf(err, "Failure when unpacking hard link to %v", destPath))
+				return
+			}
+		case tar.TypeSymlink:
+			if err = os.Symlink(hdr.Linkname, destPath); err != nil {
+				aup.StoreError(errors.Wrapf(err, "Failure when creating symlink at %v", destPath))
+				return
+			}
+		case tar.TypeChar:
+			log.Debugln("Ignoring tar entry of type character device at", destPath)
+		case tar.TypeBlock:
+			log.Debugln("Ignoring tar entry of type block device at", destPath)
+		case tar.TypeDir:
+			if err = os.MkdirAll(destPath, fs.FileMode(hdr.Mode)); err != nil {
+				aup.StoreError(errors.Wrapf(err, "Failure when creating directory at %v", destPath))
+				return
+			}
+		case tar.TypeFifo:
+			log.Debugln("Ignoring tar entry of type FIFO at", destPath)
+		case 103: // pax_global_header, written by git archive.  OK to ignore
+		default:
+			log.Debugln("Ignoring unknown tar entry of type", hdr.Typeflag)
+		}
+	}
+}
+
+func (aup *autoUnpacker) configure() (err error) {
+	preader, pwriter := io.Pipe()
+	bufDrained := make(chan error)
+	// gzip.NewReader function will block reading from the pipe.
+	// Asynchronously write the contents of the buffer from a separate goroutine;
+	// Note we don't return from configure() until the buffer is consumed.
+	go func() {
+		_, err := aup.buffer.WriteTo(pwriter)
+		bufDrained <- err
+	}()
+	var tarUnpacker *tar.Reader
+	switch aup.detectedType {
+	case autoBehavior:
+		return errors.New("Configure invoked before file type is known")
+	case tarBehavior:
+		tarUnpacker = tar.NewReader(preader)
+	case tarGZBehavior:
+		gzStreamer, err := gzip.NewReader(preader)
+		if err != nil {
+			return err
+		}
+		tarUnpacker = tar.NewReader(gzStreamer)
+	case tarXZBehavior:
+		return errors.New("tar.xz has not yet been implemented")
+	case zipBehavior:
+		return errors.New("zip file support has not yet been implemented")
+	}
+	go aup.unpack(tarUnpacker, preader)
+	if err = <-bufDrained; err != nil {
+		return errors.Wrap(err, "Failed to copy byte buffer to unpacker")
+	}
+	aup.writer = pwriter
+	return nil
+}
+
+func (ap *autoPacker) configure() (err error) {
+	preader, pwriter := io.Pipe()
+	if ap.Behavior == autoBehavior {
+		ap.Behavior = defaultBehavior
+	}
+	var tarPacker *tar.Writer
+	var streamer *gzip.Writer
+	switch ap.Behavior {
+	case tarBehavior:
+		tarPacker = tar.NewWriter(pwriter)
+	case tarGZBehavior:
+		streamer = gzip.NewWriter(pwriter)
+		tarPacker = tar.NewWriter(streamer)
+	case tarXZBehavior:
+		return errors.New("tar.xz has not yet been implemented")
+	case zipBehavior:
+		return errors.New("zip file support has not yet been implemented")
+	}
+	go ap.pack(tarPacker, streamer, pwriter)
+	ap.reader = preader
+	return nil
+}
+
+func (ap *autoPacker) Read(p []byte) (n int, err error) {
+	if ap.srcDir == "" {
+		err = errors.New("AutoPacker object must be initialized via NewPacker")
+		return
+	}
+
+	if err = ap.Error(); err != nil {
+		if ap.reader != nil {
+			ap.reader.Close()
+		}
+		return
+	}
+
+	if ap.reader == nil {
+		if err = ap.configure(); err != nil {
+			return
+		}
+	}
+
+	n, readerErr := ap.reader.Read(p)
+	if err = ap.Error(); err != nil {
+		return
+	}
+	return n, readerErr
+}
+
+func (aup *autoUnpacker) Write(p []byte) (n int, err error) {
+	if aup.destDir == "" {
+		err = errors.New("AutoUnpacker object must be initialized via NewAutoUnpacker")
+		return
+	}
+	err = aup.Error()
+	if err != nil {
+		if aup.writer != nil {
+			aup.writer.Close()
+		}
+		return
+	}
+
+	if aup.detectedType == autoBehavior {
+		if n, err = aup.buffer.Write(p); err != nil {
+			return
+		}
+		if aup.detectedType, err = aup.detect(); aup.detectedType == autoBehavior {
+			n = len(p)
+			return
+		} else if err = aup.configure(); err != nil {
+			return
+		}
+		// Note the byte buffer already consumed all the bytes, hence return here.
+		return len(p), nil
+	} else if aup.writer == nil {
+		if err = aup.configure(); err != nil {
+			return
+		}
+	}
+	n, writerErr := aup.writer.Write(p)
+	if err = aup.Error(); err != nil {
+		return n, err
+	} else if writerErr != nil {
+		if writerErr == io.EOF {
+			return len(p), nil
+		}
+	}
+	return n, writerErr
+}
+
+func (aup autoUnpacker) Close() error {
+	if aup.buffer.Len() > 0 {
+		aup.StoreError(errors.New("AutoUnpacker was closed prior to detecting any file type; no bytes were written"))
+	}
+	if aup.Behavior == autoBehavior {
+		aup.StoreError(errors.New("AutoUnpacker was closed prior to any bytes written"))
+	}
+	return aup.Error()
+}
+
+func (ap *autoPacker) Close() error {
+	if ap.reader != nil {
+		return ap.reader.Close()
+	}
+	return nil
+}
diff --git a/client/pack_test.go b/client/pack_test.go
new file mode 100644
index 000000000..f582dfc7a
--- /dev/null
+++ b/client/pack_test.go
@@ -0,0 +1,160 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package client
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func createTestDirectory(t *testing.T, path string) {
+	subdirPath := filepath.Join(path, "subdir1")
+	siblingPath := filepath.Join(path, "foo.txt")
+	childPath := filepath.Join(path, "subdir1", "bar.txt")
+	err := os.Mkdir(subdirPath, 0750)
+	require.NoError(t, err)
+	err = os.WriteFile(siblingPath, []byte("foo"), 0640)
+	require.NoError(t, err)
+	err = os.WriteFile(childPath, []byte("bar"), 0440)
+	require.NoError(t, err)
+}
+
+func verifyTestDirectory(t *testing.T, testDirectory string) {
+	entryCount := 0
+	err := filepath.WalkDir(testDirectory, func(path string, dent fs.DirEntry, err error) error {
+		// Skip the top-level directory itself.
+		if len(testDirectory) >= len(path) {
+			return nil
+		}
+		switch path[len(testDirectory)+1:] {
+		case "subdir1":
+			fi, err := dent.Info()
+			require.NoError(t, err)
+			assert.True(t, fi.Mode().IsDir())
+			assert.Equal(t, fi.Mode()&fs.ModePerm, fs.FileMode(0750))
+		case "foo.txt":
+			fi, err := dent.Info()
+			require.NoError(t, err)
+			assert.True(t, fi.Mode().IsRegular())
+			assert.Equal(t, fi.Mode()&fs.ModePerm, fs.FileMode(0640))
+			buffer, err := os.ReadFile(path)
+			require.NoError(t, err)
+			assert.Equal(t, string(buffer), "foo")
+		case filepath.Join("subdir1", "bar.txt"):
+			fi, err := dent.Info()
+			require.NoError(t, err)
+			assert.True(t, fi.Mode().IsRegular())
+			assert.Equal(t, fi.Mode()&fs.ModePerm, fs.FileMode(0440))
+			buffer, err := os.ReadFile(path)
+			require.NoError(t, err)
+			assert.Equal(t, string(buffer), "bar")
+		default:
+			assert.Failf(t, "Unknown file encountered in directory", path)
+		}
+		entryCount += 1
+		return nil
+	})
+	require.NoError(t, err)
+	assert.Equal(t, entryCount, 3)
+}
+
+func verifyTarball(t *testing.T, reader io.Reader) {
+	tr := tar.NewReader(reader)
+	entryCount := 0
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		entryCount += 1
+		switch hdr.Name {
+		case "subdir1":
+			assert.Equal(t, hdr.Typeflag, uint8(tar.TypeDir))
+			assert.Equal(t, hdr.Mode, int64(0750))
+		case "foo.txt":
+			assert.Equal(t, hdr.Typeflag, uint8(tar.TypeReg))
+			assert.Equal(t, hdr.Mode, int64(0640))
+			buffer := new(bytes.Buffer)
+			_, err := io.Copy(buffer, tr)
+			require.NoError(t, err)
+			assert.Equal(t, buffer.String(), string([]byte("foo")))
+		case filepath.Join("subdir1", "bar.txt"):
+			assert.Equal(t, hdr.Typeflag, uint8(tar.TypeReg))
+			assert.Equal(t, hdr.Mode, int64(0440))
+			buffer := new(bytes.Buffer)
+			_, err := io.Copy(buffer, tr)
+			require.NoError(t, err)
+			assert.True(t, bytes.Equal(buffer.Bytes(), []byte("bar")))
+		default:
+			assert.Failf(t, "Unknown file encountered in tarball", hdr.Name)
+		}
+	}
+	assert.Equal(t, entryCount, 3)
+}
+
+func TestAutoPacker(t *testing.T) {
+	t.Parallel()
+
+	t.Run("create-tarfile", func(t *testing.T) {
+		dirname := t.TempDir()
+
+		createTestDirectory(t, dirname)
+		ap := newAutoPacker(dirname, tarBehavior)
+		verifyTarball(t, ap)
+
+		// Unwrap the GZIP stream, pass to the tarball verifier
+		ap = newAutoPacker(dirname, tarGZBehavior)
+		gzReader, err := gzip.NewReader(ap)
+		require.NoError(t, err)
+		verifyTarball(t, gzReader)
+
+		// Default behavior should be the same as the tar.gz
+		ap = newAutoPacker(dirname, autoBehavior)
+		gzReader, err = gzip.NewReader(ap)
+		require.NoError(t, err)
+		verifyTarball(t, gzReader)
+	})
+
+	t.Run("unpack-tarfile", func(t *testing.T) {
+		dirnameSource := t.TempDir()
+		dirnameDest := t.TempDir()
+
+		createTestDirectory(t, dirnameSource)
+		ap := newAutoPacker(dirnameSource, tarGZBehavior)
+
+		aup := newAutoUnpacker(dirnameDest, autoBehavior)
+		_, err := io.Copy(aup, ap)
+		require.NoError(t, err)
+
+		require.NoError(t, aup.Error())
+		verifyTestDirectory(t, dirnameDest)
+	})
+}
diff --git a/resources/10-stash-plugin.conf b/client/resources/10-stash-plugin.conf
similarity index 98%
rename from resources/10-stash-plugin.conf
rename to client/resources/10-stash-plugin.conf
index 4692e2912..b7ffbb63c 100644
--- a/resources/10-stash-plugin.conf
+++ b/client/resources/10-stash-plugin.conf
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
diff --git a/resources/opensciencegrid.org.pub b/client/resources/opensciencegrid.org.pub
similarity index 99%
rename from resources/opensciencegrid.org.pub
rename to client/resources/opensciencegrid.org.pub
index 3fbbbd12c..44c490336 100644
--- a/resources/opensciencegrid.org.pub
+++ b/client/resources/opensciencegrid.org.pub
@@ -7,4 +7,3 @@ Dy3YQXwmEPm7kAZwIsEbMa0PNkp85IDkdR1GpvRvDMCRmUaRHrQUPBwPIjs0akL+
 qoTxJs9k6quV0g3Wd8z65s/k5mEZ+AnHHI0+0CL3y80wnuLSBYmw05YBtKyoa1Fb
 FQIDAQAB
 -----END PUBLIC KEY-----
-
diff --git a/resources/update-namespaces.sh b/client/resources/update-namespaces.sh
similarity index 99%
rename from resources/update-namespaces.sh
rename to client/resources/update-namespaces.sh
index 3873fd41e..484ed5d72 100755
--- a/resources/update-namespaces.sh
+++ b/client/resources/update-namespaces.sh
@@ -1,13 +1,13 @@
 #!/bin/bash
 #
 # Copyright (C) 2023, Pelican Project, University of Wisconsin-Madison
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -46,4 +46,3 @@ jq --sort-keys . namespaces.json.raw > namespaces.json.formatted ||
 mv -f namespaces.json.formatted namespaces.json ||
     fail $? "Move failed"
 rm -f namespaces.json.raw
-
diff --git a/client/sharing_url.go b/client/sharing_url.go
new file mode 100644
index 000000000..ea55b2739
--- /dev/null
+++ b/client/sharing_url.go
@@ -0,0 +1,106 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, University of Nebraska-Lincoln
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package client
+
+import (
+	"net/url"
+	"strings"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+)
+
+func getDirectorFromUrl(objectUrl *url.URL) (string, error) {
+	configDirectorUrl := param.Federation_DirectorUrl.GetString()
+	var directorUrl string
+	if objectUrl.Scheme == "pelican" {
+		if objectUrl.Host == "" {
+			if configDirectorUrl == "" {
+				return "", errors.New("Must specify (or configure) the federation hostname with the pelican://-style URLs")
+			}
+			directorUrl = configDirectorUrl
+		} else {
+			discoveryUrl := url.URL{
+				Scheme: "https",
+				Host:   objectUrl.Host,
+			}
+			viper.Set("Federation.DirectorUrl", "")
+			viper.Set("Federation.DiscoveryUrl", discoveryUrl.String())
+			if err := config.DiscoverFederation(); err != nil {
+				return "", errors.Wrapf(err, "Failed to discover location of the director for the federation %s", objectUrl.Host)
+			}
+			if directorUrl = param.Federation_DirectorUrl.GetString(); directorUrl == "" {
+				return "", errors.Errorf("Director for the federation %s not discovered", objectUrl.Host)
+			}
+		}
+	} else if objectUrl.Scheme == "osdf" && configDirectorUrl == "" {
+		if objectUrl.Host != "" {
+			objectUrl.Path = "/" + objectUrl.Host + objectUrl.Path
+			objectUrl.Host = ""
+		}
+		viper.Set("Federation.DiscoveryUrl", "https://osg-htc.org")
+		if err := config.DiscoverFederation(); err != nil {
+			return "", errors.Wrap(err, "Failed to discover director for the OSDF")
+		}
+		if directorUrl = param.Federation_DirectorUrl.GetString(); directorUrl == "" {
+			return "", errors.Errorf("Director for the OSDF not discovered")
+		}
+	} else if objectUrl.Scheme == "" {
+		if configDirectorUrl == "" {
+			return "", errors.Errorf("Must provide a federation name for path %s (e.g., pelican://osg-htc.org/%s)", objectUrl.Path, objectUrl.Path)
+		} else {
+			directorUrl = configDirectorUrl
+		}
+	} else if objectUrl.Scheme != "osdf" {
+		return "", errors.Errorf("Unsupported scheme for pelican: %s://", objectUrl.Scheme)
+	}
+	return directorUrl, nil
+}
+
+func CreateSharingUrl(objectUrl *url.URL, isWrite bool) (string, error) {
+	directorUrl, err := getDirectorFromUrl(objectUrl)
+	if err != nil {
+		return "", err
+	}
+	objectUrl.Path = "/" + strings.TrimPrefix(objectUrl.Path, "/")
+
+	log.Debugln("Will query director for path", objectUrl.Path)
+	dirResp, err := queryDirector("GET", objectUrl.Path, directorUrl)
+	if err != nil {
+		log.Errorln("Error while querying the Director:", err)
+		return "", errors.Wrapf(err, "Error while querying the director at %s", directorUrl)
+	}
+	namespace, err := CreateNsFromDirectorResp(dirResp)
+	if err != nil {
+		return "", errors.Wrapf(err, "Unable to parse response from director at %s", directorUrl)
+	}
+
+	opts := config.TokenGenerationOpts{Operation: config.TokenSharedRead}
+	if isWrite {
+		opts.Operation = config.TokenSharedWrite
+	}
+	token, err := AcquireToken(objectUrl, namespace, opts)
+	if err != nil {
+		err = errors.Wrap(err, "Failed to acquire token")
+	}
+	return token, err
+}
diff --git a/client/sharing_url_test.go b/client/sharing_url_test.go
new file mode 100644
index 000000000..93aa1e4cf
--- /dev/null
+++ b/client/sharing_url_test.go
@@ -0,0 +1,170 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, University of Nebraska-Lincoln
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package client
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/pelicanplatform/pelican/config"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDirectorGeneration(t *testing.T) {
+	returnError := false
+	returnErrorRef := &returnError
+
+	handler := func(w http.ResponseWriter, r *http.Request) {
+		discoveryConfig := `{"director_endpoint": "https://location.example.com", "namespace_registration_endpoint": "https://location.example.com/namespace", "jwks_uri": "https://location.example.com/jwks"}`
+		if *returnErrorRef {
+			w.WriteHeader(http.StatusInternalServerError)
+		} else {
+			w.WriteHeader(http.StatusOK)
+			_, err := w.Write([]byte(discoveryConfig))
+			assert.NoError(t, err)
+		}
+	}
+	server := httptest.NewTLSServer(http.HandlerFunc(handler))
+	defer server.Close()
+	serverURL, err := url.Parse(server.URL)
+	require.NoError(t, err)
+
+	objectUrl := url.URL{
+		Scheme: "pelican",
+		Host:   serverURL.Host,
+		Path:   "/test/foo",
+	}
+
+	// Discovery works to get URL
+	viper.Reset()
+	viper.Set("TLSSkipVerify", true)
+	err = config.InitClient()
+	require.NoError(t, err)
+	dUrl, err := getDirectorFromUrl(&objectUrl)
+	require.NoError(t, err)
+	assert.Equal(t, dUrl, "https://location.example.com")
+
+	// Discovery URL overrides the federation config.
+	viper.Reset()
+	viper.Set("TLSSkipVerify", true)
+	viper.Set("Federation.DirectorURL", "https://location2.example.com")
+	dUrl, err = getDirectorFromUrl(&objectUrl)
+	require.NoError(t, err)
+	assert.Equal(t, dUrl, "https://location.example.com")
+
+	// Fallback to configuration if no discovery present
+	viper.Reset()
+	viper.Set("Federation.DirectorURL", "https://location2.example.com")
+	objectUrl.Host = ""
+	dUrl, err = getDirectorFromUrl(&objectUrl)
+	require.NoError(t, err)
+	assert.Equal(t, dUrl, "https://location2.example.com")
+
+	// Error if server has an error
+	viper.Reset()
+	returnError = true
+	viper.Set("TLSSkipVerify", true)
+	objectUrl.Host = serverURL.Host
+	_, err = getDirectorFromUrl(&objectUrl)
+	require.Error(t, err)
+
+	// Error if neither config nor hostname provided.
+	viper.Reset()
+	objectUrl.Host = ""
+	_, err = getDirectorFromUrl(&objectUrl)
+	require.Error(t, err)
+
+	// Error on unknown scheme
+	viper.Reset()
+	objectUrl.Scheme = "buzzard"
+	_, err = getDirectorFromUrl(&objectUrl)
+	require.Error(t, err)
+}
+
+func TestSharingUrl(t *testing.T) {
+	// Construct a local server that we can poke with QueryDirector
+	myUrl := "http://redirect.com"
+	myUrlRef := &myUrl
+	log.SetLevel(log.DebugLevel)
+	handler := func(w http.ResponseWriter, r *http.Request) {
+		issuerLoc := *myUrlRef + "/issuer"
+
+		if strings.HasPrefix(r.URL.Path, "/test") {
+			w.Header().Set("Location", *myUrlRef)
+			w.Header().Set("X-Pelican-Namespace", "namespace=/test, require-token=true")
+			w.Header().Set("X-Pelican-Authorization", fmt.Sprintf("issuer=%s", issuerLoc))
+			w.Header().Set("X-Pelican-Token-Generation", fmt.Sprintf("issuer=%s, base-path=/test, strategy=OAuth2", issuerLoc))
+			w.WriteHeader(http.StatusTemporaryRedirect)
+		} else if r.URL.Path == "/issuer/.well-known/openid-configuration" {
+			w.WriteHeader(http.StatusOK)
+			oidcConfig := fmt.Sprintf(`{"token_endpoint": "%s/token", "registration_endpoint": "%s/register", "grant_types_supported": ["urn:ietf:params:oauth:grant-type:device_code"], "device_authorization_endpoint": "%s/device_authz"}`, issuerLoc, issuerLoc, issuerLoc)
+			_, err := w.Write([]byte(oidcConfig))
+			assert.NoError(t, err)
+		} else if r.URL.Path == "/issuer/register" {
+			//requestBytes, err := io.ReadAll(r.Body)
+			//assert.NoError(t, err)
+			clientConfig := `{"client_id": "client1", "client_secret": "secret", "client_secret_expires_at": 0}`
+			w.WriteHeader(http.StatusCreated)
+			_, err := w.Write([]byte(clientConfig))
+			assert.NoError(t, err)
+		} else if r.URL.Path == "/issuer/device_authz" {
+			w.WriteHeader(http.StatusOK)
+			_, err := w.Write([]byte(`{"device_code": "1234", "user_code": "5678", "interval": 1, "verification_uri": "https://example.com", "expires_in": 20}`))
+			assert.NoError(t, err)
+		} else if r.URL.Path == "/issuer/token" {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			_, err := w.Write([]byte(`{"access_token": "token1234", "token_type": "jwt"}`))
+			assert.NoError(t, err)
+		} else {
+			fmt.Println(r)
+			requestBytes, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			fmt.Println(string(requestBytes))
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+	server := httptest.NewServer(http.HandlerFunc(handler))
+	defer server.Close()
+	myUrl = server.URL
+
+	os.Setenv("PELICAN_SKIP_TERMINAL_CHECK", "password")
+	defer os.Unsetenv("PELICAN_SKIP_TERMINAL_CHECK")
+	viper.Set("Federation.DirectorURL", myUrl)
+	viper.Set("ConfigDir", t.TempDir())
+	err := config.InitClient()
+	assert.NoError(t, err)
+
+	// Call QueryDirector with the test server URL and a source path
+	testUrl, err := url.Parse("/test/foo/bar")
+	require.NoError(t, err)
+	token, err := CreateSharingUrl(testUrl, true)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, token)
+	fmt.Println(token)
+}
diff --git a/unique_hash_darwin.go b/client/unique_hash_darwin.go
similarity index 99%
rename from unique_hash_darwin.go
rename to client/unique_hash_darwin.go
index 62c1fadbc..6ce4baa56 100644
--- a/unique_hash_darwin.go
+++ b/client/unique_hash_darwin.go
@@ -19,7 +19,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"bytes"
diff --git a/unique_hash_linux.go b/client/unique_hash_linux.go
similarity index 99%
rename from unique_hash_linux.go
rename to client/unique_hash_linux.go
index 5a4226493..5e85196cd 100644
--- a/unique_hash_linux.go
+++ b/client/unique_hash_linux.go
@@ -19,7 +19,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"bytes"
diff --git a/unique_hash_windows.go b/client/unique_hash_windows.go
similarity index 99%
rename from unique_hash_windows.go
rename to client/unique_hash_windows.go
index 8018b69ea..791aec9a4 100644
--- a/unique_hash_windows.go
+++ b/client/unique_hash_windows.go
@@ -19,7 +19,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import (
 	"bytes"
diff --git a/util.go b/client/util.go
similarity index 98%
rename from util.go
rename to client/util.go
index 797211c4e..ee070dda3 100644
--- a/util.go
+++ b/client/util.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package pelican
+package client
 
 import "fmt"
 
diff --git a/cmd/cache.go b/cmd/cache.go
new file mode 100644
index 000000000..84c5e060a
--- /dev/null
+++ b/cmd/cache.go
@@ -0,0 +1,55 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"context"
+
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/spf13/cobra"
+)
+
+var (
+	cacheCmd = &cobra.Command{
+		Use:   "cache",
+		Short: "Operate a Pelican cache service",
+		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			err := initCache(cmd.Context())
+			return err
+		},
+	}
+
+	cacheServeCmd = &cobra.Command{
+		Use:          "serve",
+		Short:        "Start the cache service",
+		RunE:         serveCache,
+		SilenceUsage: true,
+	}
+)
+
+func initCache(ctx context.Context) error {
+	metrics.SetComponentHealthStatus(metrics.OriginCache_XRootD, metrics.StatusCritical, "xrootd has not been started")
+	metrics.SetComponentHealthStatus(metrics.OriginCache_CMSD, metrics.StatusCritical, "cmsd has not been started")
+	return nil
+}
+
+func init() {
+	cacheCmd.AddCommand(cacheServeCmd)
+	cacheServeCmd.Flags().AddFlag(portFlag)
+}
diff --git a/cmd/cache_serve.go b/cmd/cache_serve.go
new file mode 100644
index 000000000..0bed38f6c
--- /dev/null
+++ b/cmd/cache_serve.go
@@ -0,0 +1,189 @@
+//go:build !windows
+
+/***************************************************************
+*
+* Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+*
+* Licensed under the Apache License, Version 2.0 (the "License"); you
+* may not use this file except in compliance with the License.  You may
+* obtain a copy of the License at
+*
+*    http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+***************************************************************/
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/url"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/pelicanplatform/pelican/cache_ui"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/daemon"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_ui"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/utils"
+	"github.com/pelicanplatform/pelican/web_ui"
+	"github.com/pelicanplatform/pelican/xrootd"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
+)
+
+func getNSAdsFromDirector() ([]director.NamespaceAd, error) {
+	// Get the endpoint of the director
+	var respNS []director.NamespaceAd
+	directorEndpoint, err := getDirectorEndpoint()
+	if err != nil {
+		return respNS, errors.Wrapf(err, "Failed to get DirectorURL from config: %v", err)
+	}
+
+	// Create the listNamespaces url
+	directorNSListEndpointURL, err := url.JoinPath(directorEndpoint, "api", "v1.0", "director", "listNamespaces")
+	if err != nil {
+		return respNS, err
+	}
+
+	respData, err := utils.MakeRequest(directorNSListEndpointURL, "GET", nil, nil)
+	if err != nil {
+		if jsonErr := json.Unmarshal(respData, &respNS); jsonErr == nil { // Error creating json
+			return respNS, errors.Wrapf(err, "Failed to make request: %v", err)
+		}
+		return respNS, errors.Wrap(err, "Failed to make request")
+	}
+
+	err = json.Unmarshal(respData, &respNS)
+	if err != nil {
+		return respNS, errors.Wrapf(err, "Failed to marshal response in to JSON: %v", err)
+	}
+
+	return respNS, nil
+}
+
+func serveCache(cmd *cobra.Command, _ []string) error {
+	cancel, err := serveCacheInternal(cmd.Context())
+	if err != nil {
+		cancel()
+		return err
+	}
+
+	return nil
+}
+
+func serveCacheInternal(cmdCtx context.Context) (context.CancelFunc, error) {
+	// Use this context for any goroutines that needs to react to server shutdown
+	ctx, shutdownCancel := context.WithCancel(cmdCtx)
+
+	err := config.InitServer(ctx, config.CacheType)
+	cobra.CheckErr(err)
+
+	egrp, ok := ctx.Value(config.EgrpKey).(*errgroup.Group)
+	if !ok {
+		egrp = &errgroup.Group{}
+	}
+
+	// Added the same logic from launcher.go as we currently launch cache separately from other services
+	egrp.Go(func() error {
+		log.Debug("Will shutdown process on signal")
+		sigs := make(chan os.Signal, 1)
+		signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
+		select {
+		case sig := <-sigs:
+			log.Warningf("Received signal %v; will shutdown process", sig)
+			shutdownCancel()
+			return nil
+		case <-ctx.Done():
+			return nil
+		}
+	})
+
+	err = xrootd.SetUpMonitoring(ctx, egrp)
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	nsAds, err := getNSAdsFromDirector()
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	cacheServer := &cache_ui.CacheServer{}
+	cacheServer.SetNamespaceAds(nsAds)
+	err = server_ui.CheckDefaults(cacheServer)
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	cachePrefix := "/caches/" + param.Xrootd_Sitename.GetString()
+
+	viper.Set("Origin.NamespacePrefix", cachePrefix)
+
+	if err = server_ui.RegisterNamespaceWithRetry(ctx, egrp); err != nil {
+		return shutdownCancel, err
+	}
+
+	if err = server_ui.LaunchPeriodicAdvertise(ctx, egrp, []server_utils.XRootDServer{cacheServer}); err != nil {
+		return shutdownCancel, err
+	}
+
+	engine, err := web_ui.GetEngine()
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	// Set up necessary APIs to support Web UI, including auth and metrics
+	if err := web_ui.ConfigureServerWebAPI(ctx, engine, egrp); err != nil {
+		return shutdownCancel, err
+	}
+
+	egrp.Go(func() (err error) {
+		if err = web_ui.RunEngine(ctx, engine, egrp); err != nil {
+			log.Errorln("Failure when running the web engine:", err)
+		}
+		return
+	})
+	if param.Server_EnableUI.GetBool() {
+		if err = web_ui.ConfigureEmbeddedPrometheus(ctx, engine); err != nil {
+			return shutdownCancel, errors.Wrap(err, "Failed to configure embedded prometheus instance")
+		}
+
+		if err = web_ui.InitServerWebLogin(ctx); err != nil {
+			return shutdownCancel, err
+		}
+	}
+
+	configPath, err := xrootd.ConfigXrootd(ctx, false)
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	xrootd.LaunchXrootdMaintenance(ctx, cacheServer, 2*time.Minute)
+
+	log.Info("Launching cache")
+	launchers, err := xrootd.ConfigureLaunchers(false, configPath, false)
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	if err = daemon.LaunchDaemons(ctx, launchers, egrp); err != nil {
+		return shutdownCancel, err
+	}
+
+	return shutdownCancel, nil
+}
diff --git a/cmd/cache_serve_windows.go b/cmd/cache_serve_windows.go
new file mode 100644
index 000000000..d67496184
--- /dev/null
+++ b/cmd/cache_serve_windows.go
@@ -0,0 +1,30 @@
+//go:build windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+func serveCache( /*cmd*/ *cobra.Command /*args*/, []string) error {
+	return errors.New("'cache serve' command is not supported on Windows")
+}
diff --git a/cmd/config_mgr.go b/cmd/config_mgr.go
index 627341c65..18c3a74c7 100644
--- a/cmd/config_mgr.go
+++ b/cmd/config_mgr.go
@@ -25,10 +25,9 @@ import (
 	"os"
 	"path"
 
-	"github.com/pelicanplatform/pelican"
+	"github.com/pelicanplatform/pelican/client"
 	"github.com/pelicanplatform/pelican/config"
 	"github.com/pelicanplatform/pelican/namespaces"
-	log "github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
 )
 
@@ -149,7 +148,11 @@ func addTokenSubcommands(tokenCmd *cobra.Command) {
 				os.Exit(1)
 			}
 
-			token, err := pelican.AcquireToken(&dest, namespace, isWrite)
+			opts := config.TokenGenerationOpts{Operation: config.TokenRead}
+			if isWrite {
+				opts.Operation = config.TokenWrite
+			}
+			token, err := client.AcquireToken(&dest, namespace, opts)
 			if err != nil {
 				fmt.Fprintln(os.Stderr, "Failed to get a token:", err)
 				os.Exit(1)
@@ -304,11 +307,3 @@ func init() {
 	rootConfigCmd.AddCommand(prefixCmd)
 	rootConfigCmd.AddCommand(tokenCmd)
 }
-
-func setLogging(logLevel log.Level) {
-	textFormatter := log.TextFormatter{}
-	textFormatter.DisableLevelTruncation = true
-	textFormatter.FullTimestamp = true
-	log.SetFormatter(&textFormatter)
-	log.SetLevel(logLevel)
-}
diff --git a/cmd/director.go b/cmd/director.go
index f56e5cf84..da89ef833 100644
--- a/cmd/director.go
+++ b/cmd/director.go
@@ -19,6 +19,10 @@
 package main
 
 import (
+	"net/url"
+
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -28,11 +32,11 @@ var (
 		Use:   "director",
 		Short: "Launch a Pelican Director",
 		Long: `Launch a Pelican Director service:
-		
+
 		The Pelican Director is the primary mechanism by which clients/caches
 		can discover the source of a requested resource. It has two endpoints
 		at /api/v1.0/director/origin/ and /api/v1.0/director/object/, where the
-		former redirects to the closest origin supporting the object and the 
+		former redirects to the closest origin supporting the object and the
 		latter redirects to the closest cache. As a shortcut, requests to the
 		director at /foo/bar will be treated as a request for the object from
 		cache.`,
@@ -46,6 +50,21 @@ var (
 	}
 )
 
+func getDirectorEndpoint() (string, error) {
+	directorEndpoint := param.Federation_DirectorUrl.GetString()
+	if directorEndpoint == "" {
+		return "", errors.New("No director specified; give the federation name (-f)")
+	}
+
+	directorEndpointURL, err := url.Parse(directorEndpoint)
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to parse director url")
+	}
+
+	// Return the string, as opposed to a pointer to the URL object
+	return directorEndpointURL.String(), nil
+}
+
 func init() {
 	// Tie the directorServe command to the root CLI command
 	directorCmd.AddCommand(directorServeCmd)
diff --git a/cmd/director_serve.go b/cmd/director_serve.go
index 261a94573..e132299c7 100644
--- a/cmd/director_serve.go
+++ b/cmd/director_serve.go
@@ -19,76 +19,16 @@
 package main
 
 import (
-	"crypto/elliptic"
-	"fmt"
-	"os"
-	"os/signal"
-	"syscall"
-
 	"github.com/pelicanplatform/pelican/config"
-	"github.com/pelicanplatform/pelican/director"
-	"github.com/pelicanplatform/pelican/web_ui"
-	log "github.com/sirupsen/logrus"
+	"github.com/pelicanplatform/pelican/launchers"
 	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
-func generateTLSCertIfNeeded() error {
-
-	// As necessary, generate a private key and corresponding cert
-	if err := config.GeneratePrivateKey(viper.GetString("TLSKey"), elliptic.P256()); err != nil {
-		return err
-	}
-	if err := config.GenerateCert(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func serveDirector( /*cmd*/ *cobra.Command /*args*/, []string) error {
-	log.Info("Initializing Director GeoIP database...")
-	director.InitializeDB()
-
-	if config.GetPreferredPrefix() == "OSDF" {
-		log.Info("Generating/advertising server ads from OSG topology service...")
-
-		// Get the ads from topology, populate the cache, and keep the cache
-		// updated with fresh info
-		if err := director.AdvertiseOSDF(); err != nil {
-			panic(err)
-		}
-	}
-	go director.PeriodicCacheReload()
-
-	err := generateTLSCertIfNeeded()
-	if err != nil {
-		return err
-	}
-
-	engine, err := web_ui.GetEngine()
+func serveDirector(cmd *cobra.Command, args []string) error {
+	cancel, err := launchers.LaunchModules(cmd.Context(), config.DirectorType)
 	if err != nil {
-		return err
+		cancel()
 	}
 
-	// Configure the shortcut middleware to either redirect to a cache
-	// or to an origin
-	defaultResponse := viper.GetString("Director.DefaultResponse")
-	if !(defaultResponse == "cache" || defaultResponse == "origin") {
-		return fmt.Errorf("The director's default response must either be set to 'cache' or 'origin',"+
-			" but you provided %q. Was there a typo?", defaultResponse)
-	}
-	log.Debugf("The director will redirect to %ss by default", defaultResponse)
-	engine.Use(director.ShortcutMiddleware(defaultResponse))
-	director.RegisterDirector(engine.Group("/"))
-
-	log.Info("Starting web engine...")
-	go web_ui.RunEngine(engine)
-
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
-	sig := <-sigs
-	_ = sig
-
-	return nil
+	return err
 }
diff --git a/cmd/fed.go b/cmd/fed.go
new file mode 100644
index 000000000..75129e8ad
--- /dev/null
+++ b/cmd/fed.go
@@ -0,0 +1,49 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+var (
+	serveCmd = &cobra.Command{
+		Use:    "serve",
+		Hidden: true,
+		Short:  "Starts pelican with a list of enabled modules",
+		Long: `Starts pelican with a list of enabled modules [registry, director, cache, origin] to enable better
+		 end-to-end and integration testing.
+
+		 If the director or namespace registry are enabled, then ensure there is a corresponding url in the
+		 pelican.yaml file.
+
+		 This feature doesn't currently support the web UIs`,
+		RunE: fedServeStart,
+	}
+)
+
+func init() {
+	serveCmd.Flags().StringSlice("module", []string{}, "Modules to be started.")
+	if err := viper.BindPFlag("Server.Modules", serveCmd.Flags().Lookup("module")); err != nil {
+		panic(err)
+	}
+	serveCmd.Flags().Uint16("origin-port", 8443, "Port for the origin")
+	serveCmd.Flags().Uint16("cache-port", 8442, "Port for the cache")
+}
diff --git a/cmd/fed_serve.go b/cmd/fed_serve.go
new file mode 100644
index 000000000..a14016c3a
--- /dev/null
+++ b/cmd/fed_serve.go
@@ -0,0 +1,52 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/launchers"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+func fedServeStart(cmd *cobra.Command, args []string) error {
+	moduleSlice := param.Server_Modules.GetStringSlice()
+	if len(moduleSlice) == 0 {
+		return errors.New("No modules are enabled; pass the --module flag or set the Server.Modules parameter")
+	}
+	modules := config.NewServerType()
+	for _, module := range moduleSlice {
+		if !modules.SetString(module) {
+			return errors.Errorf("Unknown module name: %s", module)
+		}
+	}
+	if modules.IsEnabled(config.CacheType) {
+		return errors.New("`pelican serve` does not support the cache module")
+	}
+
+	cancel, err := launchers.LaunchModules(cmd.Context(), modules)
+	if err != nil {
+		cancel()
+	}
+
+	return err
+}
diff --git a/cmd/fed_serve_test.go b/cmd/fed_serve_test.go
new file mode 100644
index 000000000..8997fd7a9
--- /dev/null
+++ b/cmd/fed_serve_test.go
@@ -0,0 +1,122 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/launchers"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/test_utils"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFedServePosixOrigin(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+
+	modules := config.ServerType(0)
+	modules.Set(config.OriginType)
+	modules.Set(config.DirectorType)
+	modules.Set(config.RegistryType)
+
+	// Create our own temp directory (for some reason t.TempDir() does not play well with xrootd)
+	tmpPathPattern := "XRootD-Test_Origin*"
+	tmpPath, err := os.MkdirTemp("", tmpPathPattern)
+	require.NoError(t, err)
+
+	// Need to set permissions or the xrootd process we spawn won't be able to write PID/UID files
+	permissions := os.FileMode(0755)
+	err = os.Chmod(tmpPath, permissions)
+	require.NoError(t, err)
+
+	viper.Set("ConfigDir", tmpPath)
+	viper.Set("Xrootd.RunLocation", filepath.Join(tmpPath, "xrootd"))
+	t.Cleanup(func() {
+		if err := os.RemoveAll(tmpPath); err != nil {
+			t.Fatal("Failed to clean up temp path")
+		}
+	})
+
+	// Increase the log level; otherwise, its difficult to debug failures
+	viper.Set("Logging.Level", "Debug")
+	config.InitConfig()
+
+	viper.Set("Origin.ExportVolume", t.TempDir()+":/test")
+	viper.Set("Origin.Mode", "posix")
+	// Disable functionality we're not using (and is difficult to make work on Mac)
+	viper.Set("Origin.EnableCmsd", false)
+	viper.Set("Origin.EnableMacaroons", false)
+	viper.Set("Origin.EnableVoms", false)
+	viper.Set("TLSSkipVerify", true)
+	viper.Set("Server.EnableUI", false)
+	viper.Set("Registry.DbLocation", filepath.Join(t.TempDir(), "ns-registry.sqlite"))
+
+	err = config.InitServer(ctx, modules)
+	require.NoError(t, err)
+
+	fedCancel, err := launchers.LaunchModules(ctx, modules)
+	defer fedCancel()
+	if err != nil {
+		log.Errorln("Failure in fedServeInternal:", err)
+		require.NoError(t, err)
+	}
+
+	desiredURL := param.Server_ExternalWebUrl.GetString() + "/.well-known/openid-configuration"
+	err = server_utils.WaitUntilWorking(ctx, "GET", desiredURL, "director", 200)
+	require.NoError(t, err)
+
+	httpc := http.Client{
+		Transport: config.GetTransport(),
+	}
+	resp, err := httpc.Get(desiredURL)
+	require.NoError(t, err)
+
+	assert.Equal(t, resp.StatusCode, http.StatusOK)
+
+	responseBody, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	expectedResponse := struct {
+		JwksUri string `json:"jwks_uri"`
+	}{}
+	err = json.Unmarshal(responseBody, &expectedResponse)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, expectedResponse.JwksUri)
+
+	cancel()
+	fedCancel()
+	assert.NoError(t, egrp.Wait())
+}
diff --git a/cmd/fed_serve_windows.go b/cmd/fed_serve_windows.go
new file mode 100644
index 000000000..297b5fa7f
--- /dev/null
+++ b/cmd/fed_serve_windows.go
@@ -0,0 +1,30 @@
+//go:build windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+func fedServeStart( /*cmd*/ *cobra.Command /*args*/, []string) error {
+	return errors.New("'serve' command is not supported on Windows")
+}
diff --git a/cmd/main.go b/cmd/main.go
index 1f674ff35..9c0b378e7 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -19,20 +19,51 @@
 package main
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 func main() {
-	exec_name := filepath.Base(os.Args[0])
-	if exec_name == "stash_plugin" || exec_name == "osdf_plugin" || exec_name == "pelican_xfer_plugin" {
-		stashPluginMain(os.Args[1:])
-	} else if exec_name == "stashcp" {
+	err := handleCLI(os.Args)
+	if err != nil {
+		os.Exit(1)
+	}
+}
+
+func handleCLI(args []string) error {
+	execName := filepath.Base(args[0])
+	// Take care of our Windows users
+	execName = strings.TrimSuffix(execName, ".exe")
+	// Being case-insensitive
+	execName = strings.ToLower(execName)
+
+	if strings.HasPrefix(execName, "stash_plugin") || strings.HasPrefix(execName, "osdf_plugin") || strings.HasPrefix(execName, "pelican_xfer_plugin") {
+		stashPluginMain(args[1:])
+	} else if strings.HasPrefix(execName, "stashcp") {
 		err := copyCmd.Execute()
 		if err != nil {
-			os.Exit(1)
+			return err
 		}
 	} else {
-		Execute()
+		// * We assume that os.Args should have minimum length of 1, so skipped empty check
+		// * Version flag is captured manually to ensure it's available to all the commands and subcommands
+		// 		This is becuase there's no gracefuly way to do it through Cobra
+		// * Note that append "--version" to CLI as the last argument will give the
+		// version info regardless of the commands and whether they are defined
+		// * Remove the -v shorthand since in "origin serve" flagset it's already used for "volume" flag
+		if args[len(args)-1] == "--version" {
+			fmt.Println("Version:", version)
+			fmt.Println("Build Date:", date)
+			fmt.Println("Build Commit:", commit)
+			fmt.Println("Built By:", builtBy)
+			return nil
+		}
+		err := Execute()
+		if err != nil {
+			os.Exit(1)
+		}
 	}
+	return nil
 }
diff --git a/cmd/main_test.go b/cmd/main_test.go
new file mode 100644
index 000000000..02cc2946e
--- /dev/null
+++ b/cmd/main_test.go
@@ -0,0 +1,231 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHandleCLIVersionFlag(t *testing.T) {
+	// Save the current version to reset this variable
+	var currentVersion = version
+	version = "0.0.1"
+	date = "2023-10-06T15:26:50Z"
+	commit = "f0f94a3edf6641c2472345819a0d5453fc9e68d1"
+	builtBy = "goreleaser"
+
+	// Reset os.Args to ensure Windows doesn't do weird things to the test
+	oldArgs := os.Args
+	os.Args = []string{os.Args[0]}
+
+	mockVersionOutput := fmt.Sprintf(
+		"Version: %s\nBuild Date: %s\nBuild Commit: %s\nBuilt By: %s",
+		version, date, commit, builtBy,
+	)
+
+	testCases := []struct {
+		name     string
+		args     []string
+		expected string
+	}{
+		// The choice of Long and Short is based on the current pattern we have
+		// that only root command has Long description and Short description
+		// for the rest of the subcommands
+		{
+			"no-flag-on-root-command",
+			[]string{"pelican"},
+			rootCmd.Long,
+		},
+		{
+			"no-flag-on-subcommand",
+			[]string{"pelican", "origin"},
+			originCmd.Short,
+		},
+		{
+			"flag-on-root-command",
+			[]string{"pelican", "--version"},
+			mockVersionOutput,
+		},
+		{
+			"flag-on-subcommand",
+			[]string{"pelican", "origin", "--version"},
+			mockVersionOutput,
+		},
+		{
+			"flag-on-second-layer-subcommand",
+			[]string{"pelican", "origin", "get", "--version"},
+			mockVersionOutput,
+		},
+		{
+			"other-flag-on-root-command",
+			[]string{"pelican", "--help"},
+			rootCmd.Long,
+		},
+	}
+
+	batchTest := func(t *testing.T, arguments []string, expected string) {
+		// Redirect output to a pip
+		oldStdout := os.Stdout
+		r, w, _ := os.Pipe()
+		os.Stdout = w
+
+		err := handleCLI(arguments)
+
+		// Close the write of pip and redirect output back to stdout
+		w.Close()
+		out, _ := io.ReadAll(r)
+		os.Stdout = oldStdout
+
+		got := strings.TrimSpace(string(out))
+		assert.NoError(t, err, "Should not have error running the function")
+		if expected != mockVersionOutput {
+			// If the expected string is not the version output, use Contains to check
+			// This is mainly for checking against command help output
+			assert.Contains(t, got, expected, "Output does not match expectation")
+		} else {
+			assert.Equal(t, expected, got, "Output does not match expectation")
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			batchTest(t, tc.args, tc.expected)
+		})
+	}
+
+	// Restore the args back when test finished
+	os.Args = oldArgs
+
+	// Set the version back to what it was
+	version = currentVersion
+}
+
+func TestHandleCLIExecutableAlias(t *testing.T) {
+	// If we're in the process started by exec.Command, run the handleCLI function.
+	if os.Getenv("BE_CRASHER") == "1" {
+		err := handleCLI(os.Args[1:])
+		if err != nil {
+			t.Fatalf("Function returns error")
+		}
+		return
+	}
+
+	oldArgs := os.Args
+	os.Args = []string{}
+	defer func() {
+		os.Args = oldArgs
+	}()
+	testCases := []struct {
+		name     string
+		args     []string
+		expected string
+	}{
+		{
+			"no-alias",
+			[]string{"pelican"},
+			rootCmd.Long,
+		},
+		{
+			"stashcp",
+			[]string{"stashcp"},
+			"No Source or Destination", // slightly different error message, good for testing though
+		},
+		{
+			"stash_plugin",
+			[]string{"stash_plugin"},
+			"No source or destination specified",
+		},
+		{
+			"osdf_plugin",
+			[]string{"stash_plugin"},
+			"No source or destination specified",
+		},
+		{
+			"pelican_xfer_plugin",
+			[]string{"stash_plugin"},
+			"No source or destination specified",
+		},
+	}
+
+	batchTest := func(t *testing.T, arguments []string, expected string) {
+		// Compile the test binary.
+		cmd := exec.Command("go", "build", "-o", arguments[0], ".")
+		err := cmd.Run()
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer os.Remove(arguments[0]) // Clean up the test binary when done.
+
+		// Run the test binary with the BE_CRASHER environment variable set.
+		cmd = exec.Command("./"+arguments[0], arguments[1:]...)
+		cmd.Env = append(os.Environ(), "BE_CRASHER=1")
+
+		// Set up pipes to capture stdout and stderr.
+		stdout, _ := cmd.StdoutPipe()
+		stderr, _ := cmd.StderrPipe()
+		if err := cmd.Start(); err != nil {
+			t.Fatal(err)
+		}
+
+		// Read and capture stdout and stderr.
+		gotBytes, _ := io.ReadAll(stdout)
+		errBytes, _ := io.ReadAll(stderr)
+
+		// Wait for the command to finish.
+		err = cmd.Wait()
+
+		got := strings.TrimSpace(string(gotBytes))
+		errString := strings.TrimSpace(string(errBytes))
+
+		// Now you can check the output and the error against your expectations.
+		// If the command exited with a non-zero status, 'err' will be non-nil.
+		if err != nil {
+			_, ok := err.(*exec.ExitError)
+			if !ok {
+				t.Fatal("Failed to cast error as *exec.ExitError")
+			}
+		}
+		// Apparently both stashcp and *_plug will trigger Exit(1) with error if
+		// the arguments are not enough/solid
+		if strings.ToLower(strings.TrimSuffix(arguments[0], ".exe")) != "pelican" {
+			assert.Contains(t, errString, expected, "Output does not match expectation")
+		} else {
+			assert.NoError(t, err, "Should not have error running the function: "+errString)
+			assert.Contains(t, got, expected, "Output does not match expectation")
+		}
+	}
+	for _, tc := range testCases {
+		if os := runtime.GOOS; os == "windows" {
+			// On Windows, you can only do *.exe
+			t.Run(tc.name+"-windows", func(t *testing.T) {
+				preserve := tc.args[0]
+				tc.args[0] = preserve + ".exe"
+				batchTest(t, tc.args, tc.expected)
+				tc.args[0] = preserve
+			})
+		} else {
+			t.Run(tc.name, func(t *testing.T) {
+				batchTest(t, tc.args, tc.expected)
+			})
+			t.Run(tc.name+"-windows", func(t *testing.T) {
+				preserve := tc.args[0]
+				tc.args[0] = preserve + ".exe"
+				batchTest(t, tc.args, tc.expected)
+				tc.args[0] = preserve
+			})
+			t.Run(tc.name+"-mixedCase", func(t *testing.T) {
+				preserve := tc.args[0]
+				tc.args[0] = strings.ToUpper(preserve)
+				batchTest(t, tc.args, tc.expected)
+				tc.args[0] = preserve
+			})
+		}
+	}
+}
diff --git a/cmd/namespace_registry_serve.go b/cmd/namespace_registry_serve.go
deleted file mode 100644
index 21ecb1807..000000000
--- a/cmd/namespace_registry_serve.go
+++ /dev/null
@@ -1,78 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-package main
-
-import (
-	"crypto/elliptic"
-	"github.com/pkg/errors"
-	"os"
-	"os/signal"
-	"syscall"
-
-	"github.com/pelicanplatform/pelican/config"
-	"github.com/pelicanplatform/pelican/namespace-registry"
-	"github.com/pelicanplatform/pelican/web_ui"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-)
-
-func serveNamespaceRegistry( /*cmd*/ *cobra.Command /*args*/, []string) error {
-	log.Info("Initializing the namespace registry's database...")
-
-	// Initialize the registry's sqlite database
-	err := nsregistry.InitializeDB()
-	if err != nil {
-		return errors.Wrap(err, "Unable to initialize the namespace registry database")
-	}
-
-	// function defined in director_serve
-	err = generateTLSCertIfNeeded()
-	if err != nil {
-		return errors.Wrap(err, "Failed to generate TLS certificate")
-	}
-
-	// The registry needs its own private key. If one doesn't exist, this will generate it
-	issuerKeyFile := viper.GetString("IssuerKey")
-	err = config.GeneratePrivateKey(issuerKeyFile, elliptic.P521())
-	if err != nil {
-		return errors.Wrap(err, "Failed to generate registry private key")
-	}
-	engine, err := web_ui.GetEngine()
-	if err != nil {
-		return err
-	}
-
-	// Call out to nsregistry to establish routes for the gin engine
-	nsregistry.RegisterNamespaceRegistry(engine.Group("/"))
-	log.Info("Starting web engine...")
-
-	// Might need to play around with this setting more to handle
-	// more complicated routing scenarios where we can't just use
-	// a wildcard. It removes duplicate / from the resource.
-	//engine.RemoveExtraSlash = true
-	go web_ui.RunEngine(engine)
-
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
-	sig := <-sigs
-	_ = sig
-
-	return nil
-}
diff --git a/cmd/object_copy.go b/cmd/object_copy.go
index 6989d19c7..0328eabae 100644
--- a/cmd/object_copy.go
+++ b/cmd/object_copy.go
@@ -24,14 +24,17 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/pelicanplatform/pelican"
+	"github.com/pelicanplatform/pelican/client"
 	"github.com/pelicanplatform/pelican/config"
 	"github.com/pelicanplatform/pelican/namespaces"
+	"github.com/pelicanplatform/pelican/param"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
 
 var (
+	execName string
+
 	copyCmd = &cobra.Command{
 		Use:   "copy {source ...} {destination}",
 		Short: "Copy a file to/from a Pelican federation",
@@ -40,7 +43,11 @@ var (
 )
 
 func init() {
-	exec_name := filepath.Base(os.Args[0])
+	execName = filepath.Base(os.Args[0])
+	// Take care of our Windows users
+	execName = strings.TrimSuffix(execName, ".exe")
+	// Being case-insensitive
+	execName = strings.ToLower(execName)
 	flagSet := copyCmd.Flags()
 	flagSet.StringP("cache", "c", "", "Cache to use")
 	flagSet.StringP("token", "t", "", "Token file to use for transfer")
@@ -48,7 +55,7 @@ func init() {
 	flagSet.StringP("cache-list-name", "n", "xroot", "(Deprecated) Cache list to use, currently either xroot or xroots; may be ignored")
 	flagSet.Lookup("cache-list-name").Hidden = true
 	// All the deprecated or hidden flags that are only relevant if we are in historical "stashcp mode"
-	if exec_name == "stashcp" {
+	if strings.HasPrefix(execName, "stashcp") {
 		copyCmd.Use = "stashcp {source ...} {destination}"
 		copyCmd.Short = "Copy a file to/from the OSDF"
 		flagSet.Lookup("cache-list-name").Hidden = false // Expose the help for this option
@@ -72,12 +79,15 @@ func init() {
 
 func copyMain(cmd *cobra.Command, args []string) {
 
-	pelican.ObjectClientOptions.Version = version
+	client.ObjectClientOptions.Version = config.PelicanVersion
 
-	if val, err := cmd.Flags().GetBool("debug"); err == nil && val {
-		setLogging(log.DebugLevel)
-	} else {
-		setLogging(log.ErrorLevel)
+	// Need to check just stashcp since it does not go through root, the other modes get checked there
+	if strings.HasPrefix(execName, "stashcp") {
+		if val, err := cmd.Flags().GetBool("debug"); err == nil && val {
+			config.SetLogging(log.DebugLevel)
+		} else {
+			config.SetLogging(log.ErrorLevel)
+		}
 	}
 
 	err := config.InitClient()
@@ -95,14 +105,14 @@ func copyMain(cmd *cobra.Command, args []string) {
 	}
 
 	// Set the progress bars to the command line option
-	pelican.ObjectClientOptions.Token, _ = cmd.Flags().GetString("token")
+	client.ObjectClientOptions.Token, _ = cmd.Flags().GetString("token")
 
-	// Check if the program was executed from a terminal
+	// Check if the program was executed from a terminal and does not specify a log location
 	// https://rosettacode.org/wiki/Check_output_device_is_a_terminal#Go
-	if fileInfo, _ := os.Stdout.Stat(); (fileInfo.Mode() & os.ModeCharDevice) != 0 {
-		pelican.ObjectClientOptions.ProgressBars = true
+	if fileInfo, _ := os.Stdout.Stat(); (fileInfo.Mode()&os.ModeCharDevice) != 0 && param.Logging_LogLocation.GetString() == "" && !param.Logging_DisableProgressBars.GetBool() {
+		client.ObjectClientOptions.ProgressBars = true
 	} else {
-		pelican.ObjectClientOptions.ProgressBars = false
+		client.ObjectClientOptions.ProgressBars = false
 	}
 
 	if val, err := cmd.Flags().GetBool("namespaces"); err == nil && val {
@@ -119,7 +129,7 @@ func copyMain(cmd *cobra.Command, args []string) {
 	// Print out all of the caches and exit
 	if val, err := cmd.Flags().GetBool("list-names"); err == nil && val {
 		listName, _ := cmd.Flags().GetString("cache-list-name")
-		cacheList, err := pelican.GetBestCache(listName)
+		cacheList, err := client.GetBestCache(listName)
 		if err != nil {
 			log.Errorln("Failed to get best caches:", err)
 			os.Exit(1)
@@ -135,7 +145,7 @@ func copyMain(cmd *cobra.Command, args []string) {
 			log.Errorln("Failed to determine correct cache list")
 			os.Exit(1)
 		}
-		cacheList, err := pelican.GetBestCache(listName)
+		cacheList, err := client.GetBestCache(listName)
 		if err != nil {
 			log.Errorln("Failed to get best cache: ", err)
 		}
@@ -162,13 +172,13 @@ func copyMain(cmd *cobra.Command, args []string) {
 	nearestCache, nearestCacheIsPresent := os.LookupEnv("NEAREST_CACHE")
 
 	if nearestCacheIsPresent {
-		pelican.NearestCache = nearestCache
-		pelican.NearestCacheList = append(pelican.NearestCacheList, pelican.NearestCache)
-		pelican.CacheOverride = true
+		client.NearestCache = nearestCache
+		client.NearestCacheList = append(client.NearestCacheList, client.NearestCache)
+		client.CacheOverride = true
 	} else if cache, _ := cmd.Flags().GetString("cache"); cache != "" {
-		pelican.NearestCache = cache
-		pelican.NearestCacheList = append(pelican.NearestCacheList, cache)
-		pelican.CacheOverride = true
+		client.NearestCache = cache
+		client.NearestCacheList = append(client.NearestCacheList, cache)
+		client.CacheOverride = true
 	}
 
 	// Convert the methods
@@ -176,7 +186,7 @@ func copyMain(cmd *cobra.Command, args []string) {
 	splitMethods := strings.Split(methodNames, ",")
 
 	// If the user overrides the cache, then only use HTTP
-	if pelican.CacheOverride {
+	if client.CacheOverride {
 		splitMethods = []string{"http"}
 	}
 
@@ -193,25 +203,26 @@ func copyMain(cmd *cobra.Command, args []string) {
 	for _, src := range source {
 		var tmpDownloaded int64
 		isRecursive, _ := cmd.Flags().GetBool("recursive")
-		tmpDownloaded, result = pelican.DoStashCPSingle(src, dest, splitMethods, isRecursive)
+		client.ObjectClientOptions.Recursive = isRecursive
+		tmpDownloaded, result = client.DoStashCPSingle(src, dest, splitMethods, isRecursive)
 		downloaded += tmpDownloaded
 		if result != nil {
 			lastSrc = src
 			break
 		} else {
-			pelican.ClearErrors()
+			client.ClearErrors()
 		}
 	}
 
 	// Exit with failure
 	if result != nil {
 		// Print the list of errors
-		errMsg := pelican.GetErrors()
+		errMsg := client.GetErrors()
 		if errMsg == "" {
 			errMsg = result.Error()
 		}
-		log.Errorln("Failure downloading " + lastSrc + ": " + errMsg)
-		if pelican.ErrorsRetryable() {
+		log.Errorln("Failure transferring " + lastSrc + ": " + errMsg)
+		if client.ErrorsRetryable() {
 			log.Errorln("Errors are retryable")
 			os.Exit(11)
 		}
diff --git a/cmd/object_get.go b/cmd/object_get.go
new file mode 100644
index 000000000..76a6b7c41
--- /dev/null
+++ b/cmd/object_get.go
@@ -0,0 +1,137 @@
+/***************************************************************
+*
+* Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+*
+* Licensed under the Apache License, Version 2.0 (the "License"); you
+* may not use this file except in compliance with the License.  You may
+* obtain a copy of the License at
+*
+*    http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+***************************************************************/
+
+package main
+
+import (
+	"os"
+
+	"github.com/pelicanplatform/pelican/client"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+var (
+	getCmd = &cobra.Command{
+		Use:   "get {source ...} {destination}",
+		Short: "Get a file from a Pelican federation",
+		Run:   getMain,
+	}
+)
+
+func init() {
+	flagSet := getCmd.Flags()
+	flagSet.StringP("cache", "c", "", "Cache to use")
+	flagSet.StringP("token", "t", "", "Token file to use for transfer")
+	flagSet.BoolP("recursive", "r", false, "Recursively download a directory.  Forces methods to only be http to get the freshest directory contents")
+	flagSet.StringP("cache-list-name", "n", "xroot", "(Deprecated) Cache list to use, currently either xroot or xroots; may be ignored")
+	flagSet.Lookup("cache-list-name").Hidden = true
+	flagSet.String("caches", "", "A JSON file containing the list of caches")
+	objectCmd.AddCommand(getCmd)
+}
+
+func getMain(cmd *cobra.Command, args []string) {
+
+	client.ObjectClientOptions.Version = version
+
+	err := config.InitClient()
+	if err != nil {
+		log.Errorln(err)
+		os.Exit(1)
+	}
+
+	// Set the progress bars to the command line option
+	client.ObjectClientOptions.Token, _ = cmd.Flags().GetString("token")
+
+	// Check if the program was executed from a terminal
+	// https://rosettacode.org/wiki/Check_output_device_is_a_terminal#Go
+	if fileInfo, _ := os.Stdout.Stat(); (fileInfo.Mode()&os.ModeCharDevice) != 0 && param.Logging_LogLocation.GetString() == "" && !param.Logging_DisableProgressBars.GetBool() {
+		client.ObjectClientOptions.ProgressBars = true
+	} else {
+		client.ObjectClientOptions.ProgressBars = false
+	}
+
+	log.Debugln("Len of source:", len(args))
+	if len(args) < 2 {
+		log.Errorln("No Source or Destination")
+		err = cmd.Help()
+		if err != nil {
+			log.Errorln("Failed to print out help:", err)
+		}
+		os.Exit(1)
+	}
+	source := args[:len(args)-1]
+	dest := args[len(args)-1]
+
+	log.Debugln("Sources:", source)
+	log.Debugln("Destination:", dest)
+
+	// Check for manually entered cache to use ??
+	nearestCache, nearestCacheIsPresent := os.LookupEnv("NEAREST_CACHE")
+
+	if nearestCacheIsPresent {
+		client.NearestCache = nearestCache
+		client.NearestCacheList = append(client.NearestCacheList, client.NearestCache)
+		client.CacheOverride = true
+	} else if cache, _ := cmd.Flags().GetString("cache"); cache != "" {
+		client.NearestCache = cache
+		client.NearestCacheList = append(client.NearestCacheList, cache)
+		client.CacheOverride = true
+	}
+
+	if len(source) > 1 {
+		if destStat, err := os.Stat(dest); err != nil && destStat.IsDir() {
+			log.Errorln("Destination is not a directory")
+			os.Exit(1)
+		}
+	}
+
+	var result error
+	var downloaded int64 = 0
+	lastSrc := ""
+	for _, src := range source {
+		var tmpDownloaded int64
+		isRecursive, _ := cmd.Flags().GetBool("recursive")
+		client.ObjectClientOptions.Recursive = isRecursive
+		tmpDownloaded, result = client.DoGet(src, dest, isRecursive)
+		downloaded += tmpDownloaded
+		if result != nil {
+			lastSrc = src
+			break
+		} else {
+			client.ClearErrors()
+		}
+	}
+
+	// Exit with failure
+	if result != nil {
+		// Print the list of errors
+		errMsg := client.GetErrors()
+		if errMsg == "" {
+			errMsg = result.Error()
+		}
+		log.Errorln("Failure getting " + lastSrc + ": " + errMsg)
+		if client.ErrorsRetryable() {
+			log.Errorln("Errors are retryable")
+			os.Exit(11)
+		}
+		os.Exit(1)
+	}
+}
diff --git a/cmd/object_get_put_test.go b/cmd/object_get_put_test.go
new file mode 100644
index 000000000..8ad4665fb
--- /dev/null
+++ b/cmd/object_get_put_test.go
@@ -0,0 +1,192 @@
+//go:build linux
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/launchers"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/pelicanplatform/pelican/utils"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetAndPut(t *testing.T) {
+	//////////////////////////////Setup our test federation//////////////////////////////////////////
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+
+	viper.Reset()
+
+	modules := config.ServerType(0)
+	modules.Set(config.OriginType)
+	modules.Set(config.DirectorType)
+	modules.Set(config.RegistryType)
+
+	// Create our own temp directory (for some reason t.TempDir() does not play well with xrootd)
+	tmpPathPattern := "XRootD-Test_Origin*"
+	tmpPath, err := os.MkdirTemp("", tmpPathPattern)
+	require.NoError(t, err)
+
+	// Need to set permissions or the xrootd process we spawn won't be able to write PID/UID files
+	permissions := os.FileMode(0755)
+	err = os.Chmod(tmpPath, permissions)
+	require.NoError(t, err)
+
+	viper.Set("ConfigDir", tmpPath)
+
+	// Increase the log level; otherwise, its difficult to debug failures
+	viper.Set("Logging.Level", "Debug")
+	config.InitConfig()
+	// Create a file to capture output from commands
+	output, err := os.CreateTemp(t.TempDir(), "output")
+	assert.NoError(t, err)
+	defer os.Remove(output.Name())
+	viper.Set("Logging.LogLocation", output.Name())
+
+	originDir, err := os.MkdirTemp("", "Origin")
+	assert.NoError(t, err)
+
+	// Change the permissions of the temporary origin directory
+	permissions = os.FileMode(0777)
+	err = os.Chmod(originDir, permissions)
+	require.NoError(t, err)
+
+	viper.Set("Origin.ExportVolume", originDir+":/test")
+	viper.Set("Origin.Mode", "posix")
+	viper.Set("Origin.EnableFallbackRead", true)
+	// Disable functionality we're not using (and is difficult to make work on Mac)
+	viper.Set("Origin.EnableCmsd", false)
+	viper.Set("Origin.EnableMacaroons", false)
+	viper.Set("Origin.EnableVoms", false)
+	viper.Set("Origin.EnableWrite", true)
+	viper.Set("TLSSkipVerify", true)
+	viper.Set("Server.EnableUI", false)
+	viper.Set("Registry.DbLocation", filepath.Join(t.TempDir(), "ns-registry.sqlite"))
+	viper.Set("Xrootd.RunLocation", tmpPath)
+
+	err = config.InitServer(ctx, modules)
+	require.NoError(t, err)
+
+	fedCancel, err := launchers.LaunchModules(ctx, modules)
+	if err != nil {
+		t.Fatalf("Failure in fedServeInternal: %v", err)
+	}
+
+	desiredURL := param.Server_ExternalWebUrl.GetString() + "/.well-known/openid-configuration"
+	err = server_utils.WaitUntilWorking(ctx, "GET", desiredURL, "director", 200)
+	require.NoError(t, err)
+
+	httpc := http.Client{
+		Transport: config.GetTransport(),
+	}
+	resp, err := httpc.Get(desiredURL)
+	require.NoError(t, err)
+
+	assert.Equal(t, resp.StatusCode, http.StatusOK)
+
+	responseBody, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	expectedResponse := struct {
+		JwksUri string `json:"jwks_uri"`
+	}{}
+	err = json.Unmarshal(responseBody, &expectedResponse)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, expectedResponse.JwksUri)
+	//////////////////////////////////////////////////////////////////////////////////////////
+	t.Run("testObjectPutAndGet", func(t *testing.T) {
+		testFileContent := "test file content"
+		// Create the temporary file to upload
+		tempFile, err := os.CreateTemp(t.TempDir(), "test")
+		assert.NoError(t, err, "Error creating temp file")
+		defer os.Remove(tempFile.Name())
+		_, err = tempFile.WriteString(testFileContent)
+		assert.NoError(t, err, "Error writing to temp file")
+		tempFile.Close()
+
+		// Create a token file
+		tokenConfig := utils.TokenConfig{
+			TokenProfile: utils.WLCG,
+			Lifetime:     time.Minute,
+			Issuer:       param.Origin_Url.GetString(),
+			Audience:     []string{param.Origin_Url.GetString()},
+			Subject:      "origin",
+		}
+		tokenConfig.AddRawScope("storage.read:/ storage.modify:/")
+		token, err := tokenConfig.CreateToken()
+		assert.NoError(t, err)
+		tempToken, err := os.CreateTemp(t.TempDir(), "token")
+		assert.NoError(t, err, "Error creating temp token file")
+		defer os.Remove(tempToken.Name())
+		_, err = tempToken.WriteString(token)
+		assert.NoError(t, err, "Error writing to temp token file")
+		tempToken.Close()
+		// Disable progress bars to not reuse the same mpb instance
+		viper.Set("Logging.DisableProgressBars", true)
+
+		// Set path for object to upload/download
+		tempPath := tempFile.Name()
+		fileName := filepath.Base(tempPath)
+		uploadURL := "osdf:///test/" + fileName
+
+		// Upload the file with PUT
+		rootCmd.SetArgs([]string{"object", "put", tempFile.Name(), uploadURL, "-d", "-t", tempToken.Name()})
+		err = rootCmd.Execute()
+		assert.NoError(t, err, "Failed to run pelican object put")
+
+		out, err := io.ReadAll(output)
+		assert.NoError(t, err)
+		// Confirm we're uploading size we are expecting
+		assert.Contains(t, string(out), "Uploaded bytes: 17")
+
+		// Download that same file with GET
+		rootCmd.SetArgs([]string{"object", "get", uploadURL, t.TempDir(), "-t", tempToken.Name(), "-c", param.Origin_Url.GetString(), "-d"})
+		err = rootCmd.Execute()
+		assert.NoError(t, err, "Failed to run pelican object get")
+
+		out, err = io.ReadAll(output)
+		assert.NoError(t, err)
+		// Confirm we download same amount of bytes as upload
+		assert.Contains(t, string(out), "Downloaded bytes: 17")
+	})
+	// cleanup
+	os.RemoveAll(tmpPath)
+	os.RemoveAll(originDir)
+
+	cancel()
+	fedCancel()
+	assert.NoError(t, egrp.Wait())
+	viper.Reset()
+}
diff --git a/cmd/object_put.go b/cmd/object_put.go
new file mode 100644
index 000000000..0eddef0b1
--- /dev/null
+++ b/cmd/object_put.go
@@ -0,0 +1,121 @@
+/***************************************************************
+*
+* Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+*
+* Licensed under the Apache License, Version 2.0 (the "License"); you
+* may not use this file except in compliance with the License.  You may
+* obtain a copy of the License at
+*
+*    http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+***************************************************************/
+
+package main
+
+import (
+	"os"
+
+	"github.com/pelicanplatform/pelican/client"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+var (
+	putCmd = &cobra.Command{
+		Use:   "put {source ...} {destination}",
+		Short: "Send a file to a Pelican federation",
+		Run:   putMain,
+	}
+)
+
+func init() {
+	flagSet := putCmd.Flags()
+	flagSet.StringP("token", "t", "", "Token file to use for transfer")
+	flagSet.BoolP("recursive", "r", false, "Recursively upload a directory.  Forces methods to only be http to get the freshest directory contents")
+	objectCmd.AddCommand(putCmd)
+}
+
+func putMain(cmd *cobra.Command, args []string) {
+
+	client.ObjectClientOptions.Version = version
+
+	err := config.InitClient()
+	if err != nil {
+		log.Errorln(err)
+		os.Exit(1)
+	}
+
+	// Set the progress bars to the command line option
+	client.ObjectClientOptions.Token, _ = cmd.Flags().GetString("token")
+
+	// Check if the program was executed from a terminal
+	// https://rosettacode.org/wiki/Check_output_device_is_a_terminal#Go
+	if fileInfo, _ := os.Stdout.Stat(); (fileInfo.Mode()&os.ModeCharDevice) != 0 && param.Logging_LogLocation.GetString() == "" && !param.Logging_DisableProgressBars.GetBool() {
+		client.ObjectClientOptions.ProgressBars = true
+	} else {
+		client.ObjectClientOptions.ProgressBars = false
+	}
+
+	log.Debugln("Len of source:", len(args))
+	if len(args) < 2 {
+		log.Errorln("No Source or Destination")
+		err = cmd.Help()
+		if err != nil {
+			log.Errorln("Failed to print out help:", err)
+		}
+		os.Exit(1)
+	}
+	source := args[:len(args)-1]
+	dest := args[len(args)-1]
+
+	log.Debugln("Sources:", source)
+	log.Debugln("Destination:", dest)
+
+	if len(source) > 1 {
+		if destStat, err := os.Stat(dest); err != nil && destStat.IsDir() {
+			log.Errorln("Destination is not a directory")
+			os.Exit(1)
+		}
+	}
+
+	var result error
+	var downloaded int64 = 0
+	lastSrc := ""
+	for _, src := range source {
+		var tmpDownloaded int64
+		isRecursive, _ := cmd.Flags().GetBool("recursive")
+		client.ObjectClientOptions.Recursive = isRecursive
+		tmpDownloaded, result = client.DoPut(src, dest, isRecursive)
+		downloaded += tmpDownloaded
+		if result != nil {
+			lastSrc = src
+			break
+		} else {
+			client.ClearErrors()
+		}
+	}
+
+	// Exit with failure
+	if result != nil {
+		// Print the list of errors
+		errMsg := client.GetErrors()
+		if errMsg == "" {
+			errMsg = result.Error()
+		}
+		log.Errorln("Failure putting " + lastSrc + ": " + errMsg)
+		if client.ErrorsRetryable() {
+			log.Errorln("Errors are retryable")
+			os.Exit(11)
+		}
+		os.Exit(1)
+	}
+
+}
diff --git a/cmd/object_share.go b/cmd/object_share.go
new file mode 100644
index 000000000..6dfbc812e
--- /dev/null
+++ b/cmd/object_share.go
@@ -0,0 +1,75 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"fmt"
+	"net/url"
+
+	"github.com/pelicanplatform/pelican/client"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	shareCmd = &cobra.Command{
+		Use: "share {URL}",
+		Short: `Generate a string for sharing access to a namespace.
+Note the sharing is based on prefixes; all object names matching the prefix will be accessible`,
+		RunE: shareMain,
+	}
+)
+
+func init() {
+	flagSet := shareCmd.Flags()
+	flagSet.Bool("write", false, "Allow writes to the target prefix")
+	objectCmd.AddCommand(shareCmd)
+}
+
+func shareMain(cmd *cobra.Command, args []string) error {
+
+	err := config.InitClient()
+	if err != nil {
+		return errors.Wrap(err, "Failed to initialize the client")
+	}
+
+	isWrite, err := cmd.Flags().GetBool("write")
+	if err != nil {
+		return errors.Wrap(err, "Unable to get the value of the --write flag")
+	}
+
+	if len(args) == 0 {
+		return errors.New("A URL must be specified to share")
+	}
+
+	objectUrl, err := url.Parse(args[0])
+	if err != nil {
+		return errors.Wrapf(err, "Failed to parse '%v' as a URL", args[0])
+	}
+
+	token, err := client.CreateSharingUrl(objectUrl, isWrite)
+	if err != nil {
+		return errors.Wrapf(err, "Failed to create a sharing URL for %v", objectUrl.String())
+	}
+
+	objectUrl.RawQuery = "authz=" + token
+	fmt.Println(objectUrl.String())
+	return nil
+}
diff --git a/cmd/origin.go b/cmd/origin.go
index 9d707e788..8405ede61 100644
--- a/cmd/origin.go
+++ b/cmd/origin.go
@@ -19,9 +19,11 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"os"
 
+	"github.com/pelicanplatform/pelican/metrics"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -30,6 +32,10 @@ var (
 	originCmd = &cobra.Command{
 		Use:   "origin",
 		Short: "Operate a Pelican origin service",
+		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			err := initOrigin(cmd.Context())
+			return err
+		},
 	}
 
 	originConfigCmd = &cobra.Command{
@@ -44,6 +50,47 @@ var (
 		RunE:         serveOrigin,
 		SilenceUsage: true,
 	}
+
+	originUiCmd = &cobra.Command{
+		Use:   "web-ui",
+		Short: "Manage the Pelican origin web UI",
+	}
+
+	originUiResetCmd = &cobra.Command{
+		Use:   "reset-password",
+		Short: "Reset the admin password for the web UI",
+		RunE:  uiPasswordReset,
+	}
+
+	// Expose the token manipulation CLI
+	originTokenCmd = &cobra.Command{
+		Use:   "token",
+		Short: "Manage Pelican origin tokens",
+	}
+
+	originTokenCreateCmd = &cobra.Command{
+		Use:   "create",
+		Short: "Create a Pelican origin token",
+		Long: `Create a JSON web token (JWT) using the origin's signing keys:
+Usage: pelican origin token create [FLAGS] claims
+E.g. pelican origin token create --profile scitokens2 aud=my-audience scope="read:/storage" scope="write:/storage"
+
+Pelican origins use JWTs as bearer tokens for authorizing specific requests,
+such as reading from or writing to the origin's underlying storage, advertising
+to a director, etc. For more information about the makeup of a JWT, see
+https://jwt.io/introduction.
+
+Additional profiles that expand on JWT are supported. They include scitokens2 and
+wlcg. For more information about these profiles, see https://scitokens.org/technical_docs/Claims
+and https://github.com/WLCG-AuthZ-WG/common-jwt-profile/blob/master/profile.md, respectively`,
+		RunE: cliTokenCreate,
+	}
+
+	originTokenVerifyCmd = &cobra.Command{
+		Use:   "verify",
+		Short: "Verify a Pelican origin token",
+		RunE:  verifyToken,
+	}
 )
 
 func configOrigin( /*cmd*/ *cobra.Command /*args*/, []string) {
@@ -51,12 +98,130 @@ func configOrigin( /*cmd*/ *cobra.Command /*args*/, []string) {
 	os.Exit(1)
 }
 
+func initOrigin(ctx context.Context) error {
+	metrics.SetComponentHealthStatus(metrics.OriginCache_XRootD, metrics.StatusCritical, "xrootd has not been started")
+	metrics.SetComponentHealthStatus(metrics.OriginCache_CMSD, metrics.StatusCritical, "cmsd has not been started")
+	return nil
+}
+
 func init() {
 	originCmd.AddCommand(originConfigCmd)
 	originCmd.AddCommand(originServeCmd)
-	originServeCmd.Flags().StringP("volume", "v", "", "Setting the volue to /SRC:/DEST will export the contents of /SRC as /DEST in the Pelican federation")
-	if err := viper.BindPFlag("ExportVolume", originServeCmd.Flags().Lookup("volume")); err != nil {
+
+	// The -m flag is used to specify what kind of backend we plan to use for the origin.
+	originServeCmd.Flags().StringP("mode", "m", "posix", "Set the mode for the origin service (default is 'posix')")
+	if err := viper.BindPFlag("Origin.Mode", originServeCmd.Flags().Lookup("mode")); err != nil {
+		panic(err)
+	}
+
+	// The -v flag is used when an origin is served in POSIX mode
+	originServeCmd.Flags().StringP("volume", "v", "", "Setting the volume to /SRC:/DEST will export the contents of /SRC as /DEST in the Pelican federation")
+	if err := viper.BindPFlag("Origin.ExportVolume", originServeCmd.Flags().Lookup("volume")); err != nil {
+		panic(err)
+	}
+
+	// The -w flag is used if we want the origin to be writeable.
+	originServeCmd.Flags().BoolP("writeable", "", true, "Allow/disable writting to the origin")
+	if err := viper.BindPFlag("Origin.EnableWrite", originServeCmd.Flags().Lookup("writeable")); err != nil {
+		panic(err)
+	}
+
+	// A variety of flags we add for S3 mode. These are ultimately required for configuring the S3 xrootd plugin
+	originServeCmd.Flags().String("service-name", "", "Specify the S3 service-name. Only used when an origin is launched in S3 mode.")
+	originServeCmd.Flags().String("region", "", "Specify the S3 region. Only used when an origin is launched in S3 mode.")
+	originServeCmd.Flags().String("bucket", "", "Specify the S3 bucket. Only used when an origin is launched in S3 mode.")
+	originServeCmd.Flags().String("service-url", "", "Specify the S3 service-url. Only used when an origin is launched in S3 mode.")
+	originServeCmd.Flags().String("bucket-access-keyfile", "", "Specify a filepath to use for configuring the bucket's access key.")
+	originServeCmd.Flags().String("bucket-secret-keyfile", "", "Specify a filepath to use for configuring the bucket's access key.")
+	if err := viper.BindPFlag("Origin.S3ServiceName", originServeCmd.Flags().Lookup("service-name")); err != nil {
+		panic(err)
+	}
+	if err := viper.BindPFlag("Origin.S3Region", originServeCmd.Flags().Lookup("region")); err != nil {
+		panic(err)
+	}
+	if err := viper.BindPFlag("Origin.S3Bucket", originServeCmd.Flags().Lookup("bucket")); err != nil {
+		panic(err)
+	}
+	if err := viper.BindPFlag("Origin.S3ServiceUrl", originServeCmd.Flags().Lookup("service-url")); err != nil {
+		panic(err)
+	}
+	if err := viper.BindPFlag("Origin.S3AccessKeyfile", originServeCmd.Flags().Lookup("bucket-access-keyfile")); err != nil {
 		panic(err)
 	}
+	if err := viper.BindPFlag("Origin.S3SecretKeyfile", originServeCmd.Flags().Lookup("bucket-secret-keyfile")); err != nil {
+		panic(err)
+	}
+
+	// Would be nice to make these mutually exclusive to mode=posix instead of to --volume, but cobra
+	// doesn't seem to have something that can make the value of a flag exclusive to other flags
+	// Anyway, we never want to run the S3 flags with the -v flag.
+	originServeCmd.MarkFlagsMutuallyExclusive("volume", "service-name")
+	originServeCmd.MarkFlagsMutuallyExclusive("volume", "region")
+	originServeCmd.MarkFlagsMutuallyExclusive("volume", "bucket")
+	originServeCmd.MarkFlagsMutuallyExclusive("volume", "service-url")
+	originServeCmd.MarkFlagsMutuallyExclusive("volume", "bucket-access-keyfile")
+	originServeCmd.MarkFlagsMutuallyExclusive("volume", "bucket-secret-keyfile")
+	// We don't require the bucket access and secret keyfiles as they're not needed for unauthenticated buckets
+	originServeCmd.MarkFlagsRequiredTogether("service-name", "region", "bucket", "service-url")
+	originServeCmd.MarkFlagsRequiredTogether("bucket-access-keyfile", "bucket-secret-keyfile")
+
+	// The port any web UI stuff will be served on
 	originServeCmd.Flags().AddFlag(portFlag)
+
+	// origin token, used for creating and verifying tokens with
+	// the origin's signing jwk.
+	originCmd.AddCommand(originTokenCmd)
+	originTokenCmd.AddCommand(originTokenCreateCmd)
+	originTokenCmd.PersistentFlags().String("profile", "wlcg", "Passing a profile ensures the token adheres to the profile's requirements. Accepted values are scitokens2 and wlcg")
+	originTokenCreateCmd.Flags().Int("lifetime", 1200, "The lifetime of the token, in seconds.")
+	originTokenCreateCmd.Flags().StringSlice("audience", []string{}, "The token's intended audience.")
+	originTokenCreateCmd.Flags().String("subject", "", "The token's subject.")
+	originTokenCreateCmd.Flags().StringSlice("scope", []string{}, "Scopes for granting fine-grained permissions to the token.")
+	originTokenCreateCmd.Flags().StringSlice("claim", []string{}, "Additional token claims. A claim must be of the form <claim name>=<value>")
+	originTokenCreateCmd.Flags().String("issuer", "", "The URL of the token's issuer. If not provided, the tool will attempt to find one in the configuration file.")
+	if err := viper.BindPFlag("IssuerUrl", originTokenCreateCmd.Flags().Lookup("issuer")); err != nil {
+		panic(err)
+	}
+	originTokenCreateCmd.Flags().String("private-key", viper.GetString("IssuerKey"), "Filepath designating the location of the private key in PEM format to be used for signing, if different from the origin's default.")
+	if err := viper.BindPFlag("IssuerKey", originTokenCreateCmd.Flags().Lookup("private-key")); err != nil {
+		panic(err)
+	}
+	originTokenCmd.AddCommand(originTokenVerifyCmd)
+
+	// A pre-run hook to enforce flags specific to each profile
+	originTokenCreateCmd.PreRun = func(cmd *cobra.Command, args []string) {
+		profile, _ := cmd.Flags().GetString("profile")
+		reqFlags := []string{}
+		reqSlices := []string{}
+		switch profile {
+		case "wlcg":
+			reqFlags = []string{"subject"}
+			reqSlices = []string{"audience"}
+		case "scitokens2":
+			reqSlices = []string{"audience", "scope"}
+		}
+
+		shouldCancel := false
+		for _, flag := range reqFlags {
+			if val, _ := cmd.Flags().GetString(flag); val == "" {
+				fmt.Printf("The --%s flag must be populated for the scitokens profile\n", flag)
+				shouldCancel = true
+			}
+		}
+		for _, flag := range reqSlices {
+			if slice, _ := cmd.Flags().GetStringSlice(flag); len(slice) == 0 {
+				fmt.Printf("The --%s flag must be populated for the scitokens profile\n", flag)
+				shouldCancel = true
+			}
+		}
+
+		if shouldCancel {
+			os.Exit(1)
+		}
+	}
+
+	originCmd.AddCommand(originUiCmd)
+	originUiCmd.AddCommand(originUiResetCmd)
+	originUiResetCmd.Flags().String("user", "admin", "The user whose password should be reset.")
+	originUiResetCmd.Flags().Bool("stdin", false, "Read the password in from stdin.")
 }
diff --git a/cmd/origin_reset_password.go b/cmd/origin_reset_password.go
new file mode 100644
index 000000000..b796cfe02
--- /dev/null
+++ b/cmd/origin_reset_password.go
@@ -0,0 +1,64 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package main
+
+import (
+	"fmt"
+	"io"
+	"syscall"
+
+	"github.com/pelicanplatform/pelican/web_ui"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+func uiPasswordReset(cmd *cobra.Command, args []string) error {
+	username, err := cmd.Flags().GetString("user")
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get value of the --user flag")
+	}
+	if username == "" {
+		return errors.New("Username must be a non-empty string")
+	}
+
+	stdin, err := cmd.Flags().GetBool("stdin")
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get value of the --stdin flag")
+	}
+
+	var bytePassword []byte
+	if stdin {
+		bytePassword, err = io.ReadAll(cmd.InOrStdin())
+		if err != nil {
+			return errors.Wrap(err, "Failed to read new password from stdin")
+		}
+	} else {
+		fmt.Print("Enter new password: ")
+		bytePassword, err = term.ReadPassword(int(syscall.Stdin))
+		if err != nil {
+			return errors.Wrap(err, "Failed to read new password from console")
+		}
+	}
+
+	if err = web_ui.WritePasswordEntry(username, string(bytePassword)); err != nil {
+		return errors.Wrapf(err, "Failed to update the password entry for user %s", username)
+	}
+
+	return nil
+}
diff --git a/cmd/origin_reset_password_test.go b/cmd/origin_reset_password_test.go
new file mode 100644
index 000000000..794d1603f
--- /dev/null
+++ b/cmd/origin_reset_password_test.go
@@ -0,0 +1,82 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tg123/go-htpasswd"
+)
+
+func TestResetPassword(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirName := t.TempDir()
+	viper.Reset()
+	viper.Set("ConfigDir", dirName)
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+
+	rootCmd.SetArgs([]string{"origin", "web-ui", "reset-password", "--stdin"})
+	byteBuffer := bytes.NewReader([]byte("1234"))
+	rootCmd.SetIn(byteBuffer)
+	err = rootCmd.Execute()
+	require.NoError(t, err)
+
+	fileName := param.Server_UIPasswordFile.GetString()
+	auth, err := htpasswd.New(fileName, []htpasswd.PasswdParser{htpasswd.AcceptBcrypt}, nil)
+	require.NoError(t, err)
+
+	assert.True(t, auth.Match("admin", "1234"))
+
+	err = originUiResetCmd.Execute()
+	require.NoError(t, err)
+	byteBuffer = bytes.NewReader([]byte("5678"))
+	originUiResetCmd.SetIn(byteBuffer)
+	err = originUiResetCmd.Execute()
+	require.NoError(t, err)
+
+	err = auth.Reload(nil)
+	require.NoError(t, err)
+
+	assert.True(t, auth.Match("admin", "5678"))
+
+	originUiResetCmd.SetArgs([]string{"origin", "web-ui", "reset-password", "--user", "testu"})
+	byteBuffer = bytes.NewReader([]byte("abcd"))
+	originUiResetCmd.SetIn(byteBuffer)
+	err = originUiResetCmd.Execute()
+	require.NoError(t, err)
+
+	err = auth.Reload(nil)
+	require.NoError(t, err)
+
+	assert.True(t, auth.Match("admin", "abcd"))
+}
diff --git a/cmd/origin_serve.go b/cmd/origin_serve.go
index 16ec364b3..a8f4d915f 100644
--- a/cmd/origin_serve.go
+++ b/cmd/origin_serve.go
@@ -21,441 +21,18 @@
 package main
 
 import (
-	"crypto/elliptic"
-	"crypto/rand"
 	_ "embed"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-	"text/template"
 
 	"github.com/pelicanplatform/pelican/config"
-	"github.com/pelicanplatform/pelican/metrics"
-	"github.com/pelicanplatform/pelican/origin_ui"
-	"github.com/pelicanplatform/pelican/web_ui"
-	"github.com/pelicanplatform/pelican/xrootd"
-	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
+	"github.com/pelicanplatform/pelican/launchers"
 	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
-var (
-
-	//go:embed resources/xrootd.cfg
-	xrootdCfg string
-	//go:embed resources/robots.txt
-	robotsTxt string
-)
-
-type (
-	OriginConfig struct {
-		Multiuser bool
-	}
-
-	XrootdConfig struct {
-		Port                   int
-		ManagerHost            string
-		ManagerPort            string
-		TLSCertificate         string
-		TLSKey                 string
-		TLSCertDir             string
-		TLSCertFile            string
-		MacaroonsKeyFile       string
-		RobotsTxtFile          string
-		Sitename               string
-		SummaryMonitoringHost  string
-		SummaryMonitoringPort  int
-		DetailedMonitoringHost string
-		DetailedMonitoringPort int
-		XrootdRun              string
-		Authfile               string
-		ScitokensConfig        string
-		Mount                  string
-		NamespacePrefix        string
-		LocalMonitoringPort    int
-		Origin                 OriginConfig
-	}
-)
-
-func init() {
-	err := config.InitServer()
-	cobra.CheckErr(err)
-	err = metrics.SetComponentHealthStatus("xrootd", "critical", "xrootd has not been started")
-	cobra.CheckErr(err)
-	err = metrics.SetComponentHealthStatus("cmsd", "critical", "cmsd has not been started")
-	cobra.CheckErr(err)
-}
-
-func checkXrootdEnv() error {
-	uid, err := config.GetDaemonUID()
-	if err != nil {
-		return err
-	}
-	gid, err := config.GetDaemonGID()
-	if err != nil {
-		return err
-	}
-	username, err := config.GetDaemonUser()
-	if err != nil {
-		return err
-	}
-	groupname, err := config.GetDaemonGroup()
-	if err != nil {
-		return err
-	}
-
-	// Ensure the runtime directory exists
-	runtimeDir := viper.GetString("XrootdRun")
-	err = config.MkdirAll(runtimeDir, 0755, uid, gid)
-	if err != nil {
-		return errors.Wrapf(err, "Unable to create runtime directory %v", runtimeDir)
-	}
-	if err = os.Chown(runtimeDir, uid, -1); err != nil {
-		return errors.Wrapf(err, "Unable to change ownership of runtime directory %v"+
-			" to desired daemon user %v", runtimeDir, username)
-	}
-
-	exportPath := filepath.Join(runtimeDir, "export")
-	if _, err := os.Stat(exportPath); err == nil {
-		if err = os.RemoveAll(exportPath); err != nil {
-			return errors.Wrap(err, "Failure when cleaning up temporary export tree")
-		}
-	}
-
-	// If we use "volume mount" style options, configure the export directories.
-	volumeMount := viper.GetString("ExportVolume")
-	if volumeMount != "" {
-		volumeMount, err = filepath.Abs(volumeMount)
-		if err != nil {
-			return err
-		}
-		volumeMountSrc := volumeMount
-		volumeMountDst := volumeMount
-		volumeMountInfo := strings.SplitN(volumeMount, ":", 2)
-		if len(volumeMountInfo) == 2 {
-			volumeMountSrc = volumeMountInfo[0]
-			volumeMountDst = volumeMountInfo[1]
-		}
-		volumeMountDst = filepath.Clean(volumeMountDst)
-		if volumeMountDst == "" {
-			return fmt.Errorf("Export volume %v has empty destination path", volumeMount)
-		}
-		if volumeMountDst[0:1] != "/" {
-			return fmt.Errorf("Export volume %v has a relative destination path",
-				volumeMountDst)
-		}
-		destPath := path.Clean(filepath.Join(exportPath, volumeMountDst[1:]))
-		err = config.MkdirAll(filepath.Dir(destPath), 0755, uid, gid)
-		if err != nil {
-			return errors.Wrapf(err, "Unable to create export directory %v",
-				filepath.Dir(destPath))
-		}
-		err = os.Symlink(volumeMountSrc, destPath)
-		if err != nil {
-			return errors.Wrapf(err, "Failed to create export symlink")
-		}
-		viper.Set("NamespacePrefix", volumeMountDst)
-	} else {
-		mountPath := viper.GetString("Mount")
-		namespacePrefix := viper.GetString("NamespacePrefix")
-		if mountPath == "" || namespacePrefix == "" {
-			return errors.New(`Export information was not provided.
-Add command line flag:
-
-    -v /mnt/foo:/bar
-
-to export the directory /mnt/foo to the path /bar in the data federation`)
-		}
-		mountPath, err := filepath.Abs(mountPath)
-		if err != nil {
-			return err
-		}
-		mountPath = filepath.Clean(mountPath)
-		namespacePrefix = filepath.Clean(namespacePrefix)
-		if namespacePrefix[0:1] != "/" {
-			return fmt.Errorf("Namespace prefix %v must have an absolute path",
-				namespacePrefix)
-		}
-		destPath := path.Clean(filepath.Join(exportPath, namespacePrefix[1:]))
-		err = config.MkdirAll(filepath.Dir(destPath), 0755, uid, gid)
-		if err != nil {
-			return errors.Wrapf(err, "Unable to create export directory %v",
-				filepath.Dir(destPath))
-		}
-		srcPath := filepath.Join(mountPath, namespacePrefix[1:])
-		err = os.Symlink(srcPath, destPath)
-		if err != nil {
-			return errors.Wrapf(err, "Failed to create export symlink")
-		}
-	}
-	viper.Set("Mount", exportPath)
-
-	keys, err := config.GenerateIssuerJWKS()
-	if err != nil {
-		return err
-	}
-	wellKnownPath := filepath.Join(exportPath, ".well-known")
-	err = config.MkdirAll(wellKnownPath, 0755, -1, gid)
-	if err != nil {
-		return err
-	}
-	file, err := os.OpenFile(filepath.Join(wellKnownPath, "issuer.jwks"),
-		os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-	buf, err := json.MarshalIndent(keys, "", " ")
-	if err != nil {
-		return errors.Wrap(err, "Failed to marshal public keys")
-	}
-	_, err = file.Write(buf)
-	if err != nil {
-		return errors.Wrap(err, "Failed to write public key set to export directory")
-	}
-
-	// If no robots.txt, create a ephemeral one for xrootd to use
-	robotsTxtFile := viper.GetString("RobotsTxtFile")
-	if _, err := os.Open(robotsTxtFile); err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			newPath := filepath.Join(runtimeDir, "robots.txt")
-			err = config.MkdirAll(path.Dir(newPath), 0755, -1, gid)
-			if err != nil {
-				return errors.Wrapf(err, "Unable to create directory %v",
-					path.Dir(newPath))
-			}
-			file, err := os.OpenFile(newPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
-			if err != nil {
-				return errors.Wrap(err, "Failed to create a default robots.txt file")
-			}
-			defer file.Close()
-			if _, err := file.WriteString(robotsTxt); err != nil {
-				return errors.Wrap(err, "Failed to write out a default robots.txt file")
-			}
-			viper.Set("RobotsTxtFile", newPath)
-		} else {
-			return err
-		}
-	}
-
-	// If macaroons secret does not exist, create one
-	macaroonsSecret := viper.GetString("MacaroonsKeyFile")
-	if _, err := os.Open(macaroonsSecret); err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			err = config.MkdirAll(path.Dir(macaroonsSecret), 0755, -1, gid)
-			if err != nil {
-				return errors.Wrapf(err, "Unable to create directory %v",
-					path.Dir(macaroonsSecret))
-			}
-			file, err := os.OpenFile(macaroonsSecret, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0640)
-			if err != nil {
-				return errors.Wrap(err, "Failed to create a new macaroons key")
-			}
-			defer file.Close()
-			buf := make([]byte, 64)
-			_, err = rand.Read(buf)
-			if err != nil {
-				return err
-			}
-			encoded := base64.StdEncoding.EncodeToString(buf) + "\n"
-			if _, err = file.WriteString(encoded); err != nil {
-				return errors.Wrap(err, "Failed to write out a macaroons key")
-			}
-		} else {
-			return err
-		}
-	}
-	if err = os.Chown(macaroonsSecret, -1, gid); err != nil {
-		return errors.Wrapf(err, "Unable to change ownership of macaroons secret %v"+
-			" to desired daemon group %v", macaroonsSecret, groupname)
-	}
-
-	// If the authfile or scitokens.cfg does not exist, create one
-	authfile := viper.GetString("Authfile")
-	err = config.MkdirAll(path.Dir(authfile), 0755, -1, gid)
-	if err != nil {
-		return errors.Wrapf(err, "Unable to create directory %v",
-			path.Dir(authfile))
-	}
-	if file, err := os.OpenFile(authfile, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0640); err == nil {
-		file.Close()
-	} else if !errors.Is(err, os.ErrExist) {
-		return err
-	}
-	if err = os.Chown(authfile, -1, gid); err != nil {
-		return errors.Wrapf(err, "Unable to change ownership of authfile %v"+
-			" to desired daemon group %v", macaroonsSecret, groupname)
-	}
-
-	scitokensCfg := viper.GetString("ScitokensConfig")
-	err = config.MkdirAll(path.Dir(scitokensCfg), 0755, -1, gid)
+func serveOrigin(cmd *cobra.Command, args []string) error {
+	cancel, err := launchers.LaunchModules(cmd.Context(), config.OriginType)
 	if err != nil {
-		return errors.Wrapf(err, "Unable to create directory %v",
-			path.Dir(scitokensCfg))
-	}
-	if file, err := os.OpenFile(scitokensCfg, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0640); err == nil {
-		file.Close()
-	} else if !errors.Is(err, os.ErrExist) {
-		return err
-	}
-	if err = os.Chown(scitokensCfg, -1, gid); err != nil {
-		return errors.Wrapf(err, "Unable to change ownership of scitokens config %v"+
-			" to desired daemon group %v", scitokensCfg, groupname)
+		cancel()
 	}
 
-	return nil
-}
-
-func checkConfigFileReadable(fileName string, errMsg string) error {
-	if _, err := os.Open(fileName); errors.Is(err, os.ErrNotExist) {
-		return errors.New(fmt.Sprintf("%v: the specified path in the configuration (%v) "+
-			"does not exist", errMsg, fileName))
-	} else if err != nil {
-		return errors.New(fmt.Sprintf("%v; an error occurred when reading %v: %v", errMsg,
-			fileName, err.Error()))
-	}
-	return nil
-}
-
-func checkDefaults() error {
-	requiredConfigs := []string{"ManagerHost", "SummaryMonitoringHost", "DetailedMonitoringHost",
-		"TLSCertificate", "TLSKey", "XrootdRun", "RobotsTxtFile"}
-	for _, configName := range requiredConfigs {
-		mgr := viper.GetString(configName)
-		if mgr == "" {
-			return errors.New(fmt.Sprintf("Required value of '%v' is not set in config",
-				configName))
-		}
-	}
-
-	// As necessary, generate a private key and corresponding cert
-	if err := config.GeneratePrivateKey(viper.GetString("TLSKey"), elliptic.P256()); err != nil {
-		return err
-	}
-	if err := config.GenerateCert(); err != nil {
-		return err
-	}
-
-	// TODO: Could upgrade this to a check for a cert in the file...
-	if err := checkConfigFileReadable(viper.GetString("TLSCertificate"),
-		"A TLS certificate is required to serve HTTPS"); err != nil {
-		return err
-	}
-	if err := checkConfigFileReadable(viper.GetString("TLSKey"),
-		"A TLS key is required to serve HTTPS"); err != nil {
-		return err
-	}
-
-	if err := checkXrootdEnv(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func configXrootd() (string, error) {
-	gid, err := config.GetDaemonGID()
-	if err != nil {
-		return "", err
-	}
-
-	var xrdConfig XrootdConfig
-	xrdConfig.LocalMonitoringPort = -1
-	if err := viper.Unmarshal(&xrdConfig); err != nil {
-		return "", err
-	}
-
-	if xrdConfig.Origin.Multiuser {
-		ok, err := config.HasMultiuserCaps()
-		if err != nil {
-			return "", errors.Wrap(err, "Failed to determine if the origin can run in multiuser mode")
-		}
-		if !ok {
-			return "", errors.New("Origin.Multiuser is set to `true` but the command was run without sufficient privilege; was it launched as root?")
-		}
-	}
-
-	templ := template.Must(template.New("xrootd.cfg").Parse(xrootdCfg))
-
-	xrootdRun := viper.GetString("XrootdRun")
-	configPath := filepath.Join(xrootdRun, "xrootd.cfg")
-	file, err := os.OpenFile(configPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
-	if err != nil {
-		return "", err
-	}
-	if err = os.Chown(configPath, -1, gid); err != nil {
-		return "", errors.Wrapf(err, "Unable to change ownership of configuration file %v"+
-			" to desired daemon gid %v", configPath, gid)
-	}
-
-	defer file.Close()
-
-	err = templ.Execute(file, xrdConfig)
-	if err != nil {
-		return "", err
-	}
-
-	return configPath, nil
-}
-
-func serveOrigin( /*cmd*/ *cobra.Command /*args*/, []string) error {
-	defer config.CleanupTempResources()
-
-	err := config.DiscoverFederation()
-	if err != nil {
-		log.Warningln("Failed to do service auto-discovery:", err)
-	}
-
-	monitorPort, err := metrics.ConfigureMonitoring()
-	if err != nil {
-		return err
-	}
-	viper.Set("LocalMonitoringPort", monitorPort)
-
-	err = checkDefaults()
-	if err != nil {
-		return err
-	}
-
-	engine, err := web_ui.GetEngine()
-	if err != nil {
-		return err
-	}
-	if err = origin_ui.ConfigureOriginUI(engine); err != nil {
-		return err
-	}
-	if err = origin_ui.PeriodicAdvertiseOrigin(); err != nil {
-		return err
-	}
-
-	go web_ui.RunEngine(engine)
-	if err = metrics.SetComponentHealthStatus("web-ui", "warning", "Authentication not initialized"); err != nil {
-		return err
-	}
-
-	// Ensure we wait until the origin has been initialized
-	// before launching XRootD.
-	if err = origin_ui.WaitUntilLogin(); err != nil {
-		return err
-	}
-	if err = metrics.SetComponentHealthStatus("web-ui", "ok", ""); err != nil {
-		return err
-	}
-
-	configPath, err := configXrootd()
-	if err != nil {
-		return err
-	}
-	privileged := viper.GetBool("Origin.Multiuser")
-	err = xrootd.LaunchXrootd(privileged, configPath)
-	if err != nil {
-		return err
-	}
-	log.Info("Clean shutdown of the origin")
-	return nil
+	return err
 }
diff --git a/cmd/origin_token.go b/cmd/origin_token.go
new file mode 100644
index 000000000..bbd5a7d94
--- /dev/null
+++ b/cmd/origin_token.go
@@ -0,0 +1,147 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/utils"
+)
+
+// Take an input slice and append its claim name
+func parseInputSlice(rawSlice *[]string, claimPrefix string) []string {
+	if len(*rawSlice) == 0 {
+		return nil
+	}
+	slice := []string{}
+	for _, val := range *rawSlice {
+		slice = append(slice, claimPrefix+"="+val)
+	}
+
+	return slice
+}
+
+// Parse claims to tokenConfig, excluding "sub". `claims` should be in the form of
+// <claim_key>=<claim=value>
+func parseClaimsToTokenConfig(claims []string) (*utils.TokenConfig, error) {
+	tokenConfig := utils.TokenConfig{}
+	for _, claim := range claims {
+		// Split by the first "=" delimiter
+		parts := strings.SplitN(claim, "=", 2)
+		if len(parts) < 2 {
+			errMsg := "The claim '" + claim + "' is invalid. Did you forget an '='?"
+			return nil, errors.New(errMsg)
+		}
+		key := parts[0]
+		val := parts[1]
+
+		switch key {
+		case "aud":
+			tokenConfig.Audience = append(tokenConfig.Audience, val)
+		case "scope":
+			tokenConfig.AddRawScope(val)
+		case "ver":
+			tokenConfig.Version = val
+		case "wlcg.ver":
+			tokenConfig.Version = val
+		case "iss":
+			tokenConfig.Issuer = val
+		default:
+			if tokenConfig.Claims == nil {
+				tokenConfig.Claims = map[string]string{}
+			}
+			if existingVal, exists := tokenConfig.Claims[key]; exists {
+				tokenConfig.Claims[key] = existingVal + " " + val
+			} else {
+				tokenConfig.Claims[key] = val
+			}
+		}
+	}
+
+	return &tokenConfig, nil
+}
+
+func cliTokenCreate(cmd *cobra.Command, args []string) error {
+	// Although we don't actually run any server stuff, we need access to the Origin's configuration
+	// to know where private keys live for token signing, so we still need to call InitServer()
+	ctx := context.Background()
+	err := config.InitServer(ctx, config.OriginType)
+	if err != nil {
+		return errors.Wrap(err, "Cannot create token, failed to initialize configuration")
+	}
+
+	// Additional claims can be passed via the --claims flag, or
+	// they can be passed as args. We join those two slices here
+	claimsSlice, err := cmd.Flags().GetStringSlice("claim")
+	if err != nil {
+		return errors.Wrap(err, "Failed to load claims passed via --claim flag")
+	}
+	args = append(args, claimsSlice...)
+
+	// Similarly for scopes. Scopes could be passed like --scope "read:/storage write:/storage"
+	// or they could be pased like --scope read:/storage --scope write:/storage. However, because
+	// we already know the name of these claims and don't expect naming via the cli, we parse the
+	// claims to name them here
+	rawScopesSlice, err := cmd.Flags().GetStringSlice("scope")
+	if err != nil {
+		return errors.Wrap(err, "Failed to load scopes passed via --scope flag")
+	}
+	scopesSlice := parseInputSlice(&rawScopesSlice, "scope")
+	if len(scopesSlice) > 0 {
+		args = append(args, scopesSlice...)
+	}
+
+	// Like scopes, we allow multiple audiences and we need to add the claim name.
+	rawAudSlice, err := cmd.Flags().GetStringSlice("audience")
+	if err != nil {
+		return errors.Wrap(err, "Failed to load audience passed via --audience flag")
+	}
+	audSlice := parseInputSlice(&rawAudSlice, "aud")
+	if len(audSlice) > 0 {
+		args = append(args, audSlice...)
+	}
+
+	tokenConfig, err := parseClaimsToTokenConfig(args)
+	if err != nil {
+		return errors.Wrap(err, "Failed to parse token claims")
+	}
+
+	// Get flags used for auxiliary parts of token creation that can't be fed directly to claimsMap
+	profile, err := cmd.Flags().GetString("profile")
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get profile '%s' from input", profile)
+	}
+	tokenConfig.TokenProfile = utils.TokenProfile(profile)
+
+	lifetime, err := cmd.Flags().GetInt("lifetime")
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get lifetime '%d' from input", lifetime)
+	}
+	tokenConfig.Lifetime = time.Duration(lifetime) * time.Second
+
+	// Flags to populate claimsMap
+	// Note that we don't get the issuer here, because that's bound to viper
+	subject, err := cmd.Flags().GetString("subject")
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get subject '%s' from input", subject)
+	}
+	tokenConfig.Subject = subject
+
+	// Finally, create the token
+	token, err := tokenConfig.CreateToken()
+	if err != nil {
+		return errors.Wrap(err, "Failed to create the token")
+	}
+
+	fmt.Println(token)
+	return nil
+}
+
+func verifyToken(cmd *cobra.Command, args []string) error {
+	return errors.New("Token verification not yet implemented")
+}
diff --git a/cmd/origin_token_test.go b/cmd/origin_token_test.go
new file mode 100644
index 000000000..ce5dcc772
--- /dev/null
+++ b/cmd/origin_token_test.go
@@ -0,0 +1,63 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseClaimsToTokenConfig(t *testing.T) {
+	// Should parse basic fields correctly
+	claims := []string{"aud=foo", "scope=baz", "ver=1.0", "iss=http://random.org"}
+	tokenConfig, err := parseClaimsToTokenConfig(claims)
+	assert.NoError(t, err)
+	assert.Equal(t, "http://random.org", tokenConfig.Issuer)
+	assert.Equal(t, []string{"foo"}, tokenConfig.Audience)
+	assert.Equal(t, "baz", tokenConfig.GetScope())
+	assert.Equal(t, "1.0", tokenConfig.Version)
+
+	// Give it something valid
+	claims = []string{"foo=boo", "bar=baz"}
+	tokenConfig, err = parseClaimsToTokenConfig(claims)
+	assert.NoError(t, err)
+	assert.Equal(t, "boo", tokenConfig.Claims["foo"])
+	assert.Equal(t, "baz", tokenConfig.Claims["bar"])
+	assert.Equal(t, len(tokenConfig.Claims), 2)
+
+	// Give it something with multiple of the same claim key
+	claims = []string{"foo=boo", "foo=baz"}
+	tokenConfig, err = parseClaimsToTokenConfig(claims)
+	assert.NoError(t, err)
+	assert.Equal(t, "boo baz", tokenConfig.Claims["foo"])
+	assert.Equal(t, 1, len(tokenConfig.Claims))
+
+	// Give it something without = delimiter
+	claims = []string{"foo=boo", "barbaz"}
+	_, err = parseClaimsToTokenConfig(claims)
+	assert.EqualError(t, err, "The claim 'barbaz' is invalid. Did you forget an '='?")
+}
+
+func TestParseInputSlice(t *testing.T) {
+	// A quick test, just to make sure this gets what it needs to
+	rawSlice := []string{"https://my-issuer.com"}
+	parsedSlice := parseInputSlice(&rawSlice, "iss")
+	assert.Equal(t, []string{"iss=https://my-issuer.com"}, parsedSlice)
+}
diff --git a/cmd/plugin.go b/cmd/plugin.go
index 2a90181df..d2c606389 100644
--- a/cmd/plugin.go
+++ b/cmd/plugin.go
@@ -20,15 +20,19 @@ package main
 
 import (
 	"bufio"
-	"errors"
 	"fmt"
+	"io/fs"
+	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
+	"syscall"
 	"time"
 
-	"github.com/pelicanplatform/pelican"
 	"github.com/pelicanplatform/pelican/classads"
+	"github.com/pelicanplatform/pelican/client"
 	"github.com/pelicanplatform/pelican/config"
+	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -66,6 +70,7 @@ func init() {
 }
 
 func stashPluginMain(args []string) {
+	config.InitConfig()
 	err := config.InitClient()
 	if err != nil {
 		log.Errorln(err)
@@ -75,10 +80,10 @@ func stashPluginMain(args []string) {
 	// Parse command line arguments
 	var upload bool = false
 	// Set the options
-	pelican.ObjectClientOptions.Recursive = false
-	pelican.ObjectClientOptions.ProgressBars = false
-	pelican.ObjectClientOptions.Version = version
-	setLogging(log.PanicLevel)
+	client.ObjectClientOptions.Recursive = false
+	client.ObjectClientOptions.ProgressBars = false
+	client.ObjectClientOptions.Version = version
+	client.ObjectClientOptions.Plugin = true
 	methods := []string{"http"}
 	var infile, outfile, testCachePath string
 	var useOutFile bool = false
@@ -113,7 +118,7 @@ func stashPluginMain(args []string) {
 			useOutFile = true
 			log.Debugln("Outfile:", outfile)
 		} else if args[0] == "-d" {
-			setLogging(log.DebugLevel)
+			config.SetLogging(log.DebugLevel)
 		} else if args[0] == "-get-caches" {
 			if len(args) < 2 {
 				log.Errorln("-get-caches requires an argument")
@@ -134,12 +139,13 @@ func stashPluginMain(args []string) {
 	}
 
 	if getCaches {
-		urls, err := pelican.GetCacheHostnames(testCachePath)
+		urls, err := client.GetCacheHostnames(testCachePath)
 		if err != nil {
-			log.Panicln("Failed to get cache URLs:", err)
+			log.Errorln("Failed to get cache URLs:", err)
+			os.Exit(1)
 		}
 
-		cachesToTry := pelican.CachesToTry
+		cachesToTry := client.CachesToTry
 		if cachesToTry > len(urls) {
 			cachesToTry = len(urls)
 		}
@@ -165,7 +171,8 @@ func stashPluginMain(args []string) {
 		// Open the input and output files
 		infileFile, err := os.Open(infile)
 		if err != nil {
-			log.Panicln("Failed to open infile:", err)
+			log.Errorln("Failed to open infile:", err)
+			os.Exit(1)
 		}
 		defer infileFile.Close()
 		// Read in classad from stdin
@@ -182,6 +189,26 @@ func stashPluginMain(args []string) {
 		}
 	}
 
+	// NOTE: HTCondor 23.3.0 and before would reuse the outfile names for multiple
+	// transfers, meaning the results of prior plugin invocations would be present
+	// by default in the outfile.  Combined with a bug that considered any exit code
+	// besides `1` a success (note: a go panic is exit code `2`), this caused the starter
+	// to incorrectly interpret plugin failures as successes, potentially leaving the user
+	// with missing or truncated output files.
+	//
+	// By moving the truncation of the output file to a very early codepath, we reduce
+	// the chances of hitting this problem.
+	outputFile := os.Stdout
+	if useOutFile {
+		var err error
+		outputFile, err = os.Create(outfile)
+		if err != nil {
+			log.Errorln("Failed to open outfile:", err)
+			os.Exit(1)
+		}
+		defer outputFile.Close()
+	}
+
 	var resultAds []*classads.ClassAd
 	retryable := false
 	for _, transfer := range transfers {
@@ -190,11 +217,23 @@ func stashPluginMain(args []string) {
 		if upload {
 			source = append(source, transfer.localFile)
 			log.Debugln("Uploading:", transfer.localFile, "to", transfer.url)
-			tmpDownloaded, result = pelican.DoStashCPSingle(transfer.localFile, transfer.url, methods, false)
+			tmpDownloaded, result = client.DoStashCPSingle(transfer.localFile, transfer.url, methods, false)
 		} else {
 			source = append(source, transfer.url)
 			log.Debugln("Downloading:", transfer.url, "to", transfer.localFile)
-			tmpDownloaded, result = pelican.DoStashCPSingle(transfer.url, transfer.localFile, methods, false)
+
+			// When we want to auto-unpack files, we should do this to the containing directory, not the destination
+			// file which HTCondor prepares
+			url, err := url.Parse(transfer.url)
+			if err != nil {
+				result = errors.Wrap(err, "Unable to parse transfer source as a URL")
+			} else {
+				localFile := transfer.localFile
+				if url.Query().Get("pack") != "" {
+					localFile = filepath.Dir(localFile)
+				}
+				tmpDownloaded, result = client.DoStashCPSingle(transfer.url, localFile, methods, false)
+			}
 		}
 		startTime := time.Now().Unix()
 		resultAd := classads.NewClassAd()
@@ -216,7 +255,7 @@ func stashPluginMain(args []string) {
 			resultAd.Set("TransferTotalBytes", tmpDownloaded)
 		} else {
 			resultAd.Set("TransferSuccess", false)
-			if pelican.GetErrors() == "" {
+			if client.GetErrors() == "" {
 				resultAd.Set("TransferError", result.Error())
 			} else {
 				errMsg := " Failure "
@@ -225,13 +264,13 @@ func stashPluginMain(args []string) {
 				} else {
 					errMsg += "downloading "
 				}
-				errMsg += transfer.url + ": " + pelican.GetErrors()
+				errMsg += transfer.url + ": " + client.GetErrors()
 				resultAd.Set("TransferError", errMsg)
-				pelican.ClearErrors()
+				client.ClearErrors()
 			}
 			resultAd.Set("TransferFileBytes", 0)
 			resultAd.Set("TransferTotalBytes", 0)
-			if pelican.ErrorsRetryable() {
+			if client.ErrorsRetryable() {
 				resultAd.Set("TransferRetryable", true)
 				retryable = true
 			} else {
@@ -244,21 +283,12 @@ func stashPluginMain(args []string) {
 
 	}
 
-	outputFile := os.Stdout
-	if useOutFile {
-		var err error
-		outputFile, err = os.Create(outfile)
-		if err != nil {
-			log.Panicln("Failed to open outfile:", err)
-		}
-		defer outputFile.Close()
-	}
-
 	success := true
 	for _, resultAd := range resultAds {
 		_, err := outputFile.WriteString(resultAd.String() + "\n")
 		if err != nil {
-			log.Panicln("Failed to write to outfile:", err)
+			log.Errorln("Failed to write to outfile:", err)
+			os.Exit(1)
 		}
 		transferSuccess, err := resultAd.Get("TransferSuccess")
 		if err != nil {
@@ -267,6 +297,23 @@ func stashPluginMain(args []string) {
 		}
 		success = success && transferSuccess.(bool)
 	}
+	if err = outputFile.Sync(); err != nil {
+		var perr *fs.PathError
+		var serr syscall.Errno
+		// Error code 1 (serr) is ERROR_INVALID_FUNCTION, the expected Windows syscall error
+		// Error code EINVAL is returned on Linux
+		// Error code ENODEV is returned on Mac OS X
+		if errors.As(err, &perr) && errors.As(perr.Unwrap(), &serr) && (int(serr) == 1 || serr == syscall.EINVAL || serr == syscall.ENODEV) {
+			log.Debugf("Error when syncing: %s; can be ignored\n", perr)
+		} else {
+			if errors.As(err, &perr) && errors.As(perr.Unwrap(), &serr) {
+				log.Errorf("Failed to sync output file: %s (errno %d)", serr, int(serr))
+			} else {
+				log.Errorln("Failed to sync output file:", err)
+			}
+			os.Exit(1)
+		}
+	}
 
 	if success {
 		os.Exit(0)
diff --git a/cmd/plugin_stage.go b/cmd/plugin_stage.go
index 49b488951..1fdd4b970 100644
--- a/cmd/plugin_stage.go
+++ b/cmd/plugin_stage.go
@@ -26,8 +26,9 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/pelicanplatform/pelican"
 	"github.com/pelicanplatform/pelican/classads"
+	"github.com/pelicanplatform/pelican/client"
+	"github.com/pelicanplatform/pelican/param"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -41,7 +42,7 @@ func init() {
 		Run:   stagePluginMain,
 	}
 	stageCmd.Flags().StringP("token", "t", "", "Token file to use for reading and/or writing")
-	if err := viper.BindPFlag("StagePlugin.Token", stageCmd.Flags().Lookup("token")); err != nil {
+	if err := viper.BindPFlag("Plugin.Token", stageCmd.Flags().Lookup("token")); err != nil {
 		panic(err)
 	}
 	stageCmd.Flags().Bool("hook", false, "Implement the HTCondor hook behavior")
@@ -49,7 +50,7 @@ func init() {
 		panic(err)
 	}
 	stageCmd.Flags().StringP("mount", "m", "", "Prefix corresponding to the local mount point of the origin")
-	if err := viper.BindPFlag("StagePlugin.LocalMount", stageCmd.Flags().Lookup("mount")); err != nil {
+	if err := viper.BindPFlag("StagePlugin.MountPrefix", stageCmd.Flags().Lookup("mount")); err != nil {
 		panic(err)
 	}
 	stageCmd.Flags().StringP("origin-prefix", "o", "", "Prefix corresponding to the local origin")
@@ -57,7 +58,7 @@ func init() {
 		panic(err)
 	}
 	stageCmd.Flags().StringP("shadow-prefix", "s", "", "Prefix corresponding to the shadow origin")
-	if err := viper.BindPFlag("StagePlugin.ShadowPrefix", stageCmd.Flags().Lookup("shadow-prefix")); err != nil {
+	if err := viper.BindPFlag("StagePlugin.ShadowOriginPrefix", stageCmd.Flags().Lookup("shadow-prefix")); err != nil {
 		panic(err)
 	}
 
@@ -85,7 +86,7 @@ Terminology:
 
 func stagePluginMain(cmd *cobra.Command, args []string) {
 
-	originPrefixStr := viper.GetString("StagePlugin.OriginPrefix")
+	originPrefixStr := param.StagePlugin_OriginPrefix.GetString()
 	if len(originPrefixStr) == 0 {
 		log.Errorln("Origin prefix not specified; must be a URL (osdf://...)")
 		os.Exit(1)
@@ -102,32 +103,33 @@ func stagePluginMain(cmd *cobra.Command, args []string) {
 	originPrefixPath := path.Clean("/" + originPrefixUri.Host + "/" + originPrefixUri.Path)
 	log.Debugln("Local origin prefix:", originPrefixPath)
 
-	mountPrefixStr := viper.GetString("StagePlugin.MountPrefix")
+	mountPrefixStr := param.StagePlugin_MountPrefix.GetString()
 	if len(mountPrefixStr) == 0 {
 		log.Errorln("Mount prefix is required; must be a local path (/mnt/foo/...)")
 		os.Exit(1)
 	}
 
-	shadowOriginPrefixStr := viper.GetString("StagePlugin.ShadowOriginPrefix")
+	shadowOriginPrefixStr := param.StagePlugin_ShadowOriginPrefix.GetString()
 	if len(shadowOriginPrefixStr) == 0 {
 		log.Errorln("Shadow origin prefix is required; must be a URL (osdf://....)")
 		os.Exit(1)
 	}
 
 	// Set the progress bars to the command line option
-	pelican.ObjectClientOptions.Token = viper.GetString("StagePlugin.Token")
+	client.ObjectClientOptions.Token = param.Plugin_Token.GetString()
+	client.ObjectClientOptions.Plugin = true
 
 	// Check if the program was executed from a terminal
 	// https://rosettacode.org/wiki/Check_output_device_is_a_terminal#Go
 	if fileInfo, _ := os.Stdout.Stat(); (fileInfo.Mode() & os.ModeCharDevice) != 0 {
-		pelican.ObjectClientOptions.ProgressBars = true
+		client.ObjectClientOptions.ProgressBars = true
 	} else {
-		pelican.ObjectClientOptions.ProgressBars = false
+		client.ObjectClientOptions.ProgressBars = false
 	}
 
 	var sources []string
 	var extraSources []string
-	isHook := viper.GetBool("StagePlugin.Hook")
+	isHook := param.StagePlugin_Hook.GetBool()
 	if isHook {
 		buffer := make([]byte, 100*1024)
 		bytesread, err := os.Stdin.Read(buffer)
@@ -185,7 +187,7 @@ func stagePluginMain(cmd *cobra.Command, args []string) {
 	var result error
 	var xformSources []string
 	for _, src := range sources {
-		_, newSource, result := pelican.DoShadowIngest(src, mountPrefixStr, shadowOriginPrefixStr)
+		_, newSource, result := client.DoShadowIngest(src, mountPrefixStr, shadowOriginPrefixStr)
 		if result != nil {
 			// What's the correct behavior on failure?  For now, we silently put the transfer
 			// back on the original list.  This is arguably the wrong approach as it might
@@ -202,8 +204,8 @@ func stagePluginMain(cmd *cobra.Command, args []string) {
 	// Exit with failure
 	if result != nil {
 		// Print the list of errors
-		log.Errorln(pelican.GetErrors())
-		if pelican.ErrorsRetryable() {
+		log.Errorln(client.GetErrors())
+		if client.ErrorsRetryable() {
 			log.Errorln("Errors are retryable")
 			os.Exit(11)
 		}
diff --git a/cmd/plugin_test.go b/cmd/plugin_test.go
index ae0806ed2..55f74befb 100644
--- a/cmd/plugin_test.go
+++ b/cmd/plugin_test.go
@@ -20,9 +20,15 @@ package main
 
 import (
 	"bufio"
+	"bytes"
+	"os"
+	"os/exec"
 	"strings"
 	"testing"
 
+	"github.com/pelicanplatform/pelican/config"
+
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -50,3 +56,39 @@ func TestReadMultiTransfer(t *testing.T) {
 	assert.Equal(t, "url://server/some/directory//blah", transfers[0].url)
 	assert.Equal(t, "/path/to/local/copy/of/blah", transfers[0].localFile)
 }
+
+func TestStashPluginMain(t *testing.T) {
+	viper.Reset()
+	config.SetPreferredPrefix("STASH")
+
+	// Temp dir for downloads
+	tempDir := os.TempDir()
+	defer os.Remove(tempDir)
+
+	// Parts of test adapted from: https://stackoverflow.com/questions/26225513/how-to-test-os-exit-scenarios-in-go
+	if os.Getenv("RUN_STASHPLUGIN") == "1" {
+		// Download a test file
+		args := []string{"pelican://pelican.example.com/osgconnect/public/osg/testfile.txt", tempDir}
+		stashPluginMain(args)
+		os.Unsetenv("STASH_LOGGING_LEVEL")
+		os.Unsetenv("RUN_STASHPLUGIN")
+		return
+	}
+
+	// Create a process to run the command (since stashPluginMain calls os.Exit(0))
+	cmd := exec.Command(os.Args[0], "-test.run=TestStashPluginMain")
+	cmd.Env = append(os.Environ(), "RUN_STASHPLUGIN=1", "STASH_LOGGING_LEVEL=debug")
+
+	// Create buffers for stderr (the output we want for test)
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	assert.Error(t, err, stderr.String())
+
+	// changing output for "\\" since in windows there are excess "\" printed in debug logs
+	output := strings.Replace(stderr.String(), "\\\\", "\\", -1)
+
+	expectedOutput := "Downloading: pelican://pelican.example.com/osgconnect/public/osg/testfile.txt to " + tempDir
+	assert.Contains(t, output, expectedOutput)
+}
diff --git a/cmd/namespace_registry.go b/cmd/registry.go
similarity index 79%
rename from cmd/namespace_registry.go
rename to cmd/registry.go
index 169906d53..1665600ae 100644
--- a/cmd/namespace_registry.go
+++ b/cmd/registry.go
@@ -23,20 +23,20 @@ import (
 )
 
 var (
-	namespaceRegistryCmd = &cobra.Command{
+	registryCmd = &cobra.Command{
 		Use:   "registry",
-		Short: "Interact with a Pelican namespace registry service",
-		Long: `Interact with a Pelican namespace registry service:
-		
+		Short: "Interact with a Pelican registry service",
+		Long: `Interact with a Pelican registry service:
+
 		The namespace registry lies at the core of Pelican's security model
 		by serving as the central point for clients to fetch the public keys
 		associated with namespaced resources. When origins wish to claim a
 		namespace prefix in their federation, they securely  associate the
 		public key of their issuer with the namespace registry (many origins
-		may act as their own issuer). Sometimes origins will provide 
-		additional OIDC metadata if the origins wish to be accessible to the 
+		may act as their own issuer). Sometimes origins will provide
+		additional OIDC metadata if the origins wish to be accessible to the
 		OSDF's caching infrastructure. Services wishing to validate the
-		authenticity of a token from an issuer can then reference the 
+		authenticity of a token from an issuer can then reference the
 		namespace registry's listed public key for that origin and verify
 		that it was signed by the correct private key.
 		`,
@@ -44,15 +44,15 @@ var (
 
 	registryServeCmd = &cobra.Command{
 		Use:          "serve",
-		Short:        "serve the namespace registry",
-		RunE:         serveNamespaceRegistry,
+		Short:        "serve the registry",
+		RunE:         serveRegistry,
 		SilenceUsage: true,
 	}
 )
 
 func init() {
 	// Tie the registryServe command to the root CLI command
-	namespaceRegistryCmd.AddCommand(registryServeCmd)
+	registryCmd.AddCommand(registryServeCmd)
 	// Set up flags for the command
 	registryServeCmd.Flags().AddFlag(portFlag)
 }
diff --git a/cmd/namespace_client.go b/cmd/registry_client.go
similarity index 66%
rename from cmd/namespace_client.go
rename to cmd/registry_client.go
index f2622731b..f26831812 100644
--- a/cmd/namespace_client.go
+++ b/cmd/registry_client.go
@@ -16,14 +16,25 @@
  *
  ***************************************************************/
 
+// The registry_client contains commands in Pelican CLI to register a namespace.
+//
+// You can access it through `./pelican namespace <command>`.
+//
+// Note that you need to have your registry server running either locally,
+// or by setting Federation.RegistryUrl to the Url of your remote Pelican registry server
+//
+// Example: `./pelican namespace register --prefix /test`
+
 package main
 
 import (
 	"net/url"
 	"os"
 
+	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/pelicanplatform/pelican/config"
-	"github.com/pelicanplatform/pelican/namespace-registry"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/registry"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -35,17 +46,16 @@ import (
 var withIdentity bool
 var prefix string
 var pubkeyPath string
-var privkeyPath string
 
 func getNamespaceEndpoint() (string, error) {
-	namespaceEndpoint := viper.GetString("NamespaceURL")
+	namespaceEndpoint := param.Federation_RegistryUrl.GetString()
 	if namespaceEndpoint == "" {
 		return "", errors.New("No namespace registry specified; either give the federation name (-f) or specify the namespace API endpoint directly (e.g., --namespace-url=https://namespace.osg-htc.org/namespaces)")
 	}
 
 	namespaceEndpointURL, err := url.Parse(namespaceEndpoint)
 	if err != nil {
-		return "", errors.Wrap(err, "Unable to parse namespace url")
+		return "", errors.Wrap(err, "Unable to parse namespace registry url")
 	}
 
 	// Return the string, as opposed to a pointer to the URL object
@@ -59,18 +69,9 @@ func registerANamespace(cmd *cobra.Command, args []string) {
 		os.Exit(1)
 	}
 
-	privkey := privkeyPath
-	if privkey == "" {
-		privkey = viper.GetString("IssuerKey")
-	}
-	if privkey == "" {
-		log.Error("Private key file is not set; specify its location with the --privkey option or by setting the IssuerKey configuration variable")
-		os.Exit(1)
-	}
-
 	namespaceEndpoint, err := getNamespaceEndpoint()
 	if err != nil {
-		log.Errorln("Failed to get NamespaceURL from config: ", err)
+		log.Errorln("Failed to get RegistryUrl from config: ", err)
 		os.Exit(1)
 	}
 
@@ -79,20 +80,48 @@ func registerANamespace(cmd *cobra.Command, args []string) {
 	if err != nil {
 		log.Errorf("Failed to construction registration endpoint URL: %v", err)
 	}
-	// registrationEndpoint := url.JoinPath(namespaceEndpoint, "/api/v1.0/registry/register").String()
 	if prefix == "" {
 		log.Error("Error: prefix is required")
 		os.Exit(1)
 	}
 
+	publicKey, err := config.GetIssuerPublicJWKS()
+	if err != nil {
+		log.Error("Error: Failed to retrieve public key: ", err)
+		os.Exit(1)
+	}
+
+	/*
+	 * TODO: For now, we only allow namespace registration to occur with a single key, but
+	 *       at some point we should expose an API for adding additional pubkeys to each
+	 *       namespace. There is a similar TODO listed in registry.go, as the choices made
+	 *       there mirror the choices made here.
+	 * To enforce that we're only trying to register one key, we check the length here
+	 */
+	if publicKey.Len() > 1 {
+		log.Errorf("Only one public key can be registered in this step, but %d were provided\n", publicKey.Len())
+		os.Exit(1)
+	}
+
+	privateKeyRaw, err := config.LoadPrivateKey(param.IssuerKey.GetString())
+	if err != nil {
+		log.Error("Failed to load private key", err)
+		os.Exit(1)
+	}
+	privateKey, err := jwk.FromRaw(privateKeyRaw)
+	if err != nil {
+		log.Error("Failed to create JWK private key", err)
+		os.Exit(1)
+	}
+
 	if withIdentity {
-		err := nsregistry.NamespaceRegisterWithIdentity(privkey, registrationEndpointURL, prefix)
+		err := registry.NamespaceRegisterWithIdentity(privateKey, registrationEndpointURL, prefix)
 		if err != nil {
 			log.Errorf("Failed to register prefix %s with identity: %v", prefix, err)
 			os.Exit(1)
 		}
 	} else {
-		err := nsregistry.NamespaceRegister(privkey, registrationEndpointURL, "", prefix)
+		err := registry.NamespaceRegister(privateKey, registrationEndpointURL, "", prefix)
 		if err != nil {
 			log.Errorf("Failed to register prefix %s: %v", prefix, err)
 			os.Exit(1)
@@ -109,7 +138,7 @@ func deleteANamespace(cmd *cobra.Command, args []string) {
 
 	namespaceEndpoint, err := getNamespaceEndpoint()
 	if err != nil {
-		log.Errorln("Failed to get NamespaceURL from config: ", err)
+		log.Errorln("Failed to get RegistryUrl from config: ", err)
 		os.Exit(1)
 	}
 
@@ -118,7 +147,7 @@ func deleteANamespace(cmd *cobra.Command, args []string) {
 		log.Errorf("Failed to construction deletion endpoint URL: %v", err)
 	}
 
-	err = nsregistry.NamespaceDelete(deletionEndpointURL, prefix)
+	err = registry.NamespaceDelete(deletionEndpointURL, prefix)
 	if err != nil {
 		log.Errorf("Failed to delete prefix %s: %v", prefix, err)
 		os.Exit(1)
@@ -134,7 +163,7 @@ func listAllNamespaces(cmd *cobra.Command, args []string) {
 
 	namespaceEndpoint, err := getNamespaceEndpoint()
 	if err != nil {
-		log.Errorln("Failed to get NamespaceURL from config: ", err)
+		log.Errorln("Failed to get RegistryUrl from config: ", err)
 		os.Exit(1)
 	}
 
@@ -143,7 +172,7 @@ func listAllNamespaces(cmd *cobra.Command, args []string) {
 		log.Errorf("Failed to construction list endpoint URL: %v", err)
 	}
 
-	err = nsregistry.NamespaceList(listEndpoint)
+	err = registry.NamespaceList(listEndpoint)
 	if err != nil {
 		log.Errorf("Failed to list namespace information: %v", err)
 		os.Exit(1)
@@ -162,12 +191,12 @@ func listAllNamespaces(cmd *cobra.Command, args []string) {
 // 	if jwks {
 // 		namespaceEndpoint, err := getNamespaceEndpoint()
 // 		if err != nil {
-// 			log.Errorln("Failed to get NamespaceURL from config:", err)
+// 			log.Errorln("Failed to get RegistryUrl from config:", err)
 // 			os.Exit(1)
 // 		}
 
 // 		endpoint := url.JoinPath(namespaceEndpoint, prefix, "issuer.jwks")
-// 		err = nsregistry.NamespaceGet(endpoint)
+// 		err = registry.NamespaceGet(endpoint)
 // 		if err != nil {
 // 			log.Errorf("Failed to get jwks info for prefix %s: %v", prefix, err)
 // 			os.Exit(1)
@@ -216,13 +245,22 @@ func init() {
 	deleteCmd.Flags().StringVar(&prefix, "prefix", "", "prefix for delete namespace")
 
 	namespaceCmd.PersistentFlags().String("namespace-url", "", "Endpoint for the namespace registry")
-	err := viper.BindPFlag("NamespaceURL", namespaceCmd.PersistentFlags().Lookup("namespace-url"))
-	if err != nil {
-		panic(err)
+	// Don't override Federation.RegistryUrl if the flag value is empty
+	if namespaceCmd.PersistentFlags().Lookup("namespace-url").Value.String() != "" {
+		if err := viper.BindPFlag("Federation.RegistryUrl", namespaceCmd.PersistentFlags().Lookup("namespace-url")); err != nil {
+			panic(err)
+		}
 	}
 
 	namespaceCmd.PersistentFlags().StringVar(&pubkeyPath, "pubkey", "", "Path to the public key")
-	namespaceCmd.PersistentFlags().StringVar(&privkeyPath, "privkey", "", "Path to the private key")
+	namespaceCmd.PersistentFlags().String("privkey", "", "Path to the private key")
+	// Don't override IssuerKey if the flag value is empty
+	if namespaceCmd.PersistentFlags().Lookup("privkey").Value.String() != "" {
+		if err := viper.BindPFlag("IssuerKey", namespaceCmd.PersistentFlags().Lookup("privkey")); err != nil {
+			panic(err)
+		}
+	}
+
 	namespaceCmd.AddCommand(registerCmd)
 	namespaceCmd.AddCommand(deleteCmd)
 	namespaceCmd.AddCommand(listCmd)
diff --git a/cmd/registry_serve.go b/cmd/registry_serve.go
new file mode 100644
index 000000000..acfd459c0
--- /dev/null
+++ b/cmd/registry_serve.go
@@ -0,0 +1,35 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package main
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/launchers"
+)
+
+func serveRegistry(cmd *cobra.Command, _ []string) error {
+	cancel, err := launchers.LaunchModules(cmd.Context(), config.RegistryType)
+	if err != nil {
+		cancel()
+	}
+
+	return err
+}
diff --git a/cmd/resources/xrootd.cfg b/cmd/resources/xrootd.cfg
deleted file mode 100644
index eaeee49d1..000000000
--- a/cmd/resources/xrootd.cfg
+++ /dev/null
@@ -1,62 +0,0 @@
-#
-# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
-# Licensed under the Apache License, Version 2.0 (the "License"); you
-# may not use this file except in compliance with the License.  You may
-# obtain a copy of the License at
-# 
-#    http://www.apache.org/licenses/LICENSE-2.0
-# 
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-all.manager {{.ManagerHost}}+ {{.ManagerPort}}
-all.role server
-if exec xrootd
-  xrd.port {{.Port}}
-  xrd.protocol http:{{.Port}} libXrdHttp.so
-fi
-xrd.tls {{.TLSCertificate}} {{.TLSKey}}
-{{if .TLSCertDir}}
-xrd.tlsca certdir {{.TLSCertDir}}
-{{else}}
-xrd.tlsca certfile {{.TLSCertFile}}
-{{end}}
-http.exthandler xrdmacaroons libXrdMacaroons.so 
-macaroons.secretkey {{.MacaroonsKeyFile}}
-ofs.authlib ++ libXrdMacaroons.so 
-http.header2cgi Authorization authz 
-http.secxtractor /usr/lib64/libXrdVoms.so 
-http.staticpreload http://static/robots.txt {{.RobotsTxtFile}}
-{{if .Sitename}}
-all.sitename {{.Sitename}}
-{{end}}
-{{if .SummaryMonitoringHost}}
-xrd.report {{.SummaryMonitoringHost}}:{{.SummaryMonitoringPort}},127.0.0.1:{{.LocalMonitoringPort}} every 30s
-{{end}}
-{{if .DetailedMonitoringHost}}
-xrootd.monitor all auth flush 30s window 5s fstat 60 lfn ops xfr 5 dest redir fstat info files user pfc tcpmon ccm {{.DetailedMonitoringHost}}:{{.DetailedMonitoringPort}} dest redir fstat info files user pfc tcpmon ccm 127.0.0.1:{{.LocalMonitoringPort}}
-{{end}}
-all.adminpath {{.XrootdRun}}
-all.pidpath {{.XrootdRun}}
-oss.localroot {{.Mount}}
-xrootd.seclib libXrdSec.so 
-sec.protocol ztn
-ofs.authorize 1 
-acc.audit deny grant
-acc.authdb {{.Authfile}}
-ofs.authlib ++ libXrdAccSciTokens.so config={{.ScitokensConfig}}
-all.export {{.NamespacePrefix}}
-{{if .Origin.Multiuser}}
-ofs.osslib libXrdMultiuser.so default 
-ofs.ckslib * libXrdMultiuser.so 
-{{end}}
-xrootd.chksum max 2 md5 adler32 crc32 
-xrootd.trace emsg login stall redirect 
-pfc.trace info 
-pss.setopt DebugLevel 1 
-xrootd.tls all 
diff --git a/cmd/root.go b/cmd/root.go
index cfea79728..51e418dbb 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -19,8 +19,7 @@
 package main
 
 import (
-	"os"
-	"path/filepath"
+	"context"
 	"strconv"
 	"strings"
 
@@ -29,6 +28,7 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
 )
 
 type uint16Value uint16
@@ -45,7 +45,7 @@ with data federations, enabling the sharing of objects and collections
 across multiple dataset providers.`,
 	}
 
-	// We want the value of this port flag to correspond to the WebPort viper key.
+	// We want the value of this port flag to correspond to the Port viper key.
 	// However, only one flag pointer can correspond to the key.  If we define this
 	// in `pelican registry serve` and `pelican director serve`, then whatever init()
 	// function is run second will be the only one that is set (the first definition
@@ -77,25 +77,34 @@ func (i *uint16Value) Type() string {
 
 func (i *uint16Value) String() string { return strconv.FormatUint(uint64(*i), 10) }
 
-func Execute() {
-	err := rootCmd.Execute()
-	if err != nil {
-		os.Exit(1)
-	}
+func Execute() error {
+	egrp, egrpCtx := errgroup.WithContext(context.Background())
+	defer func() {
+		err := egrp.Wait()
+		if err != nil {
+			log.Errorln("Fatal error occurred that lead to the shutdown of the process:", err)
+		} else {
+			// Use Error instead of Info because our default log level is Error
+			log.Error("Pelican is safely exited")
+		}
+	}()
+	ctx := context.WithValue(egrpCtx, config.EgrpKey, egrp)
+	return rootCmd.ExecuteContext(ctx)
 }
 
 func init() {
-
-	cobra.OnInitialize(initConfig)
-
+	config.PelicanVersion = version
+	cobra.OnInitialize(config.InitConfig)
 	rootCmd.AddCommand(objectCmd)
 	objectCmd.CompletionOptions.DisableDefaultCmd = true
 	rootCmd.AddCommand(directorCmd)
-	rootCmd.AddCommand(namespaceRegistryCmd)
+	rootCmd.AddCommand(registryCmd)
 	rootCmd.AddCommand(originCmd)
+	rootCmd.AddCommand(cacheCmd)
 	rootCmd.AddCommand(namespaceCmd)
 	rootCmd.AddCommand(rootConfigCmd)
 	rootCmd.AddCommand(rootPluginCmd)
+	rootCmd.AddCommand(serveCmd)
 	preferredPrefix := config.GetPreferredPrefix()
 	rootCmd.Use = strings.ToLower(preferredPrefix)
 
@@ -104,45 +113,30 @@ func init() {
 	rootCmd.PersistentFlags().BoolP("debug", "d", false, "Enable debug logs")
 
 	rootCmd.PersistentFlags().StringP("federation", "f", "", "Pelican federation to utilize")
-	if err := viper.BindPFlag("FederationURL", rootCmd.PersistentFlags().Lookup("federation")); err != nil {
+	if err := viper.BindPFlag("Federation.DiscoveryUrl", rootCmd.PersistentFlags().Lookup("federation")); err != nil {
 		panic(err)
 	}
 
+	rootCmd.PersistentFlags().StringP("log", "l", "", "Specified log output file")
+	if err := viper.BindPFlag("Logging.LogLocation", rootCmd.PersistentFlags().Lookup("log")); err != nil {
+		panic(err)
+	}
+
+	// Register the version flag here just so --help will show this flag
+	// Actual checking is executed at main.go
+	// Remove the shorthand -v since in "origin serve" flagset it's already used for "volume" flag
+	rootCmd.PersistentFlags().BoolP("version", "", false, "Print the version and exit")
+
 	rootCmd.PersistentFlags().BoolVarP(&outputJSON, "json", "", false, "output results in JSON format")
 	rootCmd.CompletionOptions.DisableDefaultCmd = true
-}
 
-func initConfig() {
-	if cfgFile != "" {
-		viper.SetConfigFile(cfgFile)
-	} else {
-		home, err := os.UserHomeDir()
-		cobra.CheckErr(err)
-
-		viper.AddConfigPath(filepath.Join(home, ".config", "pelican"))
-		viper.AddConfigPath(filepath.Join("/etc", "pelican"))
-		viper.SetConfigType("yaml")
-		viper.SetConfigName("pelican")
+	if err := viper.BindPFlag("config", rootCmd.PersistentFlags().Lookup("config")); err != nil {
+		panic(err)
 	}
 	if err := viper.BindPFlag("Debug", rootCmd.PersistentFlags().Lookup("debug")); err != nil {
 		panic(err)
 	}
-	if err := viper.BindPFlag("WebPort", portFlag); err != nil {
+	if err := viper.BindPFlag("Server.WebPort", portFlag); err != nil {
 		panic(err)
 	}
-
-	viper.SetEnvPrefix(config.GetPreferredPrefix())
-	viper.AutomaticEnv()
-	// This line allows viper to use an env var like ORIGIN_VALUE to override the viper string "Origin.Value"
-	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
-	if err := viper.MergeInConfig(); err != nil {
-		if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
-			cobra.CheckErr(err)
-		}
-	}
-
-	setLogging(log.ErrorLevel)
-	if viper.GetBool("Debug") {
-		setLogging(log.DebugLevel)
-	}
 }
diff --git a/config/config.go b/config/config.go
index 35fbc850f..d5eec35fb 100644
--- a/config/config.go
+++ b/config/config.go
@@ -19,58 +19,91 @@
 package config
 
 import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
 	_ "embed"
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
-	"os/signal"
 	"path"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
+	"github.com/go-playground/validator/v10"
+	"github.com/pelicanplatform/pelican/param"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
 )
 
 // Structs holding the OAuth2 state (and any other OSDF config needed)
+type (
+	TokenEntry struct {
+		Expiration   int64  `yaml:"expiration"`
+		AccessToken  string `yaml:"access_token"`
+		RefreshToken string `yaml:"refresh_token,omitempty"`
+	}
 
-type TokenEntry struct {
-	Expiration   int64  `yaml:"expiration"`
-	AccessToken  string `yaml:"access_token"`
-	RefreshToken string `yaml:"refresh_token,omitempty"`
-}
+	PrefixEntry struct {
+		// OSDF namespace prefix
+		Prefix       string       `yaml:"prefix"`
+		ClientID     string       `yaml:"client_id"`
+		ClientSecret string       `yaml:"client_secret"`
+		Tokens       []TokenEntry `yaml:"tokens,omitempty"`
+	}
 
-type PrefixEntry struct {
-	// OSDF namespace prefix
-	Prefix       string       `yaml:"prefix"`
-	ClientID     string       `yaml:"client_id"`
-	ClientSecret string       `yaml:"client_secret"`
-	Tokens       []TokenEntry `yaml:"tokens,omitempty"`
-}
+	OSDFConfig struct {
 
-type OSDFConfig struct {
+		// Top-level OSDF object
+		OSDF struct {
+			// List of OAuth2 client configurations
+			OauthClient []PrefixEntry `yaml:"oauth_client,omitempty"`
+		} `yaml:"OSDF"`
+	}
 
-	// Top-level OSDF object
-	OSDF struct {
-		// List of OAuth2 client configurations
-		OauthClient []PrefixEntry `yaml:"oauth_client,omitempty"`
-	} `yaml:"OSDF"`
-}
+	FederationDiscovery struct {
+		DirectorEndpoint              string `json:"director_endpoint"`
+		NamespaceRegistrationEndpoint string `json:"namespace_registration_endpoint"`
+		JwksUri                       string `json:"jwks_uri"`
+	}
 
-type FederationDiscovery struct {
-	DirectorEndpoint              string `json:"director_endpoint"`
-	NamespaceRegistrationEndpoint string `json:"namespace_registration_endpoint"`
-	CollectorEndpoint             string `json:"collector_endpoint"`
-	JwksUri                       string `json:"jwks_uri"`
-}
+	TokenOperation int
+
+	TokenGenerationOpts struct {
+		Operation TokenOperation
+	}
+
+	ServerType int // ServerType is a bit mask indicating which Pelican server(s) are running in the current process
+
+	ContextKey string
+)
+
+const (
+	CacheType ServerType = 1 << iota
+	OriginType
+	DirectorType
+	RegistryType
+
+	EgrpKey ContextKey = "egrp"
+)
+
+const (
+	TokenWrite TokenOperation = iota
+	TokenRead
+	TokenSharedWrite
+	TokenSharedRead
+)
 
 var (
 	// Some of the unit tests probe behavior specific to OSDF vs Pelican.  Hence,
@@ -85,8 +118,136 @@ var (
 	// Potentially holds a directory to cleanup
 	tempRunDir  string
 	cleanupOnce sync.Once
+
+	// Our global transports that only will get reconfigured if needed
+	transport     *http.Transport
+	onceTransport sync.Once
+
+	// Global struct validator
+	validate *validator.Validate
+
+	// A variable indicating enabled Pelican servers in the current process
+	enabledServers ServerType
+	setServerOnce  sync.Once
+
+	// Pelican version
+	PelicanVersion string
 )
 
+func init() {
+	validate = validator.New(validator.WithRequiredStructEnabled())
+}
+
+// Set sets a list of newServers to ServerType instance
+func (sType *ServerType) SetList(newServers []ServerType) {
+	for _, server := range newServers {
+		*sType |= server
+	}
+}
+
+// Enable a single server type in the bitmask
+func (sType *ServerType) Set(server ServerType) ServerType {
+	*sType |= server
+	return *sType
+}
+
+// IsEnabled checks if a testServer is in the ServerType instance
+func (sType ServerType) IsEnabled(testServer ServerType) bool {
+	return sType&testServer == testServer
+}
+
+// Clear all values in a server type
+func (sType *ServerType) Clear() {
+	*sType = ServerType(0)
+}
+
+// setEnabledServer sets the global variable config.EnabledServers to include newServers.
+// Since this function should only be called in config package, we mark it "private" to avoid
+// reset value in other pacakge
+//
+// This will only be called once in a single process
+func setEnabledServer(newServers ServerType) {
+	setServerOnce.Do(func() {
+		// For each process, we only want to set enabled servers once
+		enabledServers.Set(newServers)
+	})
+}
+
+// IsServerEnabled checks if testServer is enabled in the current process.
+//
+// Use this function to check which server(s) are running in the current process.
+func IsServerEnabled(testServer ServerType) bool {
+	return enabledServers.IsEnabled(testServer)
+}
+
+// Get a string slice of currently enabled servers, sorted by alphabetical order.
+// By default, it calls String method of each enabled server.
+// To get strings in lowerCase, set lowerCase = true.
+func GetEnabledServerString(lowerCase bool) []string {
+	servers := make([]string, 0)
+	if enabledServers.IsEnabled(CacheType) {
+		servers = append(servers, CacheType.String())
+	}
+	if enabledServers.IsEnabled(OriginType) {
+		servers = append(servers, OriginType.String())
+	}
+	if enabledServers.IsEnabled(DirectorType) {
+		servers = append(servers, DirectorType.String())
+	}
+	if enabledServers.IsEnabled(RegistryType) {
+		servers = append(servers, RegistryType.String())
+	}
+	sort.Strings(servers)
+	if lowerCase {
+		for i, serverStr := range servers {
+			servers[i] = strings.ToLower(serverStr)
+		}
+		return servers
+	} else {
+		return servers
+	}
+}
+
+// Create a new, empty ServerType bitmask
+func NewServerType() ServerType {
+	return ServerType(0)
+}
+
+// Get the string representation of a ServerType instance. This is intended
+// for getting the string form of a single ServerType contant, such as CacheType
+// OriginType, etc. To get a string slice of enabled servers, use EnabledServerString()
+func (sType ServerType) String() string {
+	switch sType {
+	case CacheType:
+		return "Cache"
+	case OriginType:
+		return "Origin"
+	case DirectorType:
+		return "Director"
+	case RegistryType:
+		return "Registry"
+	}
+	return "Unknown"
+}
+
+func (sType *ServerType) SetString(name string) bool {
+	switch strings.ToLower(name) {
+	case "cache":
+		*sType |= CacheType
+		return true
+	case "origin":
+		*sType |= OriginType
+		return true
+	case "director":
+		*sType |= DirectorType
+		return true
+	case "registry":
+		*sType |= RegistryType
+		return true
+	}
+	return false
+}
+
 // Based on the name of the current binary, determine the preferred "style"
 // of behavior.  For example, a binary with the "osdf_" prefix should utilize
 // the known URLs for OSDF.  For "pelican"-style commands, the user will
@@ -132,15 +293,34 @@ func GetAllPrefixes() []string {
 }
 
 func DiscoverFederation() error {
-	federationStr := viper.GetString("FederationURL")
+	federationStr := param.Federation_DiscoveryUrl.GetString()
+	externalUrlStr := param.Server_ExternalWebUrl.GetString()
+	defer func() {
+		// Set default guesses if these values are still unset.
+		if param.Federation_DirectorUrl.GetString() == "" && enabledServers.IsEnabled(DirectorType) {
+			viper.Set("Federation.DirectorUrl", externalUrlStr)
+		}
+		if param.Federation_RegistryUrl.GetString() == "" && enabledServers.IsEnabled(RegistryType) {
+			viper.Set("Federation.RegistryUrl", externalUrlStr)
+		}
+		if param.Federation_JwkUrl.GetString() == "" && enabledServers.IsEnabled(DirectorType) {
+			viper.Set("Federation.JwkUrl", externalUrlStr+"/.well-known/issuer.jwks")
+		}
+	}()
 	if len(federationStr) == 0 {
 		log.Debugln("Federation URL is unset; skipping discovery")
 		return nil
 	}
+	if federationStr == externalUrlStr {
+		log.Debugln("Current web engine hosts the federation; skipping auto-discovery of services")
+		return nil
+	}
+
 	log.Debugln("Federation URL:", federationStr)
-	curDirectorURL := viper.GetString("DirectorURL")
-	curNamespaceURL := viper.GetString("DirectorURL")
-	if len(curDirectorURL) != 0 && len(curNamespaceURL) != 0 {
+	curDirectorURL := param.Federation_DirectorUrl.GetString()
+	curRegistryURL := param.Federation_RegistryUrl.GetString()
+	curFederationJwkURL := param.Federation_JwkUrl.GetString()
+	if len(curDirectorURL) != 0 && len(curRegistryURL) != 0 && len(curFederationJwkURL) != 0 {
 		return nil
 	}
 
@@ -156,10 +336,14 @@ func DiscoverFederation() error {
 	}
 
 	discoveryUrl, _ := url.Parse(federationUrl.String())
-	discoveryUrl.Path = path.Join(".well-known/pelican-configuration", federationUrl.Path)
+	discoveryUrl.Path, err = url.JoinPath(federationUrl.Path, ".well-known/pelican-configuration")
+	if err != nil {
+		return errors.Wrap(err, "Unable to parse federation url because of invalid path")
+	}
 
 	httpClient := http.Client{
-		Timeout: time.Second * 5,
+		Transport: GetTransport(),
+		Timeout:   time.Second * 5,
 	}
 	req, err := http.NewRequest(http.MethodGet, discoveryUrl.String(), nil)
 	if err != nil {
@@ -188,42 +372,49 @@ func DiscoverFederation() error {
 	}
 	if curDirectorURL == "" {
 		log.Debugln("Federation service discovery resulted in director URL", metadata.DirectorEndpoint)
-		viper.Set("DirectorURL", metadata.DirectorEndpoint)
+		viper.Set("Federation.DirectorUrl", metadata.DirectorEndpoint)
 	}
-	if curNamespaceURL == "" {
-		log.Debugln("Federation service discovery resulted in namespace registration URL",
+	if curRegistryURL == "" {
+		log.Debugln("Federation service discovery resulted in registry URL",
 			metadata.NamespaceRegistrationEndpoint)
-		viper.Set("NamespaceURL", metadata.NamespaceRegistrationEndpoint)
+		viper.Set("Federation.RegistryUrl", metadata.NamespaceRegistrationEndpoint)
+	}
+	if curFederationJwkURL == "" {
+		log.Debugln("Federation service discovery resulted in JWKS URL",
+			metadata.JwksUri)
+		viper.Set("Federation.JwkUrl", metadata.JwksUri)
 	}
 
 	return nil
 }
 
-func cleanupDirOnShutdown(dir string) {
-	sigs := make(chan os.Signal, 1)
+// TODO: It's not clear that this function works correctly.  We should
+// pass an errgroup here and ensure that the cleanup is complete before
+// the main thread shuts down.
+func cleanupDirOnShutdown(ctx context.Context, dir string) {
 	tempRunDir = dir
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
-	go func() {
-		<-sigs
-		CleanupTempResources()
-	}()
+	egrp, ok := ctx.Value(EgrpKey).(*errgroup.Group)
+	if !ok {
+		egrp = &errgroup.Group{}
+	}
+	egrp.Go(func() error {
+		<-ctx.Done()
+		err := CleanupTempResources()
+		if err != nil {
+			log.Infoln("Error when cleaning up temporary directories:", err)
+		}
+		return err
+	})
 }
 
-func CleanupTempResources() {
+func CleanupTempResources() (err error) {
 	cleanupOnce.Do(func() {
 		if tempRunDir != "" {
-			os.RemoveAll(tempRunDir)
+			err = os.RemoveAll(tempRunDir)
 			tempRunDir = ""
 		}
 	})
-}
-
-func ComputeExternalAddress() string {
-	config_url := viper.GetString("ExternalAddress")
-	if config_url != "" {
-		return config_url
-	}
-	return fmt.Sprintf("%v:%v", viper.GetString("Hostname"), viper.GetInt("WebPort"))
+	return
 }
 
 func getConfigBase() (string, error) {
@@ -235,63 +426,278 @@ func getConfigBase() (string, error) {
 	return filepath.Join(home, ".config", "pelican"), nil
 }
 
-func InitServer() error {
+func setupTransport() {
+	//Getting timeouts and other information from defaults.yaml
+	maxIdleConns := param.Transport_MaxIdleConns.GetInt()
+	idleConnTimeout := param.Transport_IdleConnTimeout.GetDuration()
+	transportTLSHandshakeTimeout := param.Transport_TLSHandshakeTimeout.GetDuration()
+	expectContinueTimeout := param.Transport_ExpectContinueTimeout.GetDuration()
+	responseHeaderTimeout := param.Transport_ResponseHeaderTimeout.GetDuration()
+
+	transportDialerTimeout := param.Transport_DialerTimeout.GetDuration()
+	transportKeepAlive := param.Transport_DialerKeepAlive.GetDuration()
+
+	//Set up the transport
+	transport = &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   transportDialerTimeout,
+			KeepAlive: transportKeepAlive,
+		}).DialContext,
+		MaxIdleConns:          maxIdleConns,
+		IdleConnTimeout:       idleConnTimeout,
+		TLSHandshakeTimeout:   transportTLSHandshakeTimeout,
+		ExpectContinueTimeout: expectContinueTimeout,
+		ResponseHeaderTimeout: responseHeaderTimeout,
+	}
+	if param.TLSSkipVerify.GetBool() {
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	if caCert, err := LoadCertficate(param.Server_TLSCACertificateFile.GetString()); err == nil {
+		systemPool, err := x509.SystemCertPool()
+		if err == nil {
+			systemPool.AddCert(caCert)
+			// Ensure that we don't override the InsecureSkipVerify if it's present
+			if transport.TLSClientConfig == nil {
+				transport.TLSClientConfig = &tls.Config{RootCAs: systemPool}
+			} else {
+				transport.TLSClientConfig.RootCAs = systemPool
+			}
+		}
+	}
+}
+
+func parseServerIssuerURL(sType ServerType) error {
+	if param.Server_IssuerUrl.GetString() != "" {
+		_, err := url.Parse(param.Server_IssuerUrl.GetString())
+		if err != nil {
+			return errors.Wrapf(err, "Failed to parse the Server.IssuerUrl %s loaded from config", param.Server_IssuerUrl.GetString())
+		}
+		return nil
+	}
+
+	if param.Server_IssuerHostname.GetString() != "" {
+		if param.Server_IssuerPort.GetInt() != 0 { // Will be the default if not set
+			// We assume any issuer is running https, otherwise we're crazy
+			issuerUrl := url.URL{
+				Scheme: "https",
+				Host:   fmt.Sprintf("%s:%d", param.Server_IssuerHostname.GetString(), param.Server_IssuerPort.GetInt()),
+			}
+			viper.Set("Server.IssuerUrl", issuerUrl.String())
+			return nil
+		}
+		return errors.New("If Server.IssuerHostname is configured, you must provide a valid port")
+	}
+
+	if sType.IsEnabled(OriginType) {
+		// If Origin.Mode is set to anything that isn't "posix" or "", assume we're running a plugin and
+		// that the origin's issuer URL actually uses the same port as OriginUI instead of XRootD. This is
+		// because under that condition, keys are being served by the Pelican process instead of by XRootD
+		originMode := param.Origin_Mode.GetString()
+		if originMode == "" || originMode == "posix" {
+			// In this case, we use the default set up by config.go, which uses the xrootd port
+			issuerUrl, err := url.Parse(param.Origin_Url.GetString())
+			if err != nil {
+				return errors.Wrap(err, "Failed to parse the issuer URL from the default origin URL")
+			}
+			viper.Set("Server.IssuerUrl", issuerUrl.String())
+			return nil
+		} else {
+			issuerUrl, err := url.Parse(param.Server_ExternalWebUrl.GetString())
+			if err != nil {
+				return errors.Wrap(err, "Failed to parse the issuer URL generated from Server.ExternalWebUrl")
+			}
+			viper.Set("Server.IssuerUrl", issuerUrl.String())
+			return nil
+		}
+	} else {
+		issuerUrlStr := param.Server_ExternalWebUrl.GetString()
+		issuerUrl, err := url.Parse(issuerUrlStr)
+		if err != nil {
+			return errors.Wrap(err, "Failed to parse the issuer URL generated using the parsed Server.ExternalWebUrl")
+		}
+		viper.Set("Server.IssuerUrl", issuerUrl.String())
+		return nil
+	}
+}
+
+// function to get/setup the transport (only once)
+func GetTransport() *http.Transport {
+	onceTransport.Do(func() {
+		setupTransport()
+	})
+	return transport
+}
+
+// Get singleton global validte method for field validation
+func GetValidate() *validator.Validate {
+	return validate
+}
+
+func InitConfig() {
 	viper.SetConfigType("yaml")
-	if IsRootExecution() {
-		viper.SetDefault("TLSCertificate", "/etc/pelican/certificates/tls.crt")
-		viper.SetDefault("TLSKey", "/etc/pelican/certificates/tls.key")
-		viper.SetDefault("XrootdRun", "/run/pelican/xrootd")
-		viper.SetDefault("RobotsTxtFile", "/etc/pelican/robots.txt")
-		viper.SetDefault("ScitokensConfig", "/etc/pelican/xrootd/scitokens.cfg")
-		viper.SetDefault("Authfile", "/etc/pelican/xrootd/authfile")
-		viper.SetDefault("MacaroonsKeyFile", "/etc/pelican/macaroons-secret")
-		viper.SetDefault("IssuerKey", "/etc/pelican/issuer.jwk")
-		viper.SetDefault("OriginUI.PasswordFile", "/etc/pelican/origin-ui-passwd")
-		viper.SetDefault("XrootdMultiuser", true)
-		viper.SetDefault("GeoIPLocation", "/var/cache/pelican/maxmind/GeoLite2-City.mmdb")
-		viper.SetDefault("NSRegistryLocation", "/var/lib/pelican/registry.sqlite")
-		viper.SetDefault("OIDC.ClientIDFile", "/etc/pelican/oidc-client-id")
-		viper.SetDefault("OIDC.ClientSecretFile", "/etc/pelican/oidc-client-secret")
-		viper.SetDefault("MonitoringData", "/var/lib/pelican/monitoring/data")
+	// 1) Set up defaults.yaml
+	err := viper.MergeConfig(strings.NewReader(defaultsYaml))
+	if err != nil {
+		cobra.CheckErr(err)
+	}
+	// 2) Set up osdf.yaml (if needed)
+	prefix := GetPreferredPrefix()
+	if prefix == "OSDF" {
+		err := viper.MergeConfig(strings.NewReader(osdfDefaultsYaml))
+		if err != nil {
+			cobra.CheckErr(err)
+		}
+	}
+	if configFile := viper.GetString("config"); configFile != "" {
+		viper.SetConfigFile(configFile)
 	} else {
-		configBase, err := getConfigBase()
+		home, err := os.UserHomeDir()
 		if err != nil {
-			return err
+			log.Warningln("No home directory found for user -- will check for configuration yaml in /etc/pelican/")
 		}
-		viper.SetDefault("TLSCertificate", filepath.Join(configBase, "certificates", "tls.crt"))
-		viper.SetDefault("TLSKey", filepath.Join(configBase, "certificates", "tls.key"))
-		viper.SetDefault("RobotsTxtFile", filepath.Join(configBase, "robots.txt"))
-		viper.SetDefault("ScitokensConfig", filepath.Join(configBase, "xrootd", "scitokens.cfg"))
-		viper.SetDefault("Authfile", filepath.Join(configBase, "xrootd", "authfile"))
-		viper.SetDefault("MacaroonsKeyFile", filepath.Join(configBase, "macaroons-secret"))
-		viper.SetDefault("IssuerKey", filepath.Join(configBase, "issuer.jwk"))
-		viper.SetDefault("OriginUI.PasswordFile", filepath.Join(configBase, "origin-ui-passwd"))
-		viper.SetDefault("GeoIPLocation", filepath.Join(configBase, "maxmind", "GeoLite2-City.mmdb"))
-		viper.SetDefault("NSRegistryLocation", filepath.Join(configBase, "ns-registry.sqlite"))
-		viper.SetDefault("OIDC.ClientIDFile", filepath.Join(configBase, "oidc-client-id"))
-		viper.SetDefault("OIDC.ClientSecretFile", filepath.Join(configBase, "oidc-client-secret"))
-		viper.SetDefault("MonitoringData", filepath.Join(configBase, "monitoring/data"))
+
+		// 3) Set up pelican.yaml (has higher precedence)
+		viper.AddConfigPath(filepath.Join(home, ".config", "pelican"))
+		viper.AddConfigPath(filepath.Join("/etc", "pelican"))
+		viper.SetConfigType("yaml")
+		viper.SetConfigName("pelican")
+	}
+
+	viper.SetEnvPrefix(prefix)
+	viper.AutomaticEnv()
+	// This line allows viper to use an env var like ORIGIN_VALUE to override the viper string "Origin.Value"
+	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	if err := viper.MergeInConfig(); err != nil {
+		if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
+			cobra.CheckErr(err)
+		}
+	}
+	if param.Debug.GetBool() {
+		SetLogging(log.DebugLevel)
+	} else {
+		logLevel := param.Logging_Level.GetString()
+		level, err := log.ParseLevel(logLevel)
+		cobra.CheckErr(err)
+		SetLogging(level)
+	}
+
+	logLocation := param.Logging_LogLocation.GetString()
+	if logLocation != "" {
+		dir := filepath.Dir(logLocation)
+		if dir != "" {
+			if err := os.MkdirAll(dir, 0644); err != nil {
+				log.Errorf("Failed to access/create specified directory. Error: %v", err)
+				os.Exit(1)
+			}
+		}
+		// Note: do not need to close the file, logrus does it for us
+		f, err := os.OpenFile(logLocation, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0644)
+		if err != nil {
+			log.Errorf("Failed to access specified log file. Error: %v", err)
+			os.Exit(1)
+		}
+		log.SetOutput(f)
+	}
+
+	if oldNsUrl := viper.GetString("Federation.NamespaceUrl"); oldNsUrl != "" {
+		log.Warningln("Federation.NamespaceUrl is deprecated and will be removed in future release. Please migrate to use Federation.RegistryUrl instead")
+		viper.SetDefault("Federation.RegistryUrl", oldNsUrl)
+	}
+}
+
+func initConfigDir() error {
+	configDir := viper.GetString("ConfigDir")
+	if configDir == "" {
+		if IsRootExecution() {
+			configDir = "/etc/pelican"
+		} else {
+			configTmp, err := getConfigBase()
+			if err != nil {
+				return err
+			}
+			configDir = configTmp
+		}
+		viper.SetDefault("ConfigDir", configDir)
+	}
+	return nil
+}
+
+// Initialize Pelican server instance. Pass a bit mask of `currentServers` if you want to enable multiple services.
+// Note not all configurations are supported: currently, if you enable both cache and origin then an error
+// is thrown
+func InitServer(ctx context.Context, currentServers ServerType) error {
+	if err := initConfigDir(); err != nil {
+		return errors.Wrap(err, "Failed to initialize the server configuration")
+	}
+	if currentServers.IsEnabled(OriginType) && currentServers.IsEnabled(CacheType) {
+		return errors.New("A cache and origin cannot both be enabled in the same instance")
+	}
+
+	setEnabledServer(currentServers)
+
+	xrootdPrefix := ""
+	if currentServers.IsEnabled(OriginType) {
+		xrootdPrefix = "origin"
+	} else if currentServers.IsEnabled(CacheType) {
+		xrootdPrefix = "cache"
+	}
+	configDir := viper.GetString("ConfigDir")
+	viper.SetConfigType("yaml")
+	viper.SetDefault("Server.TLSCertificate", filepath.Join(configDir, "certificates", "tls.crt"))
+	viper.SetDefault("Server.TLSKey", filepath.Join(configDir, "certificates", "tls.key"))
+	viper.SetDefault("Server.TLSCAKey", filepath.Join(configDir, "certificates", "tlsca.key"))
+	viper.SetDefault("Server.SessionSecretFile", filepath.Join(configDir, "session-secret"))
+	viper.SetDefault("Xrootd.RobotsTxtFile", filepath.Join(configDir, "robots.txt"))
+	viper.SetDefault("Xrootd.ScitokensConfig", filepath.Join(configDir, "xrootd", "scitokens.cfg"))
+	viper.SetDefault("Xrootd.Authfile", filepath.Join(configDir, "xrootd", "authfile"))
+	viper.SetDefault("Xrootd.MacaroonsKeyFile", filepath.Join(configDir, "macaroons-secret"))
+	viper.SetDefault("IssuerKey", filepath.Join(configDir, "issuer.jwk"))
+	viper.SetDefault("Server.UIPasswordFile", filepath.Join(configDir, "server-web-passwd"))
+	viper.SetDefault("Server.UIActivationCodeFile", filepath.Join(configDir, "server-web-activation-code"))
+	viper.SetDefault("Server.SessionSecretFile", filepath.Join(configDir, "session-secret"))
+	viper.SetDefault("OIDC.ClientIDFile", filepath.Join(configDir, "oidc-client-id"))
+	viper.SetDefault("OIDC.ClientSecretFile", filepath.Join(configDir, "oidc-client-secret"))
+	viper.SetDefault("Cache.ExportLocation", "/")
+	viper.SetDefault("Registry.RequireKeyChaining", true)
+	if IsRootExecution() {
+		viper.SetDefault("Xrootd.RunLocation", filepath.Join("/run", "pelican", "xrootd", xrootdPrefix))
+		viper.SetDefault("Cache.DataLocation", "/run/pelican/xcache")
+		viper.SetDefault("Origin.Multiuser", true)
+		viper.SetDefault("Director.GeoIPLocation", "/var/cache/pelican/maxmind/GeoLite2-City.mmdb")
+		viper.SetDefault("Registry.DbLocation", "/var/lib/pelican/registry.sqlite")
+		viper.SetDefault("Monitoring.DataLocation", "/var/lib/pelican/monitoring/data")
+	} else {
+		viper.SetDefault("Director.GeoIPLocation", filepath.Join(configDir, "maxmind", "GeoLite2-City.mmdb"))
+		viper.SetDefault("Registry.DbLocation", filepath.Join(configDir, "ns-registry.sqlite"))
+		viper.SetDefault("Monitoring.DataLocation", filepath.Join(configDir, "monitoring/data"))
 
 		if userRuntimeDir := os.Getenv("XDG_RUNTIME_DIR"); userRuntimeDir != "" {
-			runtimeDir := filepath.Join(userRuntimeDir, "pelican")
+			runtimeDir := filepath.Join(userRuntimeDir, "pelican", xrootdPrefix)
 			err := os.MkdirAll(runtimeDir, 0750)
 			if err != nil {
 				return err
 			}
-			viper.SetDefault("XrootdRun", runtimeDir)
+			viper.SetDefault("Xrootd.RunLocation", runtimeDir)
+			viper.SetDefault("Cache.DataLocation", path.Join(runtimeDir, "xcache"))
 		} else {
 			dir, err := os.MkdirTemp("", "pelican-xrootd-*")
 			if err != nil {
 				return err
 			}
-			viper.SetDefault("XrootdRun", dir)
-			cleanupDirOnShutdown(dir)
+			viper.SetDefault("Xrootd.RunLocation", filepath.Join(dir, xrootdPrefix))
+			viper.SetDefault("Cache.DataLocation", path.Join(dir, "xcache"))
+			cleanupDirOnShutdown(ctx, dir)
 		}
-		viper.SetDefault("XrootdMultiuser", false)
+		viper.SetDefault("Origin.Multiuser", false)
+	}
+	// Any platform-specific paths should go here
+	err := InitServerOSDefaults()
+	if err != nil {
+		return errors.Wrapf(err, "Failure when setting up OS-specific configuration")
 	}
-	viper.SetDefault("TLSCertFile", "/etc/pki/tls/cert.pem")
 
-	err := os.MkdirAll(viper.GetString("MonitoringData"), 0750)
+	err = os.MkdirAll(param.Monitoring_DataLocation.GetString(), 0750)
 	if err != nil {
 		return errors.Wrapf(err, "Failure when creating a directory for the monitoring data")
 	}
@@ -300,45 +706,102 @@ func InitServer() error {
 	if err != nil {
 		return err
 	}
-	viper.SetDefault("Hostname", hostname)
-	viper.SetDefault("Sitename", hostname)
-	viper.SetDefault("Hostname", hostname)
+	viper.SetDefault("Server.Hostname", hostname)
+	viper.SetDefault("Xrootd.Sitename", hostname)
+	// For the rest of the function, use the hostname provided by the admin if
+	// they have overridden the defaults.
+	hostname = viper.GetString("Server.Hostname")
 
-	err = viper.MergeConfig(strings.NewReader(defaultsYaml))
+	if currentServers.IsEnabled(CacheType) {
+		viper.Set("Xrootd.Port", param.Cache_Port.GetInt())
+	}
+	xrootdPort := param.Xrootd_Port.GetInt()
+	if xrootdPort != 443 {
+		viper.SetDefault("Origin.Url", fmt.Sprintf("https://%v:%v", param.Server_Hostname.GetString(), xrootdPort))
+	} else {
+		viper.SetDefault("Origin.Url", fmt.Sprintf("https://%v", param.Server_Hostname.GetString()))
+	}
+
+	webPort := param.Server_WebPort.GetInt()
+	viper.SetDefault("Server.ExternalWebUrl", fmt.Sprint("https://", hostname, ":", webPort))
+	externalAddressStr := param.Server_ExternalWebUrl.GetString()
+	if _, err = url.Parse(externalAddressStr); err != nil {
+		return errors.Wrap(err, fmt.Sprint("Invalid Server.ExternalWebUrl: ", externalAddressStr))
+	}
+
+	if currentServers.IsEnabled(DirectorType) && param.Federation_DirectorUrl.GetString() == "" {
+		viper.SetDefault("Federation.DirectorUrl", viper.GetString("Server.ExternalWebUrl"))
+	}
+
+	tokenRefreshInterval := param.Monitoring_TokenRefreshInterval.GetDuration()
+	tokenExpiresIn := param.Monitoring_TokenExpiresIn.GetDuration()
+
+	if tokenExpiresIn == 0 || tokenRefreshInterval == 0 || tokenRefreshInterval > tokenExpiresIn {
+		viper.Set("Monitoring.TokenRefreshInterval", time.Minute*59)
+		viper.Set("Monitoring.TokenExpiresIn", time.Hour*1)
+		log.Warningln("Invalid Monitoring.TokenRefreshInterval or Monitoring.TokenExpiresIn. Fallback to 59m for refresh interval and 1h for valid interval")
+	}
+
+	// Unmarshal Viper config into a Go struct
+	unmarshalledConfig, err := param.UnmarshalConfig()
+	if err != nil || unmarshalledConfig == nil {
+		return err
+	}
+
+	// As necessary, generate private keys, JWKS and corresponding certs
+
+	// Note: This function will generate a private key in the location stored by the viper var "IssuerKey"
+	// iff there isn't any valid private key present in that location
+	_, err = GetIssuerPublicJWKS()
 	if err != nil {
 		return err
 	}
 
-	prefix := GetPreferredPrefix()
-	if prefix == "OSDF" {
-		err := viper.MergeConfig(strings.NewReader(osdfDefaultsYaml))
-		if err != nil {
-			return err
-		}
+	// Check if we have required files in place to set up TLS, or we will generate them
+	err = GenerateCert()
+	if err != nil {
+		return err
 	}
-	return nil
+
+	// Generate the session secret and save it as the default value
+	if err := GenerateSessionSecret(); err != nil {
+		return err
+	}
+
+	// After we know we have the certs we need, call setupTransport (which uses those certs for its TLSConfig)
+	setupTransport()
+
+	// Setup CSRF middleware. To use it, you need to add this middleware to your chain
+	// of http handlers by calling config.GetCSRFHandler()
+	setupCSRFHandler()
+
+	// Set up the server's issuer URL so we can access that data wherever we need to find keys and whatnot
+	// This populates Server.IssuerUrl, and can be safely fetched using server_utils.GetServerIssuerURL()
+	err = parseServerIssuerURL(currentServers)
+	if err != nil {
+		return err
+	}
+
+	return DiscoverFederation()
 }
 
 func InitClient() error {
-	if IsRootExecution() {
-		viper.SetDefault("IssuerKey", "/etc/pelican/issuer.jwk")
-	} else {
-		configBase, err := getConfigBase()
-		if err != nil {
-			return err
-		}
-		viper.SetDefault("IssuerKey", filepath.Join(configBase, "issuer.jwk"))
+	if err := initConfigDir(); err != nil {
+		log.Warningln("No home directory found for user -- will check for configuration yaml in /etc/pelican/")
+		viper.Set("ConfigDir", "/etc/pelican")
 	}
 
+	configDir := viper.GetString("ConfigDir")
+	viper.SetDefault("IssuerKey", filepath.Join(configDir, "issuer.jwk"))
+
 	upper_prefix := GetPreferredPrefix()
-	lower_prefix := strings.ToLower(upper_prefix)
 
-	viper.SetDefault("StoppedTransferTimeout", 100)
-	viper.SetDefault("SlowTransferRampupTime", 100)
-	viper.SetDefault("SlowTransferWindow", 30)
+	viper.SetDefault("Client.StoppedTransferTimeout", 100)
+	viper.SetDefault("Client.SlowTransferRampupTime", 100)
+	viper.SetDefault("Client.SlowTransferWindow", 30)
 
 	if upper_prefix == "OSDF" || upper_prefix == "STASH" {
-		viper.SetDefault("TopologyNamespaceURL", "https://topology.opensciencegrid.org/osdf/namespaces")
+		viper.SetDefault("Federation.TopologyNamespaceURL", "https://topology.opensciencegrid.org/osdf/namespaces")
 	}
 
 	viper.SetEnvPrefix(upper_prefix)
@@ -346,7 +809,6 @@ func InitClient() error {
 
 	viper.SetConfigName("config")
 	viper.SetConfigType("yaml")
-	viper.AddConfigPath("$HOME/." + lower_prefix)
 	err := viper.ReadInConfig()
 	if err != nil {
 		if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
@@ -371,31 +833,31 @@ func InitClient() error {
 	prefixes_with_osg := append(prefixes, "OSG")
 	for _, prefix := range prefixes_with_osg {
 		if _, isSet := os.LookupEnv(prefix + "_DISABLE_HTTP_PROXY"); isSet {
-			viper.Set("DisableHttpProxy", true)
+			viper.Set("Client.DisableHttpProxy", true)
 			break
 		}
 	}
 	for _, prefix := range prefixes_with_osg {
 		if _, isSet := os.LookupEnv(prefix + "_DISABLE_PROXY_FALLBACK"); isSet {
-			viper.Set("DisableProxyFallback", true)
+			viper.Set("Client.DisableProxyFallback", true)
 			break
 		}
 	}
 	for _, prefix := range prefixes {
 		if val, isSet := os.LookupEnv(prefix + "_DIRECTOR_URL"); isSet {
-			viper.Set("DirectorURL", val)
+			viper.Set("Federation.DirectorURL", val)
 			break
 		}
 	}
 	for _, prefix := range prefixes {
 		if val, isSet := os.LookupEnv(prefix + "_NAMESPACE_URL"); isSet {
-			viper.Set("NamespaceURL", val)
+			viper.Set("Federation.RegistryUrl", val)
 			break
 		}
 	}
 	for _, prefix := range prefixes {
 		if val, isSet := os.LookupEnv(prefix + "_TOPOLOGY_NAMESPACE_URL"); isSet {
-			viper.Set("TopologyNamespaceURL", val)
+			viper.Set("Federation.TopologyNamespaceURL", val)
 			break
 		}
 	}
@@ -419,7 +881,35 @@ func InitClient() error {
 		}
 		break
 	}
-	viper.Set("MinimumDownloadSpeed", downloadLimit)
+	if viper.IsSet("MinimumDownloadSpeed") {
+		viper.SetDefault("Client.MinimumDownloadSpeed", param.MinimumDownloadSpeed.GetInt())
+	} else {
+		viper.Set("Client.MinimumDownloadSpeed", downloadLimit)
+	}
+
+	// Handle more legacy config options
+	if viper.IsSet("DisableProxyFallback") {
+		viper.SetDefault("Client.DisableProxyFallback", param.DisableProxyFallback.GetBool())
+	}
+	if viper.IsSet("DisableHttpProxy") {
+		viper.SetDefault("Client.DisableHttpProxy", param.DisableHttpProxy.GetBool())
+	}
+
+	setupTransport()
+
+	// Unmarshal Viper config into a Go struct
+	unmarshalledConfig, err := param.UnmarshalConfig()
+	if err != nil || unmarshalledConfig == nil {
+		return err
+	}
 
 	return DiscoverFederation()
 }
+
+func SetLogging(logLevel log.Level) {
+	textFormatter := log.TextFormatter{}
+	textFormatter.DisableLevelTruncation = true
+	textFormatter.FullTimestamp = true
+	log.SetFormatter(&textFormatter)
+	log.SetLevel(logLevel)
+}
diff --git a/config/config_default.go b/config/config_default.go
new file mode 100644
index 000000000..7eae31902
--- /dev/null
+++ b/config/config_default.go
@@ -0,0 +1,54 @@
+//go:build !linux
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package config
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/viper"
+)
+
+func InitServerOSDefaults() error {
+	// Windows / Mac don't have a default set of CAs installed at
+	// a well-known location as is expected by XRootD. We want to always generate our own CA
+	// if Server_TLSCertificate (host certificate) is not explicitly set so that
+	// we can sign our host cert by our CA instead of self-signing
+	tlscaFile := filepath.Join(viper.GetString("ConfigDir"), "certificates", "tlsca.pem")
+	viper.SetDefault("Server.TLSCACertificateFile", tlscaFile)
+
+	tlscaKeyFile := filepath.Join(viper.GetString("ConfigDir"), "certificates", "tlscakey.pem")
+	viper.SetDefault("Server.TLSCAKey", tlscaKeyFile)
+
+	if err := os.MkdirAll(filepath.Dir(tlscaFile), 0755); err != nil {
+		return err
+	}
+
+	// Note: creating an empty file is insufficient for XRootD
+	/*
+		fp, err := os.OpenFile(tlscaFile, os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			return err
+		}
+		defer fp.Close()
+	*/
+	return nil
+}
diff --git a/config/config_linux.go b/config/config_linux.go
new file mode 100644
index 000000000..c9092b65c
--- /dev/null
+++ b/config/config_linux.go
@@ -0,0 +1,36 @@
+//go:build linux
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package config
+
+import (
+	"path/filepath"
+
+	"github.com/spf13/viper"
+)
+
+func InitServerOSDefaults() error {
+	// For Linux, even if we have well-known system CAs, we don't want to
+	// use them, because we want to always generate our own CA if Server_TLSCertificate (host certificate)
+	// is not explicitly set so that we can sign our host cert by our CA instead of self-signing
+	configDir := viper.GetString("ConfigDir")
+	viper.SetDefault("Server.TLSCACertificateFile", filepath.Join(configDir, "certificates", "tlsca.pem"))
+	return nil
+}
diff --git a/config/config_test.go b/config/config_test.go
new file mode 100644
index 000000000..afff9eb6f
--- /dev/null
+++ b/config/config_test.go
@@ -0,0 +1,263 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package config
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/sirupsen/logrus"
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var server *httptest.Server
+
+func TestMain(m *testing.M) {
+	// Create a test server
+	server = httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// simuilate long server response
+		time.Sleep(5 * time.Second)
+		w.WriteHeader(http.StatusOK)
+		code, err := w.Write([]byte("Success"))
+		if err != nil {
+			fmt.Printf("Error writing out reponse: %d, %v", code, err)
+			os.Exit(1)
+		}
+	}))
+	// Init server to get configs initiallized
+	viper.Set("Transport.MaxIdleConns", 30)
+	viper.Set("Transport.IdleConnTimeout", time.Second*90)
+	viper.Set("Transport.TLSHandshakeTimeout", time.Second*15)
+	viper.Set("Transport.ExpectContinueTimeout", time.Second*1)
+	viper.Set("Transport.ResponseHeaderTimeout", time.Second*10)
+
+	viper.Set("Transport.Dialer.Timeout", time.Second*1)
+	viper.Set("Transport.Dialer.KeepAlive", time.Second*30)
+	viper.Set("TLSSkipVerify", true)
+	server.StartTLS()
+	defer server.Close()
+	exitCode := m.Run()
+	os.Exit(exitCode)
+}
+
+func TestResponseHeaderTimeout(t *testing.T) {
+	// Change the viper value of the timeout
+	viper.Set("Transport.ResponseHeaderTimeout", time.Millisecond*25)
+	setupTransport()
+	transport := GetTransport()
+	client := &http.Client{Transport: transport}
+	// make a request
+	req, err := http.NewRequest("GET", server.URL, nil)
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+
+	// Perform the request and handle the timeout
+	_, err = client.Do(req)
+	if err != nil {
+		// Check if the error is a timeout error
+		assert.True(t, strings.Contains(err.Error(), "timeout awaiting response headers"))
+	} else {
+		t.Fatalf("Test returned no error when there should be")
+	}
+
+	viper.Set("Transport.ResponseHeaderTimeout", time.Second*10)
+}
+
+func TestDialerTimeout(t *testing.T) {
+	// Change the viper value of the timeout
+	viper.Set("Transport.Dialer.Timeout", time.Millisecond*25)
+	setupTransport()
+	transport := GetTransport()
+	client := &http.Client{Transport: transport}
+
+	unreachableServerURL := "http://abc123:1000"
+
+	// make a request
+	req, err := http.NewRequest("GET", unreachableServerURL, nil)
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+
+	// Perform the request and handle the timeout
+	_, err = client.Do(req)
+	if err != nil {
+		// Check if the error is a timeout error
+		assert.True(t, strings.Contains(err.Error(), "dial tcp"))
+	} else {
+		t.Fatalf("Test returned no error when there should be")
+	}
+
+	viper.Set("Transport.Dialer.Timeout", time.Second*10)
+}
+
+func TestInitConfig(t *testing.T) {
+	// Set prefix to OSDF to ensure that config is being set
+	testingPreferredPrefix = "OSDF"
+
+	// Create a temp config file to use
+	tempCfgFile, err := os.CreateTemp("", "pelican-*.yaml")
+	viper.Set("config", tempCfgFile.Name())
+	if err != nil {
+		t.Fatalf("Failed to make temp file: %v", err)
+	}
+
+	InitConfig() // Should set up pelican.yaml, osdf.yaml and defaults.yaml
+
+	// Check if server address is correct by defaults.yaml
+	assert.Equal(t, "0.0.0.0", param.Server_WebHost.GetString())
+	// Check that Federation Discovery url is correct by osdf.yaml
+	assert.Equal(t, "osg-htc.org", param.Federation_DiscoveryUrl.GetString())
+
+	viper.Set("Server.WebHost", "1.1.1.1") // should write to temp config file
+	if err := viper.WriteConfigAs(tempCfgFile.Name()); err != nil {
+		t.Fatalf("Failed to write to config file: %v", err)
+	}
+	viper.Reset()
+	viper.Set("config", tempCfgFile.Name()) // Set the temp file as the new 'pelican.yaml'
+	InitConfig()
+
+	// Check if server address overrides the default
+	assert.Equal(t, "1.1.1.1", param.Server_WebHost.GetString())
+	viper.Reset()
+
+	//Test if prefix is not set, should not be able to find osdfYaml configuration
+	testingPreferredPrefix = ""
+	tempCfgFile, err = os.CreateTemp("", "pelican-*.yaml")
+	viper.Set("config", tempCfgFile.Name())
+	if err != nil {
+		t.Fatalf("Failed to make temp file: %v", err)
+	}
+	InitConfig()
+	assert.Equal(t, "", param.Federation_DiscoveryUrl.GetString())
+}
+
+func TestDeprecateLogMessage(t *testing.T) {
+	t.Run("expect-deprecated-message-if-namespace-url-is-set", func(t *testing.T) {
+		hook := test.NewGlobal()
+		viper.Reset()
+		// The default value is set to Error, but this is a warning message
+		viper.Set("Logging.Level", "Warning")
+		viper.Set("Federation.NamespaceUrl", "https://dont-use.com")
+		InitConfig()
+
+		require.Equal(t, 1, len(hook.Entries))
+		assert.Equal(t, logrus.WarnLevel, hook.LastEntry().Level)
+		assert.Equal(t, "Federation.NamespaceUrl is deprecated and will be removed in future release. Please migrate to use Federation.RegistryUrl instead", hook.LastEntry().Message)
+		// We expect the default value of Federation.RegistryUrl is set to Federation.NamespaceUrl
+		// if Federation.NamespaceUrl is not empty for backward compatibility
+		assert.Equal(t, "https://dont-use.com", viper.GetString("Federation.RegistryUrl"))
+		hook.Reset()
+	})
+
+	t.Run("no-deprecated-message-if-namespace-url-unset", func(t *testing.T) {
+		hook := test.NewGlobal()
+		viper.Reset()
+		viper.Set("Logging.Level", "Warning")
+		viper.Set("Federation.RegistryUrl", "https://dont-use.com")
+		InitConfig()
+
+		assert.Equal(t, 0, len(hook.Entries))
+		assert.Equal(t, "https://dont-use.com", viper.GetString("Federation.RegistryUrl"))
+		assert.Equal(t, "", viper.GetString("Federation.NamespaceUrl"))
+		hook.Reset()
+	})
+}
+
+func TestEnabledServers(t *testing.T) {
+	allServerTypes := []ServerType{OriginType, CacheType, DirectorType, RegistryType}
+	allServerStrs := make([]string, 0)
+	allServerStrsLower := make([]string, 0)
+	for _, st := range allServerTypes {
+		allServerStrs = append(allServerStrs, st.String())
+		allServerStrsLower = append(allServerStrsLower, strings.ToLower(st.String()))
+	}
+	sort.Strings(allServerStrs)
+	sort.Strings(allServerStrsLower)
+
+	t.Run("no-value-set", func(t *testing.T) {
+		enabledServers = 0
+		for _, server := range allServerTypes {
+			assert.False(t, IsServerEnabled(server))
+		}
+	})
+
+	t.Run("enable-one-server", func(t *testing.T) {
+		for _, server := range allServerTypes {
+			enabledServers = 0
+			// We didn't call setEnabledServer as it will only set once per process
+			enabledServers.SetList([]ServerType{server})
+			assert.True(t, IsServerEnabled(server))
+			assert.Equal(t, []string{server.String()}, GetEnabledServerString(false))
+			assert.Equal(t, []string{strings.ToLower(server.String())}, GetEnabledServerString(true))
+		}
+	})
+
+	t.Run("enable-multiple-servers", func(t *testing.T) {
+		enabledServers = 0
+		enabledServers.SetList([]ServerType{OriginType, CacheType})
+		serverStr := []string{OriginType.String(), CacheType.String()}
+		serverStrLower := []string{strings.ToLower(OriginType.String()), strings.ToLower(CacheType.String())}
+		sort.Strings(serverStr)
+		sort.Strings(serverStrLower)
+		assert.True(t, IsServerEnabled(OriginType))
+		assert.True(t, IsServerEnabled(CacheType))
+		assert.Equal(t, serverStr, GetEnabledServerString(false))
+		assert.Equal(t, serverStrLower, GetEnabledServerString(true))
+	})
+
+	t.Run("enable-all-servers", func(t *testing.T) {
+		enabledServers = 0
+		enabledServers.SetList(allServerTypes)
+		assert.True(t, IsServerEnabled(OriginType))
+		assert.True(t, IsServerEnabled(CacheType))
+		assert.True(t, IsServerEnabled(RegistryType))
+		assert.True(t, IsServerEnabled(DirectorType))
+		assert.Equal(t, allServerStrs, GetEnabledServerString(false))
+		assert.Equal(t, allServerStrsLower, GetEnabledServerString(true))
+	})
+
+	t.Run("setEnabledServer-only-set-once", func(t *testing.T) {
+		enabledServers = 0
+		sType := OriginType
+		sType.Set(CacheType)
+		setEnabledServer(sType)
+		assert.True(t, IsServerEnabled(OriginType))
+		assert.True(t, IsServerEnabled(CacheType))
+
+		sType.Clear()
+		sType.Set(DirectorType)
+		sType.Set(RegistryType)
+		setEnabledServer(sType)
+		assert.True(t, IsServerEnabled(OriginType))
+		assert.True(t, IsServerEnabled(CacheType))
+		assert.False(t, IsServerEnabled(DirectorType))
+		assert.False(t, IsServerEnabled(RegistryType))
+	})
+}
diff --git a/config/csrf.go b/config/csrf.go
new file mode 100644
index 000000000..2885c8559
--- /dev/null
+++ b/config/csrf.go
@@ -0,0 +1,66 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package config
+
+import (
+	"net/http"
+	"sync"
+
+	"github.com/gin-gonic/gin"
+	"github.com/gorilla/csrf"
+	adapter "github.com/gwatts/gin-adapter"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+var (
+	// Global CSRF handler that shares the same auth key
+	csrfHanlder     gin.HandlerFunc
+	onceCSRFHanlder sync.Once
+)
+
+func setupCSRFHandler() {
+	csrfKey, err := LoadSessionSecret()
+	if err != nil {
+		log.Error("Error loading session secret, abort setting up CSRF handler:", err)
+		return
+	}
+	CSRF := csrf.Protect(csrfKey,
+		csrf.SameSite(csrf.SameSiteStrictMode),
+		csrf.Path("/"),
+		csrf.ErrorHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusForbidden)
+			_, err := w.Write([]byte(`{"message": "CSRF token invalid"}`))
+			if err != nil {
+				log.Error("Error writing error message back as response")
+			}
+		})),
+	)
+	csrfHanlder = adapter.Wrap(CSRF)
+}
+
+func GetCSRFHandler() (gin.HandlerFunc, error) {
+	onceCSRFHanlder.Do(func() {
+		setupCSRFHandler()
+	})
+	if csrfHanlder == nil {
+		return nil, errors.New("Error setting up the CSRF hanlder")
+	}
+	return csrfHanlder, nil
+}
diff --git a/config/encrypted.go b/config/encrypted.go
index 8b23255cc..4c47934de 100644
--- a/config/encrypted.go
+++ b/config/encrypted.go
@@ -29,6 +29,7 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/spf13/viper"
 	"github.com/youmark/pkcs8"
 	"golang.org/x/crypto/curve25519"
 	"golang.org/x/crypto/nacl/box"
@@ -42,23 +43,20 @@ import (
 var setEmptyPassword = false
 
 func GetEncryptedConfigName() (string, error) {
-	if IsRootExecution() {
-		return "/etc/pelican/credentials/client-credentials.pem", nil
+	configDir := viper.GetString("ConfigDir")
+	if GetPreferredPrefix() == "PELICAN" || IsRootExecution() {
+		return filepath.Join(configDir, "credentials", "client-credentials.pem"), nil
 	}
-	config_location := filepath.Join("pelican", "client-credentials.pem")
-	if GetPreferredPrefix() != "PELICAN" {
-		config_location = filepath.Join("osdf-client", "oauth2-client.pem")
-	}
-	config_root := os.Getenv("XDG_CONFIG_HOME")
-	if len(config_root) == 0 {
+	configLocation := filepath.Join("osdf-client", "oauth2-client.pem")
+	configRoot := os.Getenv("XDG_CONFIG_HOME")
+	if len(configRoot) == 0 {
 		dirname, err := os.UserHomeDir()
 		if err != nil {
 			return "", err
 		}
-		config_root = filepath.Join(dirname, ".config")
+		configRoot = filepath.Join(dirname, ".config")
 	}
-	fmt.Printf("Final location: %v/%v", config_root, config_location)
-	return filepath.Join(config_root, config_location), nil
+	return filepath.Join(configRoot, configLocation), nil
 }
 
 func EncryptedConfigExists() (bool, error) {
diff --git a/config/init_server_creds.go b/config/init_server_creds.go
index 5077feb9a..60ca2227a 100644
--- a/config/init_server_creds.go
+++ b/config/init_server_creds.go
@@ -22,28 +22,38 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/sha256"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
 	"math/big"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"runtime"
 	"sync/atomic"
 	"time"
 
 	"github.com/lestrrat-go/jwx/v2/jwa"
 	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pelicanplatform/pelican/param"
 	"github.com/pkg/errors"
-	"github.com/spf13/viper"
+	log "github.com/sirupsen/logrus"
 )
 
 var (
-	privateKey atomic.Pointer[jwk.Key]
+	// This is the private JWK for the server to sign tokens. This key remains
+	// the same if the IssuerKey is unchanged
+	issuerPrivateJWK atomic.Pointer[jwk.Key]
 )
 
-func LoadPrivateKey(tlsKey string) (*ecdsa.PrivateKey, error) {
-	rest, err := os.ReadFile(tlsKey)
+// Return a pointer to an ECDSA private key read from keyLocation.
+//
+// This can be used to load any ECDSA private key we generated for
+// various purposes including IssuerKey, TLSKey, and TLSCAKey
+func LoadPrivateKey(keyLocation string) (*ecdsa.PrivateKey, error) {
+	rest, err := os.ReadFile(keyLocation)
 	if err != nil {
 		return nil, nil
 	}
@@ -69,53 +79,220 @@ func LoadPrivateKey(tlsKey string) (*ecdsa.PrivateKey, error) {
 		}
 	}
 	if privateKey == nil {
-		return nil, fmt.Errorf("Private key file, %v, contains no private key", tlsKey)
+		return nil, fmt.Errorf("Private key file, %v, contains no private key", keyLocation)
 	}
 	return privateKey, nil
 }
 
-func LoadPublicKey(existingJWKS string, issuerKeyFile string) (*jwk.Set, error) {
-	jwks := jwk.NewSet()
-	if existingJWKS != "" {
-		var err error
-		jwks, err = jwk.ReadFile(existingJWKS)
+// Check if a file exists at keyLocation, return the file if so; otherwise, generate
+// and writes a PEM-encoded ECDSA-encrypted private key with elliptic curve assigned
+// by curve
+func GeneratePrivateKey(keyLocation string, curve elliptic.Curve) error {
+	uid, err := GetDaemonUID()
+	if err != nil {
+		return err
+	}
+
+	gid, err := GetDaemonGID()
+	if err != nil {
+		return err
+	}
+	user, err := GetDaemonUser()
+	if err != nil {
+		return err
+	}
+	groupname, err := GetDaemonGroup()
+	if err != nil {
+		return err
+	}
+
+	if file, err := os.Open(keyLocation); err == nil {
+		defer file.Close()
+		// Make sure key is valid if there is one
+		if _, err := LoadPrivateKey(keyLocation); err != nil {
+			return err
+		}
+		return nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return errors.Wrap(err, "Failed to load private key due to I/O error")
+	}
+	keyDir := filepath.Dir(keyLocation)
+	if err := MkdirAll(keyDir, 0750, -1, gid); err != nil {
+		return err
+	}
+	// In this case, the private key file doesn't exist.
+	file, err := os.OpenFile(keyLocation, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0400)
+	if err != nil {
+		return errors.Wrap(err, "Failed to create new private key file")
+	}
+	defer file.Close()
+	priv, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		return err
+	}
+	// Windows does not have "chown", has to work differently
+	currentOS := runtime.GOOS
+	if currentOS == "windows" {
+		cmd := exec.Command("icacls", keyLocation, "/grant", user+":F")
+		output, err := cmd.CombinedOutput()
 		if err != nil {
-			return nil, errors.Wrap(err, "Failed to read issuer JWKS file")
+			return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v: %s",
+				keyLocation, groupname, string(output))
+		}
+	} else { // Else we are running on linux/mac
+		if err = os.Chown(keyLocation, uid, gid); err != nil {
+			return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v",
+				keyLocation, groupname)
 		}
 	}
 
-	if err := GeneratePrivateKey(issuerKeyFile, elliptic.P521()); err != nil {
-		return nil, errors.Wrap(err, "Failed to generate new private key")
+	bytes, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return err
 	}
-	contents, err := os.ReadFile(issuerKeyFile)
+	priv_block := pem.Block{Type: "PRIVATE KEY", Bytes: bytes}
+	if err = pem.Encode(file, &priv_block); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Helper function to generate a Certificate Authority (CA) certificate and its private key
+// for non-production environment so that we can use the private key of the CA
+// to sign the host certificate
+func GenerateCACert() error {
+	gid, err := GetDaemonGID()
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to read issuer key file")
+		return err
 	}
-	key, err := jwk.ParseKey(contents, jwk.WithPEM(true))
+	groupname, err := GetDaemonGroup()
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to parse issuer key file %v", issuerKeyFile)
+		return err
+	}
+	user, err := GetDaemonUser()
+	if err != nil {
+		return err
 	}
 
-	// Add the algorithm to the key, needed for verifying tokens elsewhere
-	err = key.Set(jwk.AlgorithmKey, jwa.ES512)
+	// If you provide a CA, you must also provide its private key in order for
+	// GenerateCert to sign the  host certificate by that key, or we will generate
+	// a new CA
+	tlsCACert := param.Server_TLSCACertificateFile.GetString()
+	if file, err := os.Open(tlsCACert); err == nil {
+		file.Close()
+		tlsCAKey := param.Server_TLSCAKey.GetString()
+		if file, err := os.Open(tlsCAKey); err == nil {
+			file.Close()
+			return nil
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return errors.Wrap(err, "Failed to load TLS CA private key due to I/O error")
+		}
+		return nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return errors.Wrap(err, "Failed to load TLS CA certificate due to I/O error")
+	}
+
+	// No existing CA cert present, generate a new CA root certificate and private key
+	tlsCertDir := filepath.Dir(tlsCACert)
+	if err := MkdirAll(tlsCertDir, 0755, -1, gid); err != nil {
+		return err
+	}
+
+	tlsCAKey := param.Server_TLSCAKey.GetString()
+	if err := GeneratePrivateKey(tlsCAKey, elliptic.P256()); err != nil {
+		return err
+	}
+	privateKey, err := LoadPrivateKey(tlsCAKey)
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to add alg specification to key header")
+		return err
 	}
 
-	pkey, err := jwk.PublicKeyOf(key)
+	log.Debugln("Will generate a new CA certificate for the server")
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to generate public key from file %v", issuerKeyFile)
+		return err
 	}
-	err = jwk.AssignKeyID(pkey)
+	hostname := param.Server_Hostname.GetString()
+	notBefore := time.Now()
+	template := x509.Certificate{
+		SerialNumber: serialNumber,
+		Subject: pkix.Name{
+			Organization: []string{"Pelican CA"},
+			CommonName:   hostname,
+		},
+		NotBefore:             notBefore,
+		NotAfter:              notBefore.AddDate(10, 0, 0),
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	template.DNSNames = []string{hostname}
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &(privateKey.PublicKey),
+		privateKey)
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to assign key ID to public key")
+		return err
 	}
-	if err = jwks.AddKey(pkey); err != nil {
-		return nil, errors.Wrap(err, "Failed to add public key to new JWKS")
+	file, err := os.OpenFile(tlsCACert, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0640)
+	if err != nil {
+		return err
 	}
-	return &jwks, nil
+	defer file.Close()
+
+	// Windows does not have "chown", has to work differently
+	currentOS := runtime.GOOS
+	if currentOS == "windows" {
+		cmd := exec.Command("icacls", tlsCACert, "/grant", user+":F")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v: %s",
+				tlsCACert, groupname, string(output))
+		}
+	} else { // Else we are running on linux/mac
+		if err = os.Chown(tlsCACert, -1, gid); err != nil {
+			return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v",
+				tlsCACert, groupname)
+		}
+	}
+
+	if err = pem.Encode(file, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
+		return err
+	}
+
+	return nil
 }
 
+// Read a PEM-encoded TLS certficate file, parse and return the first
+// certificate appeared in the chain. Return error if there's no cert
+// present in the file
+func LoadCertficate(certFile string) (*x509.Certificate, error) {
+	rest, err := os.ReadFile(certFile)
+	if err != nil {
+		return nil, err
+	}
+
+	var cert *x509.Certificate
+	var block *pem.Block
+	for {
+		block, rest = pem.Decode(rest)
+		if block == nil {
+			break
+		} else if block.Type == "CERTIFICATE" {
+			cert, err = x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				return nil, err
+			}
+			break
+		}
+	}
+	if cert == nil {
+		return nil, fmt.Errorf("Certificate file, %v, contains no certificate", certFile)
+	}
+	return cert, nil
+}
+
+// Generate a TLS certificate (host certificate) and its private key
+// for non-production environment if the requied TLS files are not present
 func GenerateCert() error {
 	gid, err := GetDaemonGID()
 	if err != nil {
@@ -125,34 +302,83 @@ func GenerateCert() error {
 	if err != nil {
 		return err
 	}
+	user, err := GetDaemonUser()
+	if err != nil {
+		return err
+	}
 
-	tlsCert := viper.GetString("TLSCertificate")
+	tlsCert := param.Server_TLSCertificate.GetString()
 	if file, err := os.Open(tlsCert); err == nil {
 		file.Close()
-		return nil
+		// Check that the matched-pair private key is present
+		tlsKey := param.Server_TLSKey.GetString()
+		if file, err := os.Open(tlsKey); err == nil {
+			file.Close()
+			// Check that CA is also present
+			caCert := param.Server_TLSCACertificateFile.GetString()
+			if _, err := os.Open(caCert); err == nil {
+				file.Close()
+				// Check that the CA is a valid CA
+				if _, err := LoadCertficate(caCert); err != nil {
+					return errors.Wrap(err, "Failed to load CA cert")
+				} else {
+					// TODO: Check that the private key is a pair of the server cert
+
+					// Here we return based on the check that
+					// 1. TLS cert is present
+					// 2. The private key of TLS cert if present
+					// 3. The CA is present
+					return nil
+				}
+			} else if !errors.Is(err, os.ErrNotExist) {
+				return errors.Wrap(err, "Failed to load TLS CA cert due to I/O error")
+			}
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return errors.Wrap(err, "Failed to load TLS host private key due to I/O error")
+		}
 	} else if !errors.Is(err, os.ErrNotExist) {
+		return errors.Wrap(err, "Failed to load TLS host certificate due to I/O error")
+	}
+
+	// In this case, no host certificate exists - we should generate our own.
+
+	if err := GenerateCACert(); err != nil {
 		return err
 	}
-	certDir := filepath.Dir(tlsCert)
-	if err := MkdirAll(certDir, 0755, -1, gid); err != nil {
+	caCert, err := LoadCertficate(param.Server_TLSCACertificateFile.GetString())
+	if err != nil {
 		return err
 	}
 
-	tlsKey := viper.GetString("TLSKey")
+	tlsCertDir := filepath.Dir(tlsCert)
+	if err := MkdirAll(tlsCertDir, 0755, -1, gid); err != nil {
+		return err
+	}
+
+	tlsKey := param.Server_TLSKey.GetString()
+
+	// In case we didn't generate TLS private key
+	if err := GeneratePrivateKey(tlsKey, elliptic.P256()); err != nil {
+		return err
+	}
 	privateKey, err := LoadPrivateKey(tlsKey)
 	if err != nil {
 		return err
 	}
 
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	// The private key of CA will always be present
+	caPrivateKey, err := LoadPrivateKey(param.Server_TLSCAKey.GetString())
 	if err != nil {
 		return err
 	}
-	hostname, err := os.Hostname()
+
+	log.Debugln("Will generate a new host certificate for the server")
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
 		return err
 	}
+	hostname := param.Server_Hostname.GetString()
 	notBefore := time.Now()
 	template := x509.Certificate{
 		SerialNumber: serialNumber,
@@ -167,8 +393,13 @@ func GenerateCert() error {
 		BasicConstraintsValid: true,
 	}
 	template.DNSNames = []string{hostname}
-	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &(privateKey.PublicKey),
-		privateKey)
+
+	// If there's pre-existing CA certificates, self-sign instead of using the generated CA
+	signingCert := caCert
+	signingKey := caPrivateKey
+
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, signingCert, &(privateKey.PublicKey),
+		signingKey)
 	if err != nil {
 		return err
 	}
@@ -177,9 +408,21 @@ func GenerateCert() error {
 		return err
 	}
 	defer file.Close()
-	if err = os.Chown(tlsCert, -1, gid); err != nil {
-		return errors.Wrapf(err, "Failed to chown generated certificate %v to daemon group %v",
-			tlsCert, groupname)
+
+	// Windows does not have "chown", has to work differently
+	currentOS := runtime.GOOS
+	if currentOS == "windows" {
+		cmd := exec.Command("icacls", tlsCert, "/grant", user+":F")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v: %s",
+				tlsCert, groupname, string(output))
+		}
+	} else { // Else we are running on linux/mac
+		if err = os.Chown(tlsCert, -1, gid); err != nil {
+			return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v",
+				tlsCert, groupname)
+		}
 	}
 
 	if err = pem.Encode(file, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
@@ -189,72 +432,214 @@ func GenerateCert() error {
 	return nil
 }
 
-func GeneratePrivateKey(keyLocation string, curve elliptic.Curve) error {
+// Helper function to load the issuer/server's private key to sign tokens it issues.
+// Only intended to be called internally
+func loadIssuerPrivateJWK(issuerKeyFile string) (jwk.Key, error) {
+	// Check to see if we already had an IssuerKey or generate one
+	if err := GeneratePrivateKey(issuerKeyFile, elliptic.P256()); err != nil {
+		return nil, errors.Wrap(err, "Failed to generate new private key")
+	}
+	contents, err := os.ReadFile(issuerKeyFile)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to read issuer key file")
+	}
+	key, err := jwk.ParseKey(contents, jwk.WithPEM(true))
+	if err != nil {
+		return nil, errors.Wrapf(err, "Failed to parse issuer key file %v", issuerKeyFile)
+	}
+
+	// Add the algorithm to the key, needed for verifying tokens elsewhere
+	err = key.Set(jwk.AlgorithmKey, jwa.ES256)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to add alg specification to key header")
+	}
+
+	// Assign key id to the private key so that the public key obtainer thereafter
+	// has the same kid
+	err = jwk.AssignKeyID(key)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to assign key ID to private key")
+	}
+
+	issuerPrivateJWK.Store(&key)
+
+	return key, nil
+}
+
+// Helper function to load the issuer/server's public key for other servers
+// to verify the token signed by this server. Only intended to be called internally
+func loadIssuerPublicJWKS(existingJWKS string, issuerKeyFile string) (jwk.Set, error) {
+	jwks := jwk.NewSet()
+	if existingJWKS != "" {
+		var err error
+		jwks, err = jwk.ReadFile(existingJWKS)
+		if err != nil {
+			return nil, errors.Wrap(err, "Failed to read issuer JWKS file")
+		}
+	}
+	// This returns issuerPrivateJWK if it's non-nil, or find and parse private JWK
+	// located at IssuerKey if there is one, or generate a new private key
+	key, err := loadIssuerPrivateJWK(issuerKeyFile)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to load issuer private JWK")
+	}
+
+	pkey, err := jwk.PublicKeyOf(key)
+	if err != nil {
+		return nil, errors.Wrapf(err, "Failed to generate public key from file %v", issuerKeyFile)
+	}
+
+	if err = jwks.AddKey(pkey); err != nil {
+		return nil, errors.Wrap(err, "Failed to add public key to new JWKS")
+	}
+	return jwks, nil
+}
+
+// Return the private JWK for the server to sign tokens
+func GetIssuerPrivateJWK() (jwk.Key, error) {
+	key := issuerPrivateJWK.Load()
+	if key == nil {
+		issuerKeyFile := param.IssuerKey.GetString()
+		newKey, err := loadIssuerPrivateJWK(issuerKeyFile)
+		if err != nil {
+			return nil, errors.Wrap(err, "Failed to load issuer private key")
+		}
+		key = &newKey
+	}
+	return *key, nil
+}
+
+// Check if a valid JWKS file exists at Server_IssuerJwks, return that file if so;
+// otherwise, generate and store a private key at IssuerKey and return a public key of
+// that private key, encapsulated in the JWKS format
+//
+// The private key generated is loaded to issuerPrivateJWK variable which is used for
+// this server to sign JWTs it issues. The public key returned will be exposed publicly
+// for other servers to verify JWTs signed by this server, typically via a well-known URL
+// i.e. "/.well-known/issuer.jwks"
+func GetIssuerPublicJWKS() (jwk.Set, error) {
+	existingJWKS := param.Server_IssuerJwks.GetString()
+	issuerKeyFile := param.IssuerKey.GetString()
+	return loadIssuerPublicJWKS(existingJWKS, issuerKeyFile)
+}
+
+// Check if there is a session secret exists at param.Server_SessionSecretFile and is not empty if there is one.
+// If not, generate the secret to encrypt/decrypt session cookie
+func GenerateSessionSecret() error {
+	secretLocation := param.Server_SessionSecretFile.GetString()
+
+	if secretLocation == "" {
+		return errors.New("Empty filename for Server_SessionSecretFile")
+	}
+
+	uid, err := GetDaemonUID()
+	if err != nil {
+		return err
+	}
+
 	gid, err := GetDaemonGID()
 	if err != nil {
 		return err
 	}
+	user, err := GetDaemonUser()
+	if err != nil {
+		return err
+	}
 	groupname, err := GetDaemonGroup()
 	if err != nil {
 		return err
 	}
 
-	if file, err := os.Open(keyLocation); err == nil {
-		file.Close()
+	// First open the file and see if there is a secret in it already
+	if file, err := os.Open(secretLocation); err == nil {
+		defer file.Close()
+		existingSecretBytes := make([]byte, 1024)
+		_, err := file.Read(existingSecretBytes)
+		if err != nil {
+			return errors.Wrap(err, "Failed to read existing session secret file")
+		}
+		if len(string(existingSecretBytes)) == 0 {
+			return errors.Wrap(err, "Empty session secret file")
+		}
 		return nil
 	} else if !errors.Is(err, os.ErrNotExist) {
-		return errors.Wrap(err, "Failed to load private key due to I/O error")
+		return errors.Wrap(err, "Failed to load session secret due to I/O error")
 	}
-	keyDir := filepath.Dir(keyLocation)
+	keyDir := filepath.Dir(secretLocation)
 	if err := MkdirAll(keyDir, 0750, -1, gid); err != nil {
 		return err
 	}
-	// In this case, the private key file doesn't exist.
-	file, err := os.OpenFile(keyLocation, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0400)
+
+	// In this case, the session secret file doesn't exist.
+	file, err := os.OpenFile(secretLocation, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0400)
 	if err != nil {
-		return errors.Wrap(err, "Failed to create new private key file")
+		return errors.Wrap(err, fmt.Sprint("Failed to create new session secret file at ", secretLocation))
 	}
 	defer file.Close()
-	priv, err := ecdsa.GenerateKey(curve, rand.Reader)
+	// Windows does not have "chown", has to work differently
+	currentOS := runtime.GOOS
+	if currentOS == "windows" {
+		cmd := exec.Command("icacls", secretLocation, "/grant", user+":F")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return errors.Wrapf(err, "Failed to chown generated session secret %v to daemon group %v: %s",
+				secretLocation, groupname, string(output))
+		}
+	} else { // Else we are running on linux/mac
+		if err = os.Chown(secretLocation, uid, gid); err != nil {
+			return errors.Wrapf(err, "Failed to chown generated session secret %v to daemon group %v",
+				secretLocation, groupname)
+		}
+	}
+
+	// How we generate the secret:
+	// Concatenate the byte array pelican with the DER form of the service's private key,
+	// Take a hash, and use the hash's bytes as the secret.
+
+	// Use issuer private key as the source to generate the secret
+	issuerKeyFile := param.IssuerKey.GetString()
+	privateKey, err := LoadPrivateKey(issuerKeyFile)
 	if err != nil {
 		return err
 	}
-	if err = os.Chown(keyLocation, uid, gid); err != nil {
-		return errors.Wrapf(err, "Failed to chown generated key %v to daemon group %v",
-			keyLocation, groupname)
-	}
 
-	bytes, err := x509.MarshalPKCS8PrivateKey(priv)
+	derPrivateKey, err := x509.MarshalPKCS8PrivateKey(privateKey)
+
 	if err != nil {
 		return err
 	}
-	priv_block := pem.Block{Type: "PRIVATE KEY", Bytes: bytes}
-	if err = pem.Encode(file, &priv_block); err != nil {
-		return err
+	byteArray := []byte("pelican")
+
+	concatenated := append(byteArray, derPrivateKey...)
+
+	hash := sha256.Sum256(concatenated)
+
+	secret := string(hash[:])
+
+	_, err = file.WriteString(secret)
+
+	if err != nil {
+		return errors.Wrap(err, "")
 	}
 	return nil
 }
 
-func GenerateIssuerJWKS() (*jwk.Set, error) {
-	existingJWKS := viper.GetString("IssuerJWKS")
-	issuerKeyFile := viper.GetString("IssuerKey")
-	return LoadPublicKey(existingJWKS, issuerKeyFile)
-}
+// Load session secret from Server_SessionSecretFile. Generate session secret
+// if no file present.
+func LoadSessionSecret() ([]byte, error) {
+	secretLocation := param.Server_SessionSecretFile.GetString()
 
-func GetOriginJWK() (*jwk.Key, error) {
-	key := privateKey.Load()
-	if key == nil {
-		issuerKeyFile := viper.GetString("IssuerKey")
-		contents, err := os.ReadFile(issuerKeyFile)
-		if err != nil {
-			return nil, errors.Wrap(err, "Failed to read key file")
-		}
-		newKey, err := jwk.ParseKey(contents, jwk.WithPEM(true))
-		if err != nil {
-			return nil, errors.Wrapf(err, "Failed to parse key file")
-		}
-		privateKey.Store(&newKey)
-		key = &newKey
+	if secretLocation == "" {
+		return []byte{}, errors.New("Empty filename for Server_SessionSecretFile")
 	}
-	return key, nil
+
+	if err := GenerateSessionSecret(); err != nil {
+		return []byte{}, err
+	}
+
+	rest, err := os.ReadFile(secretLocation)
+	if err != nil {
+		return []byte{}, errors.Wrap(err, "Error reading secret file")
+	}
+	return rest, nil
 }
diff --git a/oauth2/issuer_metadata.go b/config/issuer_metadata.go
similarity index 93%
rename from oauth2/issuer_metadata.go
rename to config/issuer_metadata.go
index c414f0b55..4ed7b2b40 100644
--- a/oauth2/issuer_metadata.go
+++ b/config/issuer_metadata.go
@@ -16,7 +16,7 @@
  *
  ***************************************************************/
 
-package oauth2
+package config
 
 import (
 	"encoding/json"
@@ -32,7 +32,9 @@ type OauthIssuer struct {
 	DeviceAuthURL   string   `json:"device_authorization_endpoint"`
 	TokenURL        string   `json:"token_endpoint"`
 	RegistrationURL string   `json:"registration_endpoint"`
+	UserInfoURL     string   `json:"userinfo_endpoint"`
 	GrantTypes      []string `json:"grant_types_supported"`
+	ScopesSupported []string `json:"scopes_supported"`
 }
 
 func GetIssuerMetadata(issuer_url string) (*OauthIssuer, error) {
diff --git a/config/mkdirall.go b/config/mkdirall.go
index 1e5411058..e559f98d7 100644
--- a/config/mkdirall.go
+++ b/config/mkdirall.go
@@ -20,7 +20,11 @@ package config
 
 import (
 	"os"
+	"os/exec"
+	"runtime"
 	"syscall"
+
+	"github.com/pkg/errors"
 )
 
 // This is the pelican version of `MkdirAll`; ensures that any created directory
@@ -69,5 +73,31 @@ func MkdirAll(path string, perm os.FileMode, uid int, gid int) error {
 		}
 		return err
 	}
-	return os.Chown(path, uid, gid)
+
+	user, err := GetDaemonUser()
+	if err != nil {
+		return err
+	}
+	groupname, err := GetDaemonGroup()
+	if err != nil {
+		return err
+	}
+
+	// Windows does not have "chown", has to work differently
+	currentOS := runtime.GOOS
+	if currentOS == "windows" {
+		cmd := exec.Command("icacls", path, "/grant", user+":F")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			return errors.Wrapf(err, "Failed to chown directory %v to groupname %v: %s",
+				path, groupname, string(output))
+		}
+		return nil
+	} else { // Else we are running on linux/mac
+		if err = os.Chown(path, uid, gid); err != nil {
+			return errors.Wrapf(err, "Failed to chown directory %v to groupname %v",
+				path, groupname)
+		}
+	}
+	return nil
 }
diff --git a/config/oidc_metadata.go b/config/oidc_metadata.go
new file mode 100644
index 000000000..7de631fb5
--- /dev/null
+++ b/config/oidc_metadata.go
@@ -0,0 +1,175 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package config
+
+import (
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+)
+
+var (
+	onceMetadata  sync.Once
+	metadataError error
+	oidcMetadata  *OauthIssuer
+
+	onceClient   sync.Once
+	clientError  error
+	clientID     string
+	clientSecret string
+)
+
+func getMetadata() {
+
+	issuerUrl := param.OIDC_Issuer.GetString()
+	if issuerUrl == "" {
+		metadataError = errors.New("OIDC.Issuer is not set; unable to do metadata discovery")
+		return
+	}
+	log.Debugln("Getting OIDC issuer metadata via URL", issuerUrl)
+	metadata, err := GetIssuerMetadata(issuerUrl)
+	if err != nil {
+		metadataError = err
+		return
+	}
+	oidcMetadata = metadata
+
+	if param.OIDC_DeviceAuthEndpoint.GetString() == "" {
+		viper.Set("OIDC.DeviceAuthEndpoint", metadata.DeviceAuthURL)
+	}
+	if param.OIDC_TokenEndpoint.GetString() == "" {
+		viper.Set("OIDC.TokenEndpoint", metadata.TokenURL)
+	}
+	if param.OIDC_UserInfoEndpoint.GetString() == "" {
+		viper.Set("OIDC.UserInfoEndpoint", metadata.UserInfoURL)
+	}
+	if param.OIDC_AuthorizationEndpoint.GetString() == "" {
+		viper.Set("OIDC.AuthorizationEndpoint", metadata.AuthURL)
+	}
+}
+
+func getMetadataValue(metadataFunc func() string) (result string, err error) {
+	onceMetadata.Do(getMetadata)
+	result = metadataFunc()
+	// Assume if the OIDC value is set then that was from the config file
+	// so we skip any errors
+	if result == "" {
+		err = metadataError
+	}
+	return
+}
+
+func GetOIDCDeviceAuthEndpoint() (result string, err error) {
+	return getMetadataValue(param.OIDC_DeviceAuthEndpoint.GetString)
+}
+
+func GetOIDCTokenEndpoint() (result string, err error) {
+	return getMetadataValue(param.OIDC_TokenEndpoint.GetString)
+}
+
+func GetOIDCUserInfoEndpoint() (result string, err error) {
+	return getMetadataValue(param.OIDC_UserInfoEndpoint.GetString)
+}
+
+func GetOIDCAuthorizationEndpoint() (result string, err error) {
+	return getMetadataValue(param.OIDC_AuthorizationEndpoint.GetString)
+}
+
+func GetOIDCSupportedScopes() (results []string, err error) {
+	onceMetadata.Do(getMetadata)
+	err = metadataError
+	if err != nil {
+		return
+	}
+	results = make([]string, len(oidcMetadata.ScopesSupported))
+	copy(results, oidcMetadata.ScopesSupported)
+	return
+}
+
+func getClientID() {
+	if envID := viper.GetString("OIDCCLIENTID"); envID != "" {
+		clientID = envID
+		return
+	}
+
+	if result := param.OIDC_ClientID.GetString(); result != "" {
+		clientID = result
+		return
+	}
+
+	clientFile := param.OIDC_ClientIDFile.GetString()
+	if clientFile == "" {
+		clientError = errors.New("ClientID is not available; set one of OIDC.ClientID, OIDC.ClientIDFile, or the environment variable PELICAN_OIDCCLIENTID")
+		return
+	}
+	contents, err := os.ReadFile(clientFile)
+	if err != nil {
+		clientError = errors.Wrapf(err, "Failed reading provided OIDC.ClientIDFile %s", clientFile)
+		return
+	}
+	clientID = strings.TrimSpace(string(contents))
+}
+
+func getClientSecret() {
+	if envSecret := viper.GetString("OIDCCLIENTSECRET"); envSecret != "" {
+		clientSecret = envSecret
+		return
+	}
+
+	clientFile := param.OIDC_ClientSecretFile.GetString()
+	if clientFile == "" {
+		clientError = errors.New("An OIDC Client Secret file must be specified in the config " +
+			"(OIDC.ClientSecretFile), or the secret must be provided via the environment " +
+			"variable PELICAN_OIDCCLIENTSECRET")
+		return
+	}
+	contents, err := os.ReadFile(clientFile)
+	if err != nil {
+		clientError = errors.Wrapf(err, "Failed reading provided OIDC.ClientSecretFile %s",
+			clientFile)
+		return
+	}
+	clientSecret = strings.TrimSpace(string(contents))
+}
+
+func getClient() {
+	getClientID()
+	if clientError == nil {
+		getClientSecret()
+	}
+}
+
+func GetOIDCClientID() (result string, err error) {
+	onceClient.Do(getClient)
+	err = clientError
+	result = clientID
+	return
+}
+
+func GetOIDCClientSecret() (result string, err error) {
+	onceClient.Do(getClient)
+	err = clientError
+	result = clientSecret
+	return
+}
diff --git a/config/privs.go b/config/privs.go
index 0134ee207..a1fa53435 100644
--- a/config/privs.go
+++ b/config/privs.go
@@ -19,76 +19,131 @@
 package config
 
 import (
+	"math"
 	"os/user"
+	"runtime"
 	"strconv"
+	"strings"
 
 	"github.com/pkg/errors"
 )
 
+type User struct {
+	Uid       int
+	Gid       int
+	Sid       string
+	Username  string
+	Groupname string
+	err       error
+}
+
 var (
 	isRootExec bool
 
-	uidErr      error
-	gidErr      error
-	usernameErr error
-	groupErr    error
-
-	uid      int
-	gid      int
-	username string
-	group    string
+	xrootdUser User
+	oa4mpUser  User
 )
 
 func init() {
 	userObj, err := user.Current()
 	isRootExec = err == nil && userObj.Username == "root"
 
-	uid = -1
-	gid = -1
-	if err != nil {
-		uidErr = err
-		gidErr = err
-		usernameErr = err
-		groupErr = err
-		return
-	}
-	desiredUsername := userObj.Username
+	xrootdUser = newUser()
+	oa4mpUser = newUser()
+
 	if isRootExec {
-		desiredUsername = "xrootd"
-		userObj, err = user.Lookup(desiredUsername)
+		xrootdUser = initUserObject("xrootd", nil)
+		oa4mpUser = initUserObject("tomcat", nil)
+	} else if err != nil {
+		xrootdUser.err = err
+		oa4mpUser.err = err
+	} else {
+		xrootdUser = initUserObject(userObj.Username, userObj)
+		oa4mpUser = initUserObject(userObj.Username, userObj)
+	}
+}
+
+func initUserObject(desiredUsername string, userObj *user.User) User {
+	result := newUser()
+	result.Username = desiredUsername
+	if userObj == nil {
+		userObjNew, err := user.Lookup(desiredUsername)
 		if err != nil {
-			err = errors.Wrap(err, "Unable to lookup the xrootd runtime user"+
-				" information; does the xrootd user exist?")
-			uidErr = err
-			gidErr = err
-			usernameErr = err
-			groupErr = err
-			return
+			err = errors.Wrapf(err, "Unable to lookup the runtime user"+
+				" information; does the %s user exist?", desiredUsername)
+			result.err = err
+			return result
 		}
+		userObj = userObjNew
 	}
-	username = desiredUsername
-	uid, err = strconv.Atoi(userObj.Uid)
-	if err != nil {
-		uid = -1
-		uidErr = err
-	}
-	gid, err = strconv.Atoi(userObj.Gid)
-	if err != nil {
-		gid = -1
-		gidErr = err
-	}
-	groupObj, err := user.LookupGroupId(userObj.Gid)
-	if err == nil {
-		group = groupObj.Name
-	} else {
-		// Fall back to using the GID as the group name.  This is done because,
-		// currently, the group name is just for logging strings.  The group name
-		// lookup often fails because we've disabled CGO and only CGO will use the
-		// full glibc stack to resolve information via SSSD.
-		//
-		// This decision should be revisited if we ever enable CGO.
-		group = userObj.Gid
+
+	//Windows has userId's different from mac and linux, need to parse to get it
+	currentOS := runtime.GOOS
+	if currentOS == "windows" {
+		//Get the user ID from the SID
+		sidParts := strings.Split(userObj.Uid, "-")
+		uidString := sidParts[len(sidParts)-1]
+		var uid uint64
+		uid, result.err = strconv.ParseUint(uidString, 10, 32)
+		if result.err != nil {
+			result.Uid = -1
+			return result
+		}
+		// On 32-bit systems, converting from uint32 to int may overflow
+		if uid > math.MaxInt {
+			result.Uid = -1
+			result.err = errors.New("UID value overflows on 32-bit system")
+			return result
+		}
+		result.Uid = int(uid)
+		result.Sid = userObj.Gid
+		//group is just the whole SID
+		result.Groupname = userObj.Gid
+	} else { //Mac and linux have similar enough uid's so can group them here
+		var uid uint64
+		uid, result.err = strconv.ParseUint(userObj.Uid, 10, 32)
+		if result.err != nil {
+			result.Uid = -1
+			return result
+		}
+		if uid > math.MaxInt {
+			result.Uid = -1
+			result.err = errors.New("UID value overflows on 32-bit system")
+			return result
+		}
+		result.Uid = int(uid)
+		var gid uint64
+		gid, result.err = strconv.ParseUint(userObj.Gid, 10, 32)
+		if result.err != nil {
+			result.Gid = -1
+			return result
+		}
+		if gid > math.MaxInt {
+			result.Uid = -1
+			result.err = errors.New("GID value overflows on 32-bit system")
+			return result
+		}
+		result.Gid = int(gid)
+		groupObj, err := user.LookupGroupId(userObj.Gid)
+		if err == nil {
+			result.Groupname = groupObj.Name
+		} else {
+			// Fall back to using the GID as the group name.  This is done because,
+			// currently, the group name is just for logging strings.  The group name
+			// lookup often fails because we've disabled CGO and only CGO will use the
+			// full glibc stack to resolve information via SSSD.
+			//
+			// This decision should be revisited if we ever enable CGO.
+			result.Groupname = userObj.Gid
+		}
 	}
+	return result
+}
+
+func newUser() (userObj User) {
+	userObj.Uid = -1
+	userObj.Gid = -1
+	return
 }
 
 func IsRootExecution() bool {
@@ -96,17 +151,29 @@ func IsRootExecution() bool {
 }
 
 func GetDaemonUID() (int, error) {
-	return uid, uidErr
+	return xrootdUser.Uid, xrootdUser.err
 }
 
 func GetDaemonUser() (string, error) {
-	return username, usernameErr
+	return xrootdUser.Username, xrootdUser.err
+}
+
+func GetDaemonUserInfo() (User, error) {
+	return xrootdUser, xrootdUser.err
 }
 
 func GetDaemonGID() (int, error) {
-	return gid, gidErr
+	return xrootdUser.Gid, xrootdUser.err
+}
+
+func GetDaemonSID() (string, error) {
+	return xrootdUser.Sid, xrootdUser.err
 }
 
 func GetDaemonGroup() (string, error) {
-	return group, groupErr
+	return xrootdUser.Groupname, xrootdUser.err
+}
+
+func GetOA4MPUser() (User, error) {
+	return oa4mpUser, oa4mpUser.err
 }
diff --git a/config/resources/defaults.yaml b/config/resources/defaults.yaml
index a58d0c59d..4c0eb5fc2 100644
--- a/config/resources/defaults.yaml
+++ b/config/resources/defaults.yaml
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -14,27 +14,59 @@
 # limitations under the License.
 #
 
-Port: 8443
-WebPort: 8444
-WebAddress: "0.0.0.0"
-ManagerPort: 1213
-SummaryMonitoringPort: 9931
-DetailedMonitoringPort: 9930
-MonitoringPortLower: 9930
-MonitoringPortHigher: 9999
-Mount: ""
-NamespacePrefix: ""
 Debug: false
+Logging:
+  Level: "Error"
+Server:
+  WebPort: 8444
+  WebHost: "0.0.0.0"
+  EnableUI: true
+  RegistrationRetryInterval: 10s
 Director:
   DefaultResponse: cache
+  AdvertisementTTL: 15m
+  OriginCacheHealthTestInterval: 15s
+Cache:
+  Port: 8443
 Origin:
+  NamespacePrefix: ""
   Multiuser: false
+  EnableMacaroons: false
+  EnableVoms: true
+  EnableUI: true
+  EnableWrite: true
+  SelfTest: true
+Registry:
+  InstitutionsUrlReloadMinutes: 15m
+Monitoring:
+  PortLower: 9930
+  PortHigher: 9999
+  TokenExpiresIn: 1h
+  TokenRefreshInterval: 59m
+  MetricAuthorization: true
+  AggregatePrefixes: ["/*"]
+Xrootd:
+  Port: 8443
+  Mount: ""
+  ManagerPort: 1213
+  DetailedMonitoringPort: 9930
+  SummaryMonitoringPort: 9931
 Transport:
-  Dialer:
-    Timeout: 10s
-    KeepAlive: 30s
+  DialerTimeout: 10s
+  DialerKeepAlive: 30s
   MaxIdleConns: 30
   IdleConnTimeout: 90s
   TLSHandshakeTimeout: 15s
   ExpectContinueTimeout: 1s
   ResponseHeaderTimeout: 10s
+OIDC:
+  AuthorizationEndpoint: "https://cilogon.org/authorize"
+  DeviceAuthEndpoint: "https://cilogon.org/oauth2/device_authorization"
+  TokenEndpoint: "https://cilogon.org/oauth2/token"
+  UserInfoEndpoint: "https://cilogon.org/oauth2/userinfo"
+Issuer:
+  TomcatLocation: /opt/tomcat
+  ScitokensServerLocation: /opt/scitokens-server
+  QDLLocation: /opt/qdl
+  OIDCAuthenticationUserClaim: sub
+  AuthenticationSource: OIDC
diff --git a/config/resources/osdf.yaml b/config/resources/osdf.yaml
index d3540573b..528145787 100644
--- a/config/resources/osdf.yaml
+++ b/config/resources/osdf.yaml
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -14,8 +14,11 @@
 # limitations under the License.
 #
 
-ManagerHost: redirector.osgstorage.org
-SummaryMonitoringHost: xrd-report.osgstorage.org
-DetailedMonitoringHost: xrd-mon.osgstorage.org
-TopologyNamespaceURL: https://topology.opensciencegrid.org/stashcache/namespaces.json
-FederationURL: osg-htc.org
+Xrootd:
+  ManagerHost: redirector.osgstorage.org
+  SummaryMonitoringHost: xrd-report.osgstorage.org
+  DetailedMonitoringHost: xrd-mon.osgstorage.org
+Federation:
+  DiscoveryUrl: osg-htc.org
+  TopologyNamespaceURL: https://topology.opensciencegrid.org/osdf/namespaces
+  TopologyReloadInterval: 10
diff --git a/daemon/launch.go b/daemon/launch.go
new file mode 100644
index 000000000..3034bd405
--- /dev/null
+++ b/daemon/launch.go
@@ -0,0 +1,40 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package daemon
+
+import (
+	"context"
+)
+
+type (
+	Launcher interface {
+		Name() string
+		Launch(ctx context.Context) (context.Context, int, error)
+	}
+
+	DaemonLauncher struct {
+		DaemonName string
+		Args       []string
+		Uid        int
+		Gid        int
+	}
+)
+
+func (launcher DaemonLauncher) Name() string {
+	return launcher.DaemonName
+}
diff --git a/daemon/launch_unix.go b/daemon/launch_unix.go
new file mode 100644
index 000000000..2bde98cc3
--- /dev/null
+++ b/daemon/launch_unix.go
@@ -0,0 +1,209 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package daemon
+
+import (
+	"bufio"
+	"context"
+	_ "embed"
+	"io"
+	"os"
+	"os/exec"
+	"os/signal"
+	"reflect"
+	"syscall"
+	"time"
+
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+type (
+	launchInfo struct {
+		ctx    context.Context
+		expiry time.Time
+		pid    int
+		name   string
+	}
+)
+
+func ForwardCommandToLogger(ctx context.Context, daemonName string, cmdStdout io.ReadCloser, cmdStderr io.ReadCloser) {
+	cmd_logger := log.WithFields(log.Fields{"daemon": daemonName})
+	stdout_scanner := bufio.NewScanner(cmdStdout)
+	stdout_lines := make(chan string, 10)
+
+	stderr_scanner := bufio.NewScanner(cmdStderr)
+	stderr_lines := make(chan string, 10)
+	go func() {
+		defer close(stdout_lines)
+		for stdout_scanner.Scan() {
+			stdout_lines <- stdout_scanner.Text()
+		}
+	}()
+	go func() {
+		defer close(stderr_lines)
+		for stderr_scanner.Scan() {
+			stderr_lines <- stderr_scanner.Text()
+		}
+	}()
+	for {
+		select {
+		case stdout_line, ok := <-stdout_lines:
+			if ok {
+				cmd_logger.Info(stdout_line)
+			} else {
+				stdout_lines = nil
+			}
+		case stderr_line, ok := <-stderr_lines:
+			if ok {
+				cmd_logger.Info(stderr_line)
+			} else {
+				stderr_lines = nil
+			}
+		}
+		if stdout_lines == nil && stderr_lines == nil {
+			break
+		}
+	}
+	<-ctx.Done()
+}
+
+func (launcher DaemonLauncher) Launch(ctx context.Context) (context.Context, int, error) {
+
+	cmd := exec.CommandContext(ctx, launcher.Args[0], launcher.Args[1:]...)
+	if cmd.Err != nil {
+		return ctx, -1, cmd.Err
+	}
+	cmdStdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return ctx, -1, err
+	}
+	cmdStderr, err := cmd.StderrPipe()
+	if err != nil {
+		return ctx, -1, err
+	}
+
+	if launcher.Uid != -1 && launcher.Gid != -1 {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+		cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(launcher.Uid), Gid: uint32(launcher.Gid)}
+		log.Infof("Will launch daemon %q with UID %v and GID %v", launcher.DaemonName, launcher.Uid, launcher.Gid)
+	} else if launcher.Uid != -1 || launcher.Gid != -1 {
+		return ctx, -1, errors.New("If either uid or gid is specified for daemon, both must be specified")
+	}
+
+	if err := cmd.Start(); err != nil {
+		return ctx, -1, err
+	}
+	go ForwardCommandToLogger(ctx, launcher.Name(), cmdStdout, cmdStderr)
+
+	ctx_result, cancel := context.WithCancelCause(ctx)
+	go func() {
+		cancel(cmd.Wait())
+	}()
+	return ctx_result, cmd.Process.Pid, nil
+}
+
+func LaunchDaemons(ctx context.Context, launchers []Launcher, egrp *errgroup.Group) (err error) {
+
+	daemons := make([]launchInfo, len(launchers))
+	for idx, daemon := range launchers {
+		ctx, pid, err := daemon.Launch(ctx)
+		if err != nil {
+			err = errors.Wrapf(err, "Failed to launch %s daemon", daemon.Name())
+			// This is secure as long as deamon.Name() is either "xrootd" or "cmsd"
+			metrics.SetComponentHealthStatus(metrics.HealthStatusComponent(daemon.Name()), metrics.StatusCritical, err.Error())
+			return err
+		}
+		daemons[idx].ctx = ctx
+		daemons[idx].pid = pid
+		daemons[idx].name = daemon.Name()
+		log.Infoln("Successfully launched", daemon.Name())
+		metrics.SetComponentHealthStatus(metrics.HealthStatusComponent(daemon.Name()), metrics.StatusOK, "")
+	}
+
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
+	cases := make([]reflect.SelectCase, len(daemons)+2)
+	for idx, daemon := range daemons {
+		cases[idx].Dir = reflect.SelectRecv
+		cases[idx].Chan = reflect.ValueOf(daemon.ctx.Done())
+	}
+	cases[len(daemons)].Dir = reflect.SelectRecv
+	cases[len(daemons)].Chan = reflect.ValueOf(sigs)
+	cases[len(daemons)+1].Dir = reflect.SelectRecv
+
+	egrp.Go(func() error {
+		for {
+			timer := time.NewTimer(time.Second)
+			cases[len(daemons)+1].Chan = reflect.ValueOf(timer.C)
+
+			chosen, recv, _ := reflect.Select(cases)
+			if chosen == len(daemons) {
+				sys_sig, ok := recv.Interface().(syscall.Signal)
+				if !ok {
+					panic(errors.New("Unable to convert signal to syscall.Signal"))
+				}
+				log.Warnf("Forwarding signal %v to daemons\n", sys_sig)
+				var lastErr error
+				for idx, daemon := range daemons {
+					if err = syscall.Kill(daemon.pid, sys_sig); err != nil {
+						lastErr = errors.Wrapf(err, "Failed to forward signal to %s process", launchers[idx].Name())
+					}
+					daemon.expiry = time.Now().Add(10 * time.Second)
+					log.Infof("Daemon %q with pid %d was killed", daemon.name, daemon.pid)
+				}
+				if lastErr != nil {
+					log.Errorln("Last error when killing launched daemons:", lastErr)
+					return lastErr
+				}
+			} else if chosen < len(daemons) {
+				if waitResult := context.Cause(daemons[chosen].ctx); waitResult != nil {
+					if !daemons[chosen].expiry.IsZero() {
+						return nil
+					} else if errors.Is(waitResult, context.Canceled) {
+						return nil
+					}
+					metrics.SetComponentHealthStatus(metrics.HealthStatusComponent(launchers[chosen].Name()), metrics.StatusCritical,
+						"process failed unexpectedly")
+					err = errors.Wrapf(waitResult, "%s process failed unexpectedly", launchers[chosen].Name())
+					log.Errorln(err)
+					return err
+				}
+				log.Debugln("Daemons have been shut down successfully")
+				return nil
+			} else {
+				for idx, daemon := range daemons {
+					if !daemon.expiry.IsZero() && time.Now().After(daemon.expiry) {
+						if err = syscall.Kill(daemon.pid, syscall.SIGKILL); err != nil {
+							err = errors.Wrapf(err, "Failed to SIGKILL the %s process", launchers[idx].Name())
+							log.Errorln(err)
+							return err
+						}
+					}
+				}
+			}
+		}
+	})
+
+	return nil
+}
diff --git a/daemon/launch_windows.go b/daemon/launch_windows.go
new file mode 100644
index 000000000..32dbace20
--- /dev/null
+++ b/daemon/launch_windows.go
@@ -0,0 +1,41 @@
+//go:build windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package daemon
+
+import (
+	"context"
+	"io"
+
+	"github.com/pkg/errors"
+	"golang.org/x/sync/errgroup"
+)
+
+func LaunchDaemons(ctx context.Context, launchers []Launcher, egrp *errgroup.Group) (err error) {
+	return errors.New("launching daemons is not supported on Windows")
+}
+
+func (launcher DaemonLauncher) Launch(ctx context.Context) (context.Context, int, error) {
+	return context.Background(), -1, errors.New("launching daemons is not supported on Windows")
+}
+
+func ForwardCommandToLogger(ctx context.Context, daemonName string, cmdStdout io.ReadCloser, cmdStderr io.ReadCloser) {
+	return
+}
diff --git a/director/advertise.go b/director/advertise.go
index 4357d1768..ba32f1cb3 100644
--- a/director/advertise.go
+++ b/director/advertise.go
@@ -19,85 +19,58 @@
 package director
 
 import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
+	"context"
 	"net/url"
 	"strings"
 	"time"
 
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
-)
-
-type (
-	Server struct {
-		AuthEndpoint string `json:"auth_endpoint"`
-		Endpoint     string `json:"endpoint"`
-		Resource     string `json:"resource"`
-	}
-
-	CredentialGeneration struct {
-		BasePath      string `json:"base_path"`
-		Issuer        string `json:"issuer"`
-		MaxScopeDepth int    `json:"max_scope_depth"`
-		Strategy      string `json:"strategy"`
-		VaultIssuer   string `json:"vault_issuer"`
-		VaultServer   string `json:"vault_server"`
-	}
 
-	Namespace struct {
-		Caches               []Server             `json:"caches"`
-		Origins              []Server             `json:"origins"`
-		CredentialGeneration CredentialGeneration `json:"credential_generation"`
-		DirlistHost          string               `json:"dirlisthost"`
-		Path                 string               `json:"path"`
-		ReadHTTPS            bool                 `json:"readhttps"`
-		UseTokenOnRead       bool                 `json:"usetokenonread"`
-		WritebackHost        string               `json:"writebackhost"`
-	}
-
-	NamespaceJSON struct {
-		Caches     []Server    `json:"caches"`
-		Namespaces []Namespace `json:"namespaces"`
-	}
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/utils"
 )
 
-// Populate internal cache with origin/cache ads
-func AdvertiseOSDF() error {
-	namespaceURL := viper.GetString("TopologyNamespaceURL")
-	if namespaceURL == "" {
-		return errors.New("Topology namespaces.json configuration option (`TopologyNamespaceURL`) not set")
+func parseServerAd(server utils.Server, serverType ServerType) ServerAd {
+	serverAd := ServerAd{}
+	serverAd.Type = serverType
+	serverAd.Name = server.Resource
+
+	serverAd.EnableWrite = param.Origin_EnableWrite.GetBool()
+	// url.Parse requires that the scheme be present before the hostname,
+	// but endpoints do not have a scheme. As such, we need to add one for the.
+	// correct parsing. Luckily, we don't use this anywhere else (it's just to
+	// make the url.Parse function behave as expected)
+	if !strings.HasPrefix(server.AuthEndpoint, "http") { // just in case there's already an http(s) tacked in front
+		server.AuthEndpoint = "https://" + server.AuthEndpoint
 	}
-
-	req, err := http.NewRequest("GET", namespaceURL, nil)
+	if !strings.HasPrefix(server.Endpoint, "http") { // just in case there's already an http(s) tacked in front
+		server.Endpoint = "http://" + server.Endpoint
+	}
+	serverAuthUrl, err := url.Parse(server.AuthEndpoint)
 	if err != nil {
-		return errors.Wrap(err, "Failure when getting OSDF namespace data from topology")
+		log.Warningf("Namespace JSON returned server %s with invalid authenticated URL %s",
+			server.Resource, server.AuthEndpoint)
 	}
+	serverAd.AuthURL = *serverAuthUrl
 
-	req.Header.Set("Accept", "application/json")
-
-	client := http.Client{}
-	resp, err := client.Do(req)
+	serverUrl, err := url.Parse(server.Endpoint)
 	if err != nil {
-		return errors.Wrap(err, "Failure when getting response for OSDF namespace data")
+		log.Warningf("Namespace JSON returned server %s with invalid unauthenticated URL %s",
+			server.Resource, server.Endpoint)
 	}
-	defer resp.Body.Close()
+	serverAd.URL = *serverUrl
 
-	if resp.StatusCode > 299 {
-		return fmt.Errorf("Error response %v from OSDF namespace endpoint: %v", resp.StatusCode, resp.Status)
-	}
+	// We will leave serverAd.WebURL as empty when fetched from topology
 
-	respBytes, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return errors.Wrap(err, "Failure when reading OSDF namespace response")
-	}
+	return serverAd
+}
 
-	var namespaces NamespaceJSON
-	if err = json.Unmarshal(respBytes, &namespaces); err != nil {
-		return errors.Wrapf(err, "Failure when parsing JSON response from topology URL %v", namespaceURL)
+// Populate internal cache with origin/cache ads
+func AdvertiseOSDF() error {
+	namespaces, err := utils.GetTopologyJSON()
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get topology JSON")
 	}
 
 	cacheAdMap := make(map[ServerAd][]NamespaceAd)
@@ -106,6 +79,7 @@ func AdvertiseOSDF() error {
 		nsAd := NamespaceAd{}
 		nsAd.RequireToken = ns.UseTokenOnRead
 		nsAd.Path = ns.Path
+		nsAd.DirlistHost = ns.DirlistHost
 		issuerURL, err := url.Parse(ns.CredentialGeneration.Issuer)
 		if err != nil {
 			log.Warningf("Invalid URL %v when parsing topology response: %v\n", ns.CredentialGeneration.Issuer, err)
@@ -122,65 +96,13 @@ func AdvertiseOSDF() error {
 		// they're listed as inactive by topology). These namespaces will all be mapped to the
 		// same useless origin ad, resulting in a 404 for queries to those namespaces
 		for _, origin := range ns.Origins {
-			originAd := ServerAd{}
-			originAd.Type = OriginType
-			originAd.Name = origin.Resource
-			// url.Parse requires that the scheme be present before the hostname,
-			// but endpoints do not have a scheme. As such, we need to add one for the.
-			// correct parsing. Luckily, we don't use this anywhere else (it's just to
-			// make the url.Parse function behave as expected)
-			if !strings.HasPrefix(origin.AuthEndpoint, "http") { // just in case there's already an http(s) tacked in front
-				origin.AuthEndpoint = "https://" + origin.AuthEndpoint
-			}
-			if !strings.HasPrefix(origin.Endpoint, "http") { // just in case there's already an http(s) tacked in front
-				origin.Endpoint = "http://" + origin.Endpoint
-			}
-			originAuthURL, err := url.Parse(origin.AuthEndpoint)
-			if err != nil {
-				log.Warningf("Namespace JSON returned origin %s with invalid authenticated URL %s",
-					origin.Resource, origin.AuthEndpoint)
-			}
-			originAd.AuthURL = *originAuthURL
-			originURL, err := url.Parse(origin.Endpoint)
-			if err != nil {
-				log.Warningf("Namespace JSON returned origin %s with invalid unauthenticated URL %s",
-					origin.Resource, origin.Endpoint)
-			}
-			originAd.URL = *originURL
-
+			originAd := parseServerAd(origin, OriginType)
 			originAdMap[originAd] = append(originAdMap[originAd], nsAd)
 		}
 
 		for _, cache := range ns.Caches {
-			cacheAd := ServerAd{}
-			cacheAd.Type = CacheType
-			cacheAd.Name = cache.Resource
-
-			if !strings.HasPrefix(cache.AuthEndpoint, "http") { // just in case there's already an http(s) tacked in front
-				cache.AuthEndpoint = "https://" + cache.AuthEndpoint
-			}
-			if !strings.HasPrefix(cache.Endpoint, "http") { // just in case there's already an http(s) tacked in front
-				cache.Endpoint = "http://" + cache.Endpoint
-			}
-			cacheAuthURL, err := url.Parse(cache.AuthEndpoint)
-			if err != nil {
-				log.Warningf("Namespace JSON returned cache %s with invalid authenticated URL %s",
-					cache.Resource, cache.AuthEndpoint)
-			}
-			cacheAd.AuthURL = *cacheAuthURL
-
-			cacheURL, err := url.Parse(cache.Endpoint)
-			if err != nil {
-				log.Warningf("Namespace JSON returned cache %s with invalid unauthenticated URL %s",
-					cache.Resource, cache.Endpoint)
-			}
-			cacheAd.URL = *cacheURL
-
-			cacheNS := NamespaceAd{}
-			cacheNS.Path = ns.Path
-			cacheNS.RequireToken = ns.UseTokenOnRead
-			cacheAdMap[cacheAd] = append(cacheAdMap[cacheAd], cacheNS)
-
+			cacheAd := parseServerAd(cache, CacheType)
+			cacheAdMap[cacheAd] = append(cacheAdMap[cacheAd], nsAd)
 		}
 	}
 
@@ -195,16 +117,21 @@ func AdvertiseOSDF() error {
 	return nil
 }
 
-func PeriodicCacheReload() {
+func PeriodicCacheReload(ctx context.Context) {
+	ticker := time.NewTicker(param.Federation_TopologyReloadInterval.GetDuration())
 	for {
-		// The ad cache times out every 15 minutes, so update it every
-		// 10. If a key isn't updated, it will survive for 5 minutes
-		// and then disappear
-		time.Sleep(time.Minute * 10)
-		err := AdvertiseOSDF()
-		if err != nil {
-			log.Warningf("Failed to re-advertise: %s. Will try again later",
-				err)
+		select {
+		case <-ticker.C:
+			// The ad cache times out every 15 minutes, so update it every
+			// 10. If a key isn't updated, it will survive for 5 minutes
+			// and then disappear
+			err := AdvertiseOSDF()
+			if err != nil {
+				log.Warningf("Failed to re-advertise: %s. Will try again later",
+					err)
+			}
+		case <-ctx.Done():
+			return
 		}
 	}
 }
diff --git a/director/advertise_test.go b/director/advertise_test.go
new file mode 100644
index 000000000..97521d440
--- /dev/null
+++ b/director/advertise_test.go
@@ -0,0 +1,132 @@
+package director
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/pelicanplatform/pelican/utils"
+)
+
+func TestParseServerAd(t *testing.T) {
+
+	server := utils.Server{
+		AuthEndpoint: "https://my-auth-endpoint.com",
+		Endpoint:     "http://my-endpoint.com",
+		Resource:     "MY_SERVER",
+	}
+
+	// Check that we populate all of the fields correctly -- note that lat/long don't get updated
+	// until right before the ad is recorded, so we don't check for that here.
+	ad := parseServerAd(server, OriginType)
+	assert.Equal(t, ad.AuthURL.String(), "https://my-auth-endpoint.com")
+	assert.Equal(t, ad.URL.String(), "http://my-endpoint.com")
+	assert.Equal(t, ad.WebURL.String(), "")
+	assert.Equal(t, ad.Name, "MY_SERVER")
+	assert.True(t, ad.Type == OriginType)
+
+	// A quick check that type is set correctly
+	ad = parseServerAd(server, CacheType)
+	assert.True(t, ad.Type == CacheType)
+}
+
+func JSONHandler(w http.ResponseWriter, r *http.Request) {
+	jsonResponse := `
+	{
+		"caches": [
+			{
+				"auth_endpoint": "https://cache-auth-endpoint.com",
+				"endpoint": "http://cache-endpoint.com",
+				"resource": "MY_CACHE"
+			}
+		],
+		"namespaces": [
+			{
+				"caches": [
+					{
+						"auth_endpoint": "https://cache-auth-endpoint.com",
+						"endpoint": "http://cache-endpoint.com",
+						"resource": "MY_CACHE"
+					}
+				],
+				"credential_generation": {
+					"base_path": "/server",
+					"issuer": "https://my-issuer.com",
+					"max_scope_depth": 3,
+					"strategy": "OAuth2",
+					"vault_issuer": null,
+					"vault_server": null
+				},
+				"dirlisthost": null,
+				"origins": [
+					{
+						"auth_endpoint": "https://origin1-auth-endpoint.com",
+						"endpoint": "http://origin1-endpoint.com",
+						"resource": "MY_ORIGIN1"
+					}
+				],
+				"path": "/my/server",
+				"readhttps": true,
+				"usetokenonread": true,
+				"writebackhost": "https://writeback.my-server.com"
+			},
+			{
+				"caches": [
+					{
+						"auth_endpoint": "https://cache-auth-endpoint.com",
+						"endpoint": "http://cache-endpoint.com",
+						"resource": "MY_CACHE"
+					}
+				],
+				"credential_generation": null,
+				"dirlisthost": null,
+				"origins": [
+					{
+						"auth_endpoint": "https://origin2-auth-endpoint.com",
+						"endpoint": "http://origin2-endpoint.com",
+						"resource": "MY_ORIGIN2"
+					}
+				],
+				"path": "/my/server/2",
+				"readhttps": true,
+				"usetokenonread": false,
+				"writebackhost": null
+			}
+		]
+	}
+	`
+
+	// Set the Content-Type header to indicate JSON.
+	w.Header().Set("Content-Type", "application/json")
+
+	// Write the JSON response to the response body.
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte(jsonResponse))
+}
+func TestAdvertiseOSDF(t *testing.T) {
+	viper.Reset()
+	topoServer := httptest.NewServer(http.HandlerFunc(JSONHandler))
+	defer topoServer.Close()
+	viper.Set("Federation.TopologyNamespaceUrl", topoServer.URL)
+
+	err := AdvertiseOSDF()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Test a few values. If they're correct, it indicates the whole process likely succeeded
+	nsAd, oAds, cAds := GetAdsForPath("/my/server/path/to/file")
+	assert.Equal(t, nsAd.Path, "/my/server")
+	assert.Equal(t, nsAd.MaxScopeDepth, uint(3))
+	assert.Equal(t, oAds[0].AuthURL.String(), "https://origin1-auth-endpoint.com")
+	assert.Equal(t, cAds[0].URL.String(), "http://cache-endpoint.com")
+
+	nsAd, oAds, cAds = GetAdsForPath("/my/server/2/path/to/file")
+	assert.Equal(t, nsAd.Path, "/my/server/2")
+	assert.Equal(t, nsAd.RequireToken, false)
+	assert.Equal(t, oAds[0].AuthURL.String(), "https://origin2-auth-endpoint.com")
+	assert.Equal(t, cAds[0].URL.String(), "http://cache-endpoint.com")
+}
diff --git a/director/cache_ads.go b/director/cache_ads.go
index eb49f6c6d..638149a97 100644
--- a/director/cache_ads.go
+++ b/director/cache_ads.go
@@ -30,27 +30,32 @@ import (
 	"time"
 
 	"github.com/jellydator/ttlcache/v3"
+	"github.com/pelicanplatform/pelican/param"
 	log "github.com/sirupsen/logrus"
 )
 
 type (
 	NamespaceAd struct {
-		RequireToken  bool
-		Path          string
-		Issuer        url.URL
-		MaxScopeDepth uint
-		Strategy      StrategyType
-		BasePath      string
-		VaultServer   string
+		RequireToken  bool         `json:"requireToken"`
+		Path          string       `json:"path"`
+		Issuer        url.URL      `json:"url"`
+		MaxScopeDepth uint         `json:"maxScopeDepth"`
+		Strategy      StrategyType `json:"strategy"`
+		BasePath      string       `json:"basePath"`
+		VaultServer   string       `json:"vaultServer"`
+		DirlistHost   string       `json:"dirlisthost"`
 	}
 
 	ServerAd struct {
-		Name      string
-		AuthURL   url.URL
-		URL       url.URL
-		Type      ServerType
-		Latitude  float64
-		Longitude float64
+		Name               string
+		AuthURL            url.URL
+		URL                url.URL // This is server's XRootD URL for file transfer
+		WebURL             url.URL // This is server's Web interface and API
+		Type               ServerType
+		Latitude           float64
+		Longitude          float64
+		EnableWrite        bool
+		EnableFallbackRead bool // True if reads from the origin are permitted when no cache is available
 	}
 
 	ServerType   string
@@ -78,7 +83,13 @@ func RecordAd(ad ServerAd, namespaceAds *[]NamespaceAd) {
 	}
 	serverAdMutex.Lock()
 	defer serverAdMutex.Unlock()
-	serverAds.Set(ad, *namespaceAds, ttlcache.DefaultTTL)
+
+	customTTL := param.Director_AdvertisementTTL.GetDuration()
+	if customTTL == 0 {
+		serverAds.Set(ad, *namespaceAds, ttlcache.DefaultTTL)
+	} else {
+		serverAds.Set(ad, *namespaceAds, customTTL)
+	}
 }
 
 func UpdateLatLong(ad *ServerAd) error {
@@ -107,46 +118,90 @@ func UpdateLatLong(ad *ServerAd) error {
 }
 
 func matchesPrefix(reqPath string, namespaceAds []NamespaceAd) *NamespaceAd {
+	var best *NamespaceAd
+
 	for _, namespace := range namespaceAds {
 		serverPath := namespace.Path
 		if strings.Compare(serverPath, reqPath) == 0 {
 			return &namespace
 		}
+
 		// Some namespaces in Topology already have the trailing /, some don't
 		// Perhaps this should be standardized, but in case it isn't we need to
-		// handle it
+		// handle it throughout this function. Note that reqPath already has the
+		// tail from being called by GetAdsForPath
 		if serverPath[len(serverPath)-1:] != "/" {
 			serverPath += "/"
 		}
-		if strings.HasPrefix(reqPath, serverPath) {
-			return &namespace
+
+		// The assignment of best doesn't account for the trailing / that we need to consider
+		// Account for that by setting up a tmpBest string that adds the / if needed
+		var tmpBest string
+		if best != nil {
+			tmpBest = best.Path
+			if tmpBest[len(tmpBest)-1:] != "/" {
+				tmpBest += "/"
+			}
+		}
+
+		// Make the len comparison with tmpBest, because serverPath is one char longer now
+		if strings.HasPrefix(reqPath, serverPath) && len(serverPath) > len(tmpBest) {
+			if best == nil {
+				best = new(NamespaceAd)
+			}
+			*best = namespace
 		}
 	}
-	return nil
+	return best
 }
 
 func GetAdsForPath(reqPath string) (originNamespace NamespaceAd, originAds []ServerAd, cacheAds []ServerAd) {
 	serverAdMutex.RLock()
 	defer serverAdMutex.RUnlock()
+
+	// Clean the path, but re-append a trailing / to deal with some namespaces
+	// from topo that have a trailing /
 	reqPath = path.Clean(reqPath)
+	reqPath += "/"
 
+	// Iterate through all of the server ads. For each "item", the key
+	// is the server ad itself (either cache or origin), and the value
+	// is a slice of namespace prefixes are supported by that server
+	var best *NamespaceAd
 	for _, item := range serverAds.Items() {
 		if item == nil {
 			continue
 		}
 		serverAd := item.Key()
 		if serverAd.Type == OriginType {
-			ns := matchesPrefix(reqPath, item.Value())
-			if ns != nil {
-				originNamespace = *ns
-				originAds = append(originAds, serverAd)
+			if ns := matchesPrefix(reqPath, item.Value()); ns != nil {
+				if best == nil || len(ns.Path) > len(best.Path) {
+					best = ns
+					// If anything was previously set by a namespace that constituted a shorter
+					// prefix, we overwrite that here because we found a better ns. We also clear
+					// the other slice of server ads, because we know those aren't good anymore
+					originAds = append(originAds[:0], serverAd)
+					cacheAds = []ServerAd{}
+				} else if ns.Path == best.Path {
+					originAds = append(originAds, serverAd)
+				}
 			}
 			continue
 		} else if serverAd.Type == CacheType {
-			if matchesPrefix(reqPath, item.Value()) != nil {
-				cacheAds = append(cacheAds, serverAd)
+			if ns := matchesPrefix(reqPath, item.Value()); ns != nil {
+				if best == nil || len(ns.Path) > len(best.Path) {
+					best = ns
+					cacheAds = append(cacheAds[:0], serverAd)
+					originAds = []ServerAd{}
+				} else if ns.Path == best.Path {
+					cacheAds = append(cacheAds, serverAd)
+				}
 			}
 		}
 	}
+
+	if best != nil {
+		originNamespace = *best
+	}
 	return
 }
diff --git a/director/cache_ads_test.go b/director/cache_ads_test.go
new file mode 100644
index 000000000..cd6cc8474
--- /dev/null
+++ b/director/cache_ads_test.go
@@ -0,0 +1,321 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package director
+
+import (
+	"context"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+func hasServerAdWithName(serverAds []ServerAd, name string) bool {
+	for _, serverAd := range serverAds {
+		if serverAd.Name == name {
+			return true
+		}
+	}
+	return false
+}
+
+// Test getAdsForPath to make sure various nuanced cases work. Under the hood
+// this really tests matchesPrefix, but we test this higher level function to
+// avoid having to mess with the cache.
+func TestGetAdsForPath(t *testing.T) {
+	/*
+		FLOW:
+			- Set up a few dummy namespaces, origin, and cache ads
+			- Record the ads
+			- Query for a few paths and make sure the correct ads are returned
+	*/
+	nsAd1 := NamespaceAd{
+		RequireToken: true,
+		Path:         "/chtc",
+		Issuer: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+	}
+
+	nsAd2 := NamespaceAd{
+		RequireToken: false,
+		Path:         "/chtc/PUBLIC",
+		Issuer: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+	}
+
+	nsAd3 := NamespaceAd{
+		RequireToken: false,
+		Path:         "/chtc/PUBLIC2/",
+		Issuer: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+	}
+
+	cacheAd1 := ServerAd{
+		Name: "cache1",
+		AuthURL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		Type: CacheType,
+	}
+
+	cacheAd2 := ServerAd{
+		Name: "cache2",
+		AuthURL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		Type: CacheType,
+	}
+
+	originAd1 := ServerAd{
+		Name: "origin1",
+		AuthURL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		Type: OriginType,
+	}
+
+	originAd2 := ServerAd{
+		Name: "origin2",
+		AuthURL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "wisc.edu",
+		},
+		Type: OriginType,
+	}
+
+	o1Slice := []NamespaceAd{nsAd1}
+	o2Slice := []NamespaceAd{nsAd2, nsAd3}
+	c1Slice := []NamespaceAd{nsAd1, nsAd2}
+	RecordAd(originAd2, &o2Slice)
+	RecordAd(originAd1, &o1Slice)
+	RecordAd(cacheAd1, &c1Slice)
+	RecordAd(cacheAd2, &o1Slice)
+
+	nsAd, oAds, cAds := GetAdsForPath("/chtc")
+	assert.Equal(t, nsAd.Path, "/chtc")
+	assert.Equal(t, len(oAds), 1)
+	assert.Equal(t, len(cAds), 2)
+	assert.True(t, hasServerAdWithName(oAds, "origin1"))
+	assert.True(t, hasServerAdWithName(cAds, "cache1"))
+	assert.True(t, hasServerAdWithName(cAds, "cache2"))
+
+	nsAd, oAds, cAds = GetAdsForPath("/chtc/")
+	assert.Equal(t, nsAd.Path, "/chtc")
+	assert.Equal(t, len(oAds), 1)
+	assert.Equal(t, len(cAds), 2)
+	assert.True(t, hasServerAdWithName(oAds, "origin1"))
+	assert.True(t, hasServerAdWithName(cAds, "cache1"))
+	assert.True(t, hasServerAdWithName(cAds, "cache2"))
+
+	nsAd, oAds, cAds = GetAdsForPath("/chtc/PUBLI")
+	assert.Equal(t, nsAd.Path, "/chtc")
+	assert.Equal(t, len(oAds), 1)
+	assert.Equal(t, len(cAds), 2)
+	assert.True(t, hasServerAdWithName(oAds, "origin1"))
+	assert.True(t, hasServerAdWithName(cAds, "cache1"))
+	assert.True(t, hasServerAdWithName(cAds, "cache2"))
+
+	nsAd, oAds, cAds = GetAdsForPath("/chtc/PUBLIC")
+	assert.Equal(t, nsAd.Path, "/chtc/PUBLIC")
+	assert.Equal(t, len(oAds), 1)
+	assert.Equal(t, len(cAds), 1)
+	assert.True(t, hasServerAdWithName(oAds, "origin2"))
+	assert.True(t, hasServerAdWithName(cAds, "cache1"))
+
+	nsAd, oAds, cAds = GetAdsForPath("/chtc/PUBLIC2")
+	// since the stored path is actually /chtc/PUBLIC2/, the extra / is returned
+	assert.Equal(t, nsAd.Path, "/chtc/PUBLIC2/")
+	assert.Equal(t, len(oAds), 1)
+	assert.Equal(t, len(cAds), 0)
+	assert.True(t, hasServerAdWithName(oAds, "origin2"))
+
+	// Finally, let's throw in a test for a path we know shouldn't exist
+	// in the ttlcache
+	nsAd, oAds, cAds = GetAdsForPath("/does/not/exist")
+	assert.Equal(t, nsAd.Path, "")
+	assert.Equal(t, len(oAds), 0)
+	assert.Equal(t, len(cAds), 0)
+}
+
+func TestConfigCacheEviction(t *testing.T) {
+	mockPelicanOriginServerAd := ServerAd{
+		Name:    "test-origin-server",
+		AuthURL: url.URL{},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "fake-origin.org:8443",
+		},
+		WebURL: url.URL{
+			Scheme: "https",
+			Host:   "fake-origin.org:8444",
+		},
+		Type:      OriginType,
+		Latitude:  123.05,
+		Longitude: 456.78,
+	}
+	mockNamespaceAd := NamespaceAd{
+		RequireToken:  true,
+		Path:          "/foo/bar/",
+		Issuer:        url.URL{},
+		MaxScopeDepth: 1,
+		Strategy:      "",
+		BasePath:      "",
+		VaultServer:   "",
+	}
+
+	t.Run("evicted-origin-can-cancel-health-test", func(t *testing.T) {
+		// Start cache eviction
+		shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
+		egrp, ctx := errgroup.WithContext(shutdownCtx)
+		ConfigTTLCache(ctx, egrp)
+		defer func() {
+			shutdownCancel()
+			err := egrp.Wait()
+			assert.NoError(t, err)
+		}()
+
+		ctx, cancelFunc := context.WithDeadline(ctx, time.Now().Add(time.Second*5))
+
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.DeleteAll()
+			serverAds.Set(mockPelicanOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+			healthTestCancelFuncsMutex.Lock()
+			defer healthTestCancelFuncsMutex.Unlock()
+			// Clear the map for the new test
+			healthTestCancelFuncs = make(map[ServerAd]context.CancelFunc)
+			healthTestCancelFuncs[mockPelicanOriginServerAd] = cancelFunc
+
+			require.True(t, serverAds.Has(mockPelicanOriginServerAd), "serverAds failed to register the originAd")
+		}()
+
+		cancelChan := make(chan int)
+		go func() {
+			<-ctx.Done()
+			if ctx.Err() == context.Canceled {
+				cancelChan <- 1
+			}
+		}()
+
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.Delete(mockPelicanOriginServerAd) // This should call onEviction handler and close the context
+
+			require.False(t, serverAds.Has(mockPelicanOriginServerAd), "serverAds didn't delete originAd")
+		}()
+
+		// OnEviction is handled on a different goroutine than the cache management
+		// So we want to wait for a bit so that OnEviction can have time to be
+		// executed
+		select {
+		case <-cancelChan:
+			require.True(t, true)
+		case <-time.After(3 * time.Second):
+			require.False(t, true)
+		}
+		func() {
+			healthTestCancelFuncsMutex.RLock()
+			defer healthTestCancelFuncsMutex.RUnlock()
+			assert.True(t, healthTestCancelFuncs[mockPelicanOriginServerAd] == nil, "Evicted origin didn't clear cancelFunc in the map")
+		}()
+	})
+}
+
+func TestServerAdsCacheEviction(t *testing.T) {
+	mockServerAd := ServerAd{Name: "foo", Type: OriginType, URL: url.URL{}}
+
+	t.Run("evict-after-expire-time", func(t *testing.T) {
+		// Start cache eviction
+		shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
+		egrp, ctx := errgroup.WithContext(shutdownCtx)
+		ConfigTTLCache(ctx, egrp)
+		defer func() {
+			shutdownCancel()
+			err := egrp.Wait()
+			assert.NoError(t, err)
+		}()
+
+		deletedChan := make(chan int)
+		cancelChan := make(chan int)
+
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.DeleteAll()
+
+			serverAds.Set(mockServerAd, []NamespaceAd{}, time.Second*2)
+			require.True(t, serverAds.Has(mockServerAd), "Failed to register server Ad")
+		}()
+
+		// Keep checking if the cache item is present until absent or cancelled
+		go func() {
+			for {
+				select {
+				case <-cancelChan:
+					return
+				default:
+					if !serverAds.Has(mockServerAd) {
+						deletedChan <- 1
+						return
+					}
+				}
+			}
+		}()
+
+		// Wait for 3s to check if the expired cache item is evicted
+		select {
+		case <-deletedChan:
+			require.True(t, true)
+		case <-time.After(3 * time.Second):
+			cancelChan <- 1
+			require.False(t, true, "Cache didn't evict expired item")
+		}
+	})
+}
diff --git a/director/director.go b/director/director.go
new file mode 100644
index 000000000..67820c38d
--- /dev/null
+++ b/director/director.go
@@ -0,0 +1,93 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package director
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+type (
+	listServerRequest struct {
+		ServerType string `form:"server_type"` // "cache" or "origin"
+	}
+
+	listServerResponse struct {
+		Name      string     `json:"name"`
+		AuthURL   string     `json:"authUrl"`
+		URL       string     `json:"url"`    // This is server's XRootD URL for file transfer
+		WebURL    string     `json:"webUrl"` // This is server's Web interface and API
+		Type      ServerType `json:"type"`
+		Latitude  float64    `json:"latitude"`
+		Longitude float64    `json:"longitude"`
+	}
+)
+
+func (req listServerRequest) ToInternalServerType() ServerType {
+	if req.ServerType == "cache" {
+		return CacheType
+	}
+	if req.ServerType == "origin" {
+		return OriginType
+	}
+	return ""
+}
+
+func listServers(ctx *gin.Context) {
+	queryParams := listServerRequest{}
+	if ctx.ShouldBindQuery(&queryParams) != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+	var servers []ServerAd
+	if queryParams.ServerType != "" {
+		if !strings.EqualFold(queryParams.ServerType, string(OriginType)) && !strings.EqualFold(queryParams.ServerType, string(CacheType)) {
+			ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid server type"})
+			return
+		}
+		servers = ListServerAds([]ServerType{ServerType(queryParams.ToInternalServerType())})
+	} else {
+		servers = ListServerAds([]ServerType{OriginType, CacheType})
+
+	}
+	resList := make([]listServerResponse, 0)
+	for _, server := range servers {
+		res := listServerResponse{
+			Name:      server.Name,
+			AuthURL:   server.AuthURL.String(),
+			URL:       server.URL.String(),
+			WebURL:    server.WebURL.String(),
+			Type:      server.Type,
+			Latitude:  server.Latitude,
+			Longitude: server.Longitude,
+		}
+		resList = append(resList, res)
+	}
+	ctx.JSON(http.StatusOK, resList)
+}
+
+func RegisterDirectorWebAPI(router *gin.RouterGroup) {
+	registryWebAPI := router.Group("/api/v1.0/director_ui")
+	// Follow RESTful schema
+	{
+		registryWebAPI.GET("/servers", listServers)
+	}
+}
diff --git a/director/director_api.go b/director/director_api.go
new file mode 100644
index 000000000..ccd7d4345
--- /dev/null
+++ b/director/director_api.go
@@ -0,0 +1,215 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package director
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+// List all namespaces from origins registered at the director
+func ListNamespacesFromOrigins() []NamespaceAd {
+
+	serverAdMutex.RLock()
+	defer serverAdMutex.RUnlock()
+
+	serverAdItems := serverAds.Items()
+	namespaces := make([]NamespaceAd, 0, len(serverAdItems))
+	for _, item := range serverAdItems {
+		if item.Key().Type == OriginType {
+			namespaces = append(namespaces, item.Value()...)
+		}
+	}
+	return namespaces
+}
+
+// List all serverAds in the cache that matches the serverType array
+func ListServerAds(serverTypes []ServerType) []ServerAd {
+	serverAdMutex.RLock()
+	defer serverAdMutex.RUnlock()
+	ads := make([]ServerAd, 0)
+	for _, ad := range serverAds.Keys() {
+		for _, serverType := range serverTypes {
+			if ad.Type == serverType {
+				ads = append(ads, ad)
+			}
+		}
+	}
+	return ads
+}
+
+// Create a token for director's Prometheus instance to access
+// director's origins service discovery endpoint. This function is intended
+// to be called only on a director server
+func CreateDirectorSDToken() (string, error) {
+	// TODO: We might want to change this to ComputeExternalAddress() instead
+	// so that director admin don't need to specify Federation_DirectorUrl to get
+	// director working
+	directorURL := param.Federation_DirectorUrl.GetString()
+	if directorURL == "" {
+		return "", errors.New("Director URL is not known; cannot create director service discovery token")
+	}
+	tokenExpireTime := param.Monitoring_TokenExpiresIn.GetDuration()
+
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.Pelican_DirectorServiceDiscovery.String()).
+		Issuer(directorURL).
+		Audience([]string{directorURL}).
+		Subject("director").
+		Expiration(time.Now().Add(tokenExpireTime)).
+		Build()
+	if err != nil {
+		return "", err
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to load the director's JWK")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", err
+	}
+	return string(signed), nil
+}
+
+// Verify that a token received is a valid token from director and has
+// correct scope for accessing the service discovery endpoint. This function
+// is intended to be called on the same director server that issues the token.
+func VerifyDirectorSDToken(strToken string) (bool, error) {
+	// This token is essentialled an "issuer"/server itself issued token and
+	// the server happended to be a director. This allows us to just follow
+	// IssuerCheck logic for this token
+	directorURL := param.Server_ExternalWebUrl.GetString()
+	token, err := jwt.Parse([]byte(strToken), jwt.WithVerify(false))
+	if err != nil {
+		return false, err
+	}
+
+	if directorURL != token.Issuer() {
+		return false, errors.Errorf("Token issuer is not a director")
+	}
+	// Given that this function is intended to be called on the same director server
+	// that issues the token. so it's safe to skip getting the public key
+	// from director's discovery URL.
+	key, err := config.GetIssuerPublicJWKS()
+	if err != nil {
+		return false, err
+	}
+	tok, err := jwt.Parse([]byte(strToken), jwt.WithKeySet(key), jwt.WithValidate(true))
+	if err != nil {
+		return false, err
+	}
+
+	scope_any, present := tok.Get("scope")
+	if !present {
+		return false, errors.New("No scope is present; required to advertise to director")
+	}
+	scope, ok := scope_any.(string)
+	if !ok {
+		return false, errors.New("scope claim in token is not string-valued")
+	}
+
+	scopes := strings.Split(scope, " ")
+
+	for _, scope := range scopes {
+		if scope == token_scopes.Pelican_DirectorServiceDiscovery.String() {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// Create a token for director's Prometheus scraper to access discovered
+// origins and caches `/metrics` endpoint. This function is intended to be called on
+// a director server
+func CreateDirectorScrapeToken() (string, error) {
+	// We assume this function is only called on a director server,
+	// the external address of which should be the director's URL
+	directorURL := param.Server_ExternalWebUrl.GetString()
+	tokenExpireTime := param.Monitoring_TokenExpiresIn.GetDuration()
+
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.Monitoring_Scrape.String()).
+		Issuer(directorURL). // Exclude audience from token to prevent http header overflow
+		Subject("director").
+		Expiration(time.Now().Add(tokenExpireTime)).
+		Build()
+	if err != nil {
+		return "", err
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+
+	if err != nil {
+		return "", errors.Wrap(err, "failed to load the director's private JWK")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", err
+	}
+	return string(signed), nil
+}
+
+// Configure TTL caches to enable cache eviction and other additional cache events handling logic
+//
+// The `ctx` is the context for listening to server shutdown event in order to cleanup internal cache eviction
+// goroutine and `wg` is the wait group to notify when the clean up goroutine finishes
+func ConfigTTLCache(ctx context.Context, egrp *errgroup.Group) {
+	// Start automatic expired item deletion
+	go serverAds.Start()
+	go namespaceKeys.Start()
+
+	serverAds.OnEviction(func(ctx context.Context, er ttlcache.EvictionReason, i *ttlcache.Item[ServerAd, []NamespaceAd]) {
+		healthTestCancelFuncsMutex.Lock()
+		defer healthTestCancelFuncsMutex.Unlock()
+		if cancelFunc, exists := healthTestCancelFuncs[i.Key()]; exists {
+			// Call the cancel function for the evicted originAd to end its health test
+			cancelFunc()
+
+			// Remove the cancel function from the map as it's no longer needed
+			delete(healthTestCancelFuncs, i.Key())
+		}
+	})
+
+	// Put stop logic in a separate goroutine so that parent function is not blocking
+	egrp.Go(func() error {
+		<-ctx.Done()
+		log.Info("Gracefully stopping director TTL cache eviction...")
+		serverAds.DeleteAll()
+		serverAds.Stop()
+		namespaceKeys.DeleteAll()
+		namespaceKeys.Stop()
+		log.Info("Director TTL cache eviction has been stopped")
+		return nil
+	})
+}
diff --git a/director/director_api_test.go b/director/director_api_test.go
new file mode 100644
index 000000000..15cf097a4
--- /dev/null
+++ b/director/director_api_test.go
@@ -0,0 +1,147 @@
+package director
+
+import (
+	"fmt"
+	"net/url"
+	"testing"
+
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var mockOriginServerAd ServerAd = ServerAd{
+	Name:      "test-origin-server",
+	AuthURL:   url.URL{},
+	URL:       url.URL{},
+	Type:      OriginType,
+	Latitude:  123.05,
+	Longitude: 456.78,
+}
+
+var mockCacheServerAd ServerAd = ServerAd{
+	Name:      "test-cache-server",
+	AuthURL:   url.URL{},
+	URL:       url.URL{},
+	Type:      CacheType,
+	Latitude:  45.67,
+	Longitude: 123.05,
+}
+
+const mockPathPreix string = "/foo/bar/"
+
+func mockNamespaceAds(size int, serverPrefix string) []NamespaceAd {
+	namespaceAds := make([]NamespaceAd, size)
+	for i := 0; i < size; i++ {
+		namespaceAds[i] = NamespaceAd{
+			RequireToken:  true,
+			Path:          mockPathPreix + serverPrefix + "/" + fmt.Sprint(i),
+			Issuer:        url.URL{},
+			MaxScopeDepth: 1,
+			Strategy:      "",
+			BasePath:      "",
+			VaultServer:   "",
+		}
+	}
+	return namespaceAds
+}
+
+func namespaceAdContainsPath(ns []NamespaceAd, path string) bool {
+	for _, v := range ns {
+		if v.Path == path {
+			return true
+		}
+	}
+	return false
+}
+
+func TestListNamespaces(t *testing.T) {
+	setup := func() {
+		serverAdMutex.Lock()
+		defer serverAdMutex.Unlock()
+		serverAds.DeleteAll()
+	}
+
+	t.Run("empty-entry", func(t *testing.T) {
+		setup()
+		ns := ListNamespacesFromOrigins()
+
+		// Initially there should be 0 namespaces registered
+		assert.Equal(t, 0, len(ns), "List is not empty for empty namespace cache.")
+	})
+	t.Run("one-origin-namespace-entry", func(t *testing.T) {
+		setup()
+		serverAds.Set(mockOriginServerAd, mockNamespaceAds(1, "origin1"), ttlcache.DefaultTTL)
+		ns := ListNamespacesFromOrigins()
+
+		// Only one entry added
+		assert.Equal(t, 1, len(ns), "List has length not equal to 1 for namespace cache with 1 entry.")
+		assert.True(t, namespaceAdContainsPath(ns, mockPathPreix+"origin1/"+fmt.Sprint(0)), "Returned namespace path does not match what's added")
+	})
+	t.Run("multiple-origin-namespace-entries-from-same-origin", func(t *testing.T) {
+		setup()
+		serverAds.Set(mockOriginServerAd, mockNamespaceAds(10, "origin1"), ttlcache.DefaultTTL)
+		ns := ListNamespacesFromOrigins()
+
+		assert.Equal(t, 10, len(ns), "List has length not equal to 10 for namespace cache with 10 entries.")
+		assert.True(t, namespaceAdContainsPath(ns, mockPathPreix+"origin1/"+fmt.Sprint(5)), "Returned namespace path does not match what's added")
+	})
+	t.Run("multiple-origin-namespace-entries-from-different-origins", func(t *testing.T) {
+		setup()
+
+		serverAds.Set(mockOriginServerAd, mockNamespaceAds(10, "origin1"), ttlcache.DefaultTTL)
+
+		// change the name field of serverAD as same name will cause cache to merge
+		oldServerName := mockOriginServerAd.Name
+		mockOriginServerAd.Name = "test-origin-server-2"
+
+		serverAds.Set(mockOriginServerAd, mockNamespaceAds(10, "origin2"), ttlcache.DefaultTTL)
+		ns := ListNamespacesFromOrigins()
+
+		assert.Equal(t, 20, len(ns), "List has length not equal to 10 for namespace cache with 10 entries.")
+		assert.True(t, namespaceAdContainsPath(ns, mockPathPreix+"origin1/"+fmt.Sprint(5)), "Returned namespace path does not match what's added")
+		assert.True(t, namespaceAdContainsPath(ns, mockPathPreix+"origin2/"+fmt.Sprint(9)), "Returned namespace path does not match what's added")
+		mockOriginServerAd.Name = oldServerName
+	})
+	t.Run("one-cache-namespace-entry", func(t *testing.T) {
+		setup()
+		serverAds.Set(mockCacheServerAd, mockNamespaceAds(1, "cache1"), ttlcache.DefaultTTL)
+		ns := ListNamespacesFromOrigins()
+
+		// Should not show namespace from cache server
+		assert.Equal(t, 0, len(ns), "List is not empty for namespace cache with entry from cache server.")
+	})
+}
+
+func TestListServerAds(t *testing.T) {
+
+	t.Run("emtpy-cache", func(t *testing.T) {
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.DeleteAll()
+		}()
+		ads := ListServerAds([]ServerType{OriginType, CacheType})
+		assert.Equal(t, 0, len(ads))
+	})
+
+	t.Run("get-by-server-type", func(t *testing.T) {
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.DeleteAll()
+		}()
+		serverAds.Set(mockOriginServerAd, []NamespaceAd{}, ttlcache.DefaultTTL)
+		serverAds.Set(mockCacheServerAd, []NamespaceAd{}, ttlcache.DefaultTTL)
+		adsAll := ListServerAds([]ServerType{OriginType, CacheType})
+		assert.Equal(t, 2, len(adsAll))
+
+		adsOrigin := ListServerAds([]ServerType{OriginType})
+		require.Equal(t, 1, len(adsOrigin))
+		assert.True(t, adsOrigin[0] == mockOriginServerAd)
+
+		adsCache := ListServerAds([]ServerType{CacheType})
+		require.Equal(t, 1, len(adsCache))
+		assert.True(t, adsCache[0] == mockCacheServerAd)
+	})
+}
diff --git a/director/director_test.go b/director/director_test.go
new file mode 100644
index 000000000..0cac16a2a
--- /dev/null
+++ b/director/director_test.go
@@ -0,0 +1,127 @@
+package director
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListServers(t *testing.T) {
+	router := gin.Default()
+
+	router.GET("/servers", listServers)
+
+	func() {
+		serverAdMutex.Lock()
+		defer serverAdMutex.Unlock()
+		serverAds.Set(mockOriginServerAd, mockNamespaceAds(5, "origin1"), ttlcache.DefaultTTL)
+		serverAds.Set(mockCacheServerAd, mockNamespaceAds(4, "cache1"), ttlcache.DefaultTTL)
+		require.True(t, serverAds.Has(mockOriginServerAd))
+		require.True(t, serverAds.Has(mockCacheServerAd))
+	}()
+
+	mocklistOriginRes := listServerResponse{
+		Name:      mockOriginServerAd.Name,
+		AuthURL:   mockOriginServerAd.AuthURL.String(),
+		URL:       mockOriginServerAd.URL.String(),
+		WebURL:    mockOriginServerAd.WebURL.String(),
+		Type:      mockOriginServerAd.Type,
+		Latitude:  mockOriginServerAd.Latitude,
+		Longitude: mockOriginServerAd.Longitude,
+	}
+	mocklistCacheRes := listServerResponse{
+		Name:      mockCacheServerAd.Name,
+		AuthURL:   mockCacheServerAd.AuthURL.String(),
+		URL:       mockCacheServerAd.URL.String(),
+		WebURL:    mockCacheServerAd.WebURL.String(),
+		Type:      mockCacheServerAd.Type,
+		Latitude:  mockCacheServerAd.Latitude,
+		Longitude: mockCacheServerAd.Longitude,
+	}
+
+	t.Run("query-origin", func(t *testing.T) {
+		// Create a request to the endpoint
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest("GET", "/servers?server_type=origin", nil)
+		router.ServeHTTP(w, req)
+
+		// Check the response
+		require.Equal(t, 200, w.Code)
+
+		var got []listServerResponse
+		err := json.Unmarshal(w.Body.Bytes(), &got)
+		if err != nil {
+			t.Fatalf("Failed to unmarshal response body: %v", err)
+		}
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mocklistOriginRes, got[0], "Response data does not match expected")
+	})
+
+	t.Run("query-cache", func(t *testing.T) {
+		// Create a request to the endpoint
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest("GET", "/servers?server_type=cache", nil)
+		router.ServeHTTP(w, req)
+
+		// Check the response
+		require.Equal(t, 200, w.Code)
+
+		var got []listServerResponse
+		err := json.Unmarshal(w.Body.Bytes(), &got)
+		if err != nil {
+			t.Fatalf("Failed to unmarshal response body: %v", err)
+		}
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mocklistCacheRes, got[0], "Response data does not match expected")
+	})
+
+	t.Run("query-all-with-empty-server-type", func(t *testing.T) {
+		// Create a request to the endpoint
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest("GET", "/servers?server_type=", nil)
+		router.ServeHTTP(w, req)
+
+		// Check the response
+		require.Equal(t, 200, w.Code)
+
+		var got []listServerResponse
+		err := json.Unmarshal(w.Body.Bytes(), &got)
+		if err != nil {
+			t.Fatalf("Failed to unmarshal response body: %v", err)
+		}
+		require.Equal(t, 2, len(got))
+	})
+
+	t.Run("query-all-without-query-param", func(t *testing.T) {
+		// Create a request to the endpoint
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest("GET", "/servers", nil)
+		router.ServeHTTP(w, req)
+
+		// Check the response
+		require.Equal(t, 200, w.Code)
+
+		var got []listServerResponse
+		err := json.Unmarshal(w.Body.Bytes(), &got)
+		if err != nil {
+			t.Fatalf("Failed to unmarshal response body: %v", err)
+		}
+		require.Equal(t, 2, len(got))
+	})
+
+	t.Run("query-with-invalid-param", func(t *testing.T) {
+		// Create a request to the endpoint
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest("GET", "/servers?server_type=staging", nil)
+		router.ServeHTTP(w, req)
+
+		// Check the response
+		require.Equal(t, 400, w.Code)
+	})
+}
diff --git a/director/discovery.go b/director/discovery.go
new file mode 100644
index 000000000..fa2a4055e
--- /dev/null
+++ b/director/discovery.go
@@ -0,0 +1,116 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package director
+
+import (
+	"encoding/json"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	log "github.com/sirupsen/logrus"
+)
+
+type OpenIdDiscoveryResponse struct {
+	Issuer  string `json:"issuer"`
+	JwksUri string `json:"jwks_uri"`
+}
+
+const (
+	openIdDiscoveryPath     string = "/.well-known/openid-configuration"
+	federationDiscoveryPath string = "/.well-known/pelican-configuration"
+	directorJWKSPath        string = "/.well-known/issuer.jwks"
+)
+
+func federationDiscoveryHandler(ctx *gin.Context) {
+	directorUrl := param.Federation_DirectorUrl.GetString()
+	if len(directorUrl) == 0 {
+		ctx.JSON(500, gin.H{"error": "Bad server configuration: Director URL is not set"})
+		return
+	}
+	registryUrl := param.Federation_RegistryUrl.GetString()
+	if len(registryUrl) == 0 {
+		ctx.JSON(500, gin.H{"error": "Bad server configuration: Registry URL is not set"})
+		return
+	}
+
+	rs := config.FederationDiscovery{
+		DirectorEndpoint:              directorUrl,
+		NamespaceRegistrationEndpoint: registryUrl,
+		JwksUri:                       directorUrl + directorJWKSPath,
+	}
+
+	jsonData, err := json.MarshalIndent(rs, "", "  ")
+	if err != nil {
+		ctx.JSON(500, gin.H{"error": "Failed to marshal federation's discovery response"})
+		return
+	}
+	// Append a new line to the JSON data
+	jsonData = append(jsonData, '\n')
+	ctx.Header("Content-Disposition", "attachment; filename=pelican-configuration.json")
+	ctx.Data(200, "application/json", jsonData)
+}
+
+// Director metadata discovery endpoint for OpenID style
+// token authentication, providing issuer endpoint and director's jwks endpoint
+func openIdDiscoveryHandler(ctx *gin.Context) {
+	directorUrl := param.Federation_DirectorUrl.GetString()
+	if len(directorUrl) == 0 {
+		ctx.JSON(500, gin.H{"error": "Bad server configuration: Director URL is not set"})
+		return
+	}
+	rs := OpenIdDiscoveryResponse{
+		Issuer:  directorUrl,
+		JwksUri: directorUrl + directorJWKSPath,
+	}
+	jsonData, err := json.MarshalIndent(rs, "", "  ")
+	if err != nil {
+		ctx.JSON(500, gin.H{"error": "Failed to marshal director's discovery response"})
+		return
+	}
+	// Append a new line to the JSON data
+	jsonData = append(jsonData, '\n')
+	ctx.Header("Content-Disposition", "attachment; filename=pelican-director-configuration.json")
+	ctx.Data(200, "application/json", jsonData)
+}
+
+// Returns director's public key
+func jwksHandler(ctx *gin.Context) {
+	key, err := config.GetIssuerPublicJWKS()
+	if err != nil {
+		log.Errorf("Failed to load director's public key: %v", err)
+		ctx.JSON(500, gin.H{"error": "Failed to load director's public key"})
+	} else {
+		jsonData, err := json.MarshalIndent(key, "", "  ")
+		if err != nil {
+			ctx.JSON(500, gin.H{"error": "Failed to marshal director's public key"})
+			return
+		}
+		// Append a new line to the JSON data
+		jsonData = append(jsonData, '\n')
+		ctx.Header("Content-Disposition", "attachment; filename=public-signing-key.jwks")
+		ctx.Data(200, "application/json", jsonData)
+	}
+}
+
+func RegisterDirectorAuth(router *gin.RouterGroup) {
+	router.GET(federationDiscoveryPath, federationDiscoveryHandler)
+	router.GET(openIdDiscoveryPath, openIdDiscoveryHandler)
+	router.GET(directorJWKSPath, jwksHandler)
+}
diff --git a/director/origin_api.go b/director/origin_api.go
index e30d1c0ee..8026da14f 100644
--- a/director/origin_api.go
+++ b/director/origin_api.go
@@ -20,9 +20,9 @@ package director
 
 import (
 	"context"
-	"errors"
+	"encoding/json"
+	"net/http"
 	"net/url"
-	"path"
 	"strings"
 	"sync"
 	"time"
@@ -32,39 +32,54 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/lestrrat-go/jwx/v2/jwt"
 	"github.com/pelicanplatform/pelican/config"
-	"github.com/spf13/viper"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/pelicanplatform/pelican/utils"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
 )
 
 type (
 	OriginAdvertise struct {
-		Name       string        `json:"name"`
-		URL        string        `json:"url"`
-		Namespaces []NamespaceAd `json:"namespaces"`
+		Name               string        `json:"name"`
+		URL                string        `json:"url"`               // This is the url for origin's XRootD service and file transfer
+		WebURL             string        `json:"web_url,omitempty"` // This is the url for origin's web engine and APIs
+		Namespaces         []NamespaceAd `json:"namespaces"`
+		EnableWrite        bool          `json:"enablewrite"`
+		EnableFallbackRead bool          `json:"enable-fallback-read"` // True if the origin will allow direct client reads when no caches are available
 	}
 )
 
+// Create interface
+// Add it to namespacekeys in place of jwk.cache
+type NamespaceCache interface {
+	Register(u string, options ...jwk.RegisterOption) error
+	Get(ctx context.Context, u string) (jwk.Set, error)
+}
+
 var (
-	namespaceKeys      = ttlcache.New[string, *jwk.Cache](ttlcache.WithTTL[string, *jwk.Cache](15 * time.Minute))
+	namespaceKeys      = ttlcache.New[string, NamespaceCache](ttlcache.WithTTL[string, NamespaceCache](15 * time.Minute))
 	namespaceKeysMutex = sync.RWMutex{}
+
+	adminApprovalErr error
 )
 
 func CreateAdvertiseToken(namespace string) (string, error) {
-	key, err := config.GetOriginJWK()
-	if err != nil {
-		return "", err
-	}
-	issuer_url, err := GetIssuerURL(namespace)
+	// TODO: Need to come back and carefully consider a few naming practices.
+	//       Here, issuerUrl is actually the registry database url, and not
+	//       the token issuer url for this namespace
+	issuerUrl, err := GetRegistryIssuerURL(namespace)
 	if err != nil {
 		return "", err
 	}
-	director := viper.GetString("DirectorURL")
+	director := param.Federation_DirectorUrl.GetString()
 	if director == "" {
 		return "", errors.New("Director URL is not known; cannot create advertise token")
 	}
 
 	tok, err := jwt.NewBuilder().
-		Claim("scope", "pelican.advertise").
-		Issuer(issuer_url).
+		Claim("scope", token_scopes.Pelican_Advertise.String()).
+		Issuer(issuerUrl).
 		Audience([]string{director}).
 		Subject("origin").
 		Expiration(time.Now().Add(time.Minute)).
@@ -73,7 +88,20 @@ func CreateAdvertiseToken(namespace string) (string, error) {
 		return "", err
 	}
 
-	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES512, key))
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to load the origin's JWK")
+	}
+
+	// Get/assign the kid, needed for verification of the token by the director
+	// TODO: Create more generic "tokenCreate" functions so we don't have to do
+	//       this by hand all the time
+	err = jwk.AssignKeyID(key)
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to assign kid to the token")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
 	if err != nil {
 		return "", err
 	}
@@ -83,31 +111,61 @@ func CreateAdvertiseToken(namespace string) (string, error) {
 // Given a token and a location in the namespace to advertise in,
 // see if the entity is authorized to advertise an origin for the
 // namespace
-func VerifyAdvertiseToken(token, namespace string) (bool, error) {
-	issuer_url, err := GetIssuerURL(namespace)
+func VerifyAdvertiseToken(ctx context.Context, token, namespace string) (bool, error) {
+	issuerUrl, err := GetRegistryIssuerURL(namespace)
 	if err != nil {
 		return false, err
 	}
-	var ar *jwk.Cache
-	{
+
+	var ar NamespaceCache
+
+	// defer statements are scoped to function, not lexical enclosure,
+	// which is why we wrap these defer statements in anon funcs
+	func() {
 		namespaceKeysMutex.RLock()
-		defer namespaceKeysMutex.Unlock()
+		defer namespaceKeysMutex.RUnlock()
 		item := namespaceKeys.Get(namespace)
-		if !item.IsExpired() {
-			ar = item.Value()
+		if item != nil {
+			if !item.IsExpired() {
+				ar = item.Value()
+			}
 		}
-	}
-	ctx := context.Background()
+	}()
 	if ar == nil {
-		ar := jwk.NewCache(ctx)
-		if err = ar.Register(issuer_url, jwk.WithMinRefreshInterval(15*time.Minute)); err != nil {
+		ar = jwk.NewCache(ctx)
+		client := &http.Client{Transport: config.GetTransport()}
+		if err = ar.Register(issuerUrl, jwk.WithMinRefreshInterval(15*time.Minute), jwk.WithHTTPClient(client)); err != nil {
 			return false, err
 		}
 		namespaceKeysMutex.Lock()
 		defer namespaceKeysMutex.Unlock()
-		namespaceKeys.Set(namespace, ar, ttlcache.DefaultTTL)
+
+		customTTL := param.Director_AdvertisementTTL.GetDuration()
+		if customTTL == 0 {
+			namespaceKeys.Set(namespace, ar, ttlcache.DefaultTTL)
+		} else {
+			namespaceKeys.Set(namespace, ar, customTTL)
+		}
+
+	}
+	log.Debugln("Attempting to fetch keys from ", issuerUrl)
+	keyset, err := ar.Get(ctx, issuerUrl)
+
+	if log.IsLevelEnabled(log.DebugLevel) {
+		// Let's check that we can convert to JSON and get the right thing...
+		jsonbuf, err := json.Marshal(keyset)
+		if err != nil {
+			return false, errors.Wrap(err, "failed to marshal the public keyset into JWKS JSON")
+		}
+		log.Debugln("Constructed JWKS from fetching jwks:", string(jsonbuf))
+		// This seems never get reached, as registry returns 403 for pending approval namespace
+		// and there will be HTTP error in getting jwks; thus it will always be error
+		if jsonbuf == nil {
+			adminApprovalErr = errors.New(namespace + " has not been approved by an administrator.")
+			return false, adminApprovalErr
+		}
 	}
-	keyset, err := ar.Get(ctx, issuer_url)
+
 	if err != nil {
 		return false, err
 	}
@@ -129,15 +187,92 @@ func VerifyAdvertiseToken(token, namespace string) (bool, error) {
 	scopes := strings.Split(scope, " ")
 
 	for _, scope := range scopes {
-		if scope == "pelican.advertise" {
+		if scope == token_scopes.Pelican_Advertise.String() {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// Create a token for director to report the health status to the
+// origin
+func CreateDirectorTestReportToken(originWebUrl string) (string, error) {
+	directorURL := param.Federation_DirectorUrl.GetString()
+	if directorURL == "" {
+		return "", errors.New("Director URL is not known; cannot create director test report token")
+	}
+
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.Pelican_DirectorTestReport.String()).
+		Issuer(directorURL).
+		Audience([]string{originWebUrl}).
+		Subject("director").
+		Expiration(time.Now().Add(time.Minute)).
+		Build()
+	if err != nil {
+		return "", err
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to load the origin's JWK")
+	}
+
+	err = jwk.AssignKeyID(key)
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to assign kid to the token")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", err
+	}
+	return string(signed), nil
+}
+
+// Verify that a token received is a valid token from director
+func VerifyDirectorTestReportToken(strToken string) (bool, error) {
+	directorURL := param.Federation_DirectorUrl.GetString()
+	token, err := jwt.Parse([]byte(strToken), jwt.WithVerify(false))
+	if err != nil {
+		return false, err
+	}
+
+	if directorURL != token.Issuer() {
+		return false, errors.Errorf("Token issuer is not a director")
+	}
+
+	key, err := utils.LoadDirectorPublicKey()
+	if err != nil {
+		return false, err
+	}
+
+	tok, err := jwt.Parse([]byte(strToken), jwt.WithKey(jwa.ES256, key), jwt.WithValidate(true))
+	if err != nil {
+		return false, err
+	}
+
+	scope_any, present := tok.Get("scope")
+	if !present {
+		return false, errors.New("No scope is present; required to advertise to director")
+	}
+	scope, ok := scope_any.(string)
+	if !ok {
+		return false, errors.New("scope claim in token is not string-valued")
+	}
+
+	scopes := strings.Split(scope, " ")
+
+	for _, scope := range scopes {
+		if scope == token_scopes.Pelican_DirectorTestReport.String() {
 			return true, nil
 		}
 	}
 	return false, nil
 }
 
-func GetIssuerURL(prefix string) (string, error) {
-	namespace_url_string := viper.GetString("NamespaceURL")
+func GetRegistryIssuerURL(prefix string) (string, error) {
+	namespace_url_string := param.Federation_RegistryUrl.GetString()
 	if namespace_url_string == "" {
 		return "", errors.New("Namespace URL is not set")
 	}
@@ -145,6 +280,9 @@ func GetIssuerURL(prefix string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	namespace_url.Path = path.Join(namespace_url.Path, "namespaces", prefix)
+	namespace_url.Path, err = url.JoinPath(namespace_url.Path, "api", "v1.0", "registry", prefix, ".well-known", "issuer.jwks")
+	if err != nil {
+		return "", err
+	}
 	return namespace_url.String(), nil
 }
diff --git a/director/origin_api_test.go b/director/origin_api_test.go
new file mode 100644
index 000000000..08bc30047
--- /dev/null
+++ b/director/origin_api_test.go
@@ -0,0 +1,223 @@
+package director
+
+import (
+	"context"
+	"crypto/elliptic"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+func TestVerifyAdvertiseToken(t *testing.T) {
+	/*
+	* Runs unit tests on the VerifyAdvertiseToken function
+	 */
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+
+	tDir := t.TempDir()
+	kfile := filepath.Join(tDir, "t-key")
+
+	//Setup a private key and a token
+	viper.Set("IssuerKey", kfile)
+
+	viper.Set("Federation.RegistryUrl", "https://get-your-tokens.org")
+	viper.Set("Federation.DirectorURL", "https://director-url.org")
+
+	kSet, err := config.GetIssuerPublicJWKS()
+	ar := MockCache{
+		GetFn: func(key string, keyset *jwk.Set) (jwk.Set, error) {
+			if key != "https://get-your-tokens.org/api/v1.0/registry/test-namespace/.well-known/issuer.jwks" {
+				t.Errorf("expecting: https://get-your-tokens.org/api/v1.0/registry/test-namespace/.well-known/issuer.jwks, got %q", key)
+			}
+			return *keyset, nil
+		},
+		RegisterFn: func(m *MockCache) error {
+			m.keyset = kSet
+			return nil
+		},
+	}
+
+	// Perform injections (ar.Register will create a jwk.keyset with the publickey in it)
+	func() {
+		if err = ar.Register("", jwk.WithMinRefreshInterval(15*time.Minute)); err != nil {
+			t.Errorf("this should never happen, should actually be impossible, including check for the linter")
+		}
+		namespaceKeysMutex.Lock()
+		defer namespaceKeysMutex.Unlock()
+		namespaceKeys.Set("test-namespace", &ar, ttlcache.DefaultTTL)
+	}()
+
+	// A verified token with a the correct scope - should return no error
+	tok, err := CreateAdvertiseToken("test-namespace")
+	assert.NoError(t, err)
+	ok, err := VerifyAdvertiseToken(ctx, tok, "test-namespace")
+	assert.NoError(t, err)
+	assert.Equal(t, true, ok, "Expected scope to be 'pelican.advertise'")
+
+	//Create token without a scope - should return an error
+	key, err := config.GetIssuerPrivateJWK()
+	err = jwk.AssignKeyID(key)
+	assert.NoError(t, err)
+
+	scopelessTok, err := jwt.NewBuilder().
+		Issuer("").
+		Audience([]string{"director.test"}).
+		Subject("origin").
+		Build()
+
+	signed, err := jwt.Sign(scopelessTok, jwt.WithKey(jwa.ES256, key))
+
+	ok, err = VerifyAdvertiseToken(ctx, string(signed), "test-namespace")
+	assert.Equal(t, false, ok)
+	assert.Equal(t, "No scope is present; required to advertise to director", err.Error())
+
+	//Create a token without a string valued scope
+	nonStrScopeTok, err := jwt.NewBuilder().
+		Issuer("").
+		Claim("scope", 22).
+		Audience([]string{"director.test"}).
+		Subject("origin").
+		Build()
+
+	signed, err = jwt.Sign(nonStrScopeTok, jwt.WithKey(jwa.ES256, key))
+
+	ok, err = VerifyAdvertiseToken(ctx, string(signed), "test-namespace")
+	assert.Equal(t, false, ok)
+	assert.Equal(t, "scope claim in token is not string-valued", err.Error())
+
+	//Create a token without a pelican.namespace scope
+	wrongScopeTok, err := jwt.NewBuilder().
+		Issuer("").
+		Claim("scope", "wrong.scope").
+		Audience([]string{"director.test"}).
+		Subject("origin").
+		Build()
+
+	signed, err = jwt.Sign(wrongScopeTok, jwt.WithKey(jwa.ES256, key))
+
+	ok, err = VerifyAdvertiseToken(ctx, string(signed), "test-namespace")
+	assert.Equal(t, false, ok, "Should fail due to incorrect scope name")
+	assert.NoError(t, err, "Incorrect scope name should not throw and error")
+}
+
+func TestCreateAdvertiseToken(t *testing.T) {
+	/*
+	* Runs unit tests on the CreateAdvertiseToken function
+	 */
+
+	viper.Reset()
+
+	// Create a temp directory to store the private key file
+	tDir := t.TempDir()
+	kfile := filepath.Join(tDir, "t-key")
+
+	// Generate a private key
+	viper.Set("IssuerKey", kfile)
+	err := config.GeneratePrivateKey(kfile, elliptic.P521())
+	assert.NoError(t, err)
+
+	// Test without a namsepace set and check to see if it returns the expected error
+	tok, err := CreateAdvertiseToken("test-namespace")
+	assert.Equal(t, "", tok)
+	assert.Equal(t, "Namespace URL is not set", err.Error())
+	viper.Set("Federation.RegistryUrl", "https://get-your-tokens.org")
+
+	// Test without a DirectorURL set and check to see if it returns the expected error
+	tok, err = CreateAdvertiseToken("test-namespace")
+	assert.Equal(t, "", tok)
+	assert.Equal(t, "Director URL is not known; cannot create advertise token", err.Error())
+	viper.Set("Federation.DirectorURL", "https://director-url.org")
+
+	// Test the CreateAdvertiseToken with good values and test that it returns a non-nil token value and no error
+	tok, err = CreateAdvertiseToken("test-namespace")
+	assert.Equal(t, nil, err)
+	assert.NotEqual(t, "", tok)
+}
+
+func TestGetRegistryIssuerURL(t *testing.T) {
+	/*
+	* Runs unit tests on the GetRegistryIssuerURL function
+	 */
+	viper.Reset()
+
+	// No namespace url has been set, so an error is expected
+	url, err := GetRegistryIssuerURL("")
+	assert.Equal(t, "", url)
+	assert.Equal(t, "Namespace URL is not set", err.Error())
+
+	// Test to make sure the path is as expected
+	viper.Set("Federation.RegistryUrl", "test-path")
+	url, err = GetRegistryIssuerURL("test-prefix")
+	assert.Equal(t, nil, err)
+	assert.Equal(t, "test-path/api/v1.0/registry/test-prefix/.well-known/issuer.jwks", url)
+
+}
+
+func TestNamespaceKeysCacheEviction(t *testing.T) {
+	t.Run("evict-after-expire-time", func(t *testing.T) {
+		// Start cache eviction
+		shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
+		egrp, ctx := errgroup.WithContext(shutdownCtx)
+		ConfigTTLCache(ctx, egrp)
+		defer func() {
+			shutdownCancel()
+			err := egrp.Wait()
+			assert.NoError(t, err)
+		}()
+
+		mockNamespaceKey := "foo"
+		mockCtx := context.Background()
+		mockAr := jwk.NewCache(mockCtx)
+
+		deletedChan := make(chan int)
+		cancelChan := make(chan int)
+
+		go func() {
+			namespaceKeysMutex.Lock()
+			defer namespaceKeysMutex.Unlock()
+			namespaceKeys.DeleteAll()
+
+			namespaceKeys.Set(mockNamespaceKey, mockAr, time.Second*2)
+			require.True(t, namespaceKeys.Has(mockNamespaceKey), "Failed to register namespace key")
+		}()
+
+		// Keep checking if the cache item is absent or cancelled
+		go func() {
+			for {
+				select {
+				case <-cancelChan:
+					return
+				default:
+					if !namespaceKeys.Has(mockNamespaceKey) {
+						deletedChan <- 1
+						return
+					}
+				}
+			}
+		}()
+
+		// Wait for 3s to check if the expired cache item is evicted
+		select {
+		case <-deletedChan:
+			require.True(t, true)
+		case <-time.After(3 * time.Second):
+			cancelChan <- 1
+			require.False(t, true, "Cache didn't evict expired item")
+		}
+	})
+}
diff --git a/director/origin_monitor.go b/director/origin_monitor.go
new file mode 100644
index 000000000..94e3275ca
--- /dev/null
+++ b/director/origin_monitor.go
@@ -0,0 +1,199 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package director
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/utils"
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+type (
+	DirectorTest struct {
+		Status    string `json:"status"`
+		Message   string `json:"message"`
+		Timestamp int64  `json:"timestamp"`
+	}
+)
+
+// Report the health status of test file transfer to origin
+func reportStatusToOrigin(ctx context.Context, originWebUrl string, status string, message string) error {
+	tkn, err := CreateDirectorTestReportToken(originWebUrl)
+	if err != nil {
+		return errors.Wrap(err, "Failed to create a token for the diretor test upload")
+	}
+
+	reportUrl, err := url.Parse(originWebUrl)
+	if err != nil {
+		return errors.Wrap(err, "The origin URL is not parseable as a URL")
+	}
+
+	if status != "ok" && status != "error" {
+		return errors.Errorf("Bad status for reporting director test")
+	}
+
+	reportUrl.Path = "/api/v1.0/origin-api/directorTest"
+
+	dt := DirectorTest{
+		Status:    status,
+		Message:   message,
+		Timestamp: time.Now().Unix(),
+	}
+
+	jsonData, err := json.Marshal(dt)
+	if err != nil {
+		// handle error
+		return errors.Wrap(err, "Failed to parse request body for reporting director test")
+	}
+
+	reqBody := bytes.NewBuffer(jsonData)
+
+	log.Debugln("Director is uploading origin test results to", reportUrl.String())
+	req, err := http.NewRequestWithContext(ctx, "POST", reportUrl.String(), reqBody)
+	if err != nil {
+		return errors.Wrap(err, "Failed to create POST request for reporting director test")
+	}
+
+	req.Header.Set("Authorization", "Bearer "+tkn)
+	req.Header.Set("Content-Type", "application/json")
+
+	tr := config.GetTransport()
+	client := http.Client{Transport: tr}
+	resp, err := client.Do(req)
+	if err != nil {
+		return errors.Wrap(err, "Failed to start request for reporting director test")
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return errors.Wrap(err, "Failed to read response body for reporting director test")
+	}
+
+	if resp.StatusCode > 299 {
+		return errors.Errorf("Error response %v from reporting director test: %v", resp.StatusCode, string(body))
+	}
+
+	return nil
+}
+
+// Run a periodic test file transfer against an origin to ensure
+// it's talking to the director
+func LaunchPeriodicDirectorTest(ctx context.Context, originAd ServerAd) {
+	originName := originAd.Name
+	originUrl := originAd.URL.String()
+	originWebUrl := originAd.WebURL.String()
+
+	log.Debug(fmt.Sprintf("Starting Director test for origin %s at %s", originName, originUrl))
+
+	metrics.PelicanDirectorFileTransferTestSuite.With(
+		prometheus.Labels{
+			"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type),
+		}).Inc()
+
+	metrics.PelicanDirectorActiveFileTransferTestSuite.With(
+		prometheus.Labels{
+			"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type),
+		}).Inc()
+
+	customInterval := param.Director_OriginCacheHealthTestInterval.GetDuration()
+	if customInterval < 15*time.Second {
+		log.Warningf("You set Director.OriginCacheHealthTestInterval to a very small number %s, which will cause high traffic volume to xrootd servers.", customInterval.String())
+	}
+	if customInterval == 0 {
+		customInterval = 15 * time.Second
+		log.Error("Invalid config value: Director.OriginCacheHealthTestInterval is 0. Fallback to 15s.")
+	}
+	ticker := time.NewTicker(customInterval)
+
+	egrp, ok := ctx.Value(config.EgrpKey).(*errgroup.Group)
+	if !ok {
+		egrp = &errgroup.Group{}
+	}
+
+	egrp.Go(func() error {
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ctx.Done():
+				log.Debug(fmt.Sprintf("End director test cycle for origin: %s at %s", originName, originUrl))
+
+				metrics.PelicanDirectorActiveFileTransferTestSuite.With(
+					prometheus.Labels{
+						"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type),
+					}).Dec()
+
+				return nil
+			case <-ticker.C:
+				log.Debug(fmt.Sprintf("Starting a new Director test cycle for origin: %s at %s", originName, originUrl))
+				fileTests := utils.TestFileTransferImpl{}
+				ok, err := fileTests.RunTests(ctx, originUrl, "", utils.DirectorFileTest)
+				if ok && err == nil {
+					log.Debugln("Director file transfer test cycle succeeded at", time.Now().Format(time.UnixDate), " for origin: ", originUrl)
+					if err := reportStatusToOrigin(ctx, originWebUrl, "ok", "Director test cycle succeeded at "+time.Now().Format(time.RFC3339)); err != nil {
+						log.Warningln("Failed to report director test result to origin:", err)
+						metrics.PelicanDirectorFileTransferTestsRuns.With(
+							prometheus.Labels{
+								"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type), "status": string(metrics.FTXTestSuccess), "report_status": string(metrics.FTXTestFailed),
+							},
+						).Inc()
+					} else {
+						metrics.PelicanDirectorFileTransferTestsRuns.With(
+							prometheus.Labels{
+								"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type), "status": string(metrics.FTXTestSuccess), "report_status": string(metrics.FTXTestSuccess),
+							},
+						).Inc()
+					}
+				} else {
+					log.Warningln("Director file transfer test cycle failed for origin: ", originUrl, " ", err)
+					if err := reportStatusToOrigin(ctx, originWebUrl, "error", "Director file transfer test cycle failed for origin: "+originUrl+" "+err.Error()); err != nil {
+						log.Warningln("Failed to report director test result to origin: ", err)
+						metrics.PelicanDirectorFileTransferTestsRuns.With(
+							prometheus.Labels{
+								"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type), "status": string(metrics.FTXTestFailed), "report_status": string(metrics.FTXTestFailed),
+							},
+						).Inc()
+					} else {
+						metrics.PelicanDirectorFileTransferTestsRuns.With(
+							prometheus.Labels{
+								"server_name": originName, "server_web_url": originWebUrl, "server_type": string(originAd.Type), "status": string(metrics.FTXTestFailed), "report_status": string(metrics.FTXTestSuccess),
+							},
+						).Inc()
+					}
+				}
+
+			}
+		}
+	})
+}
diff --git a/director/redirect.go b/director/redirect.go
index 61635caea..c788dc4c1 100644
--- a/director/redirect.go
+++ b/director/redirect.go
@@ -19,17 +19,43 @@
 package director
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"net/netip"
 	"net/url"
 	"path"
+	"regexp"
 	"strings"
+	"sync"
+
+	"github.com/pelicanplatform/pelican/param"
 
 	"github.com/gin-gonic/gin"
+	"github.com/hashicorp/go-version"
+	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 )
 
+type PromDiscoveryItem struct {
+	Targets []string          `json:"targets"`
+	Labels  map[string]string `json:"labels"`
+}
+
+var (
+	minClientVersion, _        = version.NewVersion("7.0.0")
+	minOriginVersion, _        = version.NewVersion("7.0.0")
+	minCacheVersion, _         = version.NewVersion("7.3.0")
+	healthTestCancelFuncs      = make(map[ServerAd]context.CancelFunc)
+	healthTestCancelFuncsMutex = sync.RWMutex{}
+)
+
+// The endpoint for director Prometheus instance to discover Pelican servers
+// for scraping (origins/caches).
+//
+// TODO: Add registry server as well to this endpoint when we need to scrape from it
+const DirectorServerDiscoveryEndpoint = "/api/v1.0/director/discoverServers"
+
 func getRedirectURL(reqPath string, ad ServerAd, requiresAuth bool) (redirectURL url.URL) {
 	var serverURL url.URL
 	if requiresAuth {
@@ -69,8 +95,12 @@ func getRealIP(ginCtx *gin.Context) (ipAddr netip.Addr, err error) {
 func getAuthzEscaped(req *http.Request) (authzEscaped string) {
 	if authzQuery := req.URL.Query()["authz"]; len(authzQuery) > 0 {
 		authzEscaped = authzQuery[0]
+		// if the authz URL query is coming from XRootD, it probably has a "Bearer " tacked in front
+		// even though it's coming via a URL
+		authzEscaped = strings.TrimPrefix(authzEscaped, "Bearer ")
 	} else if authzHeader := req.Header["Authorization"]; len(authzHeader) > 0 {
-		authzEscaped = url.QueryEscape(authzHeader[0])
+		authzEscaped = strings.TrimPrefix(authzHeader[0], "Bearer ")
+		authzEscaped = url.QueryEscape(authzEscaped)
 	}
 	return
 }
@@ -85,7 +115,65 @@ func getFinalRedirectURL(rurl url.URL, authzEscaped string) string {
 	return rurl.String()
 }
 
+func versionCompatCheck(ginCtx *gin.Context) error {
+	// Check that the version of whichever service (eg client, origin, etc) is talking to the Director
+	// is actually something the Director thinks it can communicate with
+
+	// The service/version is sent via User-Agent header in the form "pelican-<service>/<version>"
+	userAgentSlc := ginCtx.Request.Header["User-Agent"]
+	if len(userAgentSlc) < 1 {
+		return errors.New("No user agent could be found")
+	}
+
+	// gin gives us a slice of user agents. Since pelican services should only ever
+	// send one UA, assume that it is the 0-th element of the slice.
+	userAgent := userAgentSlc[0]
+
+	// Make sure we're working with something that's formatted the way we expect. If we
+	// don't match, then we're definitely not coming from one of the services, so we
+	// let things go without an error. Maybe someone is using curl?
+	uaRegExp := regexp.MustCompile(`^pelican-[^\/]+\/\d+\.\d+\.\d+`)
+	if matches := uaRegExp.MatchString(userAgent); !matches {
+		return nil
+	}
+
+	userAgentSplit := strings.Split(userAgent, "/")
+	// Grab the actual service/version that's using the Director. There may be different versioning
+	// requirements between origins, clients, and other services.
+	service := (strings.Split(userAgentSplit[0], "-"))[1]
+	reqVerStr := userAgentSplit[1]
+	reqVer, err := version.NewVersion(reqVerStr)
+	if err != nil {
+		return errors.Wrapf(err, "Could not parse service version as a semantic version: %s\n", reqVerStr)
+	}
+
+	var minCompatVer *version.Version
+	switch service {
+	case "client":
+		minCompatVer = minClientVersion
+	case "origin":
+		minCompatVer = minOriginVersion
+	case "cache":
+		minCompatVer = minCacheVersion
+	default:
+		return errors.Errorf("Invalid version format. The director does not support your %s version (%s).", service, reqVer.String())
+	}
+
+	if reqVer.LessThan(minCompatVer) {
+		return errors.Errorf("The director does not support your %s version (%s). Please update to %s or newer.", service, reqVer.String(), minCompatVer.String())
+	}
+
+	return nil
+}
+
 func RedirectToCache(ginCtx *gin.Context) {
+	err := versionCompatCheck(ginCtx)
+	if err != nil {
+		log.Debugf("A version incompatibility was encountered while redirecting to a cache and no response was served: %v", err)
+		ginCtx.JSON(500, gin.H{"error": "Incompatible versions detected: " + fmt.Sprintf("%v", err)})
+		return
+	}
+
 	reqPath := path.Clean("/" + ginCtx.Request.URL.Path)
 	reqPath = strings.TrimPrefix(reqPath, "/api/v1.0/director/object")
 	ipAddr, err := getRealIP(ginCtx)
@@ -96,19 +184,32 @@ func RedirectToCache(ginCtx *gin.Context) {
 
 	authzBearerEscaped := getAuthzEscaped(ginCtx.Request)
 
-	namespaceAd, _, cacheAds := GetAdsForPath(reqPath)
-	if len(cacheAds) == 0 {
-		ginCtx.String(404, "No cache found for path\n")
-		return
-	}
+	namespaceAd, originAds, cacheAds := GetAdsForPath(reqPath)
+	// if GetAdsForPath doesn't find any ads because the prefix doesn't exist, we should
+	// report the lack of path first -- this is most important for the user because it tells them
+	// they're trying to get an object that simply doesn't exist
 	if namespaceAd.Path == "" {
 		ginCtx.String(404, "No namespace found for path. Either it doesn't exist, or the Director is experiencing problems\n")
 		return
 	}
-	cacheAds, err = SortServers(ipAddr, cacheAds)
-	if err != nil {
-		ginCtx.String(500, "Failed to determine server ordering")
-		return
+	// If the namespace prefix DOES exist, then it makes sense to say we couldn't find a valid cache.
+	if len(cacheAds) == 0 {
+		for _, originAd := range originAds {
+			if originAd.EnableFallbackRead {
+				cacheAds = append(cacheAds, originAd)
+				break
+			}
+		}
+		if len(cacheAds) == 0 {
+			ginCtx.String(http.StatusNotFound, "No cache found for path")
+			return
+		}
+	} else {
+		cacheAds, err = SortServers(ipAddr, cacheAds)
+		if err != nil {
+			ginCtx.String(http.StatusInternalServerError, "Failed to determine server ordering")
+			return
+		}
 	}
 	redirectURL := getRedirectURL(reqPath, cacheAds[0], namespaceAd.RequireToken)
 
@@ -146,8 +247,8 @@ func RedirectToCache(ginCtx *gin.Context) {
 			ginCtx.Writer.Header()["X-Pelican-Token-Generation"] = []string{tokenGen}
 		}
 	}
-	ginCtx.Writer.Header()["X-Pelican-Namespace"] = []string{fmt.Sprintf("namespace=%s, require-token=%v",
-		namespaceAd.Path, namespaceAd.RequireToken)}
+	ginCtx.Writer.Header()["X-Pelican-Namespace"] = []string{fmt.Sprintf("namespace=%s, require-token=%v, collections-url=%s",
+		namespaceAd.Path, namespaceAd.RequireToken, namespaceAd.DirlistHost)}
 
 	// Note we only append the `authz` query parameter in the case of the redirect response and not the
 	// duplicate link metadata above.  This is purposeful: the Link header might get too long if we repeat
@@ -157,6 +258,13 @@ func RedirectToCache(ginCtx *gin.Context) {
 }
 
 func RedirectToOrigin(ginCtx *gin.Context) {
+	err := versionCompatCheck(ginCtx)
+	if err != nil {
+		log.Debugf("A version incompatibility was encountered while redirecting to an origin and no response was served: %v", err)
+		ginCtx.JSON(500, gin.H{"error": "Incompatible versions detected: " + fmt.Sprintf("%v", err)})
+		return
+	}
+
 	reqPath := path.Clean("/" + ginCtx.Request.URL.Path)
 	reqPath = strings.TrimPrefix(reqPath, "/api/v1.0/director/origin")
 
@@ -170,32 +278,110 @@ func RedirectToOrigin(ginCtx *gin.Context) {
 	authzBearerEscaped := getAuthzEscaped(ginCtx.Request)
 
 	namespaceAd, originAds, _ := GetAdsForPath(reqPath)
+	// if GetAdsForPath doesn't find any ads because the prefix doesn't exist, we should
+	// report the lack of path first -- this is most important for the user because it tells them
+	// they're trying to get an object that simply doesn't exist
 	if namespaceAd.Path == "" {
-		ginCtx.String(404, "No origin found for path\n")
+		ginCtx.String(http.StatusNotFound, "No namespace found for path. Either it doesn't exist, or the Director is experiencing problems\n")
+		return
+	}
+	// If the namespace prefix DOES exist, then it makes sense to say we couldn't find the origin.
+	if len(originAds) == 0 {
+		ginCtx.String(http.StatusNotFound, "There are currently no origins exporting the provided namespace prefix\n")
 		return
 	}
 
 	originAds, err = SortServers(ipAddr, originAds)
 	if err != nil {
-		ginCtx.String(500, "Failed to determine origin ordering")
+		ginCtx.String(http.StatusInternalServerError, "Failed to determine origin ordering")
 		return
 	}
+	ginCtx.Writer.Header()["X-Pelican-Namespace"] = []string{fmt.Sprintf("namespace=%s, require-token=%v, collections-url=%s",
+		namespaceAd.Path, namespaceAd.RequireToken, namespaceAd.DirlistHost)}
 
-	redirectURL := getRedirectURL(reqPath, originAds[0], namespaceAd.RequireToken)
-	// See note in RedirectToCache as to why we only add the authz query parameter to this URL,
-	// not those in the `Link`.
-	ginCtx.Redirect(307, getFinalRedirectURL(redirectURL, authzBearerEscaped))
+	var redirectURL url.URL
+	// If we are doing a PUT, check to see if any origins are writeable
+	if ginCtx.Request.Method == "PUT" {
+		for idx, ad := range originAds {
+			if ad.EnableWrite {
+				redirectURL = getRedirectURL(reqPath, originAds[idx], namespaceAd.RequireToken)
+				ginCtx.Redirect(http.StatusTemporaryRedirect, getFinalRedirectURL(redirectURL, authzBearerEscaped))
+				return
+			}
+		}
+		ginCtx.String(http.StatusMethodNotAllowed, "No origins on specified endpoint are writeable\n")
+		return
+	} else { // Otherwise, we are doing a GET
+		redirectURL := getRedirectURL(reqPath, originAds[0], namespaceAd.RequireToken)
+		// See note in RedirectToCache as to why we only add the authz query parameter to this URL,
+		// not those in the `Link`.
+		ginCtx.Redirect(http.StatusTemporaryRedirect, getFinalRedirectURL(redirectURL, authzBearerEscaped))
+	}
+}
+
+func checkHostnameRedirects(c *gin.Context, incomingHost string) {
+	oRedirectHosts := param.Director_OriginResponseHostnames.GetStringSlice()
+	cRedirectHosts := param.Director_CacheResponseHostnames.GetStringSlice()
 
+	for _, hostname := range oRedirectHosts {
+		if hostname == incomingHost {
+			if !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director/") {
+				c.Request.URL.Path = "/api/v1.0/director/origin" + c.Request.URL.Path
+				RedirectToOrigin(c)
+				c.Abort()
+				log.Debugln("Director is serving an origin based on incoming 'Host' header value of '" + hostname + "'")
+				return
+			}
+		}
+	}
+	for _, hostname := range cRedirectHosts {
+		if hostname == incomingHost {
+			if !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director/") {
+				c.Request.URL.Path = "/api/v1.0/director/object" + c.Request.URL.Path
+				RedirectToCache(c)
+				c.Abort()
+				log.Debugln("Director is serving a cache based on incoming 'Host' header value of '" + hostname + "'")
+				return
+			}
+		}
+	}
 }
 
 // Middleware sends GET /foo/bar to the RedirectToCache function, as if the
 // original request had been made to /api/v1.0/director/object/foo/bar
 func ShortcutMiddleware(defaultResponse string) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		// If this is a request for getting public key, don't modify the path
+		// If this is a request to the Prometheus API, don't modify the path
+		if strings.HasPrefix(c.Request.URL.Path, "/.well-known/") ||
+			(strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/") && !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director/")) {
+			c.Next()
+			return
+		}
+		// Regardless of the remainder of the settings, we currently handle a PUT as a query to the origin endpoint
+		if c.Request.Method == "PUT" {
+			c.Request.URL.Path = "/api/v1.0/director/origin" + c.Request.URL.Path
+			RedirectToOrigin(c)
+			c.Abort()
+			return
+		}
+
+		// We grab the host and x-forwarded-host headers, which can be set by a client with the intent of changing the
+		// Director's default behavior (eg the director normally forwards to caches, but if it receives a request with
+		// a pre-configured hostname in its x-forwarded-host header, that indicates we should actually serve an origin.)
+		host, hostPresent := c.Request.Header["Host"]
+		xForwardedHost, xForwardedHostPresent := c.Request.Header["X-Forwarded-Host"]
+
+		if hostPresent {
+			checkHostnameRedirects(c, host[0])
+		} else if xForwardedHostPresent {
+			checkHostnameRedirects(c, xForwardedHost[0])
+		}
+
 		// If we're configured for cache mode or we haven't set the flag,
 		// we should use cache middleware
 		if defaultResponse == "cache" {
-			if !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director") {
+			if !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director/") {
 				c.Request.URL.Path = "/api/v1.0/director/object" + c.Request.URL.Path
 				RedirectToCache(c)
 				c.Abort()
@@ -205,7 +391,7 @@ func ShortcutMiddleware(defaultResponse string) gin.HandlerFunc {
 			// If the path starts with the correct prefix, continue with the next handler
 			c.Next()
 		} else if defaultResponse == "origin" {
-			if !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director") {
+			if !strings.HasPrefix(c.Request.URL.Path, "/api/v1.0/director/") {
 				c.Request.URL.Path = "/api/v1.0/director/origin" + c.Request.URL.Path
 				RedirectToOrigin(c)
 				c.Abort()
@@ -216,53 +402,182 @@ func ShortcutMiddleware(defaultResponse string) gin.HandlerFunc {
 	}
 }
 
-func RegisterOrigin(ctx *gin.Context) {
+func registerServeAd(engineCtx context.Context, ctx *gin.Context, sType ServerType) {
 	tokens, present := ctx.Request.Header["Authorization"]
 	if !present || len(tokens) == 0 {
-		ctx.JSON(401, gin.H{"error": "Bearer token not present in the 'Authorization' header"})
+		ctx.JSON(http.StatusForbidden, gin.H{"error": "Bearer token not present in the 'Authorization' header"})
+		return
+	}
+
+	err := versionCompatCheck(ctx)
+	if err != nil {
+		log.Debugf("A version incompatibility was encountered while registering %s and no response was served: %v", sType, err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Incompatible versions detected: " + fmt.Sprintf("%v", err)})
 		return
 	}
+
 	ad := OriginAdvertise{}
 	if ctx.ShouldBind(&ad) != nil {
-		ctx.JSON(400, gin.H{"error": "Invalid origin registration"})
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid " + sType + " registration"})
 		return
 	}
 
-	for _, namespace := range ad.Namespaces {
-		ok, err := VerifyAdvertiseToken(tokens[0], namespace.Path)
+	if sType == OriginType {
+		for _, namespace := range ad.Namespaces {
+			// We're assuming there's only one token in the slice
+			token := strings.TrimPrefix(tokens[0], "Bearer ")
+			ok, err := VerifyAdvertiseToken(engineCtx, token, namespace.Path)
+			if err != nil {
+				log.Warningln("Failed to verify token:", err)
+				ctx.JSON(http.StatusForbidden, gin.H{"error": "Authorization token verification failed"})
+				return
+			}
+			if !ok {
+				log.Warningf("%s %v advertised to namespace %v without valid registration\n",
+					sType, ad.Name, namespace.Path)
+				ctx.JSON(http.StatusForbidden, gin.H{"error": sType + " not authorized to advertise to this namespace"})
+				return
+			}
+		}
+	} else {
+		token := strings.TrimPrefix(tokens[0], "Bearer ")
+		prefix := path.Join("caches", ad.Name)
+		ok, err := VerifyAdvertiseToken(engineCtx, token, prefix)
 		if err != nil {
-			log.Warningln("Failed to verify token:", err)
-			ctx.JSON(400, gin.H{"error": "Authorization token verification failed"})
+			if err == adminApprovalErr {
+				log.Warningln("Failed to verify token. Cache was not approved:", err)
+				ctx.JSON(http.StatusForbidden, gin.H{"error": "Cache is not admin approved"})
+			} else {
+				log.Warningln("Failed to verify token:", err)
+				ctx.JSON(http.StatusForbidden, gin.H{"error": "Authorization token verification failed"})
+			}
 			return
 		}
 		if !ok {
-			log.Warningf("Origin %v advertised to namespace %v without valid registration\n",
-				ad.Name, namespace.Path)
-			ctx.JSON(400, gin.H{"error": "Origin not authorized to advertise to this namespace"})
+			log.Warningf("%s %v advertised to namespace %v without valid registration\n",
+				sType, ad.Name, prefix)
+			ctx.JSON(http.StatusForbidden, gin.H{"error": sType + " not authorized to advertise to this namespace"})
 			return
 		}
 	}
 
 	ad_url, err := url.Parse(ad.URL)
 	if err != nil {
-		log.Warningf("Failed to parse origin URL %v: %v\n", ad.URL, err)
-		ctx.JSON(400, gin.H{"error": "Invalid origin URL"})
+		log.Warningf("Failed to parse %s URL %v: %v\n", sType, ad.URL, err)
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid " + sType + " URL"})
 		return
 	}
 
-	originAd := ServerAd{
-		Name:    ad.Name,
-		AuthURL: *ad_url,
-		URL:     *ad_url,
-		Type:    OriginType,
+	adWebUrl, err := url.Parse(ad.WebURL)
+	if err != nil && ad.WebURL != "" { // We allow empty WebURL string for backward compatibility
+		log.Warningf("Failed to parse origin Web URL %v: %v\n", ad.WebURL, err)
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid origin Web URL"})
+		return
 	}
-	RecordAd(originAd, &ad.Namespaces)
-	ctx.JSON(200, gin.H{"msg": "Successful registration"})
+
+	sAd := ServerAd{
+		Name:               ad.Name,
+		AuthURL:            *ad_url,
+		URL:                *ad_url,
+		WebURL:             *adWebUrl,
+		Type:               sType,
+		EnableWrite:        ad.EnableWrite,
+		EnableFallbackRead: ad.EnableFallbackRead,
+	}
+
+	hasOriginAdInCache := serverAds.Has(sAd)
+	RecordAd(sAd, &ad.Namespaces)
+
+	// Start director periodic test of origin's health status if origin AD
+	// has WebURL field AND it's not already been registered
+	healthTestCancelFuncsMutex.Lock()
+	defer healthTestCancelFuncsMutex.Unlock()
+	if ad.WebURL != "" && !hasOriginAdInCache {
+		if _, ok := healthTestCancelFuncs[sAd]; ok {
+			// If somehow we didn't clear the key, we call cancel first before
+			// adding a new test cycle
+			healthTestCancelFuncs[sAd]()
+		}
+		ctx, cancel := context.WithCancel(context.Background())
+		healthTestCancelFuncs[sAd] = cancel
+		LaunchPeriodicDirectorTest(ctx, sAd)
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"msg": "Successful registration"})
+}
+
+// Return a list of registered origins and caches in Prometheus HTTP SD format
+// for director's Prometheus service discovery
+func DiscoverOriginCache(ctx *gin.Context) {
+	// Check token for authorization
+	tokens, present := ctx.Request.Header["Authorization"]
+	if !present || len(tokens) == 0 {
+		ctx.JSON(401, gin.H{"error": "Bearer token not present in the 'Authorization' header"})
+		return
+	}
+	token := strings.TrimPrefix(tokens[0], "Bearer ")
+	ok, err := VerifyDirectorSDToken(token)
+	if err != nil {
+		log.Warningln("Failed to verify director service discovery token:", err)
+		ctx.JSON(401, gin.H{"error": fmt.Sprintf("Authorization token verification failed: %v\n", err)})
+		return
+	}
+	if !ok {
+		log.Warningf("Invalid token for accessing director's sevice discovery")
+		ctx.JSON(401, gin.H{"error": "Invalid token for accessing director's sevice discovery"})
+		return
+	}
+
+	serverAdMutex.RLock()
+	defer serverAdMutex.RUnlock()
+	serverAds := serverAds.Keys()
+	promDiscoveryRes := make([]PromDiscoveryItem, 0)
+	for _, ad := range serverAds {
+		if ad.WebURL.String() == "" {
+			// Origins and caches fetched from topology can't be scraped as they
+			// don't have a WebURL
+			continue
+		}
+		promDiscoveryRes = append(promDiscoveryRes, PromDiscoveryItem{
+			Targets: []string{ad.WebURL.Hostname() + ":" + ad.WebURL.Port()},
+			Labels: map[string]string{
+				"server_type":     string(ad.Type),
+				"server_name":     ad.Name,
+				"server_auth_url": ad.AuthURL.String(),
+				"server_url":      ad.URL.String(),
+				"server_web_url":  ad.WebURL.String(),
+				"server_lat":      fmt.Sprintf("%.4f", ad.Latitude),
+				"server_long":     fmt.Sprintf("%.4f", ad.Longitude),
+			},
+		})
+	}
+	ctx.JSON(200, promDiscoveryRes)
+}
+
+func RegisterOrigin(ctx context.Context, gctx *gin.Context) {
+	registerServeAd(ctx, gctx, OriginType)
+}
+
+func RegisterCache(ctx context.Context, gctx *gin.Context) {
+	registerServeAd(ctx, gctx, CacheType)
+}
+
+func ListNamespaces(ctx *gin.Context) {
+	namespaceAds := ListNamespacesFromOrigins()
+
+	ctx.JSON(http.StatusOK, namespaceAds)
 }
 
-func RegisterDirector(router *gin.RouterGroup) {
+func RegisterDirector(ctx context.Context, router *gin.RouterGroup) {
 	// Establish the routes used for cache/origin redirection
 	router.GET("/api/v1.0/director/object/*any", RedirectToCache)
 	router.GET("/api/v1.0/director/origin/*any", RedirectToOrigin)
-	router.POST("/api/v1.0/director/registerOrigin", RegisterOrigin)
+	router.PUT("/api/v1.0/director/origin/*any", RedirectToOrigin)
+	router.POST("/api/v1.0/director/registerOrigin", func(gctx *gin.Context) { RegisterOrigin(ctx, gctx) })
+	// In the foreseeable feature, director will scrape all servers in Pelican ecosystem (including registry)
+	// so that director can be our point of contact for collecting system-level metrics.
+	// Rename the endpoint to reflect such plan.
+	router.GET(DirectorServerDiscoveryEndpoint, DiscoverOriginCache)
+	router.POST("/api/v1.0/director/registerCache", func(gctx *gin.Context) { RegisterCache(ctx, gctx) })
+	router.GET("/api/v1.0/director/listNamespaces", ListNamespaces)
 }
diff --git a/director/redirect_test.go b/director/redirect_test.go
new file mode 100644
index 000000000..577230dc7
--- /dev/null
+++ b/director/redirect_test.go
@@ -0,0 +1,713 @@
+package director
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type MockCache struct {
+	GetFn      func(u string, kset *jwk.Set) (jwk.Set, error)
+	RegisterFn func(*MockCache) error
+
+	keyset jwk.Set
+}
+
+func (m *MockCache) Get(ctx context.Context, u string) (jwk.Set, error) {
+	return m.GetFn(u, &m.keyset)
+}
+
+func (m *MockCache) Register(u string, options ...jwk.RegisterOption) error {
+	m.keyset = jwk.NewSet()
+	return m.RegisterFn(m)
+}
+
+func NamespaceAdContainsPath(ns []NamespaceAd, path string) bool {
+	for _, v := range ns {
+		if v.Path == path {
+			return true
+		}
+	}
+	return false
+}
+
+func TestDirectorRegistration(t *testing.T) {
+	/*
+	* Tests the RegisterOrigin endpoint. Specifically it creates a keypair and
+	* corresponding token and invokes the registration endpoint, it then does
+	* so again with an invalid token and confirms that the correct error is returned
+	 */
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+
+	viper.Set("Federation.RegistryUrl", "https://get-your-tokens.org")
+
+	setupContext := func() (*gin.Context, *gin.Engine, *httptest.ResponseRecorder) {
+		// Setup httptest recorder and context for the the unit test
+		w := httptest.NewRecorder()
+		c, r := gin.CreateTestContext(w)
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			assert.Equal(t, "POST", req.Method, "Not POST Method")
+			_, err := w.Write([]byte(":)"))
+			assert.NoError(t, err)
+		}))
+		defer ts.Close()
+
+		c.Request = &http.Request{
+			URL: &url.URL{},
+		}
+		return c, r, w
+	}
+
+	generateToken := func(c *gin.Context) (jwk.Key, string, url.URL) {
+		// Create a private key to use for the test
+		privateKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+		assert.NoError(t, err, "Error generating private key")
+
+		// Convert from raw ecdsa to jwk.Key
+		pKey, err := jwk.FromRaw(privateKey)
+		assert.NoError(t, err, "Unable to convert ecdsa.PrivateKey to jwk.Key")
+
+		//Assign Key id to the private key
+		err = jwk.AssignKeyID(pKey)
+		assert.NoError(t, err, "Error assigning kid to private key")
+
+		//Set an algorithm for the key
+		err = pKey.Set(jwk.AlgorithmKey, jwa.ES256)
+		assert.NoError(t, err, "Unable to set algorithm for pKey")
+
+		issuerURL := url.URL{
+			Scheme: "https",
+			Path:   "get-your-tokens.org/namespaces/foo/bar",
+			Host:   c.Request.URL.Host,
+		}
+
+		// Create a token to be inserted
+		tok, err := jwt.NewBuilder().
+			Issuer(issuerURL.String()).
+			Claim("scope", token_scopes.Pelican_Advertise.String()).
+			Audience([]string{"director.test"}).
+			Subject("origin").
+			Build()
+		assert.NoError(t, err, "Error creating token")
+
+		signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, pKey))
+		assert.NoError(t, err, "Error signing token")
+
+		return pKey, string(signed), issuerURL
+	}
+
+	setupRequest := func(c *gin.Context, r *gin.Engine, bodyByt []byte, token string) {
+		r.POST("/", func(gctx *gin.Context) { RegisterOrigin(ctx, gctx) })
+		c.Request, _ = http.NewRequest(http.MethodPost, "/", bytes.NewBuffer(bodyByt))
+		c.Request.Header.Set("Authorization", "Bearer "+token)
+		c.Request.Header.Set("Content-Type", "application/json")
+		// Hard code the current min version. When this test starts failing because of new stuff in the Director,
+		// we'll know that means it's time to update the min version in redirect.go
+		c.Request.Header.Set("User-Agent", "pelican-origin/7.0.0")
+	}
+
+	// Inject into the cache, using a mock cache to avoid dealing with
+	// real namespaces
+	setupMockCache := func(t *testing.T, publicKey jwk.Key) MockCache {
+		return MockCache{
+			GetFn: func(key string, keyset *jwk.Set) (jwk.Set, error) {
+				if key != "https://get-your-tokens.org/api/v1.0/registry/foo/bar/.well-known/issuer.jwks" {
+					t.Errorf("expecting: https://get-your-tokens.org/api/v1.0/registry/foo/bar/.well-known/issuer.jwks, got %q", key)
+				}
+				return *keyset, nil
+			},
+			RegisterFn: func(m *MockCache) error {
+				err := jwk.Set.AddKey(m.keyset, publicKey)
+				if err != nil {
+					t.Error(err)
+				}
+				return nil
+			},
+		}
+	}
+
+	// Perform injections (ar.Register will create a jwk.keyset with the publickey in it)
+	useMockCache := func(ar MockCache, issuerURL url.URL) {
+		if err := ar.Register(issuerURL.String(), jwk.WithMinRefreshInterval(15*time.Minute)); err != nil {
+			t.Errorf("this should never happen, should actually be impossible, including check for the linter")
+		}
+		namespaceKeysMutex.Lock()
+		defer namespaceKeysMutex.Unlock()
+		namespaceKeys.Set("/foo/bar", &ar, ttlcache.DefaultTTL)
+	}
+
+	teardown := func() {
+		serverAdMutex.Lock()
+		defer serverAdMutex.Unlock()
+		serverAds.DeleteAll()
+	}
+
+	t.Run("valid-token", func(t *testing.T) {
+		c, r, w := setupContext()
+		pKey, token, issuerURL := generateToken(c)
+		publicKey, err := jwk.PublicKeyOf(pKey)
+		assert.NoError(t, err, "Error creating public key from private key")
+
+		ar := setupMockCache(t, publicKey)
+		useMockCache(ar, issuerURL)
+
+		isurl := url.URL{}
+		isurl.Path = "https://get-your-tokens.org"
+
+		ad := OriginAdvertise{Name: "test", URL: "https://or-url.org", Namespaces: []NamespaceAd{{Path: "/foo/bar", Issuer: isurl}}}
+
+		jsonad, err := json.Marshal(ad)
+		assert.NoError(t, err, "Error marshalling OriginAdvertise")
+
+		setupRequest(c, r, jsonad, token)
+
+		r.ServeHTTP(w, c.Request)
+
+		// Check to see that the code exits with status code 200 after given it a good token
+		assert.Equal(t, 200, w.Result().StatusCode, "Expected status code of 200")
+
+		namaspaceADs := ListNamespacesFromOrigins()
+		// If the origin was successfully registed at director, we should be able to find it in director's originAds
+		assert.True(t, NamespaceAdContainsPath(namaspaceADs, "/foo/bar"), "Coudln't find namespace in the director cache.")
+		teardown()
+	})
+
+	// Now repeat the above test, but with an invalid token
+	t.Run("invalid-token", func(t *testing.T) {
+		c, r, w := setupContext()
+		wrongPrivateKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+		assert.NoError(t, err, "Error creating another private key")
+		_, token, issuerURL := generateToken(c)
+
+		wrongPublicKey, err := jwk.PublicKeyOf(wrongPrivateKey)
+		assert.NoError(t, err, "Error creating public key from private key")
+		ar := setupMockCache(t, wrongPublicKey)
+		useMockCache(ar, issuerURL)
+
+		isurl := url.URL{}
+		isurl.Path = "https://get-your-tokens.org"
+
+		ad := OriginAdvertise{Name: "test", URL: "https://or-url.org", Namespaces: []NamespaceAd{{Path: "/foo/bar", Issuer: isurl}}}
+
+		jsonad, err := json.Marshal(ad)
+		assert.NoError(t, err, "Error marshalling OriginAdvertise")
+
+		setupRequest(c, r, jsonad, token)
+
+		r.ServeHTTP(w, c.Request)
+
+		assert.Equal(t, http.StatusForbidden, w.Result().StatusCode, "Expected failing status code of 403")
+		body, _ := io.ReadAll(w.Result().Body)
+		assert.Equal(t, `{"error":"Authorization token verification failed"}`, string(body), "Failure wasn't because token verification failed")
+
+		namaspaceADs := ListNamespacesFromOrigins()
+		assert.False(t, NamespaceAdContainsPath(namaspaceADs, "/foo/bar"), "Found namespace in the director cache even if the token validation failed.")
+		teardown()
+	})
+
+	t.Run("valid-token-with-web-url", func(t *testing.T) {
+		c, r, w := setupContext()
+		pKey, token, issuerURL := generateToken(c)
+		publicKey, err := jwk.PublicKeyOf(pKey)
+		assert.NoError(t, err, "Error creating public key from private key")
+		ar := setupMockCache(t, publicKey)
+		useMockCache(ar, issuerURL)
+
+		isurl := url.URL{}
+		isurl.Path = "https://get-your-tokens.org"
+
+		ad := OriginAdvertise{WebURL: "https://localhost:8844", Namespaces: []NamespaceAd{{Path: "/foo/bar", Issuer: isurl}}}
+
+		jsonad, err := json.Marshal(ad)
+		assert.NoError(t, err, "Error marshalling OriginAdvertise")
+
+		setupRequest(c, r, jsonad, token)
+
+		r.ServeHTTP(w, c.Request)
+
+		assert.Equal(t, 200, w.Result().StatusCode, "Expected status code of 200")
+		assert.Equal(t, 1, len(serverAds.Keys()), "Origin fail to register at serverAds")
+		assert.Equal(t, "https://localhost:8844", serverAds.Keys()[0].WebURL.String(), "WebURL in serverAds does not match data in origin registration request")
+		teardown()
+	})
+
+	// We want to ensure backwards compatibility for WebURL
+	t.Run("valid-token-without-web-url", func(t *testing.T) {
+		c, r, w := setupContext()
+		pKey, token, issuerURL := generateToken(c)
+		publicKey, err := jwk.PublicKeyOf(pKey)
+		assert.NoError(t, err, "Error creating public key from private key")
+		ar := setupMockCache(t, publicKey)
+		useMockCache(ar, issuerURL)
+
+		isurl := url.URL{}
+		isurl.Path = "https://get-your-tokens.org"
+
+		ad := OriginAdvertise{Namespaces: []NamespaceAd{{Path: "/foo/bar", Issuer: isurl}}}
+
+		jsonad, err := json.Marshal(ad)
+		assert.NoError(t, err, "Error marshalling OriginAdvertise")
+
+		setupRequest(c, r, jsonad, token)
+
+		r.ServeHTTP(w, c.Request)
+
+		assert.Equal(t, 200, w.Result().StatusCode, "Expected status code of 200")
+		assert.Equal(t, 1, len(serverAds.Keys()), "Origin fail to register at serverAds")
+		assert.Equal(t, "", serverAds.Keys()[0].WebURL.String(), "WebURL in serverAds isn't empty with no WebURL provided in registration")
+		teardown()
+	})
+}
+
+func TestGetAuthzEscaped(t *testing.T) {
+	// Test passing a token via header with no bearer prefix
+	req, err := http.NewRequest(http.MethodPost, "http://fake-server.com", bytes.NewBuffer([]byte("a body")))
+	assert.NoError(t, err)
+	req.Header.Set("Authorization", "tokenstring")
+	escapedToken := getAuthzEscaped(req)
+	assert.Equal(t, escapedToken, "tokenstring")
+
+	// Test passing a token via query with no bearer prefix
+	req, err = http.NewRequest(http.MethodPost, "http://fake-server.com/foo?authz=tokenstring", bytes.NewBuffer([]byte("a body")))
+	assert.NoError(t, err)
+	escapedToken = getAuthzEscaped(req)
+	assert.Equal(t, escapedToken, "tokenstring")
+
+	// Test passing the token via header with Bearer prefix
+	req, err = http.NewRequest(http.MethodPost, "http://fake-server.com", bytes.NewBuffer([]byte("a body")))
+	assert.NoError(t, err)
+	req.Header.Set("Authorization", "Bearer tokenstring")
+	escapedToken = getAuthzEscaped(req)
+	assert.Equal(t, escapedToken, "tokenstring")
+
+	// Test passing the token via URL with Bearer prefix and + encoded space
+	req, err = http.NewRequest(http.MethodPost, "http://fake-server.com/foo?authz=Bearer+tokenstring", bytes.NewBuffer([]byte("a body")))
+	assert.NoError(t, err)
+	escapedToken = getAuthzEscaped(req)
+	assert.Equal(t, escapedToken, "tokenstring")
+
+	// Finally, the same test as before, but test with %20 encoded space
+	req, err = http.NewRequest(http.MethodPost, "http://fake-server.com/foo?authz=Bearer%20tokenstring", bytes.NewBuffer([]byte("a body")))
+	assert.NoError(t, err)
+	escapedToken = getAuthzEscaped(req)
+	assert.Equal(t, escapedToken, "tokenstring")
+}
+
+func TestDiscoverOriginCache(t *testing.T) {
+	mockPelicanOriginServerAd := ServerAd{
+		Name:    "1-test-origin-server",
+		AuthURL: url.URL{},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "fake-origin.org:8443",
+		},
+		WebURL: url.URL{
+			Scheme: "https",
+			Host:   "fake-origin.org:8444",
+		},
+		Type:      OriginType,
+		Latitude:  123.05,
+		Longitude: 456.78,
+	}
+
+	mockTopoOriginServerAd := ServerAd{
+		Name:    "test-topology-origin-server",
+		AuthURL: url.URL{},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "fake-topology-origin.org:8443",
+		},
+		Type:      OriginType,
+		Latitude:  123.05,
+		Longitude: 456.78,
+	}
+
+	mockCacheServerAd := ServerAd{
+		Name:    "2-test-cache-server",
+		AuthURL: url.URL{},
+		URL: url.URL{
+			Scheme: "https",
+			Host:   "fake-cache.org:8443",
+		},
+		WebURL: url.URL{
+			Scheme: "https",
+			Host:   "fake-cache.org:8444",
+		},
+		Type:      CacheType,
+		Latitude:  45.67,
+		Longitude: 123.05,
+	}
+
+	mockNamespaceAd := NamespaceAd{
+		RequireToken:  true,
+		Path:          "/foo/bar/",
+		Issuer:        url.URL{},
+		MaxScopeDepth: 1,
+		Strategy:      "",
+		BasePath:      "",
+		VaultServer:   "",
+	}
+
+	mockDirectorUrl := "https://fake-director.org:8888"
+	viper.Reset()
+	// Direcor SD will only be used for director's Prometheus scraper to get available origins,
+	// so the token issuer is issentially the director server itself
+	// There's no need to rely on Federation.DirectorUrl as token issuer in this case
+	viper.Set("Server.ExternalWebUrl", mockDirectorUrl)
+
+	tDir := t.TempDir()
+	kfile := filepath.Join(tDir, "testKey")
+	viper.Set("IssuerKey", kfile)
+
+	// Generate a private key to use for the test
+	_, err := config.GetIssuerPublicJWKS()
+	assert.NoError(t, err, "Error generating private key")
+	// Get private key
+	privateKey, err := config.GetIssuerPrivateJWK()
+	assert.NoError(t, err, "Error loading private key")
+
+	// Batch set up different tokens
+	setupToken := func(wrongIssuer string) []byte {
+		issuerURL, err := url.Parse(mockDirectorUrl)
+		assert.NoError(t, err, "Error parsing director's URL")
+		tokenIssuerString := ""
+		if wrongIssuer != "" {
+			tokenIssuerString = wrongIssuer
+		} else {
+			tokenIssuerString = issuerURL.String()
+		}
+
+		tok, err := jwt.NewBuilder().
+			Issuer(tokenIssuerString).
+			Claim("scope", token_scopes.Pelican_DirectorServiceDiscovery).
+			Audience([]string{"director.test"}).
+			Subject("director").
+			Expiration(time.Now().Add(time.Hour)).
+			Build()
+		assert.NoError(t, err, "Error creating token")
+
+		err = jwk.AssignKeyID(privateKey)
+		assert.NoError(t, err, "Error assigning key id")
+
+		// Sign token with previously created private key
+		signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, privateKey))
+		assert.NoError(t, err, "Error signing token")
+		return signed
+	}
+
+	areSlicesEqualIgnoreOrder := func(slice1, slice2 []PromDiscoveryItem) bool {
+		if len(slice1) != len(slice2) {
+			return false
+		}
+
+		counts := make(map[string]int)
+
+		for _, item := range slice1 {
+			bytes, err := json.Marshal(item)
+			require.NoError(t, err)
+			counts[string(bytes)]++
+		}
+
+		for _, item := range slice2 {
+			bytes, err := json.Marshal(item)
+			require.NoError(t, err)
+			counts[string(bytes)]--
+			if counts[string(bytes)] < 0 {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	r := gin.Default()
+	r.GET("/test", DiscoverOriginCache)
+
+	t.Run("no-token-should-give-401", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/test", nil)
+		if err != nil {
+			t.Fatalf("Could not make a GET request: %v", err)
+		}
+
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, 401, w.Code)
+		assert.Equal(t, `{"error":"Bearer token not present in the 'Authorization' header"}`, w.Body.String())
+	})
+	t.Run("token-present-with-wrong-issuer-should-give-401", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/test", nil)
+		if err != nil {
+			t.Fatalf("Could not make a GET request: %v", err)
+		}
+
+		req.Header.Set("Authorization", "Bearer "+string(setupToken("https://wrong-issuer.org")))
+
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, 401, w.Code)
+		assert.Equal(t, `{"error":"Authorization token verification failed: Token issuer is not a director\n"}`, w.Body.String())
+	})
+	t.Run("token-present-valid-should-give-200-and-empty-array", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/test", nil)
+		if err != nil {
+			t.Fatalf("Could not make a GET request: %v", err)
+		}
+
+		req.Header.Set("Authorization", "Bearer "+string(setupToken("")))
+
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, 200, w.Code)
+		assert.Equal(t, `[]`, w.Body.String())
+	})
+	t.Run("response-should-match-serverAds", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/test", nil)
+		if err != nil {
+			t.Fatalf("Could not make a GET request: %v", err)
+		}
+
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.DeleteAll()
+			serverAds.Set(mockPelicanOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+			// Server fetched from topology should not be present in SD response
+			serverAds.Set(mockTopoOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+			serverAds.Set(mockCacheServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+		}()
+
+		expectedRes := []PromDiscoveryItem{{
+			Targets: []string{mockCacheServerAd.WebURL.Hostname() + ":" + mockCacheServerAd.WebURL.Port()},
+			Labels: map[string]string{
+				"server_type":     string(mockCacheServerAd.Type),
+				"server_name":     mockCacheServerAd.Name,
+				"server_auth_url": mockCacheServerAd.AuthURL.String(),
+				"server_url":      mockCacheServerAd.URL.String(),
+				"server_web_url":  mockCacheServerAd.WebURL.String(),
+				"server_lat":      fmt.Sprintf("%.4f", mockCacheServerAd.Latitude),
+				"server_long":     fmt.Sprintf("%.4f", mockCacheServerAd.Longitude),
+			},
+		}, {
+			Targets: []string{mockPelicanOriginServerAd.WebURL.Hostname() + ":" + mockPelicanOriginServerAd.WebURL.Port()},
+			Labels: map[string]string{
+				"server_type":     string(mockPelicanOriginServerAd.Type),
+				"server_name":     mockPelicanOriginServerAd.Name,
+				"server_auth_url": mockPelicanOriginServerAd.AuthURL.String(),
+				"server_url":      mockPelicanOriginServerAd.URL.String(),
+				"server_web_url":  mockPelicanOriginServerAd.WebURL.String(),
+				"server_lat":      fmt.Sprintf("%.4f", mockPelicanOriginServerAd.Latitude),
+				"server_long":     fmt.Sprintf("%.4f", mockPelicanOriginServerAd.Longitude),
+			},
+		}}
+
+		req.Header.Set("Authorization", "Bearer "+string(setupToken("")))
+
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		require.Equal(t, 200, w.Code)
+
+		var resMarshalled []PromDiscoveryItem
+		err = json.Unmarshal(w.Body.Bytes(), &resMarshalled)
+		require.NoError(t, err, "Error unmarshall response to json")
+
+		assert.True(t, areSlicesEqualIgnoreOrder(expectedRes, resMarshalled))
+	})
+
+	t.Run("no-duplicated-origins", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/test", nil)
+		if err != nil {
+			t.Fatalf("Could not make a GET request: %v", err)
+		}
+
+		func() {
+			serverAdMutex.Lock()
+			defer serverAdMutex.Unlock()
+			serverAds.DeleteAll()
+			// Add multiple same serverAds
+			serverAds.Set(mockPelicanOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+			serverAds.Set(mockPelicanOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+			serverAds.Set(mockPelicanOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+			// Server fetched from topology should not be present in SD response
+			serverAds.Set(mockTopoOriginServerAd, []NamespaceAd{mockNamespaceAd}, ttlcache.DefaultTTL)
+		}()
+
+		expectedRes := []PromDiscoveryItem{{
+			Targets: []string{mockPelicanOriginServerAd.WebURL.Hostname() + ":" + mockPelicanOriginServerAd.WebURL.Port()},
+			Labels: map[string]string{
+				"server_type":     string(mockPelicanOriginServerAd.Type),
+				"server_name":     mockPelicanOriginServerAd.Name,
+				"server_auth_url": mockPelicanOriginServerAd.AuthURL.String(),
+				"server_url":      mockPelicanOriginServerAd.URL.String(),
+				"server_web_url":  mockPelicanOriginServerAd.WebURL.String(),
+				"server_lat":      fmt.Sprintf("%.4f", mockPelicanOriginServerAd.Latitude),
+				"server_long":     fmt.Sprintf("%.4f", mockPelicanOriginServerAd.Longitude),
+			},
+		}}
+
+		resStr, err := json.Marshal(expectedRes)
+		assert.NoError(t, err, "Could not marshal json response")
+
+		req.Header.Set("Authorization", "Bearer "+string(setupToken("")))
+
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, 200, w.Code)
+		assert.Equal(t, string(resStr), w.Body.String(), "Reponse doesn't match expected")
+	})
+}
+
+func TestRedirects(t *testing.T) {
+	// Check that the checkkHostnameRedirects uses the pre-configured hostnames to redirect
+	// requests that come in at the default paths, but not if the request is made
+	// specifically for an object or a cache via the API.
+	t.Run("redirect-check-hostnames", func(t *testing.T) {
+		// Note that we don't test here for the case when hostname redirects is turned off
+		// because the checkHostnameRedirects function should be unreachable via ShortcutMiddleware
+		// in that case, ie if we call this function and the incoming hostname matches, we should do
+		// the redirect specified
+		viper.Set("Director.OriginResponseHostnames", []string{"origin-hostname.com"})
+		viper.Set("Director.CacheResponseHostnames", []string{"cache-hostname.com"})
+
+		// base path with origin-redirect hostname, should redirect to origin
+		c, _ := gin.CreateTestContext(httptest.NewRecorder())
+		req := httptest.NewRequest("GET", "/foo/bar", nil)
+		c.Request = req
+		checkHostnameRedirects(c, "origin-hostname.com")
+		expectedPath := "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// base path with cache-redirect hostname, should redirect to cache
+		req = httptest.NewRequest("GET", "/foo/bar", nil)
+		c.Request = req
+		checkHostnameRedirects(c, "cache-hostname.com")
+		expectedPath = "/api/v1.0/director/object/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// API path that should ALWAYS redirect to an origin
+		req = httptest.NewRequest("GET", "/api/v1.0/director/origin/foo/bar", nil)
+		c.Request = req
+		// Tell it cache, but it shouldn't switch what it redirects to
+		checkHostnameRedirects(c, "cache-hostname.com")
+		expectedPath = "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// API path that should ALWAYS redirect to a cache
+		req = httptest.NewRequest("GET", "/api/v1.0/director/object/foo/bar", nil)
+		c.Request = req
+		// Tell it origin, but it shouldn't switch what it redirects to
+		checkHostnameRedirects(c, "origin-hostname.com")
+		expectedPath = "/api/v1.0/director/object/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		viper.Reset()
+	})
+
+	t.Run("redirect-middleware", func(t *testing.T) {
+		// First test that two API endpoints are functioning properly
+		c, _ := gin.CreateTestContext(httptest.NewRecorder())
+		req := httptest.NewRequest("GET", "/api/v1.0/director/origin/foo/bar", nil)
+		c.Request = req
+
+		// test both APIs when in cache mode
+		ShortcutMiddleware("cache")(c)
+		expectedPath := "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		req = httptest.NewRequest("GET", "/api/v1.0/director/object/foo/bar", nil)
+		c.Request = req
+		ShortcutMiddleware("cache")(c)
+		expectedPath = "/api/v1.0/director/object/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// test both APIs when in origin mode
+		req = httptest.NewRequest("GET", "/api/v1.0/director/origin/foo/bar", nil)
+		c.Request = req
+		ShortcutMiddleware("origin")(c)
+		expectedPath = "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		req = httptest.NewRequest("GET", "/api/v1.0/director/object/foo/bar", nil)
+		c.Request = req
+		ShortcutMiddleware("origin")(c)
+		expectedPath = "/api/v1.0/director/object/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// Test the base paths
+		// test that we get an origin at the base path when in origin mode
+		req = httptest.NewRequest("GET", "/foo/bar", nil)
+		c.Request = req
+		ShortcutMiddleware("origin")(c)
+		expectedPath = "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// test that we get a cache at the base path when in cache mode
+		req = httptest.NewRequest("GET", "/api/v1.0/director/object/foo/bar", nil)
+		c.Request = req
+		ShortcutMiddleware("cache")(c)
+		expectedPath = "/api/v1.0/director/object/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// test a PUT request always goes to the origin endpoint
+		req = httptest.NewRequest("PUT", "/foo/bar", nil)
+		c.Request = req
+		ShortcutMiddleware("cache")(c)
+		expectedPath = "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// Host-aware tests
+		// Test that we can turn on host-aware redirects and get one appropriate redirect from each
+		// type of header (as we've already tested that hostname redirects function)
+
+		// Host header
+		viper.Set("Director.OriginResponseHostnames", []string{"origin-hostname.com"})
+		viper.Set("Director.HostAwareRedirects", true)
+		req = httptest.NewRequest("GET", "/foo/bar", nil)
+		c.Request = req
+		c.Request.Header.Set("Host", "origin-hostname.com")
+		ShortcutMiddleware("cache")(c)
+		expectedPath = "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		// X-Forwarded-Host header
+		req = httptest.NewRequest("GET", "/foo/bar", nil)
+		c.Request = req
+		c.Request.Header.Set("X-Forwarded-Host", "origin-hostname.com")
+		ShortcutMiddleware("cache")(c)
+		expectedPath = "/api/v1.0/director/origin/foo/bar"
+		assert.Equal(t, expectedPath, c.Request.URL.Path)
+
+		viper.Reset()
+	})
+}
diff --git a/director/resources/geoip_overrides.yaml b/director/resources/geoip_overrides.yaml
new file mode 100644
index 000000000..dda89d895
--- /dev/null
+++ b/director/resources/geoip_overrides.yaml
@@ -0,0 +1,60 @@
+#/***************************************************************
+# *
+# * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+# *
+# * Licensed under the Apache License, Version 2.0 (the "License"); you
+# * may not use this file except in compliance with the License.  You may
+# * obtain a copy of the License at
+# *
+# *    http://www.apache.org/licenses/LICENSE-2.0
+# *
+# * Unless required by applicable law or agreed to in writing, software
+# * distributed under the License is distributed on an "AS IS" BASIS,
+# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# * See the License for the specific language governing permissions and
+# * limitations under the License.
+# *
+# ***************************************************************/
+
+# Configuration options used to test Geo Overrides in sort_test.go
+GeoIPOverrides:
+  # Valid IPv4
+  - IP: "192.168.0.1"
+    Coordinate:
+      Lat: 123.4
+      Long: 987.6
+  # Valid IPv4 CIDR
+  - IP: "10.0.0.0/24"
+    Coordinate:
+      Lat: 43.073904
+      Long: -89.384859
+  # Malformed IPv4
+  - IP: "192.168.0"
+    Coordinate:
+      Lat: 1000.0
+      Long: 2000.0
+  # Malformed IPv4 CIDR
+  - IP: "10.0.0./24"
+    Coordinate:
+      Lat: 1000.0
+      Long: 2000.0
+  # Valid IPv6
+  - IP: "FC00:0000:0000:0000:0000:0000:0000:0001"
+    Coordinate:
+      Lat: 123.4
+      Long: 987.6
+  # Valid IPv6
+  - IP: "FD00::FAB2/112"
+    Coordinate:
+      Lat: 43.073904
+      Long: -89.384859
+  # Malformed IPv6
+  - IP: "FD00::000G"
+    Coordinate:
+      Lat: 1000.0
+      Long: 2000.0
+  # Malformed IPv6
+  - IP: "FD00::000F/11S"
+    Coordinate:
+      Lat: 1000.0
+      Long: 2000.0
diff --git a/director/sort.go b/director/sort.go
index eef688517..052e41f5e 100644
--- a/director/sort.go
+++ b/director/sort.go
@@ -21,7 +21,7 @@ package director
 import (
 	"archive/tar"
 	"compress/gzip"
-	"errors"
+	"context"
 	"fmt"
 	"io"
 	"math/rand"
@@ -37,8 +37,11 @@ import (
 	"time"
 
 	"github.com/oschwald/geoip2-golang"
+	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
+
+	"github.com/pelicanplatform/pelican/param"
 )
 
 const (
@@ -58,6 +61,19 @@ type (
 	SwapMaps []SwapMap
 )
 
+type Coordinate struct {
+	Lat  float64 `mapstructure:"lat"`
+	Long float64 `mapstructure:"long"`
+}
+
+type GeoIPOverride struct {
+	IP         string     `mapstructure:"IP"`
+	Coordinate Coordinate `mapstructure:"Coordinate"`
+}
+
+var invalidOverrideLogOnce = map[string]bool{}
+var geoIPOverrides []GeoIPOverride
+
 func (me SwapMaps) Len() int {
 	return len(me)
 }
@@ -70,8 +86,64 @@ func (me SwapMaps) Swap(left, right int) {
 	me[left], me[right] = me[right], me[left]
 }
 
+// Check for any pre-configured IP-to-lat/long overrides. If the passed address
+// matches an override IP (either directly or via CIDR masking), then we use the
+// configured lat/long from the override instead of relying on MaxMind.
+// NOTE: We don't return an error because if checkOverrides encounters an issue,
+// we still have GeoIP to fall back on.
+func checkOverrides(addr net.IP) (coordinate *Coordinate) {
+	// Unmarshal the values, but only the first time we run through this block
+	if geoIPOverrides == nil {
+		err := param.GeoIPOverrides.Unmarshal(&geoIPOverrides)
+		if err != nil {
+			log.Warningf("Error while unmarshaling GeoIP Overrides: %v", err)
+		}
+	}
+
+	for _, geoIPOverride := range geoIPOverrides {
+		// Check for regular IP addresses before CIDR
+		overrideIP := net.ParseIP(geoIPOverride.IP)
+		if overrideIP == nil {
+			// The IP is malformed
+			if !invalidOverrideLogOnce[geoIPOverride.IP] && !strings.Contains(geoIPOverride.IP, "/") {
+				// Don't return here, because we have more to check.
+				// Do provide a notice to the user, however.
+				log.Warningf("Failed to parse configured GeoIPOverride address (%s). Unable to use for GeoIP resolution!", geoIPOverride.IP)
+				invalidOverrideLogOnce[geoIPOverride.IP] = true
+			}
+		}
+		if overrideIP.Equal(addr) {
+			return &geoIPOverride.Coordinate
+		}
+
+		// Alternatively, we can match by CIDR blocks
+		if strings.Contains(geoIPOverride.IP, "/") {
+			_, ipNet, err := net.ParseCIDR(geoIPOverride.IP)
+			if err != nil {
+				if !invalidOverrideLogOnce[geoIPOverride.IP] {
+					// Same reason as above for not returning.
+					log.Warningf("Failed to parse configured GeoIPOverride CIDR address (%s): %v. Unable to use for GeoIP resolution!", geoIPOverride.IP, err)
+					invalidOverrideLogOnce[geoIPOverride.IP] = true
+				}
+				continue
+			}
+			if ipNet.Contains(addr) {
+				return &geoIPOverride.Coordinate
+			}
+		}
+	}
+
+	return nil
+}
+
 func GetLatLong(addr netip.Addr) (lat float64, long float64, err error) {
 	ip := net.IP(addr.AsSlice())
+	override := checkOverrides(ip)
+	if override != nil {
+		log.Infof("Overriding Geolocation of detected IP (%s) to lat:long %f:%f based on configured overrides", ip.String(), (override.Lat), override.Long)
+		return override.Lat, override.Long, nil
+	}
+
 	reader := maxMindReader.Load()
 	if reader == nil {
 		err = errors.New("No GeoIP database is available")
@@ -83,13 +155,19 @@ func GetLatLong(addr netip.Addr) (lat float64, long float64, err error) {
 	}
 	lat = record.Location.Latitude
 	long = record.Location.Longitude
+
+	if lat == 0 && long == 0 {
+		log.Infof("GeoIP Resolution of the address %s resulted in the nul lat/long.", ip.String())
+	}
 	return
 }
 
 func SortServers(addr netip.Addr, ads []ServerAd) ([]ServerAd, error) {
 	distances := make(SwapMaps, len(ads))
 	lat, long, err := GetLatLong(addr)
-	isInvalid := err != nil
+	// If we don't get a valid coordinate set for the incoming address, either because
+	// of an error or the null address, we randomize the output
+	isInvalid := (err != nil || (lat == 0 && long == 0))
 	for idx, ad := range ads {
 		if isInvalid || (ad.Latitude == 0 && ad.Longitude == 0) {
 			// Unable to compute distances for this server; just do random distances.
@@ -116,7 +194,7 @@ func DownloadDB(localFile string) error {
 	}
 
 	var licenseKey string
-	keyFile := viper.GetString("MaxMindKeyFile")
+	keyFile := param.Director_MaxMindKeyFile.GetString()
 	keyFromEnv := viper.GetString("MAXMINDKEY")
 	if keyFile != "" {
 		contents, err := os.ReadFile(keyFile)
@@ -127,7 +205,7 @@ func DownloadDB(localFile string) error {
 	} else if keyFromEnv != "" {
 		licenseKey = keyFromEnv
 	} else {
-		return errors.New("A MaxMind key file must be specified in the config (MaxMindKeyFile), in the environment (PELICAN_MAXMINDKEYFILE), or the key must be provided via the environment variable PELICAN_MAXMINDKEY)")
+		return errors.New("A MaxMind key file must be specified in the config (Director.MaxMindKeyFile), in the environment (PELICAN_DIRECTOR_MAXMINDKEYFILE), or the key must be provided via the environment variable PELICAN_MAXMINDKEY)")
 	}
 
 	url := fmt.Sprintf(maxMindURL, licenseKey)
@@ -177,30 +255,36 @@ func DownloadDB(localFile string) error {
 	return nil
 }
 
-func PeriodicMaxMindReload() {
+func PeriodicMaxMindReload(ctx context.Context) {
 	// The MaxMindDB updates Tuesday/Thursday. While a free API key
 	// does get 1000 downloads a month, we might still want to change
 	// this eventually to guarantee we only update on those days...
+
+	// Update once every other day
+	ticker := time.NewTicker(48 * time.Hour)
 	for {
-		// Update once every other day
-		time.Sleep(time.Hour * 48)
-		localFile := viper.GetString("GeoIPLocation")
-		if err := DownloadDB(localFile); err != nil {
-			log.Warningln("Failed to download GeoIP database:", err)
-		} else {
-			localReader, err := geoip2.Open(localFile)
-			if err != nil {
-				log.Warningln("Failed to re-open GeoIP database:", err)
+		select {
+		case <-ticker.C:
+			localFile := param.Director_GeoIPLocation.GetString()
+			if err := DownloadDB(localFile); err != nil {
+				log.Warningln("Failed to download GeoIP database:", err)
 			} else {
-				maxMindReader.Store(localReader)
+				localReader, err := geoip2.Open(localFile)
+				if err != nil {
+					log.Warningln("Failed to re-open GeoIP database:", err)
+				} else {
+					maxMindReader.Store(localReader)
+				}
 			}
+		case <-ctx.Done():
+			return
 		}
 	}
 }
 
-func InitializeDB() {
-	go PeriodicMaxMindReload()
-	localFile := viper.GetString("GeoIPLocation")
+func InitializeDB(ctx context.Context) {
+	go PeriodicMaxMindReload(ctx)
+	localFile := param.Director_GeoIPLocation.GetString()
 	localReader, err := geoip2.Open(localFile)
 	if err != nil {
 		log.Warningln("Local GeoIP database file not present; will attempt a download.", err)
diff --git a/director/sort_test.go b/director/sort_test.go
new file mode 100644
index 000000000..58b0a50ea
--- /dev/null
+++ b/director/sort_test.go
@@ -0,0 +1,109 @@
+package director
+
+import (
+	"bytes"
+	_ "embed"
+	"net"
+	"strings"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/require"
+)
+
+// Geo Override Yaml mockup
+//
+//go:embed resources/geoip_overrides.yaml
+var yamlMockup string
+
+func TestCheckOverrides(t *testing.T) {
+	viper.Reset()
+
+	// We'll also check that our logging feature responsibly reports
+	// what Pelican is telling the user.
+	logOutput := &(bytes.Buffer{})
+	log.SetOutput(logOutput)
+	log.SetLevel(log.DebugLevel)
+
+	viper.SetConfigType("yaml")
+	err := viper.ReadConfig(strings.NewReader(yamlMockup))
+	if err != nil {
+		t.Fatalf("Error reading config: %v", err)
+	}
+
+	t.Run("test-no-ipv4-match", func(t *testing.T) {
+		// In the event that no override is detected, `checkOverrides` should return a nil override
+		addr := net.ParseIP("192.168.0.2")
+		coordinate := checkOverrides(addr)
+		require.Nil(t, coordinate)
+	})
+
+	t.Run("test-no-ipv6-match", func(t *testing.T) {
+		addr := net.ParseIP("ABCD::0123")
+		coordinate := checkOverrides(addr)
+		require.Nil(t, coordinate)
+	})
+
+	t.Run("test-log-output", func(t *testing.T) {
+		// Check that the log caught our malformed IP and CIDR. We only need to test this once, because it is only logged the very first time.
+		require.Contains(t, logOutput.String(), "Failed to parse configured GeoIPOverride address (192.168.0). Unable to use for GeoIP resolution!")
+		require.Contains(t, logOutput.String(), "Failed to parse configured GeoIPOverride CIDR address (10.0.0./24): invalid CIDR address: 10.0.0./24."+
+			" Unable to use for GeoIP resolution!")
+		require.Contains(t, logOutput.String(), "Failed to parse configured GeoIPOverride address (FD00::000G). Unable to use for GeoIP resolution!")
+		require.Contains(t, logOutput.String(), "Failed to parse configured GeoIPOverride CIDR address (FD00::000F/11S): invalid CIDR address: FD00::000F/11S."+
+			" Unable to use for GeoIP resolution!")
+	})
+
+	t.Run("test-ipv4-match", func(t *testing.T) {
+		// When we match against a regular IPv4, we expect a non-nil coordinate
+		expectedCoordinate := Coordinate{
+			Lat:  123.4,
+			Long: 987.6,
+		}
+
+		addr := net.ParseIP("192.168.0.1")
+		coordinate := checkOverrides(addr)
+		require.Equal(t, expectedCoordinate.Lat, coordinate.Lat)
+		require.Equal(t, expectedCoordinate.Long, coordinate.Long)
+	})
+
+	t.Run("test-ipv4-CIDR-match", func(t *testing.T) {
+		// Same goes for CIDR matches
+		expectedCoordinate := Coordinate{
+			Lat:  43.073904,
+			Long: -89.384859,
+		}
+
+		addr := net.ParseIP("10.0.0.136")
+		coordinate := checkOverrides(addr)
+		require.Equal(t, expectedCoordinate.Lat, coordinate.Lat)
+		require.Equal(t, expectedCoordinate.Long, coordinate.Long)
+	})
+
+	t.Run("test-ipv6-match", func(t *testing.T) {
+		expectedCoordinate := Coordinate{
+			Lat:  123.4,
+			Long: 987.6,
+		}
+
+		addr := net.ParseIP("FC00::0001")
+		coordinate := checkOverrides(addr)
+		require.Equal(t, expectedCoordinate.Lat, coordinate.Lat)
+		require.Equal(t, expectedCoordinate.Long, coordinate.Long)
+	})
+
+	t.Run("test-ipv6-CIDR-match", func(t *testing.T) {
+		expectedCoordinate := Coordinate{
+			Lat:  43.073904,
+			Long: -89.384859,
+		}
+
+		addr := net.ParseIP("FD00::FA1B")
+		coordinate := checkOverrides(addr)
+		require.Equal(t, expectedCoordinate.Lat, coordinate.Lat)
+		require.Equal(t, expectedCoordinate.Long, coordinate.Long)
+	})
+
+	viper.Reset()
+}
diff --git a/docs/pages/_meta.json b/docs/pages/_meta.json
new file mode 100644
index 000000000..82c298a93
--- /dev/null
+++ b/docs/pages/_meta.json
@@ -0,0 +1,5 @@
+{
+  "index": "About Pelican",
+  "install": "Install",
+  "parameters": "Configuration"
+}
diff --git a/docs/pages/client-usage.mdx b/docs/pages/client-usage.mdx
new file mode 100644
index 000000000..7b56429cc
--- /dev/null
+++ b/docs/pages/client-usage.mdx
@@ -0,0 +1,131 @@
+# Using The Pelican Client
+
+The Pelican client currently only supports *fetching* objects from Pelican federations, although a much richer feature set that will allow users to interact with federation objects in more advanced ways is forthcoming.
+
+One thing to note is that Pelican should be thought of as a tool that works with federated *objects* as opposed to *files*. The reason for this is that calling something a file carries with it the connotation that the file is mutable, ie its contents can change without requiring a new name. Objects in a Pelican federation, however, should be treated as immutable, especially in any case where objects are pulled through a cache (which will be the case for almost all files in the OSDF). This is because the underlying cache mechanism, powered by XRootD, will deliver whatever object it already has access to; if an object name changes at the origin, the cache will remain unaware and continue to deliver the old object. In the worst case, when the cache only has a partial object, it may attempt to combine its stale version with whatever exists at the origin. Use object names wisely!
+
+## Before Starting
+
+### Assumptions
+
+Before using the Pelican client to interact with objects from your federation, this guide makes several assumptions:
+
+- You are on a computer where you have access to a terminal. The Pelican client is a command line tool.
+- You've already installed the version of Pelican appropriate for your system, and Pelican is accessible via your path. To test this on Linux, you can run
+```console
+which pelican
+```
+which should output a path to the executable. If there is no output to this command, refer to the Pelican installation docs to acquire a working installation.
+
+
+### Useful Terminology
+
+**Federations:**
+Objects in Pelican belong to *federations*, which are aggregations of data that are exposed to other individuals in the federation. Each Pelican federation constitutes its own global namespace of objects and each object within a federation has its own path, much like files on a computer. Fetching any object from a federation requires at minimum two pieces of information; a URL indicating the object's federation and the path to the object within that federation (there is the potential that some objects require access tokens as well, but more on that later). For example, the Open Science Data Federation's (OSDF) central URL is https://osg-htc.org and an example object from the federation can be found at
+
+```console
+/osgconnect/public/osg/testfile.txt
+```
+
+**Note:** All object paths in a federation begin with a preceding `/`, and no relative paths are allowed.
+
+**Origins:**
+All objects in a federation live in some *origin*. Origins act like a flexible plug mechanism that exposes different type of storage backends to the federation. For example, the POSIX filesystem on most Linux computers is one type of storage backend an origin can expose to the federation. Other types of backends include S3 or HTTP servers, and Pelican plans to add many more. In most cases, a user does not need to know the particular backend used to store the object to download it from the federation.
+
+**Namespace Prefixes:**
+Each origin supports one or more *namespace prefixes*, which are analogous to the folders or directories from your computer that you use to organize files. In the example object from the OSDF mentioned earlier, the namespace prefix is `/osgconnect/public/`, and the actual object is named `osg/testfile.txt`.
+
+**Tokens and JWT:**
+Some namespace prefixes are public, like `/osgconnect/public/`, while others are protected (ie they require authentication). Objects in public namespaces can be downloaded by anybody, but downloading objects from protected namespaces requires you prove to the origin supporting that namespace that you are allowed to access the object. In Pelican, this is done using signed JSON Web Tokens, or *JWT*s for short. In many cases, these tokens can be generated automatically.
+
+
+## Get A Public Object From Your Federation
+
+To use the Pelican client to pull objects from a federation, use Pelican's `object copy` sub-command:
+
+```console
+pelican object copy -f <federation url> </federation/path/to/file> </local/path/to/file>
+```
+
+You can try this yourself by getting the public file that was mentioned earlier from the OSDF. Using the `object copy` sub command, and indicating to pelican that you're pulling from the OSDF by passing the federation URL with the `-f` flag, run:
+
+```console
+pelican object copy -f https://osg-htc.org /osgconnect/public/osg/testfile.txt downloaded-testfile.txt
+```
+
+This command will download the object `/osg/testfile.txt` from the OSDF's `/osgconnect/public` namespace and save it in your local directory with the name `downloaded-testfile.txt`.
+
+
+## Get A Protected Object From Your Federation
+
+Protected namespaces require that a Pelican client prove it is allowed to access objects from the namespace before the object can be downloaded. In many cases, Pelican clients can do this automatically by initiating an OpenID-Connect (OIDC) flow that uses an external log-in service through your browser. In other cases, a token must be provided to Pelican manually.
+
+### For Issuers That Support CILogon Code Flow
+
+Some origins are protected by token issuers that are already integrated with CILogon's Open ID Connect (OIDC) client. In these cases, the Pelican client is capable of creating the token needed to authenticate with the origin and download the file. To download protected objects from origins that are connected to CILogon, run the same command as for downloading public objects:
+
+```console
+pelican object copy -f <federation url> </federation/path/to/file> </local/path/to/file>
+```
+
+If you're doing this for the very first time, Pelican will create an encrypted token wallet on your system and you will be required to provide Pelican with a password for the wallet. If this isn't your first time, you will be asked to provide your already-configured password to unlock the token wallet.
+
+Next, Pelican will display a URL in your terminal and indicate that you should visit the URL in your browser. After copying/pasting the URL to your browser, follow all the instructions there for logging in with CILogon.
+
+Finally, if the login is successful, Pelican will automatically fetch the token from the CILogon service and continue with the download.
+
+### For Issuers With No CILogon Support
+
+There are some cases where Pelican is unable to generate the tokens it needs to prove to the origin that a user should have legitimate access to an object. When this happens, users must supply their own JWT that's signed by the origin's issuer. Instructions on how to get such a token are outside the scope of this writeup, as it may require institutional knowledge. However, once a valid token is available, Pelican can use the token to get the object by pointing the client to a file containing the token with the `-t` flag:
+
+```console
+pelican object copy -f <Federation URL> </federation/path/to/file> </local/path/to/file> -t </path/to/token/file>
+```
+
+For example, if we assume the following token grants read access to the `/ospool/PROTECTED` namespace:
+```console
+eyJhbGciOiJSUzI1NiIsImtpZCI6ImtleS1yczI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXIiOiJzY2l0b2tlbjoyLjAiLCJhdWQiOiJodHRwczovL2RlbW8uc2NpdG9rZW5zLm9yZyIsImlzcyI6Imh0dHBzOi8vZGVtby5zY2l0b2tlbnMub3JnIiwiZXhwIjoxNjk3NDgzNTU5LCJpYXQiOjE2OTc0ODI5NTksIm5iZiI6MTY5NzQ4Mjk1OSwianRpIjoiOGIzNjQ5MTUtMjM4MC00MzM2LWI1OTktN2NmYzhiNGJmNTk3In0.hCf8oi3BRoWnUrBxSKST8p8czSChetMFID4FRXiQQ6RnwhWFZD3grZ2dvdYIYYDuW-1iATN9OujHBbO8TOxTnjJd7acE7la5rZscQwY_DAr_6rLKRTSU_Tpgg8uBMQB-U45nGWJVuYS6RZ3JZ2vE5lTtvPjZjExkJOkfvVp9Kzq445UGlK4dNkvTS3SYd9QYiZPkjA_Z-u57DesOOhsgrLSXyrRCtxBD8mRe5MiRtVAFHxIXS_ZQ7B2XlmNPiR6PBb9r38qHUlYe9y824hmBW-VzR2xiJd5wLWFZOv2Ec-q2NCAqDQfGYl4UsWKinW-35OGEULQWAQgHwxKJMSEH8A
+```
+
+Then the token can be used to get the object `/ospool/PROTECTED/auth-test.txt` by saving the token in a file called `my-token` and running
+
+```console
+pelican object copy -f https://osg-htc.org /ospool/PROTECTED/auth-test.txt downloaded-auth-test.txt -t my-token
+```
+
+(Note that this token is for demonstration purposes only, and would not actually grant access to any files in the `/ospool/PROTECTED` namespace.)
+
+## Additional Pelican Flags And Their Effects
+
+Pelican clients support a variety of command line flags that modify the client's behavior:
+
+### Global Flags:
+
+- **-h or --help:** Takes no argument and can be used with any Pelican sub command for more information about the sub command and additional supported flags.
+- **-f or --federation:** Takes a URL that indicates to Pelican which federation the request should be made to.
+- **-d or --debug:** Takes no argument, but runs Pelican in debug mode, which, when enabled, provides verbose output.
+- **--config:** Takes a filepath and indicates to Pelican the location of a configuration file Pelican should use.
+- **--json:** Takes no argument and outputs results in JSON format.
+
+### Flags For `object copy`:
+
+- **-c or --cache:** Takes a cache URL and indicates to Pelican that only the specified cache should be used. When used, Pelican will not attempt to use other caches if the provided cache cannot provide the file.
+- **--caches:** Takes the path to a JSON file containing a list of caches. Similar to the `-c` flag, Pelican will attempt to use only these caches in the order they are listed.
+- **-r or --recursive:** Takes no argument and indicates to Pelican that all sub paths at the level of the provided namespace should be copied recursively. This option is only supported if the origin supports the WebDav protocol.
+- **-t or --token:** Takes a path to a file containing a signed JWT, and is used to download protected objects.
+
+## Effects Of Renaming The Pelican Binary
+
+The Pelican binary can change its behavior depending on what it is named. This feature serves two purposes; it allows Pelican to use a few convenient default settings in the case that the federation being interacted with is the OSDF, and it allows Pelican to run in legacy `stashcp` and `stash_plugin` modes.
+
+### Prefixing The Binary With OSDF
+
+When the name of the Pelican binary begins with `osdf`, Pelican will assume that all objects are coming from the OSDF which allows it to make several assumptions. The most immediate effect for users is that the `-f` flag no longer needs to be populated. The command to download a public file from above can then be simplified to:
+
+```console
+./osdf object copy /osgconnect/public/osg/testfile.txt downloaded-testfile.txt
+```
+
+### Naming The Binary `stashcp` Or `stash_plugin`
+
+The Pelican Project grew out of a command line tool called `stashcp` with an associated HTCondor plugin called `stash_plugin`, which were also used for interacting with objects in the OSDF. To support these legacy tools, Pelican has been built to behave similarly as `stashcp` and `stash_plugin` did whenever the Pelican binary is renamed to match the names of these tools.
diff --git a/docs/pages/index.mdx b/docs/pages/index.mdx
new file mode 100644
index 000000000..ca6a159d0
--- /dev/null
+++ b/docs/pages/index.mdx
@@ -0,0 +1,40 @@
+import ImageRow from "@/components/ImageRow";
+
+# What Is the Pelican Platform?
+
+Pelican provides an open-source software platform for federating dataset repositories together and delivering the
+objects to computing capacity such as the [OSPool](https://osg-htc.org/services/open_science_pool.html).
+
+**Pelican Enables**:
+- Researchers to access their datasets at scales from a notebook to a campus cluster to the national computing fabric
+- Repositories and storage providers to export datasets in a scalable manner and helps implement FAIR principles
+- Compute providers to cache datasets on-site
+- Cyberinfrastructures to build gateways and portals to large-scale datasets
+
+Objects in a federation are accessible through a common namespace; given an object name,
+the Pelican client can discover the object’s location and download it through the access layer.
+The access layer consists of distributed caches which reduce the load on the origin for repeated accesses.
+
+<ImageRow alt={"Pelican and OSDF"} src={"/pelican/pelican-and-osdf.png"}>
+	A Pelican data federation provides an access layer that helps the origin
+	distribute datasets in the repositories.  A client wanting an object contacts
+	the manager to find the closest cache which either serves the objects from
+	local storage or streams it through the origin.
+</ImageRow>
+
+
+The flagship Pelican federation is the Open Science Data Federation (OSDF).
+The OSDF has approximately two dozen caches located throughout the world, often at
+points of presence within the global Research and Education networks such as ESNet and
+Internet2.
+
+<ImageRow alt={"Pelican and OSDF"} src={"/pelican/pelican-bus.png"}>
+	The OSDF serves as a transport bus, connecting a variety of backend storage types
+</ImageRow>
+
+
+
+
+Central to Pelican is the concept of the origin service.  The origin is the intermediary between
+the existing storage and the federation.  The origin is responsible for serving data as well
+as issuing tokens (credentials) authorizing access to datasets based on the local policy.
diff --git a/docs/pages/install.mdx b/docs/pages/install.mdx
new file mode 100644
index 000000000..2b2ace214
--- /dev/null
+++ b/docs/pages/install.mdx
@@ -0,0 +1,110 @@
+# Installing the Pelican Platform
+
+This document explains how a user can download and install the Pelican client.
+
+## Installation Steps:
+
+
+### 1. Install the Pelican Platform Binary
+Navigate to the [Pelican release page](https://github.com/PelicanPlatform/pelican/releases/). Download the proper binary for the system you are running on and select which version you would like to install. If you do not know which binary to install, below is a chart that may help:
+
+| Package Name                   | Description                                                            |
+|--------------------------------|------------------------------------------------------------------------|
+| `pelican-7.1.2-1.arm64.rpm`    | RPM package for ARM64 architecture on Linux systems.                  |
+| `pelican-7.1.2-1.ppc64le.rpm`  | RPM package for little endian PowerPC architecture on Linux systems.   |
+| `pelican-7.1.2-1.x86_64.rpm`   | RPM package for x86_64 (64-bit) architecture on Linux systems.         |
+| `pelican-7.1.2-1_amd64.deb`    | Debian package for AMD64 (x86_64) architecture on Debian-based Linux systems. |
+| `pelican-7.1.2-1_arm64.deb`    | Debian package for ARM64 architecture on Debian-based Linux systems. |
+| `pelican-7.1.2-1_ppc64le.deb`  | Debian package for little-endian PowerPC architecture on Debian-based Linux systems. |
+| `pelican_amd64.apk`            | APK package for AMD64 (x86_64) architecture. |
+| `pelican_arm64.apk`            | APK package for ARM64 architecture. |
+| `pelican_Darwin_arm64.tar.gz`  | Tarball for macOS systems running on ARM64 architecture (Apple Silicon). |
+| `pelican_Darwin_x86_64.tar.gz` | Tarball for macOS systems with x86_64 architecture. |
+| `pelican_Linux_arm64.tar.gz`   | Tarball for Linux systems with ARM64 architecture. |
+| `pelican_Linux_ppc64le.tar.gz` | Tarball for Linux systems with little-endian PowerPC architecture. |
+| `pelican_Linux_x86_64.tar.gz`  | Tarball for Linux systems with x86_64 (64-bit) architecture. |
+| `pelican_ppc64le.apk`          | APK package for little-endian PowerPC architecture, suitable for some PowerPC-based systems or specific Linux distributions. |
+| `pelican_Windows_x86_64.zip`   | ZIP archive for Windows systems with x86_64 (64-bit) architecture. **Note:** Pelican on Windows is still experimental and you may run into issues. |
+
+##### RPM, APK, or DEB?
+###### RPM (Red Hat Package Manager):
+You want to install a `.rpm` package if you are using a Red Hat-based Linux distribution system such as: Red Hat Enterprise Linux, CentOS, Fedora, or openSUSE.
+
+###### APK (Alpine Package Keeper):
+You want to install a `.apk` package if you are using an Alpine Linux system.
+
+###### DEB (Debian Package):
+You want to install a `.deb` package if you are using a Linux distribution system such as: Debian, Ubuntu, or something similar.
+
+##### What about tar and zip?
+If you want a more manual setup, you can download the `.tar.gz` or `.zip` files and extract the binary where you need it. However, the above packages are recommended for more inexperienced users.
+
+##### What version should I download?
+Our versions are built like so:
+For example: 7.1.2
+- 7 represents the major version release
+- 1 represents feature releases
+- 2 represents a bug fix/patch release
+
+We recommend you to use the latest feature or major release version so it includes the latest bug fixes and features.
+
+### 2. Extract the Binary
+Once the package has finished downloading, place it in your workspace
+
+##### RPM:
+To install RPM packages, you can use the dnf or yum package manager. Just make sure you have sudo access if you are not root:
+```console
+sudo yum install pelican-7.1.2-1.x86_64.rpm
+```
+Replace 'yum' with 'dnf' for dnf install
+
+##### DEB:
+To install Debian packages, you can use apt or dpkg package manager:
+```console
+sudo dpkg -i pelican-7.1.2-1_amd64.deb
+sudo apt-get install -f
+```
+Or
+```console
+sudo apt install ./pelican-7.1.2-1_amd64.deb
+```
+
+##### APK:
+To install APK packages on Alpine Linux, you can use the apk package manager:
+```console
+apk add pelican_amd64.apk
+```
+
+##### Tarballs*:
+To install `.tar.gz` packages, you can extract with tar:
+```console
+tar -xzf pelican_Darwin_x86_64.tar.gz
+```
+
+##### Zip*:
+To install `.zip` packages, you can use [7zip](https://www.7-zip.org/) or other programs to unzip your file. Simply right click on the `.zip` file and extract all contents to a directory of your choice
+
+
+>**\*Note:** If you install a tarball or zipfile, you don't actually *install* Pelican, you just extract the binary. It's covered below how you can still use Pelican with the binary, but if you would like to have similar functionality as the other packages, you need to add Pelican to your PATH manually.
+
+### 3. Test Functionality of the Pelican Platform
+##### For rpm, deb, and apk
+If you downloaded this way, Pelican should automatically be added to the path. You can check this by:
+```console
+which pelican
+```
+and make sure you get an output. You can then check functionality by running a simple **object copy** command:
+```console
+pelican -f osg-htc.org object copy /osgconnect/public/osg/testfile.txt .
+testfile.txt 36.00 b / 36.00 b [=============================================================================================] Done!
+```
+
+##### For tarballs and zip, using the binary itself:
+Once extracted, make sure you are in the same directory as the **Pelican** executable. To test if everything works, we can do a simple **object copy** command:
+
+```console
+./pelican -f osg-htc.org object copy /osgconnect/public/osg/testfile.txt .
+testfile.txt 36.00 b / 36.00 b [=============================================================================================] Done!
+```
+
+You should now notice a file **testfile.txt** now in your directory. Congrats on making your first Pelican Object Copy!
diff --git a/docs/pages/parameters.mdx b/docs/pages/parameters.mdx
new file mode 100644
index 000000000..80d008fff
--- /dev/null
+++ b/docs/pages/parameters.mdx
@@ -0,0 +1,6 @@
+import parameters from '/public/static/parameters.json';
+import Parameters from "/components/Parameters";
+
+# Parameters
+
+<Parameters parameters={parameters}/>
diff --git a/docs/pages/serving_an_origin.mdx b/docs/pages/serving_an_origin.mdx
new file mode 100644
index 000000000..6fa339faf
--- /dev/null
+++ b/docs/pages/serving_an_origin.mdx
@@ -0,0 +1,81 @@
+import ExportedImage from "next-image-export-optimizer";
+
+# Install Pelican Origin
+
+The [Pelican](http://pelicanplatform.org/) origin exposes a storage backend like POSIX or S3 to other members of the federation. This will give you the steps to install XRootD as well as how to install Pelican and start up an origin.
+
+## Before Starting
+
+
+Before starting the installation process, consider the following points:
+
+-   **User IDs:** If it does not exist already, the installation will create the Linux user ID `xrootd`
+-   **Service certificate:** The XRootD service uses a host certificate and key pair at
+    `/etc/grid-security/xrd/xrdcert.pem` and `/etc/grid-security/xrd/xrdkey.pem` that must be owned by the `xrootd` user
+-   **Networking:** The XRootD service uses port 1094 by default
+
+As with all OSG software installations, there are some one-time (per host) steps to prepare in advance:
+
+-   Ensure the host has [a supported operating system](https://osg-htc.org/docs/release/supported_platforms/)
+-   Obtain root access to the host
+-   Prepare [the required Yum repositories](https://osg-htc.org/docs/common/yum/)
+-   Install [CA certificates](https://osg-htc.org/docs/common/ca/)
+-   Install XRootD (Instructions to follow)
+
+## XRootD
+
+#### Requirements for XRootD-Multiuser with VOMS FQANs
+
+    Using XRootD-Multiuser with a VOMS FQAN requires mapping the FQAN to a username, which requires a `voms-mapfile`.
+    Support is available in `xrootd-voms 5.4.2-1.1`, in the OSG 3.6 repos, though it is expected in XRootD 5.5.0.
+    If you want to use multiuser, ensure you are getting `xrootd-voms` from the OSG repos.
+
+
+### Installing XRootD
+
+To install an XRootD Standalone server, run the following command:
+
+```console
+root@xrootd-standalone # yum install osg-xrootd-standalone
+```
+
+## Installing Pelican
+
+
+Grab the appropriate binary for your system from the [pelican repository](https://github.com/PelicanPlatform/pelican/releases). For more details, see [the client installation instructions](/install.mdx)
+
+## Serving an Origin
+
+### Register the origin with the namespace-registry
+
+Before serving an origin, you need to register the origin with the namespace-registry. This can be done by running
+
+```pelican namespace register --prefix <namespace prefix> --namespace-url <registry url>```
+
+Where `<namespace_prefix>` is a namespace prefix associated with the origin and `<registry url>` is the url of the namespace registry. This gives the registry the public key for the origin, and makes that public key available to all of the other services in the federation for verifying tokens
+
+
+### Running Origin Serve
+
+To launch a pelican origin, run:
+
+```./pelican origin serve -f <federation> -v <local_directory>:<namespace_prefix>```
+
+Where `<federation>` is the address of the federation the origin will be a part of, `<local directory>` is the directory containing objects to be exported to the federation, and `<namespace prefix>` is the namespace at which files from `<local directory>` will be made available in the federation.
+
+The first time the origin is started, you will see something that looks like the following:
+
+
+<ExportedImage width={1000} height={1000} src={"/pelican/origin_start.png"} alt={"Image of an origin startup terminal prompt with the initializaiton code"} />
+
+To initialize the admin interface (to see the metrics), go to the website specified (in this example replace `977d77de9b9d` with `localhost`).
+
+You will see a warning that looks like the following (with some differences with respect to the browser):
+
+<ExportedImage width={1000} height={1000} src={"/pelican/invalid_certificate.png"} alt={"Image of a safari browser invalid certificate warning"} />
+
+Proceed despite the warning to get to the code entry page. Enter the code specified in the terminal and create a root metrics password. You should now see a webpage that looks like so:
+
+<ExportedImage width={1000} height={1000} src={"/pelican/metrics_view.png"} alt={"Image of prometheus metrics graphs for a Pelican origin"} />
+
+This will refresh every 10 minutes with the xrootd health metrics so that, as an admin, you can check the status of your origin.
diff --git a/docs/parameters.yaml b/docs/parameters.yaml
index 7c77c7e2a..486a1d47a 100644
--- a/docs/parameters.yaml
+++ b/docs/parameters.yaml
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -17,6 +17,10 @@
 # This file contains structured documentation about the Pelican parameters.
 # While it is somewhat human-readable, it is meant to help with the documentation
 # generation.
+
+############################
+#     Top-Level Configs    #
+############################
 ---
 name: ConfigBase
 description: >-
@@ -26,37 +30,1017 @@ default: "~/.config/pelican"
 components: ["*"]
 type: filename
 ---
-name: TLSCertificate
+name: Debug
+description: >-
+  A bool indicating whether Pelican should emit debug messages in its log.
+type: bool
+default: false
+components: ["*"]
+---
+name: TLSSkipVerify
+description: >-
+  When set to true, Pelican will skip TLS verification.  This allows a "man in the middle" attack on the connection but can simplify testing.  Intended for developers.
+type: bool
+default: false
+components: ["origin", "nsregistry", "director"]
+---
+name: IssuerKey
+description: >-
+  A filepath to the file containing a PEM-encoded ecdsa private key which later will be parsed
+  into a JWK and serves as the private key to sign various JWTs issued by this server
+
+  A public JWK will be derived from this private key and used as the key for token verification
+type: filename
+root_default: /etc/pelican/issuer.jwk
+default: $ConfigBase/issuer.jwk
+components: ["client", "nsregistry", "director"]
+---
+name: Transport.DialerTimeout
+description: >-
+  Maximum time allowed for establishing a connection to target host.
+type: duration
+default: 10s
+components: ["client", "nsregistry", "origin"]
+---
+name: Transport.DialerKeepAlive
+description: >-
+  Maximum time a TCP connection should be kept alive without any activity.
+type: duration
+default: 30s
+components: ["client", "nsregistry", "origin"]
+---
+name: Transport.MaxIdleConns
+description: >-
+  Maximum number of idle connections that the HTTP client should maintain in its connection pool.
+type: int
+default: 30
+components: ["client", "nsregistry", "origin"]
+---
+name: Transport.IdleConnTimeout
+description: >-
+  Maximum duration an idle connection should remain open in the connection pool.
+type: duration
+default: 90s
+components: ["client", "nsregistry", "origin"]
+---
+name: Transport.TLSHandshakeTimeout
+description: >-
+  Maximum time allowed for the TLS handshake to complete when making an HTTPS connection
+type: duration
+default: 15s
+components: ["client", "nsregistry", "origin"]
+---
+name: Transport.ExpectContinueTimeout
+description: >-
+  Timeout to control how long the client should wait for the "Expect: 100-continue" response from the server before sending the request
+  body.
+type: duration
+default: 1s
+components: ["client", "nsregistry", "origin"]
+---
+name: Transport.ResponseHeaderTimeout
+description: >-
+  Maximum time the client should wait for the response headers to be received from the server
+type: duration
+default: 10s
+components: ["client", "nsregistry", "origin"]
+---
+name: GeoIPOverrides
+description: >-
+  A list of IP addresses whose GeoIP resolution should be overridden with the supplied Lat/Long coordinates (in decimal form). This affects
+  both server ads (for determining the location of origins and caches) and incoming client requests (for determing where a client request is
+  coming from).
+
+  Configuration takes an IP address (both regular and CIDR) and a Coordinate made up of a lat/long pair in decimal format. For example:
+  ```
+  GeoIPOverrides:
+    - IP: "123.234.123.234"
+      Coordinate:
+        Lat: 43.073904
+        Long: -89.384859
+    - IP: "ABCD::1234/112"
+      Coordinate:
+        Lat: 39.8281
+        Long: -98.5795
+  ```
+
+  will result in the IP address "123.234.123.234" being mapped to Madison, WI, and IP addresses in the range ABCD::0000-FFFF will be mapped
+  to a field in Kansas.
+type: object
+default: none
+components: ["director"]
+---
+############################
+#     Log-Level Configs    #
+############################
+name: Logging.Level
+description: >-
+  A string defining the log level of the client. Options include (going from most info to least): Trace, Debug, Info, Warn, Error, Fatal, Panic.
+type: string
+default: Error
+components: ["*"]
+---
+name: Logging.LogLocation
+description: >-
+  A filename defining a file to write log outputs to, if the user desires.
+type: filename
+default: none
+components: ["*"]
+---
+name: Logging.DisableProgressBars
+description: >-
+  A bool defining if progress bars should be enabled or not.
+type: bool
+default: false
+components: ["Client"]
+---
+############################
+# Federation-Level Configs #
+############################
+name: Federation.DiscoveryUrl
+description: >-
+  A URL pointing to the federation's metadata discovery host.
+type: url
+default: none
+components: ["*"]
+---
+name: Federation.DirectorUrl
+description: >-
+  A URL indicating where a director service is hosted.
+type: url
+osdf_default: Default is determined dynamically through metadata at <Federation.DiscoveryUrl>/.well-known/pelican-configuration
+default: none
+components: ["client", "origin", "cache"]
+---
+name: Federation.NamespaceUrl
+description: >-
+  [Deprecated] `Federation.NamespaceUrl` is deprecated and will be removed in the future release. Please migrate to use
+  `Federation.RegistryUrl` instead.
+
+  A URL indicating where the namespace registry service is hosted.
+type: url
+osdf_default: Default is determined dynamically through metadata at <Federation.DiscoveryUrl>/.well-known/pelican-configuration
+default: none
+components: ["client", "director", "origin", "cache"]
+---
+name: Federation.RegistryUrl
+description: >-
+  A URL indicating where the namespace registry service is hosted.
+type: url
+osdf_default: Default is determined dynamically through metadata at <federation URL>/.well-known/pelican-configuration
+default: none
+components: ["client", "director", "origin", "cache"]
+---
+name: Federation.JwkUrl
+description: >-
+  A URL indicating where the JWKS for the Federation is hosted.
+type: url
+osdf_default: Default is determined dynamically through metadata at <Federation.DiscoveryUrl>/.well-known/pelican-configuration
+default: none
+components: ["*"]
+---
+name: Federation.TopologyNamespaceUrl
+description: >-
+  A URL containing namespace information for origins and caches configured via the OSG Topology application (a legacy integration). The URL
+  should point to the hosted namespace.json.
+type: url
+osdf_default: https://topology.opensciencegrid.org/osdf/namespaces
+default: none
+components: ["director", "nsregistry"]
+---
+name: Federation.TopologyReloadInterval
+description: >-
+  The frequency, in minutes, that topology should be reloaded.
+type: duration
+osdf_default: 10m
+default: none
+components: ["director", "nsregistry"]
+---
+############################
+#   Client-Level Configs   #
+############################
+name: Client.StoppedTransferTimeout
+description: >-
+  A timeout indicating when a "stopped transfer" event should be triggered.
+type: int
+default: 100
+components: ["client"]
+---
+name: Client.SlowTransferRampupTime
+description: >-
+  A duration indicating the rampup period for a slow transfer.
+type: int
+default: 30
+components: ["client"]
+---
+name: Client.SlowTransferWindow
+description: >-
+  A duration indicating the sliding window over which to consider transfer speeds for slow transfers.
+type: int
+default: 30
+components: ["client"]
+---
+name: Client.DisableHttpProxy
+description: >-
+  A bool indicating whether the client's HTTP proxy should be disabled.
+type: bool
+default: false
+components: ["client"]
+---
+name: DisableHttpProxy
+description: >-
+  A legacy configuration for disabling the client's HTTP proxy. See Client.DisableHttpProxy for new config.
+type: bool
+default: false
+components: ["client"]
+---
+name: Client.DisableProxyFallback
+description: >-
+  A bool indicating whether the a proxy fallback should be used by the client.
+type: bool
+default: false
+components: ["client"]
+---
+name: DisableProxyFallback
+description: >-
+  A legacy configuration for disabling the client's proxy fallback. See Client.DisableProxyFallback for new config.
+type: bool
+default: false
+components: ["client"]
+---
+name: Client.MinimumDownloadSpeed
+description: >-
+  The minimum speed allowed for a client download before an error is thrown.
+type: int
+default: 102400
+components: ["client"]
+---
+name: MinimumDownloadSpeed
+description: >-
+  A legacy configuration for setting the client's minimum download speed. See Client.MinimumDownloadSpeed for new config.
+type: int
+default: 102400
+components: ["client"]
+---
+############################
+#   Origin-level Configs   #
+############################
+name: Origin.Url
+description: >-
+  The origin's configured URL, as reported to XRootD. This is the file transfer endpoint for the origin.
+
+  This Url must not have the same port number as the one in Server.ExternalWebUrl (if any) or Server.WebPort
+type: url
+default: https://${Server.Hostname}:${Xrootd.Port}
+components: ["origin"]
+---
+name: Origin.ExportVolume
+description: >-
+  A path to the volume exported by an origin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.NamespacePrefix
+description: >-
+  The filepath prefix at which an origin's contents are made globally available, eg /pelican/PUBLIC.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.EnableWrite
+description: >-
+  A boolean indicating if an origin allows write access
+type: bool
+default: true
+components: ["origin"]
+---
+name: Origin.EnableFallbackRead
+description: >-
+  Set to `true` if the origin permits clients to directly read from it
+  when no cache service is available
+type: bool
+default: false
+components: ["origin"]
+---
+name: Origin.Multiuser
+description: >-
+  A bool indicating whether an origin is "multiuser", ie whether the underlying XRootD instance must be configured in multi user mode.
+type: bool
+root_default: true
+default: false
+components: ["origin"]
+---
+name: Origin.EnableCmsd
+description: >-
+  A bool indicating whether the origin should enable the `cmsd` daemon.
+type: bool
+default: true
+components: ["origin"]
+---
+name: Origin.SelfTest
+description: >-
+  A bool indicating whether the origin should perform self health checks.
+type: bool
+default: true
+components: ["origin"]
+---
+name: Origin.EnableUI
+description: >-
+  Indicate whether the origin should enable its web UI.
+type: bool
+default: true
+components: ["origin"]
+---
+name: Origin.EnableIssuer
+description: >-
+  Enable the built-in issuer daemon for the origin.
+type: bool
+default: false
+components: ["origin"]
+---
+name: Origin.ScitokensRestrictedPaths
+description: >-
+  Enable the built-in issuer daemon for the origin.
+type: stringSlice
+default: none
+components: ["origin"]
+---
+name: Origin.ScitokensMapSubject
+description: >-
+  Enable the built-in issuer daemon for the origin.
+type: bool
+default: false
+components: ["origin"]
+---
+name: Origin.ScitokensDefaultUser
+description: >-
+  Enable the built-in issuer daemon for the origin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.ScitokensUsernameClaim
+description: >-
+  Enable the built-in issuer daemon for the origin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.ScitokensNameMapFile
+description: >-
+  Enable the built-in issuer daemon for the origin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.XRootDPrefix
+description: >-
+  The directory prefix for the xrootd origin configuration files.
+type: string
+default: origin
+components: ["origin"]
+---
+name: Origin.EnableVoms
+description: >-
+  Enable X.509 / VOMS-based authentication.  This allows HTTP clients to
+  present X.509 client credentials in order to authenticate.  The configuration
+  of the authorization for these clients must be done by the admin; Pelican
+  does not support automatic VOMS authorization configuration.
+type: bool
+default: true
+components: ["origin"]
+---
+name: Origin.EnableDirListing
+description: >-
+  Allows the origin to enable directory listings. Needs to be enabled for recursive
+  downloads to work properly and for directories to be visable.
+type: bool
+default: false
+---
+name: Origin.Mode
+description: >-
+  The backend mode to be used by an origin. Current values that can be selected from
+  are either "posix" or "s3".
+type: string
+default: posix
+components: ["origin"]
+---
+name: Origin.S3ServiceName
+description: >-
+  The S3 Service Name to be used by the XRootD plugin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.S3Region
+description: >-
+  The S3 region to be used by the XRootD plugin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.S3Bucket
+description: >-
+  The S3 bucket to be used by the XRootD plugin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.S3ServiceUrl
+description: >-
+  The S3 service URL to be used by the XRootD plugin.
+type: string
+default: none
+components: ["origin"]
+---
+name: Origin.S3AccessKeyfile
+description: >-
+  A path to a file containing an S3 access keyfile for authenticated buckets when an origin is run in S3 mode.
+type: filename
+default: none
+components: ["origin"]
+---
+name: Origin.S3SecretKeyfile
+description: >-
+  A path to a file containing an S3 secret keyfile for authenticated buckets when an origin is run in S3 mode.
+type: filename
+default: none
+components: ["origin"]
+---
+############################
+#   Cache-level configs    #
+############################
+name: Cache.DataLocation
+description: >-
+  The directory for the location of the cache data files - this is where the actual data in the cache is stored.
+  This should *not* be in the same path as XRootD.Mount or else it will expose the data files as part of the files within the cache.
+type: string
+root_default: /run/pelican/xcache
+default: $XDG_RUNTIME_DIR/pelican/xcache
+components: ["cache"]
+---
+name: Cache.ExportLocation
+description: >-
+  The location of the export directory. Everything under this directory will be exposed as part of the cache. This is
+  relative to the mount location.
+type: string
+default: /
+components: ["cache"]
+---
+name: Cache.XRootDPrefix
+description: >-
+  The directory prefix for the xrootd cache configuration files.
+type: string
+default: cache
+components: ["cache"]
+---
+name: Cache.Port
+description: >-
+  The port over which the xrootd cache should be made available (this will overwrite Xrootd.Port)
+type: int
+default: 8447
+components: ["cache"]
+---
+name: Cache.EnableVoms
+description: >-
+  Enable X.509 / VOMS-based authentication for the cache.  This allows HTTP clients
+  to present X.509 client credentials in order to authenticate.  The configuration
+  of the authorization for these clients must be done by the admin; Pelican
+  does not support automatic VOMS authorization configuration.
+type: bool
+default: false
+components: ["cache"]
+---
+############################
+#  Director-level configs  #
+############################
+name: Director.DefaultResponse
+description: >-
+  The default response type of a redirect for a director instance. Can be either "cache" or "origin". If a director
+  is hosted at https://director.com, then a GET request to https://director.com/foo/bar.txt will either redirect to
+  the nearest cache for namespace /foo if Director.DefaultResponse is set to "cache" or to the origin for /foo if
+  it is set to "origin".
+type: string
+default: cache
+components: ["director"]
+---
+name: Director.CacheResponseHostnames
+description: >-
+  A list of virtual hostnames for the director. If a request is sent by the client to one of these hostnames,
+  the director assumes it should respond with a redirect to a cache.
+
+  If present, the hostname is taken from the X-Forwarded-Host header in the request. Otherwise, Host is used.
+type: stringSlice
+default: none
+components: ["director"]
+---
+name: Director.OriginResponseHostnames
+description: >-
+  A list of virtual hostnames for the director. If a request is sent by the client to one of these hostnames,
+  the director assumes it should respond with a redirect to an origin.
+
+  If present, the hostname is taken from the X-Forwarded-Host header in the request. Otherwise, Host is used.
+type: stringSlice
+default: none
+components: ["director"]
+---
+name: Director.MaxMindKeyFile
+description: >-
+  A filepath to a MaxMind API key. The director service uses the MaxMind GeoLite City database (available [here](https://dev.maxmind.com/geoip/docs/databases/city-and-country))
+  to determine which cache is nearest to a client's IP address. The database, if not already found, will be downloaded
+  automatically when a director is served and a valid key is present.
+type: url
+default: none
+components: ["director"]
+---
+name: Director.GeoIPLocation
+description: >-
+  A filepath to the intended location of the MaxMind GeoLite City database. This option can be used either to load
+  an existing database, or to configure the preferred download location if Pelican has a MaxMind API key.
+type: filename
+root_default: /var/cache/pelican/maxmind/GeoLite2-City.mmdb
+default: $ConfigBase/maxmind/GeoLite2-city.mmdb
+components: ["director"]
+---
+name: Director.AdvertisementTTL
+description: >-
+  The time to live (TTL) of director's internal cache to store origins and caches advertisement.
+type: duration
+default: 15m
+components: ["director"]
+---
+name: Director.OriginCacheHealthTestInterval
+description: >-
+  The interval of which director issues a new file transfer test to all the registered origins and caches.
+type: duration
+default: 15s
+components: ["director"]
+---
+############################
+#  Registry-level configs  #
+############################
+name: Registry.DbLocation
+description: >-
+  A filepath to the intended location of the namespace registry's database.
+type: filename
+root_default: /var/lib/pelican/registry.sqlite
+default: $ConfigBase/ns-registry.sqlite
+components: ["nsregistry"]
+---
+name: Registry.RequireKeyChaining
+description: >-
+  Specifies whether namespaces requesting registration must possess a key matching any already-registered super/sub namespaces. For
+  example, if true and a namespace `/foo/bar` is already registered, then registration of `/foo` or `/foo/bar/baz` can only be done
+  using keys registered to `/foo/bar`.
+type: bool
+default: true
+components: ["nsregistry"]
+---
+name: Registry.AdminUsers
+description: >-
+  A string slice of "subject" claim of users to give admin permission for registry UI.
+
+  The "subject" claim should be the "CILogon User Identifier" from CILogon user page: https://cilogon.org/
+type: stringSlice
+default: []
+components: ["nsregistry"]
+---
+name: Registry.Institutions
+description: >-
+  A array of institution objects available to register. Users can only select from this list
+  when they register a new namespace. Each object has `name` and `id` field where
+  `name` is a human-readable name for the institution and `id` is a unique identifier
+  for the institution. For Pelican running in OSDF alias, the `id` will be OSG ID.
+
+  For example:
+
+  ```
+  - name: University of Wisconsin - Madison
+    id: https://osg-htc.org/iid/01y2jtd41
+  ```
+
+  Note that this value will take precedence over Registry.InstitutionsUrl if both are set
+type: object
+default: none
+components: ["nsregistry"]
+---
+name: Registry.InstitutionsUrl
 description: >-
-  The name of a file containing an X.509 host certificate to use for TLS 
+  A url to get a list of available institutions for users to register their namespaces to.
+  The url must accept a GET request with 200 response in JSON/YAML content with the following format:
+
+  JSON:
+  ```JSON
+    [
+      {
+        "name": "University of Wisconsin - Madison",
+        "id": " https://osg-htc.org/iid/01y2jtd41"
+      }
+    ]
+  ```
+
+  YAML:
+  ```yaml
+    ---
+    - name: University of Wisconsin - Madison
+      id: " https://osg-htc.org/iid/01y2jtd41"
+  ```
+
+  where the id field will be stored in registry database and must be unique, and name field will be displayed in UI as the option.
+
+  Note that Pelican will cache the response of the url in a TTL cache with default refresh time of 15 minutes.
+  Also note that Registry.Institutions will take precedence over this value if both are set.
+type: url
+default: none
+components: ["nsregistry"]
+---
+name: Registry.InstitutionsUrlReloadMinutes
+description: >-
+  Number of minutes that the Registry.InstitutionsUrl will be reloaded into the TTL cache.
+type: duration
+default: 15m
+components: ["nsregistry"]
+---
+############################
+#   Server-level configs   #
+############################
+name: Server.TLSCertificate
+description: >-
+  A filepath to a file containing an X.509 host certificate to use for TLS
   authentication when running server components of Pelican.
+
+  If you override this filepath, you need to provide the matched-pair private key
+  via Server.TLSKey and a Certificate Authority (CA) certificate via Server.TLSCACertificateFile
 type: filename
 root_default: /etc/pelican/certificates/tls.crt
 default: "$ConfigBase/certificates/tls.crt"
-components: ["origin", "namespace", "director"]
+components: ["origin", "nsregistry", "director"]
 ---
-name: TLSKey
+name: Server.TLSCACertificateFile
+description: >-
+  A filepath to the TLS Certificate Authority (CA) certificate file, to be used by XRootD
+  and internal HTTP client requests.
+
+  Do not override this filepath unless you want to provide your TLS host certifacte
+type: filename
+root_default: /etc/pelican/certificates/tlsca.pem
+default: "$ConfigBase/certificates/tlsca.pem"
+components: ["origin", "nsregistry", "director"]
+---
+name: Server.TLSCACertificateDirectory
+description: >-
+  A filepath to the directory used for storing TLS Certificate Authority (CA) certificate
+  to be used by XRootD only.
+
+  This is exclusive with Server.TLSCACertificateFile for XRootD and this value takes priority
+  over Server.TLSCACertificateFile
+type: string
+default: none
+components: ["origin", "nsregistry", "director"]
+---
+name: Server.TLSCAKey
+description: >-
+  The name of a file containing a private key corresponding to the TLSCACertificate.
+  Used when running server components of Pelican.
+type: filename
+root_default: /etc/pelican/certificates/tlsca.key
+default: "$ConfigBase/certificates/tlsca.key"
+components: ["origin", "nsregistry", "director"]
+---
+name: Server.TLSKey
 description: >-
   The name of a file containing a private key corresponding to the TLSCertificate.
   Used when running server components of Pelican.
 type: filename
 root_default: /etc/pelican/certificates/tls.key
 default: "$ConfigBase/certificates/tls.key"
-components: ["origin", "namespace", "director"]
+components: ["origin", "nsregistry", "director"]
+---
+name: Server.EnableUI
+description: >-
+  Indicate whether a server should enable its web UI.
+type: bool
+default: true
+components: ["origin", "nsregistry", "director", "cache"]
+---
+name: Server.WebPort
+description: >-
+  The port number the Pelican web interface and internal web APIs will be bound to.
+type: int
+default: 8444
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.WebHost
+description: >-
+  A string-encoded IP address that the Pelican web engine is configured to listen on.
+type: string
+default: "0.0.0.0"
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.ExternalWebUrl
+description: >-
+  A URL indicating the Pelican web interface and internal web APIs address as it appears externally.
+
+  This URL must not have the same port number as the one in Origin.Url (if any) or Xrootd.Port
+type: url
+default: https://${Server.Hostname}:${Server.WebPort}
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.Hostname
+description: >-
+  The server's hostname, by default it's os.Hostname().
+type: string
+default: none
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.IssuerUrl
+description: >-
+  The URL and port at which the server's issuer can be accessed.
+type: string
+# Setting default to none for now because it changes based on server type and server mode.
+default: none
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.IssuerHostname
+description: >-
+  The hostname at which the server's issuer can be accessed.
+type: string
+# Setting default to none for now because it changes based on server type and server mode.
+default: none
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.IssuerPort
+description: >-
+  The port at which the server's issuer can be accessed.
+type: int
+# Setting default to none for now because it changes based on server type and server mode.
+default: none
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.IssuerJwks
+description: >-
+  A filepath indicating where the server's public JSON web keyset can be found.
+type: filename
+default: none
+components: ["origin", "director", "nsregistry"]
+---
+name: Server.Modules
+description: >-
+  A list of modules to enable when running pelican in `pelican serve` mode.
+type: stringSlice
+default: []
+---
+name: Server.UIActivationCodeFile
+description: >-
+  If the server's web UI has not yet been configured, this file will
+  contain the activation code necessary to turn it on.
+type: filename
+default: $ConfigBase/server-web-activation-code
+components: ["origin", "cache", "nsregistry", "director"]
+---
+name: Server.UIPasswordFile
+description: >-
+  A filepath specifying where the server's web UI password file should be stored.
+type: filename
+default: $ConfigBase/server-web-passwd
+components: ["origin", "cache", "nsregistry", "director"]
+---
+name: Server.SessionSecretFile
+description: >-
+  The filepath to the secret for encrypt/decrypt session data for Pelican web UI to initiate a session cookie
+
+  This is used for sending redirect request for OAuth2 authentication follow.
+  This is also used for CSRF auth key.
+type: filename
+default: $ConfigBase/session-secret
+  The default content of the file is the hash of the concatenation of "pelican" and the DER form of ${IssuerKey}
+components: ["nsregistry", "director"]
+---
+name: Server.RegistrationRetryInterval
+description: >-
+  The duration of delay in origin/cache registration retry attempts if the initial registration call to registry
+  was failed.
+type: duration
+default: 10s
+components: ["origin", "cache"]
+---
+################################
+#   Issuer's Configurations    #
+################################
+name: Issuer.TomcatLocation
+description: >-
+  Location of the system tomcat installation
+type: string
+default: /opt/tomcat
+components: ["origin"]
+---
+name: Issuer.ScitokensServerLocation
+description: >-
+  Location of the scitoken server installation
+type: string
+default: /opt/scitokens-server
+components: ["origin"]
+---
+name: Issuer.QDLLocation
+description: >-
+  Location of the QDL language and scripts install on the system
+type: string
+default: /opt/qdl
+components: ["origin"]
+---
+name: Issuer.AuthenticationSource
+description: >-
+  How users should authenticate with the issuer.  Currently-supported values are:
+  - `none` (default): No authentication is performed.  All requests are successful and assumed to
+    be a user named `nobody`.
+  - `OIDC`: Use the server's OIDC configuration to authenticate with an external identity provider.
+type: string
+default: OIDC
+components: ["origin"]
+---
+name: Issuer.OIDCAuthenticationRequirements
+description: >-
+  A list of claim-value pairs that indicate required values from the OIDC ID token to authenticate.
+  For example, the following setting:
+
+  ```
+  - claim: idp_name
+    value: University of Wisconsin-Madison
+  ```
+
+  would only allow tokens with `"idp_name": "University of Wisconsin-Madison"` set to authenticate.
+type: object
+default: []
+components: ["origin"]
+---
+name: Issuer.OIDCAuthenticationUserClaim
+description: >-
+  The claim in the OIDC ID token to be used as the "username" for the issuer
+type: string
+default: sub
+components: ["origin"]
+---
+name: Issuer.GroupSource
+description: >-
+  How the issuer should determine group information based on the authenticated identity.  Valid values are:
+  - `none` (default): No group information should be used.
+  - `file`: Read groups from an external, JSON-formatted file.  The file should contain a single JSON object
+    with keys corresponding to the "user" name and the value a list of strings that are interpretted as the
+    user's groups.
+type: string
+default: none
+components: ["origin"]
+---
+name: Issuer.GroupFile
+description: >-
+  The location of a file containing group information.  The file should contain a single JSON object with
+  keys corresponding to the "user" name and the value a list of strings that are interpretted as the user's
+  groups.
+type: string
+default: none
+components: ["origin"]
+---
+name: Issuer.GroupRequirements
+description: >-
+  Group membership requirements.  A request must be mapped to one of the groups in this list to successfully
+  authenticate.
+type: stringSlice
+default: []
+components: ["origin"]
+---
+name: Issuer.AuthorizationTemplates
+description: >-
+  The authorizations that should be generated for an authenticated request.  Value should be a list of
+  authorized actions.
+
+  Each action is a key-value pair with the following keys defined:
+  - `actions`: A list of authorized actions.  Valid string values are `read`, `modify`, and `create`.
+  - `prefix`: A prefix where the actions are authorized.  If the prefix contains the substring `$USER`, the
+    string is replaced with the authenticated username.  If the prefix contains the substring `$GROUP`, then
+    an authorization is emitted for _each group_ authenticated.
+
+  For example, if the request is authenticated as user `bbockelm` with groups `dept_a` and `dept_b`, then
+  the following configuration:
+
+  ```
+  - actions: ["read", "create"]
+    prefix: /projects/$GROUP
+  - actions: ["read", "modify"]
+    prefix: /home/$USER
+  ```
+
+  will result in the following authorizations:
+  - read /projects/dept_a
+  - create /projects/dept_a
+  - read /projects/dept_b
+  - create /projects/dept_b
+  - read /home/bbockelm
+  - modify /home/bbockelm
+type: object
+default: []
+components: ["origin"]
 ---
-name: XrootdRun
+###################################
+#   Server's OIDC Configuration   #
+###################################
+name: OIDC.ClientIDFile
+description: >-
+  A filepath to a file containing an OIDC Client ID. This is used by the namespace registry to establish OIDC information
+  for authenticated registration.
+type: filename
+root_default: /etc/pelican/oidc-client-id
+default: $ConfigBase/oidc-client-id
+components: ["nsregistry", "origin"]
+---
+name: OIDC.ClientID
+description: >-
+  The OIDC ClientID to use for the server.
+type: string
+default: none
+components: ["nsregistry", "origin"]
+---
+name: OIDC.ClientSecretFile
+description: >-
+  A filepath to a file containing an OIDC Client Secret. This is used by the namespace registry to establish OIDC information
+  for authenticated registration.
+type: filename
+root_default: /etc/pelican/oidc-client-secret
+default: $ConfigBase/oidc-client-secret
+components: ["nsregistry", "origin"]
+---
+name: OIDC.DeviceAuthEndpoint
+description: >-
+  A URL describing an OIDC Device Auth Endpoint. This is used by the namespace registry to establish OIDC information
+  for authenticated registration.
+type: url
+default: none
+components: ["nsregistry", "origin"]
+---
+name: OIDC.TokenEndpoint
+description: >-
+  A URL describing an OIDC Token Endpoint. This is used by the namespace registry to establish OIDC information
+  for authenticated registration.
+type: url
+default: none
+components: ["nsregistry", "origin"]
+---
+name: OIDC.UserInfoEndpoint
+description: >-
+  A URL describing an OIDC User Info Endpoint. This is used by the namespace registry to establish OIDC information
+  for authenticated registration.
+type: url
+default: none
+components: ["nsregistry", "origin"]
+---
+name: OIDC.AuthorizationEndpoint
+description: >-
+  A URL containing the OIDC authorization endpoint.
+type: url
+default: none
+components: ["origin"]
+---
+name: OIDC.Issuer
+description: >-
+  The URL of the OIDC issuer.  If set, OIDC auto-discovery may be used to find other endpoints (token, user info,
+  device auth).
+type: url
+default: none
+components: ["nsregistry", "origin"]
+---
+name: OIDC.ClientRedirectHostname
+description: >-
+  The hostname for the OIDC client redirect URL that the OIDC provider will redirect to after the user is authenticated
+
+  For development use only. Useful when developing in a container and you want to expose localhost
+  instead of container hostname to your OAuth provider
+type: string
+default: none
+components: ["nsregistry", "director"]
+---
+############################
+#   XRootD-level Configs   #
+############################
+name: Xrootd.Port
+description: >-
+  The port over which XRootD should be made available.
+type: int
+default: 8443
+components: ["origin", "cache"]
+---
+name: Xrootd.RunLocation
 description: >-
   A directory where temporary configurations will be stored for the xrootd daemon
-  started by the origin.
+  started by the origin or cache.
 
   For non-root servers, if $XDG_RUNTIME_DIR is not set, a temporary directory will
   be created (and removed on shutdown)
 type: filename
 root_default: /run/pelican/xrootd
 default: $XDG_RUNTIME_DIR/pelican
-components: ["origin"]
+components: ["origin", "cache"]
 ---
-name: RobotsTxtFile
+name: Xrootd.RobotsTxtFile
 description: >-
   Origins may be indexed by web search engines; to control the behavior of search
   engines, one may provide local policy via a [robots.txt file](https://en.wikipedia.org/wiki/Robots.txt).
@@ -68,7 +1052,7 @@ root_default: /etc/pelican/robots.txt
 default: $ConfigBase/robots.txt
 components: ["origin"]
 ---
-name: ScitokensConfig
+name: Xrootd.ScitokensConfig
 description: >-
   The location of a file configuring xrootd's
   [token-based authorization subsystem](https://github.com/xrootd/xrootd/blob/master/src/XrdSciTokens/README.md).
@@ -78,3 +1062,159 @@ type: filename
 root_default: /etc/pelican/xrootd/scitokens.cfg
 default: $ConfigBase/xrootd/scitokens.cfg
 ---
+name: Xrootd.Mount
+description: >-
+  The mount path for an instance of XRootD.
+type: string
+default: none
+components: ["origin"]
+---
+name: Xrootd.MacaroonsKeyFile
+description: >-
+  The filepath to a Macaroons key for setting up authorization in XRootD.
+type: string
+default: none
+components: ["origin"]
+---
+name: Xrootd.Authfile
+description: >-
+  The filepath to an auth file for setting up authorization in XRootD.
+type: string
+default: none
+components: ["origin"]
+---
+name: Xrootd.ManagerHost
+description: >-
+  A URL pointing toward the XRootD instance's Manager Host.
+type: url
+default: none
+components: ["origin"]
+---
+name: Xrootd.SummaryMonitoringHost
+description: >-
+  A URL pointing toward the XRootD instance's Summary Monitoring Host.
+type: url
+default: none
+components: ["origin"]
+---
+name: Xrootd.DetailedMonitoringHost
+description: >-
+  A URL pointing toward the XRootD instance's Detailed Monitoring Host.
+type: url
+default: none
+components: ["origin"]
+---
+name: Xrootd.LocalMonitoringHost
+description: >-
+  A URL pointing toward the XRootD instance's Local Monitoring Host.
+type: url
+default: none
+components: ["origin"]
+---
+name: Xrootd.Sitename
+description: >-
+  The sitename, as configured for XRootD.
+type: string
+default: none
+components: ["origin"]
+---
+############################
+# Monitoring-level configs #
+############################
+name: Monitoring.DataLocation
+description: >-
+  A filepath where Prometheus should host its monitoring data.
+type: string
+root_default: /var/lib/pelican/monitoring/data
+default: $ConfigBase/monitoring/data
+components: ["origin"]
+---
+name: Monitoring.PortLower
+description: >-
+  The lower end of a range of monitoring ports for Prometheus configuration.
+type: int
+default: 9930
+components: ["origin"]
+---
+name: Monitoring.PortHigher
+description: >-
+  The lower end of a range of monitoring ports for Prometheus configuration.
+type: int
+default: 9999
+components: ["origin"]
+---
+name: Monitoring.AggregatePrefixes
+description: >-
+  A list of path-like prefixes, potentially containing a glob (wildcard character), indicating
+  how the Prometheus-based monitoring should aggregate records when reporting.  For example,
+  if `/foo/*` is on the aggregate path list, then the monitoring data for a download of
+  objects `/foo/bar` and `/foo/baz` will be aggregated into a single series, `/foo`.
+type: stringSlice
+default: ["/*"]
+components: ["origin"]
+---
+name: Monitoring.TokenExpiresIn
+description: >-
+  The duration of which the tokens for various Prometheus endpoints expire.
+
+  This includes tokens for director's Prometheus origin discovery endpoint,
+  director's origin scraper, and server's self-scraper
+type: duration
+default: 1h
+components: ["origin", "director", "nsregistry"]
+---
+name: Monitoring.TokenRefreshInterval
+description: >-
+  The interval of which the token issuer for various Prometheus endpoints
+  refreshes the token for monitoring.
+
+  The tokens that are affected by this config are the same as the one in Monitoring.TokenExpiresIn.
+  This value must be less than Monitoring.TokenExpiresIn.
+type: duration
+default: 59m
+components: ["origin", "director", "nsregistry"]
+---
+name: Monitoring.MetricAuthorization
+description: >-
+  If authorization (Bearer token) is required for accesing /metrics endpoint
+type: bool
+default: true
+components: ["origin", "director", "nsregistry"]
+---
+############################
+#   Plugin-level configs   #
+############################
+name: Plugin.Token
+description: >-
+  The specified token for pelican plugin staging
+type: string
+default: none
+components: ["plugin"]
+---
+name: StagePlugin.Hook
+description: >-
+  Flag to specify HTCondor hook behavior
+type: bool
+default: false
+components: ["plugin"]
+---
+name: StagePlugin.MountPrefix
+description: >-
+  Prefix corresponding to the local mount point of the origin
+type: string
+default: none
+components: ["plugin"]
+---
+name: StagePlugin.OriginPrefix
+description: >-
+  Prefix corresponding to the local origin
+type: string
+default: none
+components: ["plugin"]
+---
+name: StagePlugin.ShadowOriginPrefix
+description: >-
+  Prefix corresponding to the shadow origin
+type: string
+default: none
+components: ["plugin"]
diff --git a/docs/public/invalid_certificate.png b/docs/public/invalid_certificate.png
new file mode 100644
index 000000000..64112100e
Binary files /dev/null and b/docs/public/invalid_certificate.png differ
diff --git a/docs/public/metrics_view.png b/docs/public/metrics_view.png
new file mode 100644
index 000000000..ea664659a
Binary files /dev/null and b/docs/public/metrics_view.png differ
diff --git a/docs/public/origin_start.png b/docs/public/origin_start.png
new file mode 100644
index 000000000..71080b2bb
Binary files /dev/null and b/docs/public/origin_start.png differ
diff --git a/docs/public/pelican-and-osdf.png b/docs/public/pelican-and-osdf.png
new file mode 100644
index 000000000..52ee01921
Binary files /dev/null and b/docs/public/pelican-and-osdf.png differ
diff --git a/docs/public/pelican-bus.png b/docs/public/pelican-bus.png
new file mode 100644
index 000000000..cc08c7aad
Binary files /dev/null and b/docs/public/pelican-bus.png differ
diff --git a/docs/scopes.yaml b/docs/scopes.yaml
new file mode 100644
index 000000000..9788ef401
--- /dev/null
+++ b/docs/scopes.yaml
@@ -0,0 +1,73 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This file contains structured documentaion about the scopes of JWTs
+# that will be issued and exchanged for Pelican servers to communicate with
+# each other as well as for users to access functions in Pelican server Web UI
+
+# Naming covention: <resource_name>.<action_name> snake case for naming
+
+############################
+#     Top-level Scopes     #
+############################
+---
+name: pelican.advertise
+description: >-
+  For origin and cache to advertise itself to be registered at the director
+issuedBy: ["origin", "cache"]
+acceptedBy: ["director"]
+---
+name: pelican.director_test_report
+description: >-
+  For the director to report test result of file transfer back to origins
+issuedBy: ["director"]
+acceptedBy: ["origin"]
+---
+name: pelican.director_service_discovery
+description: >-
+  For director's Prometheus instance to discover available origins to scrape from
+issuedBy: ["director"]
+acceptedBy: ["director"]
+---
+name: pelican.namespace_delete
+description: >-
+  For namespace client to delete a namespace from namespace registry
+issuedBy: ["client"]
+acceptedBy: ["registry"]
+---
+############################
+#      Web UI Scopes       #
+############################
+name: web_ui.access
+description: >-
+  For user to access various server Web UI
+issuedBy: ["*"]
+acceptedBy: ["*"]
+---
+############################
+#    Monitoring Scopes     #
+############################
+name: monitoring.scrape
+description: >-
+  For server's Prometheus instance to scrape its Prometheus http data exporter at /metrics
+issuedBy: ["*"]
+acceptedBy: ["*"]
+---
+name: monitoring.query
+description: >-
+  For Web UI user and third-party tools to access server's Prometheus query engine endpoints at /api/v1.0/prometheus
+issuedBy: ["web_ui"]
+acceptedBy: ["*"]
diff --git a/generate/main.go b/generate/main.go
new file mode 100644
index 000000000..0afaba9b3
--- /dev/null
+++ b/generate/main.go
@@ -0,0 +1,14 @@
+package main
+
+//go:generate go run ../generate
+
+// This should not be included in any release of pelican
+
+// Include more generator functions here but keep them encapsulated
+// in their separate files under `generate` package
+func main() {
+	GenParamEnum()
+	GenParamStruct()
+	GenPlaceholderPathForNext()
+	GenTokenScope()
+}
diff --git a/generate/next_generator.go b/generate/next_generator.go
new file mode 100644
index 000000000..ff7be39f6
--- /dev/null
+++ b/generate/next_generator.go
@@ -0,0 +1,28 @@
+package main
+
+// This should not be included in any release of pelican
+
+import (
+	"log"
+	"os"
+	"path/filepath"
+)
+
+// Generate a placeholder file under web_ui/frontend/out so that
+// we can build Go without error. This is mainly for the linter
+// GitHub Action that doesn't need frontend to be built. Refer to
+// linter GHA for details.
+func GenPlaceholderPathForNext() {
+	dir := "../web_ui/frontend/out"
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		log.Fatalf("error: %v", err)
+	}
+
+	filePath := filepath.Join(dir, "placeholder")
+
+	file, err := os.Create(filePath)
+	if err != nil {
+		log.Fatalf("error: %v", err)
+	}
+	file.Close()
+}
diff --git a/generate/param_generator.go b/generate/param_generator.go
new file mode 100644
index 000000000..fcb766418
--- /dev/null
+++ b/generate/param_generator.go
@@ -0,0 +1,420 @@
+package main
+
+// This should not be included in any release of pelican, instead only the generated "parameters.go" and "parameters_struct.go" should packaged.
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"text/template"
+
+	"gopkg.in/yaml.v3"
+)
+
+type GoField struct {
+	Name         string
+	Type         string
+	NestedFields map[string]*GoField
+}
+
+type TemplateData struct {
+	GeneratedConfig         string
+	GeneratedConfigWithType string
+}
+
+var requiredKeys = [3]string{"description", "default", "type"}
+
+func GenParamEnum() {
+	/*
+	* This generated a file "config/parameters.go" that is based off of docs/parameters.yaml to be used
+	* instead of explicit calls to viper.Get* It also generates a parameters.json file for website use
+	 */
+	filename, _ := filepath.Abs("../docs/parameters.yaml")
+	yamlFile, err := os.Open(filename)
+	fullJsonInt := []interface{}{}
+
+	if err != nil {
+		panic(err)
+	}
+
+	// This decoder and for loop is needed because the yaml file has multiple '---' delineated docs
+	decoder := yaml.NewDecoder(yamlFile)
+
+	var values []interface{}
+
+	for {
+		var value map[string]interface{}
+		if err := decoder.Decode(&value); err != nil {
+			if err == io.EOF {
+				break
+			}
+			panic(fmt.Errorf("document decode failed: %w", err))
+		}
+		values = append(values, value)
+	}
+
+	stringParamMap := make(map[string]string)
+	stringSliceParamMap := make(map[string]string)
+	intParamMap := make(map[string]string)
+	boolParamMap := make(map[string]string)
+	durationParamMap := make(map[string]string)
+	objectParamMap := make(map[string]string)
+
+	// Skip the first parameter (ConfigBase is special)
+	// Save the first parameter seperately in order to do "<pname> Param = iota" for the enums
+
+	// Parse and check the values of each parameter against the required Keys
+	for idx, value := range values {
+		entry := value.(map[string]interface{})
+		entryName, ok := entry["name"]
+		if !ok {
+			panic(fmt.Sprintf("Parameter entry at position %d is missing the name attribute", idx))
+		}
+		if entryName == "ConfigBase" {
+			continue
+		}
+		for _, keyName := range requiredKeys {
+			if _, ok := entry[keyName]; !ok {
+				panic(fmt.Sprintf("Parameter entry '%s' is missing required key '%s'",
+					entryName, keyName))
+			}
+		}
+
+		// Each document must be converted to json on it's own and then the name
+		// must be used as a key
+		jsonBytes, _ := json.Marshal(entry)
+		var j map[string]interface{}
+		err = json.Unmarshal(jsonBytes, &j)
+		if err != nil {
+			panic(err)
+		}
+		j2 := map[string]interface{}{entry["name"].(string): j}
+		fullJsonInt = append(fullJsonInt, j2)
+
+		rawName := entry["name"].(string)
+		name := strings.ReplaceAll(rawName, ".", "_")
+		pType := entry["type"].(string)
+		switch pType {
+		case "url":
+			fallthrough
+		case "filename":
+			fallthrough
+		case "string":
+			stringParamMap[name] = rawName
+		case "stringSlice":
+			stringSliceParamMap[name] = rawName
+		case "int":
+			intParamMap[name] = rawName
+		case "bool":
+			boolParamMap[name] = rawName
+		case "duration":
+			durationParamMap[name] = rawName
+		case "object":
+			objectParamMap[name] = rawName
+		default:
+			errMsg := fmt.Sprintf("UnknownType '%s': add a new struct and return method to the generator, or "+
+				"change the type in parameters.yaml to be an already-handled type", pType)
+			panic(errMsg)
+		}
+	}
+
+	// Create the file to be generated
+	f, err := os.Create("../param/parameters.go")
+	if err != nil {
+		panic(err)
+	}
+	defer f.Close()
+
+	// Generate the code based on the template
+	err = packageTemplate.Execute(f, struct {
+		StringMap      map[string]string
+		StringSliceMap map[string]string
+		IntMap         map[string]string
+		BoolMap        map[string]string
+		DurationMap    map[string]string
+		ObjectMap      map[string]string
+	}{StringMap: stringParamMap, StringSliceMap: stringSliceParamMap, IntMap: intParamMap, BoolMap: boolParamMap, DurationMap: durationParamMap, ObjectMap: objectParamMap})
+
+	if err != nil {
+		panic(err)
+	}
+
+	// Write the json version of the yaml document to the file
+	fullJsonBytes, err := json.Marshal(fullJsonInt)
+	if err != nil {
+		panic(err)
+	}
+	var prettyJSON bytes.Buffer
+	err = json.Indent(&prettyJSON, fullJsonBytes, "", "\t")
+	if err != nil {
+		panic(err)
+	}
+	// Create the json file to be generated (for the web ui)
+	fJSON, err := os.Create("../docs/parameters.json")
+	if err != nil {
+		panic(err)
+	}
+	_, err = fJSON.Write(prettyJSON.Bytes())
+	if err != nil {
+		panic(err)
+	}
+}
+
+// Recursively generate the struct code given the root of the GoField
+func generateGoStructCode(field *GoField, indent string) string {
+	// If it has type, it should be a leaf node as parent node
+	// does not have a type
+	if field.Type != "" {
+		return fmt.Sprintf("%s%s %s\n", indent, field.Name, field.Type)
+	}
+	code := fmt.Sprintf("%s%s struct {\n", indent, field.Name)
+	keys := make([]string, 0, len(field.NestedFields))
+	for key := range field.NestedFields {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	for _, key := range keys {
+		nested := field.NestedFields[key]
+		code += generateGoStructCode(nested, indent+"	")
+	}
+	code += fmt.Sprintf("%s}\n", indent)
+	return code
+}
+
+// Recursively generate the struct code given the root of the GoField
+func generateGoStructWithTypeCode(field *GoField, indent string) string {
+	// If it has type, it should be a leaf node as parent node
+	// does not have a type
+	if field.Type != "" {
+		return fmt.Sprintf("%s%s struct { Type string; Value %s }\n", indent, field.Name, field.Type)
+	}
+	code := fmt.Sprintf("%s%s struct {\n", indent, field.Name)
+	keys := make([]string, 0, len(field.NestedFields))
+	for key := range field.NestedFields {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	for _, key := range keys {
+		nested := field.NestedFields[key]
+		code += generateGoStructWithTypeCode(nested, indent+"	")
+	}
+	code += fmt.Sprintf("%s}\n", indent)
+	return code
+}
+
+// This generates a file param/parameters_struct.go, a struct contains typed parameters
+// that is based off of docs/parameters.yaml to be used for marshalling config to a JSON
+func GenParamStruct() {
+	// Same file-reading logic as GenParamEnum
+	filename, _ := filepath.Abs("../docs/parameters.yaml")
+	yamlFile, err := os.Open(filename)
+	if err != nil {
+		panic(err)
+	}
+	defer yamlFile.Close()
+
+	decoder := yaml.NewDecoder(yamlFile)
+
+	var values []interface{}
+
+	for {
+		var value map[string]interface{}
+		if err := decoder.Decode(&value); err != nil {
+			if err == io.EOF {
+				break
+			}
+			panic(fmt.Errorf("document decode failed: %w", err))
+		}
+		values = append(values, value)
+	}
+
+	root := &GoField{
+		NestedFields: make(map[string]*GoField),
+	}
+
+	// Convert YAML entries to a nested Go struct. We intentionally skip
+	// the first entry, i.e. ConfigBase as it's only a verbose parameter
+	// for user to read but not being set in the code
+	for i := 1; i < len(values); i++ {
+		entry := values[i].(map[string]interface{})
+
+		// Skip required YAML field check as has been done in GenParamEnum
+
+		pName := entry["name"].(string)
+		pType := entry["type"].(string)
+		goType := ""
+		// Find the corresponding Go type
+		switch pType {
+		case "url":
+			fallthrough
+		case "filename":
+			fallthrough
+		case "string":
+			goType = "string"
+		case "stringSlice":
+			goType = "[]string"
+		case "int":
+			goType = "int"
+		case "bool":
+			goType = "bool"
+		case "duration":
+			goType = "time.Duration"
+		case "object":
+			goType = "interface{}"
+		default:
+			errMsg := fmt.Sprintf("UnknownType '%s': add a new struct and return method to the generator, or "+
+				"change the type in parameters.yaml to be an already-handled type", pType)
+			panic(errMsg)
+		}
+
+		parts := strings.Split(pName, ".")
+		current := root
+		for _, part := range parts {
+			if current.NestedFields[part] == nil {
+				current.NestedFields[part] = &GoField{
+					Name:         part,
+					NestedFields: make(map[string]*GoField),
+				}
+			}
+			current = current.NestedFields[part]
+		}
+		current.Type = goType
+	}
+
+	// Manually added this config to reflect what ConfigBase was meant to be
+	// Refer to where getConfigBase() is used in InitServer() in config/config.go
+	// for details
+	root.NestedFields["ConfigDir"] = &GoField{
+		Name:         "ConfigDir",
+		NestedFields: make(map[string]*GoField),
+		Type:         "string",
+	}
+
+	data := TemplateData{
+		GeneratedConfig:         `type config` + generateGoStructCode(root, ""),
+		GeneratedConfigWithType: `type configWithType` + generateGoStructWithTypeCode(root, ""),
+	}
+
+	// Create the file to be generated
+	f, err := os.Create("../param/parameters_struct.go")
+	if err != nil {
+		panic(err)
+	}
+	defer f.Close()
+
+	err = structTemplate.Execute(f, data)
+
+	if err != nil {
+		panic(err)
+	}
+}
+
+// As more varied paramters get added to parameters.yaml with different paths and names, this may need to be
+// altered to be more general
+var packageTemplate = template.Must(template.New("").Parse(`// Code generated by go generate; DO NOT EDIT.
+
+package param
+
+import (
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+type StringParam struct {
+	name string
+}
+
+type StringSliceParam struct {
+	name string
+}
+
+type BoolParam struct {
+	name string
+}
+
+type IntParam struct {
+	name string
+}
+
+type DurationParam struct {
+	name string
+}
+
+type ObjectParam struct {
+	name string
+}
+
+func (sP StringParam) GetString() string {
+	return viper.GetString(sP.name)
+}
+
+func (slP StringSliceParam) GetStringSlice() []string {
+	return viper.GetStringSlice(slP.name)
+}
+
+func (iP IntParam) GetInt() int {
+	return viper.GetInt(iP.name)
+}
+
+func (bP BoolParam) GetBool() bool {
+	return viper.GetBool(bP.name)
+}
+
+func (bP DurationParam) GetDuration() time.Duration {
+	return viper.GetDuration(bP.name)
+}
+
+func (bP ObjectParam) Unmarshal(rawVal any) error {
+	return viper.UnmarshalKey(bP.name, rawVal)
+}
+
+var ({{range $key, $value := .StringMap}}
+	{{$key}} = StringParam{{"{"}}{{printf "%q" $value}}{{"}"}}
+	{{- end}}
+)
+
+var ({{range $key, $value := .StringSliceMap}}
+	{{$key}} = StringSliceParam{{"{"}}{{printf "%q" $value}}{{"}"}}
+	{{- end}}
+)
+
+var ({{range $key, $value := .IntMap}}
+	{{$key}} = IntParam{{"{"}}{{printf "%q" $value}}{{"}"}}
+	{{- end}}
+)
+
+var ({{range $key, $value := .BoolMap}}
+	{{$key}} = BoolParam{{"{"}}{{printf "%q" $value}}{{"}"}}
+	{{- end}}
+)
+
+var ({{range $key, $value := .DurationMap}}
+	{{$key}} = DurationParam{{"{"}}{{printf "%q" $value}}{{"}"}}
+	{{- end}}
+)
+
+var ({{range $key, $value := .ObjectMap}}
+	{{$key}} = ObjectParam{{"{"}}{{printf "%q" $value}}{{"}"}}
+	{{- end}}
+)
+`))
+
+var structTemplate = template.Must(template.New("").Parse(`// Code generated by go generate; DO NOT EDIT.
+
+package param
+
+import (
+	"time"
+)
+
+{{.GeneratedConfig}}
+
+{{.GeneratedConfigWithType}}`))
diff --git a/generate/scope_generator.go b/generate/scope_generator.go
new file mode 100644
index 000000000..aae0db593
--- /dev/null
+++ b/generate/scope_generator.go
@@ -0,0 +1,124 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+	"unicode"
+
+	"gopkg.in/yaml.v3"
+)
+
+type ScopeName struct {
+	Raw     string
+	Display string
+}
+
+var requiredScopeKeys = [3]string{"description", "issuedBy", "acceptedBy"}
+
+func handleCaseConversion(s string) string {
+	var camelCase string
+	nextCap := false
+
+	for _, r := range s {
+		if r == '_' || r == '.' {
+			nextCap = true
+			if r == '.' {
+				camelCase += "."
+			}
+			continue
+		}
+
+		if nextCap {
+			camelCase += string(unicode.ToUpper(r))
+			nextCap = false
+		} else {
+
+			camelCase += string(r)
+		}
+	}
+
+	return camelCase
+}
+
+func GenTokenScope() {
+	filename, _ := filepath.Abs("../docs/scopes.yaml")
+	yamlFile, err := os.Open(filename)
+	if err != nil {
+		panic(err)
+	}
+	defer yamlFile.Close()
+
+	decoder := yaml.NewDecoder(yamlFile)
+
+	var values []interface{}
+
+	for {
+		var value map[string]interface{}
+		if err := decoder.Decode(&value); err != nil {
+			if err == io.EOF {
+				break
+			}
+			panic(fmt.Errorf("document decode failed: %w", err))
+		}
+		values = append(values, value)
+	}
+
+	scopes := make([]ScopeName, 0)
+
+	for i := 0; i < len(values); i++ {
+		entry := values[i].(map[string]interface{})
+
+		scopeName, ok := entry["name"].(string)
+		if !ok {
+			panic(fmt.Sprintf("Scope entry at position %d is missing the name attribute", i))
+		}
+		for _, keyName := range requiredScopeKeys {
+			if _, ok := entry[keyName]; !ok {
+				panic(fmt.Sprintf("Parameter entry '%s' is missing required key '%s'",
+					scopeName, keyName))
+			}
+		}
+		camelScopeName := handleCaseConversion(scopeName)
+		scopeNameInSnake := strings.Replace(camelScopeName, ".", "_", 1)
+		r := []rune(scopeNameInSnake)
+		r[0] = unicode.ToUpper(r[0])
+		displayName := string(r)
+		scopes = append(scopes, ScopeName{Raw: scopeName, Display: displayName})
+	}
+
+	// Create the file to be generated
+	f, err := os.Create("../token_scopes/token_scopes.go")
+	if err != nil {
+		panic(err)
+	}
+	defer f.Close()
+
+	err = tokenTemplate.Execute(f, struct {
+		Scopes []ScopeName
+	}{Scopes: scopes})
+
+	if err != nil {
+		panic(err)
+	}
+}
+
+var tokenTemplate = template.Must(template.New("").Parse(`// Code generated by go generate; DO NOT EDIT.
+
+package token_scopes
+
+type TokenScope string
+
+const (
+	{{- range $idx, $scope := .Scopes}}
+	{{$scope.Display}} TokenScope = "{{$scope.Raw}}"
+	{{- end}}
+)
+
+func (s TokenScope) String() string {
+	return string(s)
+}
+`))
diff --git a/tests/citests.sh b/github_scripts/citests.sh
similarity index 55%
rename from tests/citests.sh
rename to github_scripts/citests.sh
index f5ca9b7d9..ace8e3738 100755
--- a/tests/citests.sh
+++ b/github_scripts/citests.sh
@@ -1,13 +1,13 @@
 #!/bin/bash -xe
 #
 # Copyright (C) 2023, University of Nebraska-Lincoln
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -19,7 +19,7 @@ cp pelican stashcp
 cp pelican stash_plugin
 
 to_exit=0
-./stashcp -d /osgconnect/public/dweitzel/blast/queries/query1 ./
+./stashcp -d osdf:///ospool/uc-shared/public/OSG-Staff/validation/test.txt ./query1
 rm query1
 
 # Test the plugin interface
@@ -35,10 +35,10 @@ if ! [[ $classad_output =~ "SupportedMethods = \"stash, osdf\"" ]]; then
   to_exit=1
 fi
 
-plugin_output=$(./stash_plugin stash:///osgconnect/public/dweitzel/blast/queries/query1 query1)
+plugin_output=$(./stash_plugin osdf:///ospool/uc-shared/public/OSG-Staff/validation/test.txt query1)
 rm query1
 
-if ! [[ $plugin_output =~ "TransferUrl = \"stash:///osgconnect/public/dweitzel/blast/queries/query1\"" ]]; then
+if ! [[ $plugin_output =~ "TransferUrl = \"osdf:///ospool/uc-shared/public/OSG-Staff/validation/test.txt\"" ]]; then
   echo "TransferUrl not in plugin output"
   to_exit=1
 fi
@@ -49,11 +49,41 @@ if ! [[ $plugin_output =~ "TransferSuccess = true" ]]; then
 fi
 
 cat > infile <<EOF
-[ LocalFileName = "$PWD/query1"; Url = "stash:///osgconnect/public/dweitzel/blast/queries//query1" ]
-[ LocalFileName = "$PWD/query2"; Url = "stash:///osgconnect/public/dweitzel/blast/queries//query2" ]
-[ LocalFileName = "$PWD/query3"; Url = "stash:///osgconnect/public/dweitzel/blast/queries//query3" ]
+[ LocalFileName = "$PWD/query1"; Url = "osdf:///ospool/uc-shared/public/OSG-Staff/validation/test.txt" ]
 EOF
 
 ./stash_plugin -infile $PWD/infile -outfile $PWD/outfile
 
+# Test we return 0 when HOME is not set
+OLDHOME=$HOME
+unset HOME
+./stash_plugin -classad
+exit_status=$?
+
+if ! [[ "$exit_status" = 0 ]]; then
+  echo "Plugin did not return 0 when HOME is not set"
+  to_exit=1
+fi
+
+export HOME=$OLDHOME
+
+# Test we return 0 when HOME points to a nonwritable directory
+OLDHOME=$HOME
+unset HOME
+mkdir unwritable_dir
+chmod u-w,a-w unwritable_dir
+export HOME=unwriteable_dir
+
+./stash_plugin -classad
+exit_status=$?
+
+if ! [[ "$exit_status" = 0 ]]; then
+  echo "Plugin did not return 0 when HOME is set to an unwritable dir"
+  to_exit=1
+fi
+
+unset HOME
+export HOME=$OLDHOME
+rm -r unwritable_dir
+
 exit $to_exit
diff --git a/github_scripts/get_put_test.sh b/github_scripts/get_put_test.sh
new file mode 100755
index 000000000..a0f626913
--- /dev/null
+++ b/github_scripts/get_put_test.sh
@@ -0,0 +1,148 @@
+#!/bin/bash -xe
+#
+# Copyright (C) 2023, University of Nebraska-Lincoln
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This tests the functionality of `pelican object get` and `pelican object put` with the
+# "federation in a box"
+
+# Setup env variables needed
+to_exit=0
+export PELICAN_FEDERATION_DIRECTORURL="https://$HOSTNAME:8444"
+export PELICAN_FEDERATION_REGISTRYURL="https://$HOSTNAME:8444"
+export PELICAN_TLSSKIPVERIFY=true
+export PELICAN_ORIGIN_ENABLEFALLBACKREAD=true
+export PELICAN_SERVER_ENABLEUI=false
+export PELICAN_XROOTD_RUNLOCATION=$PWD/xrootdRunLocation
+mkdir get_put_config
+export PELICAN_CONFIGDIR=$PWD/get_put_config
+export PELICAN_REGISTRY_DBLOCATION=$PWD/get_put_config/test.sql
+
+export PELICAN_OIDC_CLIENTID="sometexthere"
+
+mkdir origin
+chmod 777 origin
+export PELICAN_ORIGIN_EXPORTVOLUME="origin:/test"
+
+# Make a file to use for testing
+echo "This is some random content in the random file" > input.txt
+
+# Make a token to be used
+./pelican origin token create --audience "https://wlcg.cern.ch/jwt/v1/any" --issuer "https://`hostname`:8443" --scope "storage.read:/ storage.modify:/" --subject "bar" --lifetime 60 --private-key get_put_config/issuer.jwk > token
+
+# Run federation in the background
+federationServe="./pelican serve --module director --module registry --module origin -d"
+$federationServe &
+pid_federationServe=$!
+
+# Give the federation time to spin up:
+API_URL="https://$HOSTNAME:8444/api/v1.0/health"
+DESIRED_RESPONSE="HTTP/2 200"
+
+# Function to check if the response indicates all servers are running
+check_response() {
+    RESPONSE=$(curl -k -s -I -X GET "$API_URL" \
+                 -H "Content-Type: application/json") \
+
+    # Check if the response matches the desired output
+    if echo "$RESPONSE" | grep -q "$DESIRED_RESPONSE"; then
+        echo "Desired response received: $RESPONSE"
+        return 0
+    else
+        echo "Waiting for desired response..."
+        return 1
+    fi
+}
+
+# We don't want to do this loop for too long, indicates there is an error
+TOTAL_SLEEP_TIME=0
+
+# Loop until director, origin, and registry are running
+while check_response; [ $? -ne 0 ]
+do
+    sleep .5
+    TOTAL_SLEEP_TIME=$((TOTAL_SLEEP_TIME + 1))
+
+    # Break loop if we sleep for more than 10 seconds
+    if [ "$TOTAL_SLEEP_TIME" -gt 20 ]; then
+        echo "Total sleep time exceeded, exiting..."
+
+        # Test failed, we need to clean up
+        rm -rf origin get_put_config xrootdRunLocation
+        rm -f input.txt token
+
+        unset PELICAN_FEDERATION_DIRECTORURL
+        unset PELICAN_FEDERATION_REGISTRYURL
+        unset PELICAN_TLSSKIPVERIFY
+        unset PELICAN_ORIGIN_EXPORTVOLUME
+        unset PELICAN_SERVER_ENABLEUI
+        unset PELICAN_OIDC_CLIENTID
+        unset PELICAN_ORIGIN_ENABLEFALLBACKREAD
+        echo "TEST FAILED"
+        exit 1
+    fi
+done
+
+# Run pelican object put
+./pelican object put input.txt osdf:///test/input.txt -d -t token -l putOutput.txt
+
+# Check output of command
+if grep -q "Uploaded bytes: 47" putOutput.txt; then
+    echo "Uploaded bytes successfully!"
+else
+    echo "Did not upload correctly"
+    cat putOutput.txt
+    to_exit=1
+fi
+
+./pelican object get osdf:///test/input.txt output.txt -d -t token -l getOutput.txt
+
+# Check output of command
+if grep -q "Downloaded bytes: 47" getOutput.txt; then
+    echo "Downloaded bytes successfully!"
+else
+    echo "Did not download correctly"
+    cat getOutput.txt
+    to_exit=1
+fi
+
+if grep -q "This is some random content in the random file" output.txt; then
+    echo "Content matches the uploaded file!"
+else
+    echo "Did not download correctly, content in downloaded file is different from the uploaded file"
+    echo "Contents of the downloaded file:"
+    cat output.txt
+    echo "Contents of uploaded file:"
+    cat input.txt
+    to_exit=1
+fi
+
+# Kill the federation
+kill $pid_federationServe
+
+# Clean up temporary files
+rm -f input.txt token putOutput.txt getOutput.txt output.txt
+
+# cleanup
+rm -rf origin get_put_config xrootdRunLocation
+
+unset PELICAN_FEDERATION_DIRECTORURL
+unset PELICAN_FEDERATION_REGISTRYURL
+unset PELICAN_TLSSKIPVERIFY
+unset PELICAN_ORIGIN_EXPORTVOLUME
+unset PELICAN_SERVER_ENABLEUI
+unset PELICAN_OIDC_CLIENTID
+unset PELICAN_ORIGIN_ENABLEFALLBACKREAD
+exit $to_exit
diff --git a/github_scripts/osx_install.sh b/github_scripts/osx_install.sh
new file mode 100755
index 000000000..d8580c93f
--- /dev/null
+++ b/github_scripts/osx_install.sh
@@ -0,0 +1,197 @@
+#!/bin/sh -ex
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This script installs all the xrootd-related dependencies into the
+# Mac OS X instance in GitHub.
+#
+
+brew install minio xrootd ninja
+
+mkdir dependencies
+pushd dependencies
+
+git clone --depth=1 https://github.com/PelicanPlatform/xrdcl-pelican.git
+
+pushd xrdcl-pelican
+mkdir build
+cd build
+cmake .. -GNinja -DCMAKE_INSTALL_PREFIX=$PWD/release_dir
+ninja install
+sudo mkdir -p /etc/xrootd/client.plugins.d/
+sudo cp release_dir/etc/xrootd/client.plugins.d/pelican-plugin.conf /etc/xrootd/client.plugins.d/
+popd
+
+git clone --depth=1 https://github.com/PelicanPlatform/xrootd-s3-http.git
+pushd xrootd-s3-http
+mkdir build
+cd build
+cmake .. -GNinja -DCMAKE_INSTALL_PREFIX=$PWD/release_dir
+ninja install
+echo "Will install into: `which xrootd`"
+xrootd_libdir=$(dirname `which xrootd`)/../lib/
+sudo mkdir -p $xrootd_libdir
+sudo ln -s $PWD/release_dir/lib/libXrdHTTPServer-5.so $xrootd_libdir
+sudo ln -s $PWD/release_dir/lib/libXrdS3-5.so $xrootd_libdir
+popd
+
+git clone --depth=1 https://github.com/scitokens/scitokens-cpp.git
+pushd scitokens-cpp
+mkdir build
+cd build
+export SCITOKENS_CPP_DIR=$PWD/release_dir
+cmake .. -GNinja -DCMAKE_INSTALL_PREFIX=$PWD/release_dir
+ninja install
+sudo ln -s $PWD/release_dir/lib/libSciTokens*.dylib $xrootd_libdir
+popd
+
+git clone --depth=1 https://github.com/xrootd/xrootd.git
+pushd xrootd
+mkdir build
+cd build
+cmake .. -GNinja
+ninja libXrdAccSciTokens-5.so
+sudo ln -s $PWD/src/libXrdAccSciTokens-5.so $xrootd_libdir
+popd
+
+popd
+
+#
+# WORKAROUND: force reverse DNS for IPv4 and IPv6
+# Due to https://github.com/xrootd/xrootd/issues/2159, xrootd won't startup
+# without reverse DNS entries.  If there's no corresponding entry, the
+# reverse DNS lookup will take ~10 seconds to timeout.  This is sadly close
+# to the time allocated to the various unit tests, meaning there is often
+# few to no log messages.
+#
+# If only an IPv4 entry is present, then XRootD will still trigger a lookup
+# on IPv6 which takes many seconds to timeout
+ipv6_local=$(ifconfig en0 inet6 | grep inet6 | tail -n 1 | tr '%' ' ' | cut -w -f 3)
+ipv4_local=$(ifconfig en0 inet  | grep inet | tail -n 1 | tr '%' ' ' | cut -w -f 3)
+
+cat > /tmp/hosts_append << EOF
+$ipv4_local $HOSTNAME
+$ipv6_local $HOSTNAME
+EOF
+sudo /bin/sh -c "cat /tmp/hosts_append >> /etc/hosts"
+cat /etc/hosts
+
+# Do a quick test of xrootd startup
+mkdir -p /tmp/xrootd
+
+# Generated host cert and CA for test.example.com.  Useless
+# except for getting rid of test failures.
+cat > /tmp/xrootd/certs.pem << EOF
+-----BEGIN CERTIFICATE-----
+MIIB2DCCAX6gAwIBAgIQOlqxi40B7A9AM9kqOrq4NDAKBggqhkjOPQQDAjAwMRMw
+EQYDVQQKEwpQZWxpY2FuIENBMRkwFwYDVQQDExB0ZXN0LmV4YW1wbGUuY29tMB4X
+DTI0MDEwMTE0MDEwNFoXDTI0MTIzMTE0MDEwNFowLTEQMA4GA1UEChMHUGVsaWNh
+bjEZMBcGA1UEAxMQdGVzdC5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49
+AwEHA0IABNbj9g9EVTKDsvgs/qoVxJ6beSnq/FLJA7lu56XdcevN2CPnRf48jHIc
+VadComl88NnSmH4LKWWQx2CLZxAW0DOjfTB7MA4GA1UdDwEB/wQEAwIHgDAdBgNV
+HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAfBgNVHSME
+GDAWgBSiCQ8T/sWWELavXSKuwGoGumFWNTAbBgNVHREEFDASghB0ZXN0LmV4YW1w
+bGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIF/x2d8Dt9mYjLvD7+pxJlbGQ3oHmsFH
+CzW/jqZZcmZBAiEAy8k1VcQ01ir6KW0Sna8CBoK7Rdfe7wCKp5+/zY7oSQY=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgz0a/I/I7IRmZlFgP
+/Hngi/gC8kDpAyc9gjpEQDhfUGehRANCAATW4/YPRFUyg7L4LP6qFcSem3kp6vxS
+yQO5buel3XHrzdgj50X+PIxyHFWnQqJpfPDZ0ph+CyllkMdgi2cQFtAz
+-----END PRIVATE KEY-----
+EOF
+chmod 0400 /tmp/xrootd/certs.pem
+
+cat > /tmp/xrootd/ca-bundle.pem << EOF
+-----BEGIN CERTIFICATE-----
+MIIBvzCCAWSgAwIBAgIRAOLJb0myOC4dRnv/7ZiqiGgwCgYIKoZIzj0EAwIwMDET
+MBEGA1UEChMKUGVsaWNhbiBDQTEZMBcGA1UEAxMQdGVzdC5leGFtcGxlLmNvbTAe
+Fw0yNDAxMDExNDAxMDRaFw0zNDAxMDExNDAxMDRaMDAxEzARBgNVBAoTClBlbGlj
+YW4gQ0ExGTAXBgNVBAMTEHRlc3QuZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggq
+hkjOPQMBBwNCAATcOtoEPPDnaAZt+bpfgxilZpay+3Ti/Pnfh4GcLguBhBnuloax
+CBaoX+C3Tj/fs+xnvPNJf67f+VM6RbYafmjNo18wXTAOBgNVHQ8BAf8EBAMCAoQw
+DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUogkPE/7FlhC2r10irsBqBrphVjUw
+GwYDVR0RBBQwEoIQdGVzdC5leGFtcGxlLmNvbTAKBggqhkjOPQQDAgNJADBGAiEA
+9G2gM3d48qjQkqt7WsOky/1Vds7ekL9Qjcwy/y3UHPACIQC+A+4nO8Nrz2l8EolM
+3OotNbcykY7qePWgk5In2raHMg==
+-----END CERTIFICATE-----
+EOF
+
+touch /tmp/xrootd/authfile
+cat > /tmp/xrootd/scitokens.cfg << EOF
+[Global]
+audience = https://localhost:8443
+
+[Issuer DEMO]
+
+issuer = https://demo.scitokens.org
+base_path = /demo
+default_user = test1234
+EOF
+
+cat > test.cfg << EOF
+all.role server
+if exec xrootd
+  xrd.port 8443
+  xrd.protocol http:8443 libXrdHttp.so
+fi
+
+# For now, disable these
+xrd.tls /tmp/xrootd/certs.pem
+xrd.tlsca certfile /tmp/xrootd/ca-bundle.pem
+
+http.listingdeny true
+http.header2cgi Authorization authz
+
+all.sitename test_host
+
+xrootd.monitor all auth flush 30s window 5s fstat 60 lfn ops xfr 5  dest redir fstat info files user pfc tcpmon ccm 127.0.0.1:9931
+all.adminpath /tmp/xrootd
+all.pidpath /tmp/xrootd
+ofs.osslib libXrdS3.so
+
+# The S3 plugin doesn't currently support async mode
+xrootd.async off
+
+s3.region test-region
+s3.service_name test-name
+s3.service_url http://localhost:9000
+xrootd.seclib libXrdSec.so
+sec.protocol ztn
+ofs.authorize 1
+acc.audit deny grant
+acc.authdb /tmp/xrootd/authfile
+ofs.authlib ++ libXrdAccSciTokens.so config=/tmp/xrootd/scitokens.cfg
+all.export /test-name/test-region/test-bucket
+xrootd.chksum max 2 md5 adler32 crc32
+xrootd.trace emsg login stall redirect
+scitokens.trace all
+EOF
+
+set +ex
+ifconfig
+hostname
+xrootd -c test.cfg &
+oldproc=$!
+
+(sleep 2; kill $oldproc) &
+wait $oldproc
+if [ $? -eq 143 ]; then # Indicates the xrootd process lived until it was killed.
+  exit 0
+else
+  echo "Launched xrootd process failed."
+  exit 1
+fi
diff --git a/go.mod b/go.mod
index e42a0e23e..f5885281a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,45 +1,59 @@
 module github.com/pelicanplatform/pelican
 
+// Unpublish Go package as we are not intended to allow users us import our packages for now
+retract [v1.0.0, v1.0.5]
+
 go 1.20
 
 require (
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137
-	github.com/cavaliercoder/grab v2.0.0+incompatible
 	github.com/gin-gonic/gin v1.9.1
-	github.com/go-kit/kit v0.12.0
+	github.com/go-ini/ini v1.67.0
 	github.com/go-kit/log v0.2.1
 	github.com/golang-jwt/jwt v3.2.2+incompatible
+	github.com/gorilla/csrf v1.7.2
 	github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd
-	github.com/jellydator/ttlcache/v3 v3.0.1
+	github.com/gwatts/gin-adapter v1.0.0
+	github.com/hashicorp/go-version v1.6.0
+	github.com/jellydator/ttlcache/v3 v3.1.0
 	github.com/jsipprell/keyctl v1.0.4-0.20211208153515-36ca02672b6c
-	github.com/lestrrat-go/jwx/v2 v2.0.11
+	github.com/lestrrat-go/httprc v1.0.4
+	github.com/lestrrat-go/jwx/v2 v2.0.16
+	github.com/minio/minio-go/v7 v7.0.65
 	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f
 	github.com/oklog/run v1.1.0
+	github.com/opensaucerer/grab/v3 v3.0.1
 	github.com/oschwald/geoip2-golang v1.9.0
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.16.0
 	github.com/prometheus/common v0.44.0
 	github.com/prometheus/prometheus v0.46.0
-	github.com/sirupsen/logrus v1.8.1
+	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.16.0
 	github.com/stretchr/testify v1.8.4
 	github.com/studio-b12/gowebdav v0.9.0
 	github.com/tg123/go-htpasswd v1.2.1
-	github.com/vbauerster/mpb/v7 v7.5.3
+	github.com/vbauerster/mpb/v8 v8.6.1
 	github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a
 	github.com/zsais/go-gin-prometheus v0.1.0
 	go.uber.org/atomic v1.11.0
-	golang.org/x/crypto v0.11.0
-	golang.org/x/net v0.12.0
-	golang.org/x/oauth2 v0.10.0
-	golang.org/x/term v0.10.0
+	golang.org/x/crypto v0.15.0
+	golang.org/x/net v0.18.0
+	golang.org/x/oauth2 v0.14.0
+	golang.org/x/term v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
 	kernel.org/pub/linux/libs/security/libcap/cap v1.2.69
 	modernc.org/sqlite v1.25.0
 )
 
+require (
+	github.com/gorilla/context v1.1.1 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gorilla/sessions v1.2.1 // indirect
+)
+
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 // indirect
@@ -61,8 +75,9 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/edsrzf/mmap-go v1.1.0 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/fsnotify/fsnotify v1.6.0
 	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gin-contrib/sessions v0.0.5
 	github.com/gin-contrib/sse v0.1.0 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.2.4 // indirect
@@ -78,7 +93,7 @@ require (
 	github.com/go-openapi/validate v0.22.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.14.0 // indirect
+	github.com/go-playground/validator/v10 v10.16.0
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
@@ -94,20 +109,20 @@ require (
 	github.com/julienschmidt/httprouter v1.3.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/klauspost/compress v1.16.7 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/leodido/go-urn v1.2.4 // indirect
-	github.com/lestrrat-go/blackmagic v1.0.1 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
-	github.com/lestrrat-go/httprc v1.0.4 // indirect
 	github.com/lestrrat-go/iter v1.0.2 // indirect
 	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
-	github.com/mattn/go-sqlite3 v1.14.17 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
@@ -124,7 +139,8 @@ require (
 	github.com/prometheus/exporter-toolkit v0.10.0 // indirect
 	github.com/prometheus/procfs v0.11.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rs/xid v1.5.0 // indirect
 	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
 	github.com/spf13/afero v1.9.5 // indirect
@@ -134,17 +150,17 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
 	go.mongodb.org/mongo-driver v1.12.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.42.0 // indirect
-	go.opentelemetry.io/otel v1.16.0 // indirect
-	go.opentelemetry.io/otel/metric v1.16.0 // indirect
-	go.opentelemetry.io/otel/trace v1.16.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 // indirect
+	go.opentelemetry.io/otel v1.18.0 // indirect
+	go.opentelemetry.io/otel/metric v1.18.0 // indirect
+	go.opentelemetry.io/otel/trace v1.18.0 // indirect
 	go.uber.org/goleak v1.2.1 // indirect
 	golang.org/x/arch v0.3.0 // indirect
 	golang.org/x/exp v0.0.0-20230713183714-613f0c0eb8a1 // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.10.0 // indirect
-	golang.org/x/text v0.11.0 // indirect
+	golang.org/x/sync v0.3.0
+	golang.org/x/sys v0.14.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.11.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
diff --git a/go.sum b/go.sum
index 5d926b5ce..5fd739c8b 100644
--- a/go.sum
+++ b/go.sum
@@ -85,8 +85,6 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
 github.com/bytedance/sonic v1.9.1 h1:6iJ6NqdoxCDr6mbY8h18oSO+cShGSMRGCEo7F2h0x8s=
 github.com/bytedance/sonic v1.9.1/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
-github.com/cavaliercoder/grab v2.0.0+incompatible h1:wZHbBQx56+Yxjx2TCGDcenhh3cJn7cCLMfkEPmySTSE=
-github.com/cavaliercoder/grab v2.0.0+incompatible/go.mod h1:tTBkfNqSBfuMmMBFaO2phgyhdYhiZQ/+iXCZDzcDsMI=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
@@ -142,6 +140,8 @@ github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
 github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gin-contrib/sessions v0.0.5 h1:CATtfHmLMQrMNpJRgzjWXD7worTh7g7ritsQfmF+0jE=
+github.com/gin-contrib/sessions v0.0.5/go.mod h1:vYAuaUPqie3WUSsft6HUlCjlwwoJQs97miaG2+7neKY=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
@@ -149,10 +149,10 @@ github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SU
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.12.0 h1:e4o3o3IsBfAKQh5Qbbiqyfu97Ku7jrO/JbohvztANh4=
-github.com/go-kit/kit v0.12.0/go.mod h1:lHd+EkCZPIwYItmGDDRdhinkzX2A1sj+M9biaEaizzs=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
 github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
@@ -208,8 +208,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
-github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
+github.com/go-playground/validator/v10 v10.16.0 h1:x+plE831WK4vaKHO/jpgUGsvLKIqRRkz6M78GuJAfGE=
+github.com/go-playground/validator/v10 v10.16.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-resty/resty/v2 v2.7.0 h1:me+K9p3uhSmXtrBZ4k9jcEAfJmuC8IivWHwaLZwPrFY=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-zookeeper/zk v1.0.3 h1:7M2kwOsc//9VeeFiPtf+uSJlVpU66x9Ba5+8XK7/TDg=
@@ -318,9 +318,24 @@ github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gophercloud/gophercloud v1.5.0 h1:cDN6XFCLKiiqvYpjQLq9AiM7RDRbIC9450WpPH+yvXo=
+github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
+github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/csrf v1.7.2 h1:oTUjx0vyf2T+wkrx09Trsev1TE+/EbDAeHtSTbtC2eI=
+github.com/gorilla/csrf v1.7.2/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/gorilla/csrf v1.7.2 h1:oTUjx0vyf2T+wkrx09Trsev1TE+/EbDAeHtSTbtC2eI=
+github.com/gorilla/csrf v1.7.2/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd h1:PpuIBO5P3e9hpqBD0O/HjhShYuM6XE0i/lbE6J94kww=
 github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A=
+github.com/gwatts/gin-adapter v1.0.0 h1:TsmmhYTR79/RMTsfYJ2IQvI1F5KZ3ZFJxuQSYEOpyIA=
+github.com/gwatts/gin-adapter v1.0.0/go.mod h1:44AEV+938HsS0mjfXtBDCUZS9vONlF2gwvh8wu4sRYc=
 github.com/hashicorp/consul/api v1.22.0 h1:ydEvDooB/A0c/xpsBd8GSt7P2/zYPBui4KrNip0xGjE=
 github.com/hashicorp/cronexpr v1.1.2 h1:wG/ZYIKT+RT3QkOdgYc+xsKWVRgnxJ1OJtjjy84fJ9A=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
@@ -330,6 +345,8 @@ github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJ
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-retryablehttp v0.7.4 h1:ZQgVdpTdAL7WpMIwLzCfbalOcSUdkDZnpUv3/+BxzFA=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
+github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
@@ -345,8 +362,8 @@ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANyt
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ionos-cloud/sdk-go/v6 v6.1.8 h1:493wE/BkZxJf7x79UCE0cYGPZoqQcPiEBALvt7uVGY0=
-github.com/jellydator/ttlcache/v3 v3.0.1 h1:cHgCSMS7TdQcoprXnWUptJZzyFsqs18Lt8VVhRuZYVU=
-github.com/jellydator/ttlcache/v3 v3.0.1/go.mod h1:WwTaEmcXQ3MTjOm4bsZoDFiCu/hMvNWLO1w67RXz6h4=
+github.com/jellydator/ttlcache/v3 v3.1.0 h1:0gPFG0IHHP6xyUyXq+JaD8fwkDCqgqwohXNJBcYE71g=
+github.com/jellydator/ttlcache/v3 v3.1.0/go.mod h1:hi7MGFdMAwZna5n2tuvh63DvFLzVKySzCVW6+0gA2n4=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
@@ -377,9 +394,10 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
 github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.4 h1:acbojRNwl3o09bUq+yDCtZFc1aiwaAAxtcn8YkZXnvk=
-github.com/klauspost/cpuid/v2 v2.2.4/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
+github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
+github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b h1:udzkj9S/zlT5X367kqJis0QP7YMxobob6zhzq6Yre00=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -397,16 +415,16 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
 github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
-github.com/lestrrat-go/blackmagic v1.0.1 h1:lS5Zts+5HIC/8og6cGHb0uCcNCa3OUt1ygh3Qz2Fe80=
-github.com/lestrrat-go/blackmagic v1.0.1/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
+github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
+github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
 github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJGdI8=
 github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
 github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
 github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
-github.com/lestrrat-go/jwx/v2 v2.0.11 h1:ViHMnaMeaO0qV16RZWBHM7GTrAnX2aFLVKofc7FuKLQ=
-github.com/lestrrat-go/jwx/v2 v2.0.11/go.mod h1:ZtPtMFlrfDrH2Y0iwfa3dRFn8VzwBrB+cyrm3IBWdDg=
+github.com/lestrrat-go/jwx/v2 v2.0.16 h1:TuH3dBkYTy2giQg/9D8f20znS3JtMRuQJ372boS3lWk=
+github.com/lestrrat-go/jwx/v2 v2.0.16/go.mod h1:jBHyESp4e7QxfERM0UKkQ80/94paqNIEcdEfiUYz5zE=
 github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
@@ -423,14 +441,19 @@ github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kN
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
-github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
-github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-sqlite3 v2.0.3+incompatible h1:gXHsfypPkaMZrKbD5209QV9jbUTJKjyR5WD3HYQSd+U=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
+github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
+github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
+github.com/minio/minio-go/v7 v7.0.65 h1:sOlB8T3nQK+TApTpuN3k4WD5KasvZIE3vVFzyyCa0go=
+github.com/minio/minio-go/v7 v7.0.65/go.mod h1:R4WVUR6ZTedlCcGwZRauLMIKjgyaWxhs4Mqi/OMPmEc=
+github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
+github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -456,6 +479,8 @@ github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
+github.com/opensaucerer/grab/v3 v3.0.1 h1:R4hEPWME8qocdGo5v/qHaNN9ArK5Eebt3KRFUwFPnyQ=
+github.com/opensaucerer/grab/v3 v3.0.1/go.mod h1:3smI0bkz/Uewv4a4euAxk/xMt/fpyees39X3dpStq+Y=
 github.com/oschwald/geoip2-golang v1.9.0 h1:uvD3O6fXAXs+usU+UGExshpdP13GAqp4GBrzN7IgKZc=
 github.com/oschwald/geoip2-golang v1.9.0/go.mod h1:BHK6TvDyATVQhKNbQBdrj9eAvuwOMi2zSFXizL3K81Y=
 github.com/oschwald/maxminddb-golang v1.11.0 h1:aSXMqYR/EPNjGE8epgqwDay+P30hCBZIveY0WZbAWh0=
@@ -511,12 +536,15 @@ github.com/prometheus/prometheus v0.46.0/go.mod h1:10L5IJE5CEsjee1FnOcVswYXlPIsc
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/scaleway/scaleway-sdk-go v1.0.0-beta.19 h1:+1H+N9QFl2Sfvia0FBYfMrHYHYhmpZxhSE0wpPL2lYs=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
@@ -528,8 +556,8 @@ github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
 github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
 github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
@@ -573,8 +601,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
-github.com/vbauerster/mpb/v7 v7.5.3 h1:BkGfmb6nMrrBQDFECR/Q7RkKCw7ylMetCb4079CGs4w=
-github.com/vbauerster/mpb/v7 v7.5.3/go.mod h1:i+h4QY6lmLvBNK2ah1fSreiw3ajskRlBp9AhY/PnuOE=
+github.com/vbauerster/mpb/v8 v8.6.1 h1:XbBpIbJxJOO9yMcKPpI4oEFPW6tLAptefNQJNcGWri8=
+github.com/vbauerster/mpb/v8 v8.6.1/go.mod h1:S0tuIjikxlLxCeNijNhwAuD/BB3UE/d2nygG8SOldk0=
 github.com/vultr/govultr/v2 v2.17.2 h1:gej/rwr91Puc/tgh+j33p/BLR16UrIPnSr+AIwYWZQs=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
@@ -604,14 +632,14 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.42.0 h1:pginetY7+onl4qN1vl0xW/V/v6OBZ0vVdH+esuJgvmM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.42.0/go.mod h1:XiYsayHc36K3EByOO6nbAXnAWbrUxdjUROCEeeROOH8=
-go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
-go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
-go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
-go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
-go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
-go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 h1:KfYpVmrjI7JuToy5k8XV3nkapjWx48k4E4JOtVstzQI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0/go.mod h1:SeQhzAEccGVZVEy7aH87Nh0km+utSpo1pTv6eMMop48=
+go.opentelemetry.io/otel v1.18.0 h1:TgVozPGZ01nHyDZxK5WGPFB9QexeTMXEH7+tIClWfzs=
+go.opentelemetry.io/otel v1.18.0/go.mod h1:9lWqYO0Db579XzVuCKFNPDl4s73Voa+zEck3wHaAYQI=
+go.opentelemetry.io/otel/metric v1.18.0 h1:JwVzw94UYmbx3ej++CwLUQZxEODDj/pOuTCvzhtRrSQ=
+go.opentelemetry.io/otel/metric v1.18.0/go.mod h1:nNSpsVDjWGfb7chbRLUNW+PBNdcSTHD4Uu5pfFMOI0k=
+go.opentelemetry.io/otel/trace v1.18.0 h1:NY+czwbHbmndxojTEKiSMHkG2ClNH2PwmcHrdo0JY10=
+go.opentelemetry.io/otel/trace v1.18.0/go.mod h1:T2+SGJGuYZY3bjj5rgh/hN7KIrlpWC5nS8Mjvzckz+0=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
@@ -631,9 +659,9 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
-golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
+golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -714,8 +742,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
-golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
+golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -726,8 +754,8 @@ golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.14.0 h1:P0Vrf/2538nmC0H+pEQ3MNFRRnVR7RlqyVw+bvm26z0=
+golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -760,7 +788,6 @@ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -795,23 +822,24 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220909162455-aba9fc2a8ff2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
+golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
-golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
+golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -825,8 +853,9 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
-golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
diff --git a/images/Dockerfile b/images/Dockerfile
index 35b4501a1..afd59962e 100644
--- a/images/Dockerfile
+++ b/images/Dockerfile
@@ -16,15 +16,16 @@
 
 ARG BASE_YUM_REPO=release
 ARG BASE_OSG_SERIES=3.6
+ARG IS_PR_BUILD=true
 
-FROM node:18 AS website-build
+FROM node:20 AS website-build
 
 WORKDIR /webapp
 
-COPY origin_ui/src/package.json package.json
+COPY web_ui/frontend/package.json package.json
 
 RUN npm install
-COPY origin_ui/src ./
+COPY web_ui/frontend ./
 
 RUN npm run build
 
@@ -33,11 +34,17 @@ FROM goreleaser/goreleaser:v1.20.0 AS pelican-build
 WORKDIR /pelican
 
 COPY . .
-COPY --from=website-build /webapp/out ./origin_ui/src/out
+COPY --from=website-build /webapp/out ./web_ui/frontend/out
 
-RUN goreleaser --clean --snapshot
+RUN\
+    if ["${IS_PR_BUILD}" == "false"];\
+        then goreleaser build --clean;\
+    else goreleaser build --clean --snapshot;\
+    fi
 
-FROM --platform=linux/amd64 opensciencegrid/software-base:$BASE_OSG_SERIES-el8-$BASE_YUM_REPO
+FROM --platform=linux/amd64 hub.opensciencegrid.org/sciauth/scitokens-oauth2-server:release-20231118-1823 AS scitokens-oauth2-server
+
+FROM --platform=linux/amd64 opensciencegrid/software-base:$BASE_OSG_SERIES-el8-$BASE_YUM_REPO AS dependency-build
 
 # Create the xrootd user with a fixed GID/UID
 RUN groupadd -o -g 10940 xrootd
@@ -45,10 +52,34 @@ RUN useradd -o -u 10940 -g 10940 -s /bin/sh xrootd
 
 # Install dependencies
 RUN yum -y update \
-    && yum -y install xrootd xrootd-client xrootd-server \
+    && yum -y install xrootd xrootd-client xrdcl-http xrootd-server xrootd-scitokens xrootd-voms curl java-17-openjdk-headless \
     && yum clean all \
     && rm -rf /var/cache/yum/
 
+####
+# Start building xrootd plugins (xrdcl-pelican and s3)
+####
+FROM dependency-build AS xrootd-plugin-builder
+# Install necessary build dependencies
+RUN  yum install -y xrootd-devel xrootd-server-devel xrootd-client-devel curl-devel openssl-devel git cmake3 gcc-c++
+# Install xrdcl-pelican plugin and replace the xrdcl-http plugin
+RUN \
+    git clone https://github.com/PelicanPlatform/xrdcl-pelican.git && \
+    cd xrdcl-pelican && \
+    mkdir build && cd build && \
+    cmake -DLIB_INSTALL_DIR=/usr/lib64 .. && \
+    make && make install
+# Install the S3 and HTTP server plugins for XRootD. For now we do this from source
+# until we can sort out the RPMs.
+RUN \
+    git clone https://github.com/PelicanPlatform/xrootd-s3-http.git && \
+    cd xrootd-s3-http && \
+    mkdir build && cd build && \
+    cmake -DLIB_INSTALL_DIR=/usr/lib64 .. && \
+    make install
+
+FROM dependency-build AS final-stage
+
 WORKDIR /pelican
 
 # Copy over needed files
@@ -60,6 +91,72 @@ COPY images/supervisord/supervisord.conf /etc/supervisord.conf
 COPY images/supervisord/* /etc/supervisord.d/
 COPY images/entrypoint.sh /entrypoint.sh
 
+
+####
+# Now, start installing the SciTokens OA4MP server from
+# - https://github.com/scitokens/scitokens-oauth2-server/blob/master/Dockerfile
+####
+
+# Download and install tomcat
+RUN useradd -r -s /sbin/nologin tomcat ;\
+    mkdir -p /opt/tomcat ;\
+    curl -s -L https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.80/bin/apache-tomcat-9.0.80.tar.gz | tar -zxf - -C /opt/tomcat --strip-components=1 ;\
+    chgrp -R tomcat /opt/tomcat/conf ;\
+    chmod g+rwx /opt/tomcat/conf ;\
+    chmod g+r /opt/tomcat/conf/* ;\
+    chown -R tomcat /opt/tomcat/logs/ /opt/tomcat/temp/ /opt/tomcat/webapps/ /opt/tomcat/work/ ;\
+    chgrp -R tomcat /opt/tomcat/bin /opt/tomcat/lib ;\
+    chmod g+rwx /opt/tomcat/bin ;\
+    chmod g+r /opt/tomcat/bin/* ;\
+    ln -s /usr/lib64/libapr-1.so.0 /opt/tomcat/lib/libapr-1.so.0
+
+RUN \
+    # Create various empty directories needed by the webapp
+    mkdir -p /opt/tomcat/webapps/scitokens-server ;\
+    curl -s -L https://github.com/javaee/javamail/releases/download/JAVAMAIL-1_6_2/javax.mail.jar > /opt/tomcat/lib/javax.mail.jar ;\
+    # Install support for the QDL CLI
+    curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.3.1/oa2-qdl-installer.jar >/tmp/oa2-qdl-installer.jar ;\
+    java -jar /tmp/oa2-qdl-installer.jar -dir /opt/qdl ;\
+    rm /tmp/oa2-qdl-installer.jar ;\
+    mkdir -p /opt/qdl/var/scripts ;\
+    # Remove the default manager apps and examples -- we don't use these
+    rm -rf /opt/tomcat/webapps/ROOT /opt/tomcat/webapps/docs /opt/tomcat/webapps/examples /opt/tomcat/webapps/host-manager /opt/tomcat/webapps/manager ;\
+    true;
+
+# The generate_jwk.sh script is part of the documented bootstrap of the container.
+COPY --from=scitokens-oauth2-server /usr/local/bin/generate_jwk.sh /usr/local/bin/generate_jwk.sh
+
+# Add other QDL CLI tools and configs
+COPY --from=scitokens-oauth2-server /opt/qdl /opt/qdl
+
+# Add in the tomcat server configuration
+COPY --chown=root:tomcat oa4mp/resources/server.xml /opt/tomcat/conf/server.xml
+
+# Copy over the OA4MP webapp.
+COPY --from=scitokens-oauth2-server --chown=tomcat:tomcat /opt/tomcat/webapps/scitokens-server/ /opt/tomcat/webapps/scitokens-server/
+COPY --from=scitokens-oauth2-server --chown=tomcat:tomcat /opt/scitokens-server/ /opt/scitokens-server/
+
+# The security constraint line forces a redirect to HTTPS (which we aren't using)
+RUN sed 's/<security-constraint>/<!--&/; s/\/security-constraint>/&-->/;' /opt/scitokens-server/web.xml > /opt/tomcat/webapps/scitokens-server/WEB-INF/web.xml
+
+ENV JAVA_HOME=/usr/lib/jvm/jre \
+    CATALINA_PID=/opt/tomcat/temp/tomcat.pid \
+    CATALINA_HOME=/opt/tomcat \
+    CATALINA_BASE=/opt/tomcat \
+    CATALINA_OPTS="-Xms512M -Xmx1024M -server -XX:+UseParallelGC" \
+    JAVA_OPTS="-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -Djava.library.path=/opt/tomcat/lib" \
+    ST_HOME="/opt/scitokens-server" \
+    QDL_HOME="/opt/qdl" \
+    PATH="${ST_HOME}/bin:${QDL_HOME}/bin:${PATH}"
+
+# Copy xrdcl-pelican plugin config
+COPY --from=xrootd-plugin-builder /usr/local/etc/xrootd/client.plugins.d/pelican-plugin.conf /etc/xrootd/client.plugins.d/pelican-plugin.conf
+# Remove http plugin to use pelican plugin
+RUN rm -f /etc/xrootd/client.plugins.d/xrdcl-http-plugin.conf
+
+# Copy built s3 plugin library and xrdcl-pelican plugin library from build
+COPY --from=xrootd-plugin-builder /usr/lib64/libXrdS3-5.so /usr/lib64/libXrdHTTPServer-5.so /usr/lib64/libXrdClPelican-5.so /usr/lib64
+
 RUN chmod +x /pelican/osdf-client \
     && chmod +x /entrypoint.sh
 
diff --git a/images/dev-config.yaml b/images/dev-config.yaml
new file mode 100644
index 000000000..789b78b9f
--- /dev/null
+++ b/images/dev-config.yaml
@@ -0,0 +1,2 @@
+OriginUrl: https://localhost:8444
+TLSSkipVerify: true
diff --git a/images/dev-container-entrypoint.sh b/images/dev-container-entrypoint.sh
new file mode 100755
index 000000000..8fa8b709f
--- /dev/null
+++ b/images/dev-container-entrypoint.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# Run pre-commit install
+pre-commit install
+
+# Start an interactive bash shell
+exec "/bin/bash" -i
diff --git a/images/dev.Dockerfile b/images/dev.Dockerfile
new file mode 100644
index 000000000..9ce40d779
--- /dev/null
+++ b/images/dev.Dockerfile
@@ -0,0 +1,154 @@
+
+# We specify the platform as scitokens-oauth2-server didn't publish arm version and we don't want to
+# fail on building this container on arm machine
+FROM --platform=linux/amd64 hub.opensciencegrid.org/sciauth/scitokens-oauth2-server:release-20231118-1823 AS scitokens-oauth2-server
+
+FROM almalinux:8
+
+# https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
+ARG TARGETARCH
+
+# Doing it caused bugs, so we're not doing it; More info here: https://pkg.go.dev/cmd/go
+ENV GOFLAGS="-buildvcs=false"
+
+# Create the xrootd user with a fixed GID/UID
+RUN groupadd -o -g 10940 xrootd
+RUN useradd -o -u 10940 -g 10940 -s /bin/sh xrootd
+
+RUN yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
+
+# Get goreleaser
+SHELL ["/bin/bash", "-c"]
+RUN echo $'[goreleaser] \n\
+name=GoReleaser \n\
+baseurl=https://repo.goreleaser.com/yum/ \n\
+enabled=1 \n\
+gpgcheck=0' > /etc/yum.repos.d/goreleaser.repo
+
+# Install goreleaser and various other packages we need
+RUN yum install -y goreleaser npm xrootd-devel xrootd-server-devel xrootd-client-devel nano xrootd-scitokens \
+    xrootd-voms xrdcl-http jq procps docker make curl-devel java-17-openjdk-headless git cmake3 gcc-c++ openssl-devel \
+    && yum clean all
+
+# Install xrdcl-pelican plugin and replace the xrdcl-http plugin
+RUN \
+    git clone https://github.com/PelicanPlatform/xrdcl-pelican.git && \
+    cd xrdcl-pelican && \
+    mkdir build && cd build && \
+    cmake -DLIB_INSTALL_DIR=/usr/lib64 .. && \
+    make && make install
+# Install the S3 and HTTP server plugins for XRootD. For now we do this from source
+# until we can sort out the RPMs.
+RUN \
+    git clone https://github.com/PelicanPlatform/xrootd-s3-http.git && \
+    cd xrootd-s3-http && \
+    mkdir build && cd build && \
+    cmake -DLIB_INSTALL_DIR=/usr/lib64 .. && \
+    make install
+
+# Copy xrdcl-pelican plugin config and remove http plugin to use pelican plugin
+RUN \
+    cp /usr/local/etc/xrootd/client.plugins.d/pelican-plugin.conf /etc/xrootd/client.plugins.d/pelican-plugin.conf && \
+    rm -f /etc/xrootd/client.plugins.d/xrdcl-http-plugin.conf
+
+# Install proper version of nodejs so that make web-build works
+RUN \
+    dnf module reset -y nodejs && \
+    dnf module install -y nodejs:20
+
+# Installing the right version of go
+SHELL ["/bin/sh", "-c"]
+RUN curl https://dl.google.com/go/go1.20.8.linux-$TARGETARCH.tar.gz -o go1.20.8.linux-$TARGETARCH.tar.gz && \
+    rm -rf /usr/local/go && tar -C /usr/local -xzf go1.20.8.linux-$TARGETARCH.tar.gz
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Use npm to install node
+RUN npm install -g n
+ENV PATH="${PATH}:/usr/lib/node_modules/npm/bin"
+
+# Update node lts, upgrade npm, clean up
+RUN n lts && \
+    npm install -g npm@latest && \
+    n prune
+
+##
+# Install and configure Tomcat and the scitokens server
+##
+RUN useradd -r -s /sbin/nologin tomcat ;\
+    mkdir -p /opt/tomcat ;\
+    curl -s -L https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.80/bin/apache-tomcat-9.0.80.tar.gz | tar -zxf - -C /opt/tomcat --strip-components=1 ;\
+    chgrp -R tomcat /opt/tomcat/conf ;\
+    chmod g+rwx /opt/tomcat/conf ;\
+    chmod g+r /opt/tomcat/conf/* ;\
+    chown -R tomcat /opt/tomcat/logs/ /opt/tomcat/temp/ /opt/tomcat/webapps/ /opt/tomcat/work/ ;\
+    chgrp -R tomcat /opt/tomcat/bin /opt/tomcat/lib ;\
+    chmod g+rwx /opt/tomcat/bin ;\
+    chmod g+r /opt/tomcat/bin/* ;\
+    ln -s /usr/lib64/libapr-1.so.0 /opt/tomcat/lib/libapr-1.so.0
+
+RUN \
+    # Create various empty directories needed by the webapp
+    mkdir -p /opt/tomcat/webapps/scitokens-server ;\
+    curl -s -L https://github.com/javaee/javamail/releases/download/JAVAMAIL-1_6_2/javax.mail.jar > /opt/tomcat/lib/javax.mail.jar ;\
+    # Install support for the QDL CLI
+    curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.3.1/oa2-qdl-installer.jar >/tmp/oa2-qdl-installer.jar ;\
+    java -jar /tmp/oa2-qdl-installer.jar -dir /opt/qdl ;\
+    rm /tmp/oa2-qdl-installer.jar ;\
+    mkdir -p /opt/qdl/var/scripts ;\
+    # Remove the default manager apps and examples -- we don't use these
+    rm -rf /opt/tomcat/webapps/ROOT /opt/tomcat/webapps/docs /opt/tomcat/webapps/examples /opt/tomcat/webapps/host-manager /opt/tomcat/webapps/manager ;\
+    true;
+
+# The generate_jwk.sh script is part of the documented bootstrap of the container.
+COPY --from=scitokens-oauth2-server /usr/local/bin/generate_jwk.sh /usr/local/bin/generate_jwk.sh
+
+# Add other QDL CLI tools and configs
+COPY --from=scitokens-oauth2-server /opt/qdl /opt/qdl
+
+# Add in the tomcat server configuration
+COPY --chown=root:tomcat oa4mp/resources/server.xml /opt/tomcat/conf/server.xml
+
+# Copy over the OA4MP webapp.
+COPY --from=scitokens-oauth2-server --chown=tomcat:tomcat /opt/tomcat/webapps/scitokens-server/ /opt/tomcat/webapps/scitokens-server/
+COPY --from=scitokens-oauth2-server --chown=tomcat:tomcat /opt/scitokens-server/ /opt/scitokens-server/
+
+# The security constraint line forces a redirect to HTTPS (which we aren't using)
+RUN sed 's/<security-constraint>/<!--&/; s/\/security-constraint>/&-->/;' /opt/scitokens-server/web.xml > /opt/tomcat/webapps/scitokens-server/WEB-INF/web.xml
+
+#
+
+ENV JAVA_HOME=/usr/lib/jvm/jre \
+    CATALINA_PID=/opt/tomcat/temp/tomcat.pid \
+    CATALINA_HOME=/opt/tomcat \
+    CATALINA_BASE=/opt/tomcat \
+    CATALINA_OPTS="-Xms512M -Xmx1024M -server -XX:+UseParallelGC" \
+    JAVA_OPTS="-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -Djava.library.path=/opt/tomcat/lib" \
+    ST_HOME="/opt/scitokens-server" \
+    QDL_HOME="/opt/qdl" \
+    PATH="${ST_HOME}/bin:${QDL_HOME}/bin:${PATH}"
+
+COPY images/dev-config.yaml /etc/pelican/pelican.yaml
+
+# For S3 tests, we need the minIO server client, so we install based on detected arch
+RUN if [ "$TARGETARCH" = "amd64" ]; then \
+        curl -o minio.rpm https://dl.min.io/server/minio/release/linux-amd64/archive/minio-20231214185157.0.0-1.x86_64.rpm &&\
+        dnf install -y minio.rpm &&\
+        rm -f minio.rpm; \
+    elif [ "$TARGETARCH" = "arm64" ]; then \
+        curl -o minio.rpm https://dl.min.io/server/minio/release/linux-arm64/archive/minio-20231214185157.0.0-1.aarch64.rpm &&\
+        dnf install -y minio.rpm &&\
+        rm -f minio.rpm; \
+    fi
+
+# Install pre-commit
+RUN yum install -y python39 &&\
+    /bin/pip-3.9 install pre-commit
+
+COPY ./images/dev-container-entrypoint.sh /usr/local/bin/
+
+WORKDIR /app
+
+ENTRYPOINT ["dev-container-entrypoint.sh"]
+
+# Build with `docker build -t pelican-dev -f images/dev.Dockerfile .`
+# Run from repo root with `docker run -it -p 8444:8444 -v $PWD:/app  pelican-dev`
diff --git a/images/entrypoint.sh b/images/entrypoint.sh
index 7baf81e84..5805eb95e 100644
--- a/images/entrypoint.sh
+++ b/images/entrypoint.sh
@@ -1,13 +1,13 @@
 #!/bin/bash
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -17,6 +17,85 @@
 
 supervisord -c /etc/supervisord.conf
 
+####
+# Setup the OA4MP configuration.  Items are taken from https://github.com/scitokens/scitokens-oauth2-server/blob/master/start.sh
+# which appears to have an Apache 2.0 license.
+####
+
+# Set the hostname
+sed s+\{HOSTNAME\}+$HOSTNAME+g /opt/scitokens-server/etc/server-config.xml.tmpl > /opt/scitokens-server/etc/server-config.xml
+chgrp tomcat /opt/scitokens-server/etc/server-config.xml
+
+# Set the path in case the bash profile reset it from the container default.
+export PATH="${ST_HOME}/bin:${QDL_HOME}/bin:${PATH}"
+
+# Run the boot to inject the template
+${QDL_HOME}/var/scripts/boot.qdl
+
+# check for one or more files in a directory
+if [ -e /opt/scitokens-server/etc/qdl/ ]; then
+    # Note that `-L` is added here; this is because Kubernetes sets up some volume mounts
+    # as symlinks and `-r` will copy the symlinks (which then becomes broken).  `-L` will
+    # dereference the symlink and copy the data, which is what we want.
+    cp -rL /opt/scitokens-server/etc/qdl/*.qdl /opt/scitokens-server/var/qdl/scitokens/
+    chown -R tomcat /opt/scitokens-server/var/qdl/
+fi
+
+# Load up additional trust roots.  If OA4MP needs to contact a LDAP server, we will need
+# the CA that signed the LDAP server's certificate to be in the java trust store.
+if [ -e /opt/scitokens-server/etc/trusted-cas ]; then
+
+    shopt -s nullglob
+    for fullfile in /opt/scitokens-server/etc/trusted-cas/*.pem; do
+        echo "Importing CA certificate $fullfile into the Java trusted CA store."
+        aliasname=$(basename "$file")
+        aliasname="${filename%.*}"
+        keytool -cacerts -importcert -noprompt -storepass changeit -file "$fullfile" -alias "$aliasname"
+    done
+    shopt -u nullglob
+
+fi
+
+######
+###   OA4MP parking lot: these items need to be migrated to be generated by the `pelican origin serve` command
+######
+
+## Set the hostname and OIDC configuraiton in the proxy-config
+# sed s+\{HOSTNAME\}+$HOSTNAME+g /opt/scitokens-server/etc/proxy-config.xml.tmpl | \
+# sed s+\{CLIENT_ID\}+$CLIENT_ID+g | \
+# sed s+\{CLIENT_SECRET\}+$CLIENT_SECRET+g > /opt/scitokens-server/etc/proxy-config.xml
+# chgrp tomcat /opt/scitokens-server/etc/proxy-config.xml
+
+# Check for the JWKS key in the right location
+#if [ ! -e /opt/scitokens-server/etc/keys.jwk ]; then
+#    echo "Please provide a JWKS key in the file /opt/scitokens-server/etc/keys.jwk.  Please generate it with the following command:"
+#    echo "sudo docker run --rm  hub.opensciencegrid.org/sciauth/lightweight-token-issuer generate_jwk.sh > keys.jwk"
+#    echo "And volume mount the keys.jwk to /opt/scitokens-server/etc/keys.jwk within the container."
+#    exit 1
+#fi
+
+#####
+##### End OA4MP parking lot
+#####
+
+# Tomcat requires us to provide the intermediate chain (which, in Kubernetes, is often in the same
+# file as the host certificate itself.  If there wasn't one provided, try splitting it out.
+if [ ! -e /opt/tomcat/conf/chain.pem ]; then
+    echo "No chain present for host cert; trying to derive one"
+    pushd /tmp > /dev/null
+    if csplit -f tls- -b "%02d.crt.pem" -s -z "/opt/tomcat/conf/hostcert.pem" '/-----BEGIN CERTIFICATE-----/' '{1}' 2>/dev/null ; then
+        echo "Chain present in hostcert.pem; using it."
+        cp /tmp/tls-01.crt.pem /opt/tomcat/conf/chain.pem
+        rm /tmp/tls-*.crt.pem
+    else
+        echo "No chain present; will use empty file"
+        # No intermediate CAs found.  Create an empty file.
+        touch /opt/tomcat/conf/chain.pem
+    fi
+    popd > /dev/null
+fi
+
+
 # grab whatever arg is passed to container run command
 # and use it to launch the corresponding pelican_X daemon
 # (eg running the container with the arg director_serve will
@@ -28,5 +107,3 @@ if [ "$1" ]; then
 else
   echo "A command must be provided"
 fi
-
-
diff --git a/images/supervisord/pelican_cache_serve.conf b/images/supervisord/pelican_cache_serve.conf
new file mode 100644
index 000000000..b74cbcc93
--- /dev/null
+++ b/images/supervisord/pelican_cache_serve.conf
@@ -0,0 +1,28 @@
+
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+[program:pelican_cache_serve]
+command=/pelican/osdf-client cache serve %(ENV_OSDF_CACHE_ARGS)s
+autostart=false
+autorestart=true
+redirect_stderr=true
+# We can run the cache with all args configured via our pelican.yaml
+# or via individual environment variables, so this environment variable
+# need not be populated. However, if we don't give it at least an empty
+# var, supervisord won't expand it and there will be an error. Set the
+# default to empty.
+environment=OSDF_CACHE_ARGS=""
diff --git a/images/supervisord/pelican_director_serve.conf b/images/supervisord/pelican_director_serve.conf
index 82bacc140..c3d77f557 100644
--- a/images/supervisord/pelican_director_serve.conf
+++ b/images/supervisord/pelican_director_serve.conf
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -15,7 +15,7 @@
 #
 
 [program:pelican_director_serve]
-command=/pelican/osdf-client director serve -p %(ENV_OSDF_DIRECTOR_PORT)s 
+command=/pelican/osdf-client director serve -p %(ENV_OSDF_DIRECTOR_PORT)s
 autostart=false
 autorestart=true
 redirect_stderr=true
diff --git a/images/supervisord/pelican_origin_serve.conf b/images/supervisord/pelican_origin_serve.conf
new file mode 100644
index 000000000..39285249a
--- /dev/null
+++ b/images/supervisord/pelican_origin_serve.conf
@@ -0,0 +1,27 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+[program:pelican_origin_serve]
+command=/pelican/osdf-client origin serve %(ENV_OSDF_ORIGIN_ARGS)s
+autostart=false
+autorestart=true
+redirect_stderr=true
+# We can run the origin with all args configured via our pelican.yaml
+# or via individual environment variables, so this environment variable
+# need not be populated. However, if we don't give it at least an empty
+# var, supervisord won't expand it and there will be an error. Set the
+# default to empty.
+environment=OSDF_ORIGIN_ARGS=""
diff --git a/images/supervisord/pelican_registry_serve.conf b/images/supervisord/pelican_registry_serve.conf
index ddea9e634..cdf3259d5 100644
--- a/images/supervisord/pelican_registry_serve.conf
+++ b/images/supervisord/pelican_registry_serve.conf
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -15,7 +15,7 @@
 #
 
 [program:pelican_registry_serve]
-command=/pelican/osdf-client registry serve -p %(ENV_OSDF_REGISTRY_PORT)s 
+command=/pelican/osdf-client registry serve -p %(ENV_OSDF_REGISTRY_PORT)s
 autostart=false
 autorestart=true
 redirect_stderr=true
diff --git a/images/supervisord/supervisord.conf b/images/supervisord/supervisord.conf
index 8e3dbab6b..c908f05af 100644
--- a/images/supervisord/supervisord.conf
+++ b/images/supervisord/supervisord.conf
@@ -1,12 +1,12 @@
 #
 # Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License"); you
 # may not use this file except in compliance with the License.  You may
 # obtain a copy of the License at
-# 
+#
 #    http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -31,4 +31,3 @@ loglevel=debug
 
 [include]
 files=/etc/supervisord.d/*.conf
-
diff --git a/launchers/director_serve.go b/launchers/director_serve.go
new file mode 100644
index 000000000..732e1e00e
--- /dev/null
+++ b/launchers/director_serve.go
@@ -0,0 +1,68 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package launchers
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+func DirectorServe(ctx context.Context, engine *gin.Engine, egrp *errgroup.Group) error {
+
+	log.Info("Initializing Director GeoIP database...")
+	director.InitializeDB(ctx)
+
+	if config.GetPreferredPrefix() == "OSDF" {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusWarning, "Start requesting from topology, status unknown")
+		log.Info("Generating/advertising server ads from OSG topology service...")
+
+		// Get the ads from topology, populate the cache, and keep the cache
+		// updated with fresh info
+		if err := director.AdvertiseOSDF(); err != nil {
+			return err
+		}
+		go director.PeriodicCacheReload(ctx)
+	}
+
+	director.ConfigTTLCache(ctx, egrp)
+
+	// Configure the shortcut middleware to either redirect to a cache
+	// or to an origin
+	defaultResponse := param.Director_DefaultResponse.GetString()
+	if !(defaultResponse == "cache" || defaultResponse == "origin") {
+		return fmt.Errorf("the director's default response must either be set to 'cache' or 'origin',"+
+			" but you provided %q. Was there a typo?", defaultResponse)
+	}
+	log.Debugf("The director will redirect to %ss by default", defaultResponse)
+	rootGroup := engine.Group("/")
+	director.RegisterDirectorAuth(rootGroup)
+	director.RegisterDirectorWebAPI(rootGroup)
+	engine.Use(director.ShortcutMiddleware(defaultResponse))
+	director.RegisterDirector(ctx, rootGroup)
+
+	return nil
+}
diff --git a/launchers/launcher.go b/launchers/launcher.go
new file mode 100644
index 000000000..c39cf7856
--- /dev/null
+++ b/launchers/launcher.go
@@ -0,0 +1,195 @@
+/***************************************************************
+ *
+ * Copyright (C) 2024, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package launchers
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_ui"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/web_ui"
+)
+
+func LaunchModules(ctx context.Context, modules config.ServerType) (context.CancelFunc, error) {
+	egrp, ok := ctx.Value(config.EgrpKey).(*errgroup.Group)
+	if !ok {
+		egrp = &errgroup.Group{}
+	}
+
+	ctx, shutdownCancel := context.WithCancel(ctx)
+
+	egrp.Go(func() error {
+		log.Debug("Will shutdown process on signal")
+		sigs := make(chan os.Signal, 1)
+		signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
+		select {
+		case sig := <-sigs:
+			log.Warningf("Received signal %v; will shutdown process", sig)
+			shutdownCancel()
+			return nil
+		case <-ctx.Done():
+			return nil
+		}
+	})
+
+	engine, err := web_ui.GetEngine()
+	if err != nil {
+		return shutdownCancel, err
+	}
+
+	if err = config.InitServer(ctx, modules); err != nil {
+		return shutdownCancel, errors.Wrap(err, "Failure when configuring the server")
+	}
+
+	// Set up necessary APIs to support Web UI, including auth and metrics
+	if err := web_ui.ConfigureServerWebAPI(ctx, engine, egrp); err != nil {
+		return shutdownCancel, err
+	}
+
+	if modules.IsEnabled(config.RegistryType) {
+
+		viper.Set("Federation.RegistryURL", param.Server_ExternalWebUrl.GetString())
+
+		if err = RegistryServe(ctx, engine, egrp); err != nil {
+			return shutdownCancel, err
+		}
+	}
+
+	if modules.IsEnabled(config.DirectorType) {
+
+		viper.Set("Director.DefaultResponse", "cache")
+
+		viper.Set("Federation.DirectorURL", param.Server_ExternalWebUrl.GetString())
+
+		if err = DirectorServe(ctx, engine, egrp); err != nil {
+			return shutdownCancel, err
+		}
+	}
+
+	servers := make([]server_utils.XRootDServer, 0)
+	if modules.IsEnabled(config.OriginType) {
+		mode := param.Origin_Mode.GetString()
+		switch mode {
+		case "posix":
+			if param.Origin_ExportVolume.GetString() == "" && (param.Xrootd_Mount.GetString() == "" || param.Origin_NamespacePrefix.GetString() == "") {
+				return shutdownCancel, errors.Errorf(`
+	Export information was not provided.
+	Add the command line flag:
+
+		-v /mnt/foo:/bar
+
+	to export the directory /mnt/foo to the namespace prefix /bar in the data federation. Alternatively, specify Origin.ExportVolume in the parameters.yaml file:
+
+		Origin:
+			ExportVolume: /mnt/foo:/bar
+
+	Or, specify Xrootd.Mount and Origin.NamespacePrefix in the parameters.yaml file:
+
+		Xrootd:
+			Mount: /mnt/foo
+		Origin:
+			NamespacePrefix: /bar`)
+			}
+		case "s3":
+			if param.Origin_S3Bucket.GetString() == "" || param.Origin_S3Region.GetString() == "" ||
+				param.Origin_S3ServiceName.GetString() == "" || param.Origin_S3ServiceUrl.GetString() == "" {
+				return shutdownCancel, errors.Errorf("The S3 origin is missing configuration options to run properly." +
+					" You must specify a bucket, a region, a service name and a service URL via the command line or via" +
+					" your configuration file.")
+			}
+		default:
+			return shutdownCancel, errors.Errorf("Currently-supported origin modes include posix and s3.")
+		}
+
+		server, err := OriginServe(ctx, engine, egrp)
+		if err != nil {
+			return shutdownCancel, err
+		}
+		servers = append(servers, server)
+
+		switch mode {
+		case "posix":
+			err = server_utils.WaitUntilWorking(ctx, "GET", param.Origin_Url.GetString()+"/.well-known/openid-configuration", "Origin", http.StatusOK)
+			if err != nil {
+				return shutdownCancel, err
+			}
+		case "s3":
+			// A GET on the server root should cause XRootD to reply with permission denied -- as long as the origin is
+			// running in auth mode (probably). This might need to be revisted if we set up an S3 origin without requiring
+			// tokens
+			err = server_utils.WaitUntilWorking(ctx, "GET", param.Origin_Url.GetString(), "Origin", http.StatusForbidden)
+			if err != nil {
+				return shutdownCancel, err
+			}
+		}
+	}
+
+	log.Info("Starting web engine...")
+	egrp.Go(func() error {
+		if err := web_ui.RunEngine(ctx, engine, egrp); err != nil {
+			log.Errorln("Failure when running the web engine:", err)
+			return err
+		}
+		log.Info("Web engine has shutdown")
+		shutdownCancel()
+		return nil
+	})
+
+	if err = server_utils.WaitUntilWorking(ctx, "GET", param.Server_ExternalWebUrl.GetString()+"/api/v1.0/health", "Web UI", http.StatusOK); err != nil {
+		log.Errorln("Web engine startup appears to have failed:", err)
+		return shutdownCancel, err
+	}
+
+	if modules.IsEnabled(config.OriginType) {
+		log.Debug("Finishing origin server configuration")
+		if err = OriginServeFinish(ctx, egrp); err != nil {
+			return shutdownCancel, err
+		}
+	}
+
+	// Include cache here just in case, although we currently don't use launcher to launch cache
+	if modules.IsEnabled(config.OriginType) || modules.IsEnabled(config.CacheType) {
+		log.Debug("Launching periodic advertise")
+		if err := server_ui.LaunchPeriodicAdvertise(ctx, egrp, servers); err != nil {
+			return shutdownCancel, err
+		}
+	}
+
+	if param.Server_EnableUI.GetBool() {
+		if err = web_ui.ConfigureEmbeddedPrometheus(ctx, engine); err != nil {
+			return shutdownCancel, errors.Wrap(err, "Failed to configure embedded prometheus instance")
+		}
+
+		log.Info("Starting web login...")
+		egrp.Go(func() error { return web_ui.InitServerWebLogin(ctx) })
+	}
+
+	return shutdownCancel, nil
+}
diff --git a/launchers/origin_serve.go b/launchers/origin_serve.go
new file mode 100644
index 000000000..5cbce1e5f
--- /dev/null
+++ b/launchers/origin_serve.go
@@ -0,0 +1,107 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package launchers
+
+import (
+	"context"
+	_ "embed"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/daemon"
+	"github.com/pelicanplatform/pelican/oa4mp"
+	"github.com/pelicanplatform/pelican/origin_ui"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_ui"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/xrootd"
+	"golang.org/x/sync/errgroup"
+)
+
+func OriginServe(ctx context.Context, engine *gin.Engine, egrp *errgroup.Group) (server_utils.XRootDServer, error) {
+
+	err := xrootd.SetUpMonitoring(ctx, egrp)
+	if err != nil {
+		return nil, err
+	}
+
+	originServer := &origin_ui.OriginServer{}
+	err = server_ui.CheckDefaults(originServer)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the APIs unrelated to UI, which only contains director-based health test reporting endpoint for now
+	if err = origin_ui.ConfigureOriginAPI(engine, ctx, egrp); err != nil {
+		return nil, err
+	}
+
+	// In posix mode, we rely on xrootd to export keys. When we run the origin with
+	// different backends, we instead export the keys via the Pelican process
+	if param.Origin_Mode.GetString() != "posix" {
+		if err = origin_ui.ConfigIssJWKS(engine.Group("/.well-known")); err != nil {
+			return nil, err
+		}
+	}
+
+	if param.Origin_EnableIssuer.GetBool() {
+		if err = oa4mp.ConfigureOA4MPProxy(engine); err != nil {
+			return nil, err
+		}
+	}
+
+	configPath, err := xrootd.ConfigXrootd(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+
+	if param.Origin_SelfTest.GetBool() {
+		egrp.Go(func() error { return origin_ui.PeriodicSelfTest(ctx) })
+	}
+
+	xrootd.LaunchXrootdMaintenance(ctx, originServer, 2*time.Minute)
+
+	privileged := param.Origin_Multiuser.GetBool()
+	launchers, err := xrootd.ConfigureLaunchers(privileged, configPath, param.Origin_EnableCmsd.GetBool())
+	if err != nil {
+		return nil, err
+	}
+
+	if param.Origin_EnableIssuer.GetBool() {
+		oa4mp_launcher, err := oa4mp.ConfigureOA4MP()
+		if err != nil {
+			return nil, err
+		}
+		launchers = append(launchers, oa4mp_launcher)
+	}
+
+	if err = daemon.LaunchDaemons(ctx, launchers, egrp); err != nil {
+		return nil, err
+	}
+
+	return originServer, nil
+}
+
+// Finish configuration of the origin server.  To be invoked after the web UI components
+// have been launched.
+func OriginServeFinish(ctx context.Context, egrp *errgroup.Group) error {
+	return server_ui.RegisterNamespaceWithRetry(ctx, egrp)
+}
diff --git a/launchers/origin_serve_windows.go b/launchers/origin_serve_windows.go
new file mode 100644
index 000000000..73cf08ab6
--- /dev/null
+++ b/launchers/origin_serve_windows.go
@@ -0,0 +1,38 @@
+//go:build windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package launchers
+
+import (
+	"context"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pkg/errors"
+	"golang.org/x/sync/errgroup"
+)
+
+func OriginServe(ctx context.Context, engine *gin.Engine, egrp *errgroup.Group) (server_utils.XRootDServer, error) {
+	return nil, errors.New("Origin module is not supported on Windows")
+}
+
+func OriginServeFinish(ctx context.Context, egrp *errgroup.Group) error {
+	return errors.New("Origin module is not supported on Windows")
+}
diff --git a/launchers/registry_serve.go b/launchers/registry_serve.go
new file mode 100644
index 000000000..51ebab439
--- /dev/null
+++ b/launchers/registry_serve.go
@@ -0,0 +1,79 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package launchers
+
+import (
+	"context"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/registry"
+	"github.com/pelicanplatform/pelican/web_ui"
+)
+
+func RegistryServe(ctx context.Context, engine *gin.Engine, egrp *errgroup.Group) error {
+	log.Info("Initializing the namespace registry's database...")
+
+	// Initialize the registry's sqlite database
+	err := registry.InitializeDB(ctx)
+	if err != nil {
+		return errors.Wrap(err, "Unable to initialize the namespace registry database")
+	}
+
+	if config.GetPreferredPrefix() == "OSDF" {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusWarning, "Start requesting from topology, status unknown")
+		log.Info("Populating registry with namespaces from OSG topology service...")
+		if err := registry.PopulateTopology(); err != nil {
+			panic(errors.Wrap(err, "Unable to populate topology table"))
+		}
+
+		// Checks topology for updates every 10 minutes
+		go registry.PeriodicTopologyReload()
+	}
+
+	if param.Server_EnableUI.GetBool() {
+		if err := web_ui.ConfigOAuthClientAPIs(engine); err != nil {
+			return err
+		}
+		if err := registry.InitInstConfig(ctx, egrp); err != nil {
+			return err
+		}
+	}
+
+	rootRouterGroup := engine.Group("/")
+	// Register routes for server/Pelican client facing APIs
+	registry.RegisterRegistryAPI(rootRouterGroup)
+	// Register routes for APIs to registry Web UI
+	if err := registry.RegisterRegistryWebAPI(rootRouterGroup); err != nil {
+		return err
+	}
+
+	egrp.Go(func() error {
+		<-ctx.Done()
+		return registry.ShutdownDB()
+	})
+
+	return nil
+}
diff --git a/metrics/director.go b/metrics/director.go
new file mode 100644
index 000000000..78d922174
--- /dev/null
+++ b/metrics/director.go
@@ -0,0 +1,50 @@
+/***************************************************************
+ *
+ * Copyright (C) 2024, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package metrics
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+type (
+	DirectorFTXTestStatus string
+)
+
+const (
+	FTXTestSuccess DirectorFTXTestStatus = "Success"
+	FTXTestFailed  DirectorFTXTestStatus = "Failed"
+)
+
+var (
+	PelicanDirectorFileTransferTestSuite = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "pelican_director_total_ftx_test_suite",
+		Help: "The number of file transfer test suite the director issued",
+	}, []string{"server_name", "server_web_url", "server_type"})
+
+	PelicanDirectorActiveFileTransferTestSuite = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "pelican_director_active_ftx_test_suite",
+		Help: "The number of active director file transfer test suite",
+	}, []string{"server_name", "server_web_url", "server_type"})
+
+	PelicanDirectorFileTransferTestsRuns = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "pelican_director_total_ftx_test_runs",
+		Help: "The number of file transfer test suite director issued",
+	}, []string{"server_name", "server_web_url", "server_type", "status", "report_status"})
+)
diff --git a/metrics/health.go b/metrics/health.go
index 01ec7d6a4..3229ed13f 100644
--- a/metrics/health.go
+++ b/metrics/health.go
@@ -19,68 +19,115 @@
 package metrics
 
 import (
-	"fmt"
 	"sync"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
 )
 
 type (
+	// This is for API response so we want to display string representation of status
 	ComponentStatus struct {
-		Status  string `json:"status"`
-		Message string `json:"message,omitempty"`
+		Status     string `json:"status"`
+		Message    string `json:"message,omitempty"`
+		LastUpdate int64  `json:"last_update"`
 	}
 
 	componentStatusInternal struct {
-		Status  int
-		Message string
+		Status     HealthStatusEnum
+		Message    string
+		LastUpdate time.Time
 	}
 
 	HealthStatus struct {
 		OverallStatus   string                     `json:"status"`
 		ComponentStatus map[string]ComponentStatus `json:"components"`
 	}
+
+	HealthStatusEnum int
+
+	HealthStatusComponent string
+)
+
+const (
+	StatusCritical HealthStatusEnum = iota + 1
+	StatusWarning
+	StatusOK
+	StatusUnknown // Do not abuse this enum. Use others when possible
+)
+
+const statusIndexErrorMessage = "Error: status string index out of range"
+
+// Naming convention for components:
+//
+//	ServiceName1Name2_ComponentName
+//
+// i.e. For ""OriginCache_XRootD", it means this component is available at both
+// Origin and Cache. Please come up with the largest possible scope of the component
+const (
+	OriginCache_XRootD        HealthStatusComponent = "xrootd"
+	OriginCache_CMSD          HealthStatusComponent = "cmsd"
+	OriginCache_Federation    HealthStatusComponent = "federation" // Advertise to the director
+	OriginCache_Director      HealthStatusComponent = "director"   // File transfer with director
+	DirectorRegistry_Topology HealthStatusComponent = "topology"   // Fetch data from OSDF topology
+	Server_WebUI              HealthStatusComponent = "web-ui"
 )
 
 var (
 	healthStatus = sync.Map{}
+
+	PelicanHealthStatus = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "pelican_component_health_status",
+		Help: "The health status of various components",
+	}, []string{"component"})
+
+	PelicanHealthLastUpdate = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "pelican_component_health_status_last_update",
+		Help: "Last update timestamp of components health status",
+	}, []string{"component"})
 )
 
-func statusToInt(status string) (int, error) {
-	switch status {
-	case "ok":
-		return 3, nil
-	case "warning":
-		return 2, nil
-	case "critical":
-		return 1, nil
+// Unfortunately we don't have a better way to ensure the enum constants always have
+// matched string representation, so we will return "Error: status string index out of range"
+// as an indicator
+func (status HealthStatusEnum) String() string {
+	strings := [...]string{"critical", "warning", "ok", "unknown"}
+
+	if int(status) < 1 || int(status) > len(strings) {
+		return statusIndexErrorMessage
 	}
-	return 0, fmt.Errorf("Unknown component status: %v", status)
+	return strings[status-1]
 }
 
-func intToStatus(statusInt int) string {
-	switch statusInt {
-	case 3:
-		return "ok"
-	case 2:
-		return "warning"
-	case 1:
-		return "critical"
-	}
-	return "unknown"
+func (component HealthStatusComponent) String() string {
+	return string(component)
 }
 
-func SetComponentHealthStatus(name, state, msg string) error {
-	statusInt, err := statusToInt(state)
-	if err != nil {
-		return err
-	}
-	healthStatus.Store(name, componentStatusInternal{statusInt, msg})
-	return nil
+// Add/update the component health status. If you have a new component to record,
+// please go to metrics/health and register your component as a new constant of
+// type HealthStatusComponent. Also note that StatusUnknown is mostly for internal
+// use only, please try to avoid setting this as your component status
+func SetComponentHealthStatus(name HealthStatusComponent, state HealthStatusEnum, msg string) {
+	now := time.Now()
+	healthStatus.Store(name.String(), componentStatusInternal{state, msg, now})
+
+	PelicanHealthStatus.With(
+		prometheus.Labels{"component": name.String()}).
+		Set(float64(state))
+
+	PelicanHealthLastUpdate.With(prometheus.Labels{"component": name.String()}).
+		SetToCurrentTime()
+}
+
+func DeleteComponentHealthStatus(name HealthStatusComponent) {
+	healthStatus.Delete(name.String())
 }
 
 func GetHealthStatus() HealthStatus {
 	status := HealthStatus{}
-	status.OverallStatus = "unknown"
-	overallStatus := 4
+	status.OverallStatus = StatusUnknown.String()
+	overallStatus := StatusUnknown
 	healthStatus.Range(func(component, compstat any) bool {
 		componentStatus, ok := compstat.(componentStatusInternal)
 		if !ok {
@@ -94,14 +141,15 @@ func GetHealthStatus() HealthStatus {
 			status.ComponentStatus = make(map[string]ComponentStatus)
 		}
 		status.ComponentStatus[componentString] = ComponentStatus{
-			intToStatus(componentStatus.Status),
+			componentStatus.Status.String(),
 			componentStatus.Message,
+			componentStatus.LastUpdate.Unix(),
 		}
 		if componentStatus.Status < overallStatus {
 			overallStatus = componentStatus.Status
 		}
 		return true
 	})
-	status.OverallStatus = intToStatus(overallStatus)
+	status.OverallStatus = overallStatus.String()
 	return status
 }
diff --git a/metrics/health_test.go b/metrics/health_test.go
new file mode 100644
index 000000000..645d2a257
--- /dev/null
+++ b/metrics/health_test.go
@@ -0,0 +1,20 @@
+package metrics
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHealthStatusString(t *testing.T) {
+	expectedStrings := [...]string{"critical", "warning", "ok", "unknown"}
+
+	t.Run("health-status-string-handles-out-of-range-index", func(t *testing.T) {
+		invalidIndex := len(expectedStrings) + 1
+		for idx := range expectedStrings {
+			assert.Equal(t, expectedStrings[idx], HealthStatusEnum(idx+1).String())
+		}
+		require.Equal(t, statusIndexErrorMessage, HealthStatusEnum(invalidIndex).String())
+	})
+}
diff --git a/metrics/xrootd_metrics.go b/metrics/xrootd_metrics.go
index 786f55ef0..b5d7034eb 100644
--- a/metrics/xrootd_metrics.go
+++ b/metrics/xrootd_metrics.go
@@ -20,9 +20,11 @@ package metrics
 
 import (
 	"bytes"
+	"context"
 	"encoding/binary"
 	"encoding/xml"
 	"fmt"
+	"math"
 	"net"
 	"path"
 	"strconv"
@@ -30,23 +32,36 @@ import (
 	"time"
 
 	"github.com/jellydator/ttlcache/v3"
+	"github.com/pelicanplatform/pelican/param"
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
 )
 
 type (
-	UserId struct {
+	SummaryStatType string
+	UserId          struct {
 		Id uint32
 	}
 
+	// userid as in XRootD message info field
+	XrdUserId struct {
+		Prot string
+		User string
+		Pid  int
+		Sid  int
+		Host string
+	}
+
 	UserRecord struct {
 		AuthenticationProtocol string
+		User                   string
 		DN                     string
 		Role                   string
 		Org                    string
+		Groups                 []string
 	}
 
 	FileId struct {
@@ -73,11 +88,19 @@ type (
 		Code byte
 		Pseq byte
 		Plen uint16
-		Stod uint32
+		Stod int32
+	}
+
+	XrdXrootdMonMap struct {
+		Hdr    XrdXrootdMonHeader
+		Dictid uint32
+		Info   []byte
 	}
 
+	recTval byte
+
 	XrdXrootdMonFileHdr struct {
-		RecType byte
+		RecType recTval
 		RecFlag byte
 		RecSize int16
 		FileId  uint32
@@ -87,29 +110,121 @@ type (
 	}
 
 	XrdXrootdMonFileTOD struct {
+		Hdr  XrdXrootdMonFileHdr
+		TBeg int32
+		TEnd int32
+		SID  int64
+	}
+
+	XrdXrootdMonFileLFN struct {
+		User uint32
+		Lfn  [1032]byte
+	}
+
+	XrdXrootdMonFileOPN struct {
 		Hdr XrdXrootdMonFileHdr
-		Beg int32
-		End int32
-		SID int64
+		Fsz int64
+		Ufn XrdXrootdMonFileLFN
+	}
+
+	XrdXrootdMonStatXFR struct {
+		Read  int64 // Bytes read from file using read()
+		Readv int64 // Bytes read from file using readv()
+		Write int64 // Bytes written to file
+	}
+
+	XrdXrootdMonFileXFR struct {
+		Hdr XrdXrootdMonFileHdr // Header with recType == isXfr
+		Xfr XrdXrootdMonStatXFR
+	}
+
+	XrdXrootdMonStatOPS struct { // 48B
+		Read  int32 // Number of read() calls
+		Readv int32 // Number of readv() calls
+		Write int32 // Number of write() calls
+		RsMin int16 // Smallest readv() segment count
+		RsMax int16 // Largest readv() segment count
+		Rsegs int64 // Number of readv() segments
+		RdMin int32 // Smallest read() request size
+		RdMax int32 // Largest read() request size
+		RvMin int32 // Smallest readv() request size
+		RvMax int32 // Largest readv() request size
+		WrMin int32 // Smallest write() request size
+		WrMax int32 // Largest write() request size
+	}
+
+	// XrdXrootdMonFileCLS represents a variable length structure and
+	// includes other structures that are "Always present" or "OPTIONAL".
+	// The OPTIONAL parts are not included here as they require more context.
+	XrdXrootdMonFileCLS struct {
+		Hdr XrdXrootdMonFileHdr // Always present
+		Xfr XrdXrootdMonStatXFR // Always present
+		Ops XrdXrootdMonStatOPS // OPTIONAL
+		// Ssq XrdXrootdMonStatSSQ // OPTIONAL, not implemented here yet
+	}
+
+	SummaryPathStat struct {
+		Id    string `xml:"id,attr"`
+		Lp    string `xml:"lp"`   // The minimally reduced logical file system path i.e. top-level namespace
+		Free  int    `xml:"free"` // Kilobytes available
+		Total int    `xml:"tot"`  // Kilobytes allocated
+	}
+
+	SummaryPath struct {
+		Idx   int               `xml:",chardata"`
+		Stats []SummaryPathStat `xml:"stats"`
+	}
+
+	SummaryCacheStore struct {
+		Size int `xml:"size"`
+		Used int `xml:"used"`
+		Min  int `xml:"min"`
+		Max  int `xml:"max"`
+	}
+
+	SummaryCacheMemory struct {
+		Size int `xml:"size"`
+		Used int `xml:"used"`
+		Wq   int `xml:"wq"`
 	}
 
 	SummaryStat struct {
-		Id string `xml:"id,attr"`
-		// Relevant for id="link"
-		LinkConnections int `xml:"tot"`
-		LinkInBytes     int `xml:"in"`
-		LinkOutBytes    int `xml:"out"`
-		// Relevant for id="sched"
-		Threads     int `xml:"threads"`
-		ThreadsIdle int `xml:"idle"`
+		Id      SummaryStatType    `xml:"id,attr"`
+		Total   int                `xml:"tot"`
+		In      int                `xml:"in"`
+		Out     int                `xml:"out"`
+		Threads int                `xml:"threads"`
+		Idle    int                `xml:"idle"`
+		Paths   SummaryPath        `xml:"paths"` // For Oss Summary Data
+		Store   SummaryCacheStore  `xml:"store"`
+		Memory  SummaryCacheMemory `xml:"mem"`
 	}
 
 	SummaryStatistics struct {
 		Version string        `xml:"ver,attr"`
+		Program string        `xml:"pgm,attr"`
 		Stats   []SummaryStat `xml:"stats"`
 	}
 )
 
+// XrdXrootdMonFileHdr
+// Ref: https://github.com/xrootd/xrootd/blob/f3b2e86b9b80bb35f97dd4ad30c4cd5904902a4c/src/XrdXrootd/XrdXrootdMonData.hh#L173
+const (
+	isClose recTval = iota
+	isOpen
+	isTime
+	isXfr
+	isDisc
+)
+
+// Summary data types
+const (
+	LinkStat  SummaryStatType = "link"  // https://xrootd.slac.stanford.edu/doc/dev55/xrd_monitoring.htm#_Toc99653739
+	SchedStat SummaryStatType = "sched" // https://xrootd.slac.stanford.edu/doc/dev55/xrd_monitoring.htm#_Toc99653745
+	OssStat   SummaryStatType = "oss"   // https://xrootd.slac.stanford.edu/doc/dev55/xrd_monitoring.htm#_Toc99653741
+	CacheStat SummaryStatType = "cache" // https://xrootd.slac.stanford.edu/doc/dev55/xrd_monitoring.htm#_Toc99653733
+)
+
 var (
 	PacketsReceived = promauto.NewCounter(prometheus.CounterOpts{
 		Name: "xrootd_monitoring_packets_received",
@@ -146,16 +261,35 @@ var (
 		Help: "Number of bytes read into the server",
 	}, []string{"direction"})
 
+	StorageVolume = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "xrootd_storage_volume_bytes",
+		Help: "Storage volume usage on the server",
+	}, []string{"ns", "type", "server_type"}) // type: total/free; server_type: origin/cache
+
 	lastStats SummaryStat
 
-	sessions     = ttlcache.New[UserId, UserRecord](ttlcache.WithTTL[UserId, UserRecord](24 * time.Hour))
+	// Maps the connection identifier with a user record
+	sessions = ttlcache.New[UserId, UserRecord](ttlcache.WithTTL[UserId, UserRecord](24 * time.Hour))
+	// Maps a userid to a connection identifier.  NOTE: due to https://github.com/xrootd/xrootd/issues/2133,
+	// this may not be a unique map.
+	userids = ttlcache.New[XrdUserId, UserId](ttlcache.WithTTL[XrdUserId, UserId](24 * time.Hour))
+	// Maps a file identifier with a file record
 	transfers    = ttlcache.New[FileId, FileRecord](ttlcache.WithTTL[FileId, FileRecord](24 * time.Hour))
 	monitorPaths []PathList
 )
 
-func ConfigureMonitoring() (int, error) {
-	lower := viper.GetInt("MonitoringPortLower")
-	higher := viper.GetInt("MonitoringPortHigher")
+// Set up listening and parsing xrootd monitoring UDP packets into prometheus
+//
+// The `ctx` is the context for listening to server shutdown event in order to cleanup internal cache eviction
+// goroutine and `wg` is the wait group to notify when the clean up goroutine finishes
+func ConfigureMonitoring(ctx context.Context, egrp *errgroup.Group) (int, error) {
+	monitorPaths = make([]PathList, 0)
+	for _, monpath := range param.Monitoring_AggregatePrefixes.GetStringSlice() {
+		monitorPaths = append(monitorPaths, PathList{Paths: strings.Split(path.Clean(monpath), "/")})
+	}
+
+	lower := param.Monitoring_PortLower.GetInt()
+	higher := param.Monitoring_PortHigher.GetInt()
 
 	addr := net.UDPAddr{IP: net.ParseIP("127.0.0.1")}
 	var conn *net.UDPConn
@@ -180,12 +314,30 @@ func ConfigureMonitoring() (int, error) {
 		return -1, err
 	}
 
+	// Start ttl cache automatic eviction of expired items
+	go sessions.Start()
+	go userids.Start()
+	go transfers.Start()
+
+	// Stop automatic eviction at shutdown
+	egrp.Go(func() error {
+		<-ctx.Done()
+		conn.Close() // This will cause an net.ErrClosed in the goroutine below
+		sessions.Stop()
+		userids.Stop()
+		transfers.Stop()
+		log.Infoln("Xrootd metrics cache eviction has been stopped")
+		return nil
+	})
+
 	go func() {
 		var buf [65536]byte
 		for {
 			// TODO: actually parse the UDP packets
 			plen, _, err := conn.ReadFromUDP(buf[:])
-			if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return
+			} else if err != nil {
 				log.Errorln("Failed to read from UDP connection", err)
 				continue
 			}
@@ -199,7 +351,7 @@ func ConfigureMonitoring() (int, error) {
 	return addr.Port, nil
 }
 
-func ComputePrefix(inputPath string) string {
+func computePrefix(inputPath string, monitorPaths []PathList) string {
 	if len(monitorPaths) == 0 {
 		return "/"
 	}
@@ -234,25 +386,108 @@ func ComputePrefix(inputPath string) string {
 	return path.Clean(result)
 }
 
-func GetSIDRest(info []byte) (UserId, string, error) {
+func GetSIDRest(info []byte) (xrdUserId XrdUserId, rest string, err error) {
 	log.Debugln("GetSIDRest inputs:", string(info))
 	infoSplit := strings.SplitN(string(info), "\n", 2)
 	if len(infoSplit) == 1 {
-		return UserId{}, "", errors.New("Unable to parse SID")
+		err = errors.New("Unable to parse SID")
+		return
 	}
+	rest = infoSplit[1]
 
-	sidInfo := strings.Split(string(infoSplit[0]), ":")
+	xrdUserId, err = ParseXrdUserId(infoSplit[0])
+	return
+}
+
+func ParseXrdUserId(userid string) (xrdUserId XrdUserId, err error) {
+	// Expected format: prot/user.id:sid@clientHost
+	sidInfo := strings.SplitN(userid, ":", 2)
 	if len(sidInfo) == 1 {
-		return UserId{}, "", errors.New("Unable to parse valid SID")
+		err = errors.New("Unable to parse valid user ID - missing ':' delimiter")
+		return
 	}
-	// form: 82215220691948@localhost
-	sidAtHostname := sidInfo[len(sidInfo)-1]
+
+	// Parse server ID and client hostname,
+	// Form: 82215220691948@localhost
+	sidAtHostname := sidInfo[1]
 	sidAtHostnameInfo := strings.SplitN(sidAtHostname, "@", 2)
+	if len(sidAtHostnameInfo) == 1 {
+		err = errors.New("Unable to parse valid server ID - missing '@' delimiter")
+		return
+	}
 	sid, err := strconv.Atoi(sidAtHostnameInfo[0])
 	if err != nil {
-		return UserId{}, "", err
+		err = errors.Wrap(err, "Unable to parse valid server ID")
+		return
+	}
+
+	// Parse prot/user.id
+	protUserIdInfo := strings.SplitN(sidInfo[0], "/", 2)
+	if len(protUserIdInfo) == 1 {
+		err = errors.New("Unable to parse user ID - missing '/' delimiter")
+		return
+	}
+
+	// Parse user.id; assume user may contain multiple '.' characters
+	lastIdx := strings.LastIndex(protUserIdInfo[1], ".")
+	if lastIdx == -1 {
+		err = errors.New("Unable to parse user ID - missing '.' delimiter")
+		return
+	}
+	pid, err := strconv.Atoi(protUserIdInfo[1][lastIdx+1 : len(protUserIdInfo[1])])
+	if err != nil {
+		err = errors.Wrap(err, "Unsable to parse PID as integer")
+		return
+	}
+
+	// Finally, fill in our userid struct
+	xrdUserId.Prot = protUserIdInfo[0]
+	xrdUserId.User = protUserIdInfo[1][:lastIdx]
+	xrdUserId.Pid = pid
+	xrdUserId.Sid = sid
+	xrdUserId.Host = string(sidAtHostname[1])
+	return
+}
+
+func ParseTokenAuth(tokenauth string) (userId UserId, record UserRecord, err error) {
+	record.AuthenticationProtocol = "ztn"
+	foundUc := false
+	for _, pair := range strings.Split(tokenauth, "&") {
+		keyVal := strings.SplitN(pair, "=", 2)
+		if len(keyVal) != 2 {
+			continue
+		}
+		switch keyVal[0] {
+		case "Uc":
+			var id int
+			id, err = strconv.Atoi(keyVal[1])
+			if err != nil {
+				err = errors.Wrap(err, "Unable to parse user ID to integer")
+				return
+			}
+			if id < 0 || id > math.MaxUint32 {
+				err = errors.Errorf("Provided ID, %d, is not a valid uint32", id)
+				return
+			}
+			userId.Id = uint32(id)
+			foundUc = true
+		case "s":
+			record.DN = keyVal[1]
+		case "un":
+			record.User = keyVal[1]
+		case "o":
+			record.Org = keyVal[1]
+		case "r":
+			record.Role = keyVal[1]
+		case "g":
+			record.Groups = strings.Split(keyVal[1], " ")
+		}
+	}
+	if !foundUc {
+		err = errors.New("The user ID was not provided in the token record")
+		return
 	}
-	return UserId{Id: uint32(sid)}, string(info[1]), nil
+	return
 }
 
 func ParseFileHeader(packet []byte) (XrdXrootdMonFileHdr, error) {
@@ -260,7 +495,7 @@ func ParseFileHeader(packet []byte) (XrdXrootdMonFileHdr, error) {
 		return XrdXrootdMonFileHdr{}, fmt.Errorf("Passed header of size %v which is below the minimum header size of 8 bytes", len(packet))
 	}
 	fileHdr := XrdXrootdMonFileHdr{
-		RecType: packet[0],
+		RecType: recTval(packet[0]),
 		RecFlag: packet[1],
 		RecSize: int16(binary.BigEndian.Uint16(packet[2:4])),
 		FileId:  binary.BigEndian.Uint32(packet[4:8]),
@@ -292,7 +527,12 @@ func HandlePacket(packet []byte) error {
 	header.Code = packet[0]
 	header.Pseq = packet[1]
 	header.Plen = binary.BigEndian.Uint16(packet[2:4])
-	header.Stod = binary.BigEndian.Uint32(packet[4:8])
+	header.Stod = int32(binary.BigEndian.Uint32(packet[4:8]))
+
+	// For =, p, and x record-types, this is always 0
+	// For i, T, u, and U , this is a connection ID
+	// For d, this is a file ID.
+	dictid := binary.BigEndian.Uint32(packet[8:12])
 
 	switch header.Code {
 	case 'd':
@@ -300,14 +540,15 @@ func HandlePacket(packet []byte) error {
 		if len(packet) < 12 {
 			return errors.New("Packet is too small to be valid file-open packet")
 		}
-		dictid := binary.BigEndian.Uint32(packet[8:12])
 		fileid := FileId{Id: dictid}
-		userid, rest, err := GetSIDRest(packet[12:])
+		xrdUserId, rest, err := GetSIDRest(packet[12:])
 		if err != nil {
 			return errors.Wrapf(err, "Failed to parse XRootD monitoring packet")
 		}
-		path := ComputePrefix(rest)
-		transfers.Set(fileid, FileRecord{UserId: userid, Path: path}, ttlcache.DefaultTTL)
+		path := computePrefix(rest, monitorPaths)
+		if useridItem := userids.Get(xrdUserId); useridItem != nil {
+			transfers.Set(fileid, FileRecord{UserId: useridItem.Value(), Path: path}, ttlcache.DefaultTTL)
+		}
 	case 'f':
 		log.Debug("HandlePacket: Received a f-stream packet")
 		// sizeof(XrdXrootdMonHeader) + sizeof(XrdXrootdMonFileTOD)
@@ -326,7 +567,7 @@ func HandlePacket(packet []byte) error {
 				return err
 			}
 			switch fileHdr.RecType {
-			case 0: // XrdXrootdMonFileHdr::isClose
+			case isClose: // XrdXrootdMonFileHdr::isClose
 				log.Debugln("Received a f-stream file-close packet of size ",
 					fileHdr.RecSize)
 				fileId := FileId{Id: fileHdr.FileId}
@@ -403,23 +644,26 @@ func HandlePacket(packet []byte) error {
 				counter.Add(float64(int64(binary.BigEndian.Uint64(
 					packet[offset+xfrOffset+16:offset+xfrOffset+24]) -
 					oldWriteBytes)))
-			case 1: // XrdXrootdMonFileHdr::isOpen
+			case isOpen: // XrdXrootdMonFileHdr::isOpen
 				log.Debug("MonPacket: Received a f-stream file-open packet")
 				fileid := FileId{Id: fileHdr.FileId}
 				path := ""
+				userId := UserId{}
 				if fileHdr.RecFlag&0x01 == 0x01 { // hasLFN
 					lfnSize := uint32(fileHdr.RecSize - 20)
 					lfn := NullTermToString(packet[offset+20 : offset+lfnSize+20])
-					path := ComputePrefix(lfn)
+					// path has been difined
+					path = computePrefix(lfn, monitorPaths)
 					log.Debugf("MonPacket: User LFN %v matches prefix %v",
 						lfn, path)
+					// UserId is part of LFN
+					userId = UserId{Id: binary.BigEndian.Uint32(packet[offset+16 : offset+20])}
 				}
-				userid := UserId{Id: binary.BigEndian.Uint32(packet[offset+16 : offset+20])}
-				transfers.Set(fileid, FileRecord{UserId: userid, Path: path},
+				transfers.Set(fileid, FileRecord{UserId: userId, Path: path},
 					ttlcache.DefaultTTL)
-			case 2: // XrdXrootdMonFileHdr::isTime
+			case isTime: // XrdXrootdMonFileHdr::isTime
 				log.Debug("MonPacket: Received a f-stream time packet")
-			case 3: // XrdXrootdMonFileHdr::isXfr
+			case isXfr: // XrdXrootdMonFileHdr::isXfr
 				log.Debug("MonPacket: Received a f-stream transfer packet")
 				// NOTE: There's a lot to do here.  These records would allow us to
 				// capture partial file transfers or emulate a close on timeout.
@@ -430,18 +674,65 @@ func HandlePacket(packet []byte) error {
 				readBytes := binary.BigEndian.Uint64(packet[offset+8 : offset+16])
 				readvBytes := binary.BigEndian.Uint64(packet[offset+16 : offset+24])
 				writeBytes := binary.BigEndian.Uint64(packet[offset+24 : offset+32])
+
+				labels := prometheus.Labels{
+					"path": "/",
+					"ap":   "",
+					"dn":   "",
+					"role": "",
+					"org":  "",
+				}
+
 				if item != nil {
 					record = item.Value()
+					userRecord := sessions.Get(record.UserId)
+					labels["path"] = record.Path
+					if userRecord != nil {
+						labels["ap"] = userRecord.Value().AuthenticationProtocol
+						labels["dn"] = userRecord.Value().DN
+						labels["role"] = userRecord.Value().Role
+						labels["org"] = userRecord.Value().Org
+					}
+				}
+
+				// We record those metrics to make sure they are properly populated with initial
+				// values, or the file close hanlder will only populate them by the difference, not
+				// the total
+				labels["type"] = "read"
+				counter := TransferBytes.With(labels)
+				incBy := int64(readBytes - record.ReadBytes)
+				if incBy >= 0 {
+					counter.Add(float64(incBy))
+				} else {
+					log.Debug("File-transfer ReadBytes is less than previous value")
+				}
+				labels["type"] = "readv"
+				counter = TransferBytes.With(labels)
+				incBy = int64(readvBytes - record.ReadvBytes)
+				if incBy >= 0 {
+					counter.Add(float64(incBy))
+				} else {
+					log.Debug("File-transfer ReadVBytes is less than previous value")
+				}
+				labels["type"] = "write"
+				counter = TransferBytes.With(labels)
+				incBy = int64(writeBytes - record.WriteBytes)
+				if incBy >= 0 {
+					counter.Add(float64(incBy))
+				} else {
+					log.Debug("File-transfer WriteByte is less than previous value")
 				}
 				record.ReadBytes = readBytes
 				record.ReadvBytes = readvBytes
 				record.WriteBytes = writeBytes
 				transfers.Set(fileid, record, ttlcache.DefaultTTL)
 
-			case 4: // XrdXrootdMonFileHdr::isDisc
+			case isDisc: // XrdXrootdMonFileHdr::isDisc
 				log.Debug("MonPacket: Received a f-stream disconnect packet")
 				userId := UserId{Id: fileHdr.UserId}
-				sessions.Delete(userId)
+				if session := sessions.Get(userId); session != nil {
+					sessions.Delete(userId)
+				}
 			default:
 				log.Debug("MonPacket: Received an unhandled file monitoring packet "+
 					"of type ", fileHdr.RecType)
@@ -455,7 +746,7 @@ func HandlePacket(packet []byte) error {
 	case 'u':
 		log.Debug("MonPacket: Received a user login packet")
 		infoSize := uint32(header.Plen - 12)
-		if userid, auth, err := GetSIDRest(packet[12 : 12+infoSize]); err == nil {
+		if xrdUserId, auth, err := GetSIDRest(packet[12 : 12+infoSize]); err == nil {
 			var record UserRecord
 			for _, pair := range strings.Split(auth, "&") {
 				keyVal := strings.SplitN(pair, "=", 2)
@@ -471,9 +762,27 @@ func HandlePacket(packet []byte) error {
 					record.Org = keyVal[1]
 				case "r":
 					record.Role = keyVal[1]
+				case "g":
+					record.Groups = strings.Split(keyVal[1], " ")
 				}
 			}
-			sessions.Set(userid, record, ttlcache.DefaultTTL)
+			if len(record.AuthenticationProtocol) > 0 {
+				record.User = xrdUserId.User
+			}
+			sessions.Set(UserId{Id: dictid}, record, ttlcache.DefaultTTL)
+			userids.Set(xrdUserId, UserId{Id: dictid}, ttlcache.DefaultTTL)
+		} else {
+			return err
+		}
+	case 'T':
+		log.Debug("MonPacket: Received a token info packet")
+		infoSize := uint32(header.Plen - 12)
+		if _, tokenauth, err := GetSIDRest(packet[12 : 12+infoSize]); err == nil {
+			userId, userRecord, err := ParseTokenAuth(tokenauth)
+			if err != nil {
+				return err
+			}
+			sessions.Set(userId, userRecord, ttlcache.DefaultTTL)
 		} else {
 			return err
 		}
@@ -616,34 +925,60 @@ func HandleSummaryPacket(packet []byte) error {
 		return err
 	}
 	log.Debug("Received a summary statistics packet")
+	if summaryStats.Program != "xrootd" {
+		// We only care about the xrootd summary packets
+		return nil
+	}
 	for _, stat := range summaryStats.Stats {
 		switch stat.Id {
 
-		case "link":
-			incBy := float64(stat.LinkConnections - lastStats.LinkConnections)
-			if stat.LinkConnections < lastStats.LinkConnections {
-				incBy = float64(stat.LinkConnections)
+		case LinkStat:
+			// When stats tag has id="link", the following definitions are valid:
+			// stat.Total: Connections since start-up.
+			// stat.In: Bytes received
+			// stat.Out: Bytes sent
+
+			// Note that stat.Total is the total connections since the start-up of the servcie
+			// So we just want to make sure here that no negative value is present
+			incBy := float64(stat.Total - lastStats.Total)
+			if stat.Total < lastStats.Total {
+				incBy = float64(stat.Total)
 			}
 			Connections.Add(incBy)
-			lastStats.LinkConnections = stat.LinkConnections
+			lastStats.Total = stat.Total
 
-			incBy = float64(stat.LinkInBytes - lastStats.LinkInBytes)
-			if stat.LinkInBytes < lastStats.LinkInBytes {
-				incBy = float64(stat.LinkInBytes)
+			incBy = float64(stat.In - lastStats.In)
+			if stat.In < lastStats.In {
+				incBy = float64(stat.In)
 			}
 			BytesXfer.With(prometheus.Labels{"direction": "rx"}).Add(incBy)
-			lastStats.LinkInBytes = stat.LinkInBytes
+			lastStats.In = stat.In
 
-			incBy = float64(stat.LinkOutBytes - lastStats.LinkOutBytes)
-			if stat.LinkOutBytes < lastStats.LinkOutBytes {
-				incBy = float64(stat.LinkOutBytes)
+			incBy = float64(stat.Out - lastStats.Out)
+			if stat.Out < lastStats.Out {
+				incBy = float64(stat.Out)
 			}
 			BytesXfer.With(prometheus.Labels{"direction": "tx"}).Add(incBy)
-			lastStats.LinkOutBytes = stat.LinkOutBytes
-		case "sched":
-			Threads.With(prometheus.Labels{"state": "idle"}).Set(float64(stat.ThreadsIdle))
+			lastStats.Out = stat.Out
+		case SchedStat:
+			Threads.With(prometheus.Labels{"state": "idle"}).Set(float64(stat.Idle))
 			Threads.With(prometheus.Labels{"state": "running"}).Set(float64(stat.Threads -
-				stat.ThreadsIdle))
+				stat.Idle))
+		case OssStat: // Oss stat should only appear on origin servers
+			for _, pathStat := range stat.Paths.Stats {
+				noQuoteLp := strings.Replace(pathStat.Lp, "\"", "", 2)
+				// pathStat.Total is in kilobytes but we want to standardize all data to bytes
+				StorageVolume.With(prometheus.Labels{"ns": noQuoteLp, "type": "total", "server_type": "origin"}).
+					Set(float64(pathStat.Total * 1024))
+				StorageVolume.With(prometheus.Labels{"ns": noQuoteLp, "type": "free", "server_type": "origin"}).
+					Set(float64(pathStat.Free * 1024))
+			}
+		case CacheStat:
+			cacheStore := stat.Store
+			StorageVolume.With(prometheus.Labels{"ns": "/cache", "type": "total", "server_type": "cache"}).
+				Set(float64(cacheStore.Size))
+			StorageVolume.With(prometheus.Labels{"ns": "/cache", "type": "free", "server_type": "cache"}).
+				Set(float64(cacheStore.Size - cacheStore.Used))
 		}
 	}
 	return nil
diff --git a/metrics/xrootd_metrics_serializer.go b/metrics/xrootd_metrics_serializer.go
new file mode 100644
index 000000000..2cf465785
--- /dev/null
+++ b/metrics/xrootd_metrics_serializer.go
@@ -0,0 +1,295 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package metrics
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+
+	"github.com/pkg/errors"
+)
+
+func (monHeader *XrdXrootdMonHeader) Serialize() ([]byte, error) {
+	var buf bytes.Buffer
+	// Writing the Header
+	err := binary.Write(&buf, binary.BigEndian, monHeader.Code)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Code:", err))
+	}
+	err = binary.Write(&buf, binary.BigEndian, monHeader.Pseq)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Pseq:", err))
+	}
+	err = binary.Write(&buf, binary.BigEndian, monHeader.Plen)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Plen:", err))
+	}
+	err = binary.Write(&buf, binary.BigEndian, monHeader.Stod)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Stod:", err))
+	}
+
+	return buf.Bytes(), nil
+}
+
+func (monMap XrdXrootdMonMap) Serialize() ([]byte, error) {
+	var buf bytes.Buffer
+
+	// Writing the Header
+	headerBytes, err := monMap.Hdr.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("Failed to serialize monitor header:", err))
+	}
+	err = binary.Write(&buf, binary.BigEndian, headerBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Header:", err))
+	}
+
+	// Writing the Dictid
+	err = binary.Write(&buf, binary.BigEndian, monMap.Dictid)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Dictid:", err))
+	}
+
+	// Writing the Info slice directly
+	err = binary.Write(&buf, binary.BigEndian, monMap.Info)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprint("binary.Write failed for Info:", err))
+	}
+
+	return buf.Bytes(), nil
+}
+
+func (hdr *XrdXrootdMonFileHdr) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize RecType
+	buf.WriteByte(byte(hdr.RecType))
+	// Serialize RecFlag
+	buf.WriteByte(hdr.RecFlag)
+	// Serialize RecSize
+	if err := binary.Write(buf, binary.BigEndian, hdr.RecSize); err != nil {
+		return nil, err
+	}
+
+	// Serialize the union field based on RecType
+	switch hdr.RecType {
+	case isTime:
+		// Serialize NRecs0 and NRecs1
+		if err := binary.Write(buf, binary.BigEndian, hdr.NRecs0); err != nil {
+			return nil, err
+		}
+		if err := binary.Write(buf, binary.BigEndian, hdr.NRecs1); err != nil {
+			return nil, err
+		}
+	case isDisc:
+		// Serialize UserID
+		if err := binary.Write(buf, binary.BigEndian, hdr.UserId); err != nil {
+			return nil, err
+		}
+	default:
+		// Serialize FileID for all other cases (isClose, isOpen, isXFR)
+		if err := binary.Write(buf, binary.BigEndian, hdr.FileId); err != nil {
+			return nil, err
+		}
+	}
+
+	return buf.Bytes(), nil
+}
+
+func (ftod *XrdXrootdMonFileTOD) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// First serialize the header
+	headerBytes, err := ftod.Hdr.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(headerBytes)
+
+	// Serialize TBeg
+	if err := binary.Write(buf, binary.BigEndian, ftod.TBeg); err != nil {
+		return nil, err
+	}
+	// Serialize TEnd
+	if err := binary.Write(buf, binary.BigEndian, ftod.TEnd); err != nil {
+		return nil, err
+	}
+	// Serialize SID
+	if err := binary.Write(buf, binary.BigEndian, ftod.SID); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+func (lfn *XrdXrootdMonFileLFN) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize User
+	if err := binary.Write(buf, binary.BigEndian, lfn.User); err != nil {
+		return nil, err
+	}
+	// Serialize Lfn
+	// Here we don't need to handle endianness since it's a byte array
+	buf.Write(lfn.Lfn[:])
+
+	return buf.Bytes(), nil
+}
+
+func (opn *XrdXrootdMonFileOPN) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize the header
+	headerBytes, err := opn.Hdr.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(headerBytes)
+
+	// Serialize Fsz
+	if err := binary.Write(buf, binary.BigEndian, opn.Fsz); err != nil {
+		return nil, err
+	}
+
+	// Serialize Ufn
+	lfnBytes, err := opn.Ufn.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(lfnBytes)
+
+	return buf.Bytes(), nil
+}
+
+func (xfr *XrdXrootdMonStatXFR) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize Read
+	if err := binary.Write(buf, binary.BigEndian, xfr.Read); err != nil {
+		return nil, err
+	}
+	// Serialize Readv
+	if err := binary.Write(buf, binary.BigEndian, xfr.Readv); err != nil {
+		return nil, err
+	}
+	// Serialize Write
+	if err := binary.Write(buf, binary.BigEndian, xfr.Write); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+func (fileXFR *XrdXrootdMonFileXFR) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize the header
+	headerBytes, err := fileXFR.Hdr.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(headerBytes)
+
+	// Serialize the Xfr stats
+	xfrBytes, err := fileXFR.Xfr.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(xfrBytes)
+
+	return buf.Bytes(), nil
+}
+
+func (ops *XrdXrootdMonStatOPS) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize each field using binary.Write which encodes according to the specified endianness
+	if err := binary.Write(buf, binary.BigEndian, ops.Read); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.Readv); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.Write); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.RsMin); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.RsMax); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.Rsegs); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.RdMin); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.RdMax); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.RvMin); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.RvMax); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.WrMin); err != nil {
+		return nil, err
+	}
+	if err := binary.Write(buf, binary.BigEndian, ops.WrMax); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+// Serialize converts XrdXrootdMonFileCLS to a byte array
+func (cls *XrdXrootdMonFileCLS) Serialize() ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	// Serialize the header
+	headerBytes, err := cls.Hdr.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(headerBytes)
+
+	// Serialize the Xfr stats
+	xfrBytes, err := cls.Xfr.Serialize()
+	if err != nil {
+		return nil, err
+	}
+	buf.Write(xfrBytes)
+
+	// Conditionally serialize Ops if hasOPS flag is set
+	if cls.Hdr.RecFlag&0x02 == 0x02 {
+		opsBytes, err := cls.Ops.Serialize()
+		if err != nil {
+			return nil, err
+		}
+		buf.Write(opsBytes)
+	}
+
+	// Note: Ssq field is not implemented and thus not serialized
+
+	return buf.Bytes(), nil
+}
diff --git a/metrics/xrootd_metrics_test.go b/metrics/xrootd_metrics_test.go
new file mode 100644
index 000000000..772d6f9ab
--- /dev/null
+++ b/metrics/xrootd_metrics_test.go
@@ -0,0 +1,711 @@
+package metrics
+
+import (
+	"bytes"
+	"encoding/xml"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func getAuthInfoString(user UserRecord) string {
+	return fmt.Sprintf("&p=%s&n=%s&h=[::ffff:172.17.0.2]&o=%s&r=%s&g=&m=&I=4", user.AuthenticationProtocol, user.DN, user.Org, user.Role)
+}
+
+func getTokenAuthString(id uint32, user UserRecord) string {
+	return fmt.Sprintf("&Uc=%d&s=%s&n=%s&o=%s&r=%s&g=%s", id, user.DN, user.User, user.Org, user.Role, strings.Join(user.Groups, " "))
+}
+
+func getUserIdString(userId XrdUserId) string {
+	return fmt.Sprintf("%s/%s.%d:%d@%s", userId.Prot, userId.User, userId.Pid, userId.Sid, userId.Host)
+}
+
+func mockFileOpenPacket(pseq int, fileId, userId uint32, SID int64, path string) ([]byte, error) {
+	// f-stream file open event
+	mockMonHeader := XrdXrootdMonHeader{ // 8B
+		Code: 'f',
+		Pseq: byte(pseq),
+		Plen: uint16(8), // to change
+		Stod: int32(time.Now().Unix()),
+	}
+	mockMonFileTOD := XrdXrootdMonFileTOD{
+		Hdr: XrdXrootdMonFileHdr{ // 8B
+			RecType: isTime,
+			RecFlag: 1, // hasSID
+			RecSize: int16(24),
+			NRecs0:  0, // isTime: nRecs[0] == isXfr recs
+			NRecs1:  1, // nRecs[1] == total recs
+		},
+		TBeg: int32(time.Now().Unix()),                  // 4B
+		TEnd: int32(time.Now().Add(time.Second).Unix()), // 4B
+		SID:  SID,                                       // 8B
+	}
+	lfnByteSlice := []byte(path)
+	lfnByteSlice = append(lfnByteSlice, '\x00') // Add null byte to end the string
+
+	mockMonFileOpn := XrdXrootdMonFileOPN{
+		Hdr: XrdXrootdMonFileHdr{ // 8B
+			RecType: isOpen,
+			RecFlag: 3,      // hasLFN hasRW
+			RecSize: 0,      // to change
+			FileId:  fileId, // dictid if recType != isTime
+		},
+		Fsz: 10000, // 8B
+		Ufn: XrdXrootdMonFileLFN{ // 4B + len(lfn)
+			User: userId, // dictid for the user
+		},
+	}
+	copy(mockMonFileOpn.Ufn.Lfn[:], lfnByteSlice)
+	mockMonFileOpn.Hdr.RecSize = int16(16 + 4 + len(lfnByteSlice))
+	mockMonHeader.Plen = uint16(8 + mockMonFileTOD.Hdr.RecSize + mockMonFileOpn.Hdr.RecSize)
+
+	monHeader, err := mockMonHeader.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize monitor header")
+	}
+	fileTod, err := mockMonFileTOD.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize FileTOD")
+	}
+	fileOpn, err := mockMonFileOpn.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize FileOPN")
+	}
+
+	buf := new(bytes.Buffer)
+	buf.Write(monHeader[:])
+	buf.Write(fileTod[:])
+	buf.Write(fileOpn[:])
+
+	bytePacket := buf.Bytes()
+	return bytePacket, nil
+}
+
+func mockFileXfrPacket(pseq int, fileId uint32, SID int64, read, readv, wrtie int64) ([]byte, error) {
+	// f-stream file transfer event
+	mockMonHeader := XrdXrootdMonHeader{ // 8B
+		Code: 'f',
+		Pseq: byte(pseq),
+		Plen: uint16(8), // to change
+		Stod: int32(time.Now().Unix()),
+	}
+	mockMonFileTOD := XrdXrootdMonFileTOD{
+		Hdr: XrdXrootdMonFileHdr{ // 8B
+			RecType: isTime,
+			RecFlag: 1, // hasSID
+			RecSize: int16(24),
+			NRecs0:  0, // isTime: nRecs[0] == isXfr recs
+			NRecs1:  1, // nRecs[1] == total recs
+		},
+		TBeg: int32(time.Now().Unix()),                  // 4B
+		TEnd: int32(time.Now().Add(time.Second).Unix()), // 4B
+		SID:  SID,                                       // 8B
+	}
+	mockMonFileXfr := XrdXrootdMonFileXFR{
+		Hdr: XrdXrootdMonFileHdr{ // 8B
+			RecType: isXfr,
+			RecFlag: 0,
+			RecSize: 32,     // to change
+			FileId:  fileId, // dictid if recType != isTime
+		},
+		Xfr: XrdXrootdMonStatXFR{ // 24B
+			Read:  read,
+			Readv: readv,
+			Write: wrtie,
+		},
+	}
+	mockMonHeader.Plen = uint16(8 + mockMonFileTOD.Hdr.RecSize + mockMonFileXfr.Hdr.RecSize)
+
+	monHeader, err := mockMonHeader.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize monitor header")
+	}
+	fileTod, err := mockMonFileTOD.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize FileTOD")
+	}
+	fileXfr, err := mockMonFileXfr.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize FileOPN")
+	}
+
+	buf := new(bytes.Buffer)
+	buf.Write(monHeader[:])
+	buf.Write(fileTod[:])
+	buf.Write(fileXfr[:])
+
+	bytePacket := buf.Bytes()
+	return bytePacket, nil
+}
+
+func mockStatOps(read, readv, write int32, rsegs int64) *XrdXrootdMonStatOPS {
+	monOps := XrdXrootdMonStatOPS{ // 48B
+		Read:  read,
+		Readv: readv,
+		Write: write,
+		Rsegs: rsegs,
+	}
+
+	return &monOps
+}
+
+func mockFileClosePacket(pseq int, fileId uint32, SID int64, statOps *XrdXrootdMonStatOPS, read, readv, write int64) ([]byte, error) {
+	// f-stream file close event
+	mockMonHeader := XrdXrootdMonHeader{ // 8B
+		Code: 'f',
+		Pseq: byte(pseq),
+		Plen: uint16(8), // to change
+		Stod: int32(time.Now().Unix()),
+	}
+	mockMonFileTOD := XrdXrootdMonFileTOD{
+		Hdr: XrdXrootdMonFileHdr{ // 8B
+			RecType: isTime,
+			RecFlag: 0x01, // hasSID
+			RecSize: int16(24),
+			NRecs0:  0, // isTime: nRecs[0] == isXfr recs
+			NRecs1:  1, // nRecs[1] == total recs
+		},
+		TBeg: int32(time.Now().Unix()),                  // 4B
+		TEnd: int32(time.Now().Add(time.Second).Unix()), // 4B
+		SID:  SID,                                       // 8B
+	}
+	mockFileClose := XrdXrootdMonFileCLS{
+		Hdr: XrdXrootdMonFileHdr{ // 8B
+			RecType: isClose,
+			RecFlag: 0x02,   // hasOPS
+			RecSize: 80,     // to change
+			FileId:  fileId, // dictid if recType != isTime
+		},
+		Xfr: XrdXrootdMonStatXFR{ // 24B
+			Read:  read,
+			Readv: readv,
+			Write: write,
+		},
+		Ops: *statOps, // 48B
+	}
+
+	mockMonHeader.Plen = uint16(8 + mockMonFileTOD.Hdr.RecSize + mockFileClose.Hdr.RecSize)
+
+	monHeader, err := mockMonHeader.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize monitor header")
+	}
+	fileTod, err := mockMonFileTOD.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize FileTOD")
+	}
+	fileClose, err := mockFileClose.Serialize()
+	if err != nil {
+		return nil, errors.Wrap(err, "Error serialize FileCLS")
+	}
+
+	buf := new(bytes.Buffer)
+	buf.Write(monHeader[:])
+	buf.Write(fileTod[:])
+	buf.Write(fileClose[:])
+
+	return buf.Bytes(), nil
+}
+
+func TestHandlePacket(t *testing.T) {
+	mockFileID := uint32(999)
+	mockSID := int64(143152967831384)
+	mockUserID := uint32(10)
+	mockRead := int64(10000)
+	mockReadV := int64(20000)
+	mockWrite := int64(120)
+
+	t.Run("an-empty-detail-packet-should-return-error", func(t *testing.T) {
+		err := HandlePacket([]byte{})
+		assert.Error(t, err, "No error reported with an empty detail packet")
+	})
+
+	t.Run("record-correct-threads-from-summary-packet", func(t *testing.T) {
+		mockShedSummary := SummaryStatistics{
+			Version: "0.0",
+			Program: "xrootd",
+			Stats: []SummaryStat{
+				{
+					Id:      "sched",
+					Threads: 10,
+					Idle:    8,
+				},
+			},
+		}
+
+		Threads.Reset()
+
+		mockShedSummaryBytes, err := xml.Marshal(mockShedSummary)
+		require.NoError(t, err, "Error Marshal Summary packet")
+
+		mockPromThreads := `
+		# HELP xrootd_sched_thread_count Number of scheduler threads
+		# TYPE xrootd_sched_thread_count gauge
+		xrootd_sched_thread_count{state="idle"} 8
+		xrootd_sched_thread_count{state="running"} 2
+		`
+		expectedReader := strings.NewReader(mockPromThreads)
+
+		err = HandlePacket(mockShedSummaryBytes)
+		require.NoError(t, err, "Error handling the packet")
+		if err := testutil.CollectAndCompare(Threads, expectedReader, "xrootd_sched_thread_count"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+	})
+
+	t.Run("record-correct-link-from-summary-packet", func(t *testing.T) {
+		mockLinkSummaryBase := SummaryStatistics{
+			Version: "0.0",
+			Program: "xrootd",
+			Stats: []SummaryStat{
+				{
+					Id:    "link",
+					Total: 9,
+					In:    99,
+					Out:   999,
+				},
+			},
+		}
+		mockLinkSummaryInc := SummaryStatistics{
+			Version: "0.0",
+			Program: "xrootd",
+			Stats: []SummaryStat{
+				{
+					Id:    "link",
+					Total: 10,
+					In:    100,
+					Out:   1000,
+				},
+			},
+		}
+		mockLinkSummaryCMSD := SummaryStatistics{
+			Version: "0.0",
+			Program: "cmsd",
+			Stats: []SummaryStat{
+				{
+					Id:    "link",
+					Total: 2,
+					In:    0,
+					Out:   0,
+				},
+			},
+		}
+
+		BytesXfer.Reset()
+		Threads.Reset()
+
+		mockLinkSummaryBaseBytes, err := xml.Marshal(mockLinkSummaryBase)
+		require.NoError(t, err, "Error Marshal Summary packet")
+		mockLinkSummaryIncBaseBytes, err := xml.Marshal(mockLinkSummaryInc)
+		require.NoError(t, err, "Error Marshal Summary packet")
+		mockLinkSummaryCMSDBaseBytes, err := xml.Marshal(mockLinkSummaryCMSD)
+		require.NoError(t, err, "Error Marshal Summary packet")
+
+		mockPromLinkConnectBase := `
+		# HELP xrootd_server_connection_count Aggregate number of server connections
+		# TYPE xrootd_server_connection_count counter
+		xrootd_server_connection_count 9
+		`
+
+		mockPromLinkByteXferBase := `
+		# HELP xrootd_server_bytes Number of bytes read into the server
+		# TYPE xrootd_server_bytes counter
+		xrootd_server_bytes{direction="rx"} 99
+		xrootd_server_bytes{direction="tx"} 999
+		`
+
+		mockPromLinkConnectInc := `
+		# HELP xrootd_server_connection_count Aggregate number of server connections
+		# TYPE xrootd_server_connection_count counter
+		xrootd_server_connection_count 10
+		`
+
+		mockPromLinkByteXferInc := `
+		# HELP xrootd_server_bytes Number of bytes read into the server
+		# TYPE xrootd_server_bytes counter
+		xrootd_server_bytes{direction="rx"} 100
+		xrootd_server_bytes{direction="tx"} 1000
+		`
+
+		expectedLinkConnectBase := strings.NewReader(mockPromLinkConnectBase)
+		expectedLinkByteXferBase := strings.NewReader(mockPromLinkByteXferBase)
+		expectedLinkConnectInc := strings.NewReader(mockPromLinkConnectInc)
+		expectedLinkByteXferInc := strings.NewReader(mockPromLinkByteXferInc)
+		expectedLinkConnectIncDup := strings.NewReader(mockPromLinkConnectInc)
+		expectedLinkByteXferIncDup := strings.NewReader(mockPromLinkByteXferInc)
+
+		// First time received a summmary packet
+		err = HandlePacket(mockLinkSummaryBaseBytes)
+		require.NoError(t, err, "Error handling the packet")
+		if err := testutil.CollectAndCompare(Connections, expectedLinkConnectBase, "xrootd_server_connection_count"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+		if err := testutil.CollectAndCompare(BytesXfer, expectedLinkByteXferBase, "xrootd_server_bytes"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+
+		// Second time received a summmary packet, with numbers more than first time
+		// And metrics should be updated to the max number
+
+		// Have one CMSD summary packets which should be ignored
+		err = HandlePacket(mockLinkSummaryCMSDBaseBytes)
+		require.NoError(t, err, "Error handling the packet")
+		// Have one CMSD summary packets which should be ignored
+		err = HandlePacket(mockLinkSummaryCMSDBaseBytes)
+		require.NoError(t, err, "Error handling the packet")
+
+		err = HandlePacket(mockLinkSummaryIncBaseBytes)
+		require.NoError(t, err, "Error handling the packet")
+
+		if err := testutil.CollectAndCompare(Connections, expectedLinkConnectInc, "xrootd_server_connection_count"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+		if err := testutil.CollectAndCompare(BytesXfer, expectedLinkByteXferInc, "xrootd_server_bytes"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+
+		// Summary data sent to CMSD shouldn't be recorded into the metrics
+		err = HandlePacket(mockLinkSummaryCMSDBaseBytes)
+		require.NoError(t, err, "Error handling the packet")
+
+		if err := testutil.CollectAndCompare(Connections, expectedLinkConnectIncDup, "xrootd_server_connection_count"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+		if err := testutil.CollectAndCompare(BytesXfer, expectedLinkByteXferIncDup, "xrootd_server_bytes"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+	})
+
+	t.Run("auth-packet-u-should-register-correct-info", func(t *testing.T) {
+		mockUserRecord := UserRecord{
+			AuthenticationProtocol: "https",
+			DN:                     "clientName",
+			Role:                   "clientRole",
+			Org:                    "clientOrg",
+		}
+		mockXrdUserId := XrdUserId{
+			Prot: "https",
+			User: "unknown",
+			Pid:  0,
+			Sid:  143152967831384,
+			Host: "fae8c2865de4",
+		}
+		mockInfo := []byte(getUserIdString(mockXrdUserId) + "\n" + getAuthInfoString(mockUserRecord))
+		mockMonMap := XrdXrootdMonMap{
+			Hdr: XrdXrootdMonHeader{ // 8B
+				// u-stream provides client login information; enabled by the auth and use
+				Code: 'u',
+				Pseq: 1,
+				Plen: uint16(12 + len(mockInfo)),
+				Stod: int32(time.Now().Unix()),
+			},
+			Dictid: uint32(0x12345678), // 4B
+			Info:   mockInfo,
+		}
+
+		sessions.DeleteAll()
+
+		buf, err := mockMonMap.Serialize()
+		require.NoError(t, err, "Error serializing monitor packet")
+		err = HandlePacket(buf)
+		require.NoError(t, err, "Error handling packet")
+
+		require.Equal(t, 1, len(sessions.Keys()), "Session cache didn't update")
+
+		assert.Equal(t, uint32(0x12345678), sessions.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		sessionEntry := sessions.Get(sessions.Keys()[0]).Value()
+		assert.Equal(t, mockUserRecord.AuthenticationProtocol, sessionEntry.AuthenticationProtocol)
+		assert.Equal(t, mockUserRecord.DN, sessionEntry.DN)
+		assert.Equal(t, mockUserRecord.Role, sessionEntry.Role)
+		assert.Equal(t, mockUserRecord.Org, sessionEntry.Org)
+
+		sessions.DeleteAll()
+	})
+
+	t.Run("file-path-packet-d-should-register-correct-info", func(t *testing.T) {
+		mockXrdUserId := XrdUserId{
+			Prot: "https",
+			User: "unknown",
+			Pid:  0,
+			Sid:  143152967831384,
+			Host: "fae8c2865de4",
+		}
+
+		mockInfo := []byte(getUserIdString(mockXrdUserId) + "\n" + "/full/path/to/file.txt")
+
+		mockMonMap := XrdXrootdMonMap{
+			Hdr: XrdXrootdMonHeader{ // 8B
+				// d-stream provides the identifier assigned to a user and file path; enabled
+				Code: 'd',
+				Pseq: 1,
+				Plen: uint16(12 + len(mockInfo)),
+				Stod: int32(time.Now().Unix()),
+			},
+			Dictid: uint32(10), // 4B
+			Info:   mockInfo,
+		}
+
+		buf, err := mockMonMap.Serialize()
+		require.NoError(t, err, "Error serializing monitor packet")
+
+		transfers.DeleteAll()
+
+		err = HandlePacket(buf)
+		require.NoError(t, err, "Error handling packet")
+		require.Equal(t, 1, len(transfers.Keys()), "Transfer cache didn't update")
+		assert.Equal(t, uint32(10), transfers.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		transferEntry := transfers.Get(transfers.Keys()[0]).Value()
+		// I'm not sure the intent of the Path attribute and looking at ComputePrefix,
+		// it seems to return "/" all the time as the length of monitorPaths is
+		// never changed
+		assert.Equal(t, "/", transferEntry.Path, "Path in transfer cache entry doesn't match expected")
+
+		assert.Equal(t, uint32(0x12345678), transferEntry.UserId.Id, "UserID in transfer cache entry doesn't match expected")
+		transfers.DeleteAll()
+	})
+
+	t.Run("f-stream-file-open-event-should-register-correctly", func(t *testing.T) {
+		bytePacket, err := mockFileOpenPacket(0, mockFileID, mockUserID, mockSID, "/full/path/to/file.txt")
+		require.NoError(t, err, "Error generating mock file open packet")
+
+		transfers.DeleteAll()
+
+		err = HandlePacket(bytePacket)
+		require.NoError(t, err, "Error handling the packet")
+		require.Equal(t, 1, len(transfers.Keys()), "Transfer cache didn't update")
+		assert.Equal(t, mockFileID, transfers.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		transferEntry := transfers.Get(transfers.Keys()[0]).Value()
+		// I'm not sure the intent of the Path attribute and looking at ComputePrefix,
+		// it seems to return "/" all the time as the length of monitorPaths is
+		// never changed
+		assert.Equal(t, "/", transferEntry.Path, "Path in transfer cache entry doesn't match expected")
+		// TODO: Figure out why there's such discrepency here and the d-stream (where userid == sid),
+		// but for other tests to run, just change to what returns to me for now
+		assert.Equal(t, mockUserID, transferEntry.UserId.Id, "UserID in transfer cache entry doesn't match expected")
+		transfers.DeleteAll()
+	})
+
+	t.Run("f-stream-file-xfr-event-should-register-correctly", func(t *testing.T) {
+		bytePacket, err := mockFileXfrPacket(0, mockFileID, mockSID, mockRead, mockReadV, mockWrite)
+		require.NoError(t, err, "Error generating mock file open packet")
+
+		transfers.DeleteAll()
+
+		err = HandlePacket(bytePacket)
+		require.NoError(t, err, "Error handling the packet")
+		require.Equal(t, 1, len(transfers.Keys()), "Transfer cache didn't update")
+		assert.Equal(t, mockFileID, transfers.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		transferEntry := transfers.Get(transfers.Keys()[0]).Value()
+		assert.Equal(t, mockRead, int64(transferEntry.ReadBytes))
+		assert.Equal(t, mockReadV, int64(transferEntry.ReadvBytes))
+		assert.Equal(t, mockWrite, int64(transferEntry.WriteBytes))
+
+		transfers.DeleteAll()
+	})
+
+	t.Run("f-stream-file-open-xfr-event-should-register-correctly", func(t *testing.T) {
+		openPacket, err := mockFileOpenPacket(0, mockFileID, mockUserID, mockSID, "/full/path/to/file.txt")
+		require.NoError(t, err, "Error generating mock file open packet")
+		xftPacket, err := mockFileXfrPacket(1, mockFileID, mockSID, mockRead, mockReadV, mockWrite)
+		require.NoError(t, err, "Error generating mock file transfer packet")
+
+		transfers.DeleteAll()
+
+		err = HandlePacket(openPacket)
+		require.NoError(t, err, "Error handling the file open packet")
+
+		err = HandlePacket(xftPacket)
+		require.NoError(t, err, "Error handling the file transfer packet")
+
+		require.Equal(t, 1, len(transfers.Keys()), "Transfer cache didn't update")
+		assert.Equal(t, mockFileID, transfers.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		transferEntry := transfers.Get(transfers.Keys()[0]).Value()
+		assert.Equal(t, mockRead, int64(transferEntry.ReadBytes))
+		assert.Equal(t, mockReadV, int64(transferEntry.ReadvBytes))
+		assert.Equal(t, mockWrite, int64(transferEntry.WriteBytes))
+		assert.Equal(t, "/", transferEntry.Path, "Path in transfer cache entry doesn't match expected")
+		// TODO: Figure out why there's such discrepency here and the d-stream (where userid == sid),
+		// but for other tests to run, just change to what returns to me for now
+		assert.Equal(t, mockUserID, transferEntry.UserId.Id, "UserID in transfer cache entry doesn't match expected")
+		transfers.DeleteAll()
+	})
+
+	// Testing against close event is less meaningfult than do a full-run
+	// as the close event require user/transfer info to work as expected. Although
+	// adding another test case with file-close event only to check the edge cases is
+	// also highly recommended
+	t.Run("f-stream-file-open-xfr-close-events-should-register-correctly", func(t *testing.T) {
+		mockReadCalls := int32(120)
+		mockReadVCalls := int32(10)
+		mockWriteCalls := int32(30)
+		mockReadVSegments := int64(1000)
+
+		TransferReadvSegs.Reset()
+		TransferOps.Reset()
+		TransferBytes.Reset()
+
+		openPacket, err := mockFileOpenPacket(0, mockFileID, mockUserID, mockSID, "/full/path/to/file.txt")
+		require.NoError(t, err, "Error generating mock file open packet")
+		xftPacket, err := mockFileXfrPacket(1, mockFileID, mockSID, mockRead, mockReadV, mockWrite)
+		require.NoError(t, err, "Error generating mock file transfer packet")
+		opsState := mockStatOps(mockReadCalls, mockReadVCalls, mockWriteCalls, mockReadVSegments)
+		clsPacket, err := mockFileClosePacket(2, mockFileID, mockSID, opsState, mockRead, mockReadV, mockWrite)
+		require.NoError(t, err, "Error generating mock file close packet")
+
+		transfers.DeleteAll()
+		sessions.DeleteAll()
+
+		err = HandlePacket(openPacket)
+		require.NoError(t, err, "Error handling the file open packet")
+
+		require.Equal(t, 1, len(transfers.Keys()), "Transfer cache didn't update")
+		assert.Equal(t, mockFileID, transfers.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		transferEntry := transfers.Get(transfers.Keys()[0]).Value()
+		assert.Equal(t, "/", transferEntry.Path, "Path in transfer cache entry doesn't match expected")
+		assert.Equal(t, mockUserID, transferEntry.UserId.Id, "UserID in transfer cache entry doesn't match expected")
+
+		err = HandlePacket(xftPacket)
+		require.NoError(t, err, "Error handling the file transfer packet")
+
+		err = HandlePacket(clsPacket)
+		require.NoError(t, err, "Error handling the file close packet")
+
+		// Trasnfer item should be deleted on file close
+		require.Equal(t, 0, len(transfers.Keys()), "Transfer cache didn't update")
+
+		expectedTransferReadvSegs := `
+		# HELP xrootd_transfer_readv_segments_count Number of segments in readv operations
+		# TYPE xrootd_transfer_readv_segments_count counter
+		xrootd_transfer_readv_segments_count{ap="",dn="",org="",path="/",role=""} 1000
+		`
+
+		expectedTransferOps := `
+		# HELP xrootd_transfer_operations_count Number of transfer operations performed
+		# TYPE xrootd_transfer_operations_count counter
+		xrootd_transfer_operations_count{ap="",dn="",org="",path="/",role="",type="read"} 120
+		xrootd_transfer_operations_count{ap="",dn="",org="",path="/",role="",type="readv"} 10
+		xrootd_transfer_operations_count{ap="",dn="",org="",path="/",role="",type="write"} 30
+		`
+
+		expectedTransferBytes := `
+		# HELP xrootd_transfer_bytes Bytes of transfers
+		# TYPE xrootd_transfer_bytes counter
+		xrootd_transfer_bytes{ap="",dn="",org="",path="/",role="",type="read"} 10000
+		xrootd_transfer_bytes{ap="",dn="",org="",path="/",role="",type="readv"} 20000
+		xrootd_transfer_bytes{ap="",dn="",org="",path="/",role="",type="write"} 120
+		`
+
+		expectedTransferReadvSegsReader := strings.NewReader(expectedTransferReadvSegs)
+		expectedTransferOpsReader := strings.NewReader(expectedTransferOps)
+		expectedTransferBytesReader := strings.NewReader(expectedTransferBytes)
+
+		if err := testutil.CollectAndCompare(TransferReadvSegs, expectedTransferReadvSegsReader, "xrootd_transfer_readv_segments_count"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+
+		if err := testutil.CollectAndCompare(TransferOps, expectedTransferOpsReader, "xrootd_transfer_operations_count"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+
+		if err := testutil.CollectAndCompare(TransferBytes, expectedTransferBytesReader, "xrootd_transfer_bytes"); err != nil {
+			require.NoError(t, err, "Collected metric is different from expected")
+		}
+	})
+
+	// The token packet should update the user's session.
+	t.Run("token-packet-updates-session", func(t *testing.T) {
+		mockUserRecord := UserRecord{
+			AuthenticationProtocol: "https",
+			DN:                     "clientName",
+			Role:                   "clientRole",
+			Org:                    "clientOrg",
+		}
+		mockTokenRecord := UserRecord{
+			AuthenticationProtocol: "ztn",
+			DN:                     "token subject",
+			Role:                   "role1",
+			Org:                    "https://example.com",
+			Groups:                 []string{"group1", "group2"},
+		}
+		mockXrdUserId := XrdUserId{
+			Prot: "https",
+			User: "unknown",
+			Pid:  0,
+			Sid:  143152967831384,
+			Host: "fae8c2865de4",
+		}
+		mockUserInfo := []byte(getUserIdString(mockXrdUserId) + "\n" + getAuthInfoString(mockUserRecord))
+		mockTokenInfo := []byte(getUserIdString(mockXrdUserId) + "\n" + getTokenAuthString(0x12345678, mockTokenRecord))
+		unixtime := int32(time.Now().Unix())
+		mockMonMap1 := XrdXrootdMonMap{
+			Hdr: XrdXrootdMonHeader{
+				Code: 'u',
+				Pseq: 1,
+				Plen: uint16(12 + len(mockUserInfo)),
+				Stod: unixtime,
+			},
+			Dictid: uint32(0x12345678),
+			Info:   mockUserInfo,
+		}
+
+		mockMonMap2 := XrdXrootdMonMap{
+			Hdr: XrdXrootdMonHeader{ // 8B
+				// T provides used token information
+				Code: 'T',
+				Pseq: 1,
+				Plen: uint16(12 + len(mockTokenInfo)),
+				Stod: int32(time.Now().Unix()),
+			},
+			Dictid: uint32(0x12345679), // 4B
+			Info:   mockTokenInfo,
+		}
+
+		sessions.DeleteAll()
+
+		buf, err := mockMonMap1.Serialize()
+		require.NoError(t, err, "Error serializing monitor packet")
+		err = HandlePacket(buf)
+		require.NoError(t, err, "Error handling packet")
+
+		require.Equal(t, 1, len(sessions.Keys()), "Session cache didn't update")
+
+		assert.Equal(t, uint32(0x12345678), sessions.Keys()[0].Id, "Id in session cache entry doesn't match expected")
+		sessionEntry := sessions.Get(sessions.Keys()[0]).Value()
+		assert.Equal(t, mockUserRecord.AuthenticationProtocol, sessionEntry.AuthenticationProtocol)
+		assert.Equal(t, mockUserRecord.DN, sessionEntry.DN)
+		assert.Equal(t, mockUserRecord.Role, sessionEntry.Role)
+		assert.Equal(t, mockUserRecord.Org, sessionEntry.Org)
+
+		buf, err = mockMonMap2.Serialize()
+		require.NoError(t, err)
+		err = HandlePacket(buf)
+		require.NoError(t, err)
+
+		require.Equal(t, 1, len(sessions.Keys()))
+		sessionEntry = sessions.Get(sessions.Keys()[0]).Value()
+		assert.Equal(t, mockTokenRecord.AuthenticationProtocol, sessionEntry.AuthenticationProtocol)
+		assert.Equal(t, mockTokenRecord.DN, sessionEntry.DN)
+		assert.Equal(t, mockTokenRecord.User, sessionEntry.User)
+		assert.Equal(t, mockTokenRecord.Role, sessionEntry.Role)
+		assert.Equal(t, mockTokenRecord.Groups, sessionEntry.Groups)
+		assert.Equal(t, mockTokenRecord.Org, sessionEntry.Org)
+
+		sessions.DeleteAll()
+	})
+}
+
+func TestComputePaths(t *testing.T) {
+	assert.Equal(t, "/foo", computePrefix("/foo", []PathList{{Paths: []string{"", "*"}}}))
+	assert.Equal(t, "/", computePrefix("/foo", []PathList{{Paths: []string{"", "baz"}}}))
+	assert.Equal(t, "/", computePrefix("/foo", []PathList{{Paths: []string{"", ""}}}))
+	assert.Equal(t, "/foo", computePrefix("/foo", []PathList{{Paths: []string{"", "foo"}}}))
+	assert.Equal(t, "/foo/bar/baz", computePrefix("/foo/bar/baz", []PathList{{Paths: []string{"", "foo", "*", "baz"}}}))
+	assert.Equal(t, "/foo/bar/baz", computePrefix("/foo/bar/baz", []PathList{{Paths: []string{"", "1"}}, {Paths: []string{"", "foo", "*", "baz"}}}))
+	assert.Equal(t, "/foo/bar/baz", computePrefix("/foo/bar/baz", []PathList{{Paths: []string{"", "foo", "*", "*"}}}))
+}
diff --git a/namespace-registry/registry-db.go b/namespace-registry/registry-db.go
deleted file mode 100644
index 2b8f31b55..000000000
--- a/namespace-registry/registry-db.go
+++ /dev/null
@@ -1,193 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-package nsregistry
-
-import (
-	"database/sql"
-	"log"
-	"os"
-	"path/filepath"
-
-	"github.com/lestrrat-go/jwx/v2/jwk"
-	"github.com/pkg/errors"
-	"github.com/spf13/viper"
-	// commented sqlite driver requires CGO
-	// _ "github.com/mattn/go-sqlite3" // SQLite driver
-	_ "modernc.org/sqlite"
-)
-
-type Namespace struct {
-	ID            int
-	Prefix        string
-	Pubkey        string
-	Identity      string
-	AdminMetadata string
-}
-
-/*
-Declare the DB handle as an unexported global so that all
-functions in the package can access it without having to
-pass it around. This simplifies the HTTP handlers, and
-the handle is already thread-safe! The approach being used
-is based off of 1.b from
-https://www.alexedwards.net/blog/organising-database-access
-*/
-var db *sql.DB
-
-func createNamespaceTable() {
-	query := `
-    CREATE TABLE IF NOT EXISTS namespace (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        prefix TEXT NOT NULL UNIQUE,
-        pubkey TEXT NOT NULL,
-        identity TEXT,
-        admin_metadata TEXT
-    );`
-
-	_, err := db.Exec(query)
-	if err != nil {
-		log.Fatalf("Failed to create table: %v", err)
-	}
-}
-
-func namespaceExists(prefix string) (bool, error) {
-	checkQuery := `SELECT prefix FROM namespace WHERE prefix = ?`
-	result, err := db.Query(checkQuery, prefix)
-	if err != nil {
-		return false, err
-	}
-	defer result.Close()
-
-	found := false
-	for result.Next() {
-		found = true
-		break
-	}
-	return found, nil
-}
-
-func getPrefixJwks(prefix string) (*jwk.Set, error) {
-	jwksQuery := `SELECT pubkey FROM namespace WHERE prefix = ?`
-	var pubkeyStr string
-	err := db.QueryRow(jwksQuery, prefix).Scan(&pubkeyStr)
-	if err != nil {
-		if err == sql.ErrNoRows {
-			return nil, errors.New("prefix not found in database")
-		}
-		return nil, errors.Wrap(err, "error performing origin pubkey query")
-	}
-
-	set, err := jwk.ParseString(pubkeyStr)
-	if err != nil {
-		return nil, errors.Wrap(err, "Failed to parse pubkey as a jwks")
-	}
-
-	return &set, nil
-}
-
-/*
-Some generic functions for CRUD actions on namespaces,
-used BY the registry (as opposed to the parallel
-functions) used by the client.
-*/
-func addNamespace(ns *Namespace) error {
-	query := `INSERT INTO namespace (prefix, pubkey, identity, admin_metadata) VALUES (?, ?, ?, ?)`
-	_, err := db.Exec(query, ns.Prefix, ns.Pubkey, ns.Identity, ns.AdminMetadata)
-	return err
-}
-
-/**
- * Commenting this out until we are ready to use it.  -BB
-func updateNamespace(ns *Namespace) error {
-	query := `UPDATE namespace SET pubkey = ?, identity = ?, admin_metadata = ? WHERE prefix = ?`
-	_, err := db.Exec(query, ns.Pubkey, ns.Identity, ns.AdminMetadata, ns.Prefix)
-	return err
-}
-*/
-
-func deleteNamespace(prefix string) error {
-	deleteQuery := `DELETE FROM namespace WHERE prefix = ?`
-	_, err := db.Exec(deleteQuery, prefix)
-	if err != nil {
-		return errors.Wrap(err, "Failed to execute deletion query")
-	}
-
-	return nil
-}
-
-/**
- * Commenting this out until we are ready to use it.  -BB
-func getNamespace(prefix string) (*Namespace, error) {
-	ns := &Namespace{}
-	query := `SELECT * FROM namespace WHERE prefix = ?`
-	err := db.QueryRow(query, prefix).Scan(&ns.ID, &ns.Prefix, &ns.Pubkey, &ns.Identity, &ns.AdminMetadata)
-	if err != nil {
-		return nil, err
-	}
-	return ns, nil
-}
-*/
-
-func getAllNamespaces() ([]*Namespace, error) {
-	query := `SELECT * FROM namespace`
-	rows, err := db.Query(query)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	namespaces := make([]*Namespace, 0)
-	for rows.Next() {
-		ns := &Namespace{}
-		if err := rows.Scan(&ns.ID, &ns.Prefix, &ns.Pubkey, &ns.Identity, &ns.AdminMetadata); err != nil {
-			return nil, err
-		}
-		namespaces = append(namespaces, ns)
-	}
-
-	return namespaces, nil
-}
-
-func InitializeDB() error {
-	dbPath := viper.GetString("NSRegistryLocation")
-	if dbPath == "" {
-		err := errors.New("Could not get path for the namespace registry database.")
-		log.Fatal(err)
-		return err
-	}
-
-	// Before attempting to create the database, the path
-	// must exist or sql.Open will panic.
-	err := os.MkdirAll(filepath.Dir(dbPath), 0755)
-	if err != nil {
-		return errors.Wrap(err, "Failed to create directory for namespace registry database")
-	}
-
-	if len(filepath.Ext(dbPath)) == 0 { // No fp extension, let's add .sqlite so it's obvious what the file is
-		dbPath += ".sqlite"
-	}
-
-	db, err = sql.Open("sqlite", dbPath)
-	if err != nil {
-		return errors.Wrapf(err, "Failed to open the database with path: %s", dbPath)
-	}
-
-	createNamespaceTable()
-	return db.Ping()
-}
diff --git a/namespaces/namespaces.go b/namespaces/namespaces.go
index b0babc30d..6fe91b80b 100644
--- a/namespaces/namespaces.go
+++ b/namespaces/namespaces.go
@@ -16,6 +16,13 @@
  *
  ***************************************************************/
 
+// Package namespaces implements namespace lookups and matches for legacy [stashcp] and [osdf-client]
+// to maintain backward compatibility.
+//
+// The namespaces package should not be used for any new features Pelican introduces.
+//
+// [stashcp]: https://github.com/opensciencegrid/stashcp
+// [osdf-client]: https://github.com/htcondor/osdf-client
 package namespaces
 
 import (
@@ -29,8 +36,8 @@ import (
 	"strings"
 
 	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
 )
 
 // I don't think we actually want pelican to download the namespace every build
@@ -182,12 +189,12 @@ func GetNamespaces() ([]Namespace, error) {
 // downloadNamespace downloads the namespace information with timeouts
 func downloadNamespace() ([]byte, error) {
 	// Get the namespace url from the environment
-	namespaceUrl := viper.GetString("TopologyNamespaceURL")
-	if len(namespaceUrl) == 0 {
-		return nil, errors.New("NamespaceURL is not set; unable to locate valid caches")
+	topoNamespaceUrl := param.Federation_TopologyNamespaceUrl.GetString()
+	if len(topoNamespaceUrl) == 0 {
+		return nil, errors.New("Federation.TopologyNamespaceUrl is not set; unable to locate valid caches")
 	}
-	log.Debugln("Downloading namespaces information from", namespaceUrl)
-	resp, err := http.Get(namespaceUrl)
+	log.Debugln("Downloading namespaces information from", topoNamespaceUrl)
+	resp, err := http.Get(topoNamespaceUrl)
 	if err != nil {
 		return nil, err
 	}
diff --git a/oa4mp/proxy.go b/oa4mp/proxy.go
new file mode 100644
index 000000000..86fb73542
--- /dev/null
+++ b/oa4mp/proxy.go
@@ -0,0 +1,115 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package oa4mp
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+var (
+	// We have a custom transport object based on the common code in `config`;
+	// this is because we need a custom dialer to talk to OA4MP over a socket.
+	transport *http.Transport
+
+	onceTransport sync.Once
+)
+
+func getTransport() *http.Transport {
+	onceTransport.Do(func() {
+		socketName := filepath.Join(param.Issuer_ScitokensServerLocation.GetString(),
+			"var", "http.sock")
+		var copyTransport http.Transport = *config.GetTransport()
+		transport = &copyTransport
+		// When creating a new socket out to the remote server, ignore the actual
+		// requested address and return a Unix socket instead.
+		transport.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
+			return net.Dial("unix", socketName)
+		}
+	})
+	return transport
+}
+
+// Copy headers from proxied src to dst, removing those defined
+// by HTTP as "hop-by-hop" and not to be forwarded (see
+// https://www.rfc-editor.org/rfc/rfc9110#field.connection)
+func copyHeader(dst, src http.Header) {
+	hopByHop := make(map[string]bool)
+	hopByHop["Proxy-Conenction"] = true
+	hopByHop["Keep-Alive"] = true
+	hopByHop["TE"] = true
+	hopByHop["Transfer-Encoding"] = true
+	hopByHop["Upgrade"] = true
+	for _, value := range src["Connection"] {
+		hopByHop[http.CanonicalHeaderKey(value)] = true
+	}
+	for headerName, headerValues := range src {
+		if hopByHop[headerName] {
+			continue
+		}
+		for _, value := range headerValues {
+			dst.Add(headerName, value)
+		}
+	}
+}
+
+func oa4mpProxy(ctx *gin.Context) {
+	origPath := ctx.Request.URL.Path
+	origPath = strings.TrimPrefix(origPath, "/api/v1.0/issuer")
+	ctx.Request.URL.Path = "/scitokens-server" + origPath
+	ctx.Request.URL.Scheme = "http"
+	ctx.Request.URL.Host = "localhost"
+
+	log.Debugln("Will proxy request to URL", ctx.Request.URL.String())
+	transport = getTransport()
+	resp, err := transport.RoundTrip(ctx.Request)
+	if err != nil {
+		log.Infoln("Failed to talk to OA4MP service:", err)
+		ctx.JSON(http.StatusServiceUnavailable, gin.H{"error": "Unable to contact token issuer"})
+		return
+	}
+	defer resp.Body.Close()
+
+	copyHeader(ctx.Writer.Header(), resp.Header)
+	ctx.Writer.WriteHeader(resp.StatusCode)
+	if _, err = io.Copy(ctx.Writer, resp.Body); err != nil {
+		log.Warningln("Failed to copy response body from OA4MP to client:", err)
+	}
+}
+
+func ConfigureOA4MPProxy(router *gin.Engine) error {
+	if router == nil {
+		return errors.New("Origin configuration passed a nil pointer")
+	}
+
+	router.Any("/api/v1.0/issuer", oa4mpProxy)
+	router.Any("/api/v1.0/issuer/*path", oa4mpProxy)
+
+	return nil
+}
diff --git a/oa4mp/resources/id_token_policies.qdl b/oa4mp/resources/id_token_policies.qdl
new file mode 100644
index 000000000..d833c5452
--- /dev/null
+++ b/oa4mp/resources/id_token_policies.qdl
@@ -0,0 +1,66 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+if [0 == size(proxy_claims.)] then
+[
+     /* Fallback: OA4MP 5.4.1 doesn't set proxy_claims at all.
+        Copy from the claims token as a workaround
+      */
+{{ range $req := .OIDCAuthnReqs }}
+     if [is_defined(claims.'{{- $req.Claim -}}')] then
+     [
+         proxy_claims.'{{- $req.Claim -}}' := claims.'{{- $req.Claim -}}';
+     ];
+{{ end -}}
+     if [is_defined(claims.'{{- .OIDCAuthnUserClaim }}')] then
+     [
+         proxy_claims.'{{- .OIDCAuthnUserClaim }}' := claims.'{{- .OIDCAuthnUserClaim }}';
+     ];
+     if [0 == size(proxy_claims.)] then
+     [
+         return();
+     ];
+];
+
+say(proxy_claims.);
+
+{{ range $req := .OIDCAuthnReqs -}}
+if [!is_defined(proxy_claims.'{{- $req.Claim -}}')] then
+[
+     sys_err.ok := false;
+     sys_err.message := 'Authentication is missing claim {{- $req.Claim -}}.';
+     return();
+];
+
+if [proxy_claims.'{{- $req.Claim -}}'  != '{{- $req.Value -}}'] then
+[
+     sys_err.ok := false;
+     sys_err.message := 'Claim "{{- $req.Claim -}}" must be set to "{{- $req.Value -}}" for authentication';
+     return();
+];
+{{ end -}}
+
+if [!is_defined(proxy_claims.'{{- .OIDCAuthnUserClaim -}}')] then
+[
+     sys_err.ok := false;
+     sys_err.message := 'Authentication is missing claim "{{- .OIDCAuthnUserClaim -}}".';
+     return();
+];
+claims.'sub' := proxy_claims.'{{- .OIDCAuthnUserClaim -}}';
+
+claims.iss := '{{- .OIDCIssuerURL -}}';
diff --git a/oa4mp/resources/policies.qdl b/oa4mp/resources/policies.qdl
new file mode 100644
index 000000000..9adbca26d
--- /dev/null
+++ b/oa4mp/resources/policies.qdl
@@ -0,0 +1,50 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+access_token.'sub' := claims.'sub';
+
+{{ if eq .GroupSource "file" -}}
+cfg. := new_template('file');
+cfg.'file_path' := '{{- .GroupFile -}}';
+group_list. := get_claims(create_source(cfg.), access_token.'sub');
+{{- end }}
+
+{{ if .GroupRequirements }}
+if [0 == size(|^group_list. \/ { {{- range $idx, $grp := .GroupRequirements -}}{{- if eq $idx 0 -}}'{{- $grp -}}'{{else}}, '{{- $grp -}}'{{- end -}}{{- end -}} })] then
+[
+    sys_err.ok := false;
+    sys_err.message := 'Authenticated user is not in any of the following groups: {{ range $idx, $grp := .GroupRequirements -}}{{- if eq $idx 0 -}}"{{- $grp -}}"{{else}}, "{{- $grp -}}"{{- end -}}{{- end -}}';
+    return();
+];
+{{- end }}
+
+scopes := {};
+{{ range .GroupAuthzTemplates }}
+while [has_value(key, group_list.)]
+[
+    group_scopes := { {{- range $idx, $action := .Actions }}{{- if eq $idx 0 -}}'{{- $action -}}'{{else}}, '{{- $action -}}'{{- end -}}{{ end -}} } + '{{- .Prefix -}}';
+    scopes := scopes \/ |^replace(~group_scopes, '$GROUP', key);
+];
+{{- end }}
+{{ range .UserAuthzTemplates }}
+user_scopes := { {{- range $idx, $action := .Actions }}{{- if eq $idx 0 -}}'{{- $action -}}'{{else}}, '{{- $action -}}'{{- end -}}{{ end -}} } + '{{- .Prefix -}}';
+scopes := scopes \/ |^replace(~user_scopes, '$USER', claims.'sub');
+{{ end }}
+access_token.'scope' := detokenize(scopes, ' ', 2);
+
+access_token.iss := '{{- .OIDCIssuerURL -}}';
diff --git a/oa4mp/resources/proxy-config.xml b/oa4mp/resources/proxy-config.xml
new file mode 100644
index 000000000..f7f3135ec
--- /dev/null
+++ b/oa4mp/resources/proxy-config.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+-->
+<config>
+    <client name="proxy-client">
+        <logging
+                logFileName="/dev/stdout"
+                logName="oa4mp"
+                logFileCount="1"
+                debug="trace"/>
+        <id>{{- .ClientID -}}</id>
+        <secret>{{- .ClientSecret -}}</secret>
+        <callbackUri>{{- .IssuerURL -}}/ready</callbackUri>
+        <serviceUri>{{- .OIDCIssuerURL -}}/oauth2</serviceUri>
+        <authorizeUri>{{- .OIDCAuthorizationURL -}}</authorizeUri>
+        <accessTokenUri>{{- .OIDCTokenEndpointURL -}}</accessTokenUri>
+        <deviceAuthorizationUri>{{- .OIDCDeviceAuthURL -}}</deviceAuthorizationUri>
+        <userInfoUri>{{- .OIDCUserInfoURL -}}</userInfoUri>
+        <wellKnownUri>{{- .OIDCIssuerURL -}}/.well-known/openid-configuration</wellKnownUri>
+        <scopes>
+        {{- range $scope, $value := .ScopesRequested }}
+            <scope enabled="{{- $value -}}">{{- $scope -}}</scope>
+        {{- end }}
+        </scopes>
+        <memoryStore><assetStore/></memoryStore>
+    </client>
+
+</config>
diff --git a/oa4mp/resources/server-config.xml b/oa4mp/resources/server-config.xml
new file mode 100644
index 000000000..e6b7147d1
--- /dev/null
+++ b/oa4mp/resources/server-config.xml
@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+-->
+<config>
+    <service name="scitokens-server"
+             disableDefaultStores="true"
+             authorizationGrantLifetime="750 sec"
+             defaultAccessTokenLifetime="1009 sec."
+             maxAccessTokenLifetime="1800 sec"
+             maxRefreshTokenLifetime="2592000 sec"
+             maxClientRefreshTokenLifetime="1296000 sec."
+             refreshTokenEnabled="true"
+             enableTokenExchange="true"
+             clientSecretLength="24"
+             cleanupInterval= "60 min"
+             scheme="oa4mp"
+             schemeSpecificPart=""
+             debug="trace"
+             OIDCEnabled = "false"
+             serverDN="CN=localhost"
+             issuer="{{- .IssuerURL -}}"
+             address="{{- .IssuerURL -}}">
+
+        <unusedClientCleanup gracePeriod="6 hr"
+                             deleteVersions="false"
+                             enabled="true"
+                             interval="4 hr">
+          <whitelist>
+             <clientID>localhost:template</clientID>
+          </whitelist>
+          <blacklist/>
+        </unusedClientCleanup>
+
+        <logging
+                logFileName="/dev/stdout"
+                logName="scitokens-server"
+                logFileCount="1"
+                debug="trace"/>
+        <JSONWebKey>
+            <path>{{- .JwksLocation -}}</path>
+        </JSONWebKey>
+        <!-- Remove the next authorizationServlet if using a proxy -->
+        <!--<authorizationServlet authorizationURI="https://{HOSTNAME}/scitokens-server/authorize"/>-->
+       <authorizationServlet
+                useProxy="true"
+                cfgFile="{{- .ScitokensServerLocation -}}/etc/proxy-config.xml"
+                cfgName="proxy-client"
+        />
+        <deviceFlowServlet
+                verificationURI="{{- .IssuerURL -}}/device"
+                interval="5"
+                codeChars="0123456789ABCDEFX"
+                codeLength="9"
+                codeSeparator="_"
+                codePeriodLength="3"
+        />
+
+        <clientManagement>
+           <api protocol="rfc7591"
+                enabled="true"
+                endpoint="oidc-cm"
+                anonymousOK="true"
+                autoApprove="true"
+                autoApproverName="anonymous"
+                template="localhost:template"
+           />
+           <api protocol="rfc7592" enabled="true" endpoint="oidc-cm"/>
+           <api protocol="oa4mp" enabled="false" />
+        </clientManagement>
+
+        <fileStore path="{{- .ScitokensServerLocation -}}/var/storage/file_store">
+            <clients/>
+            <clientApprovals/>
+            <transactions/>
+            <permissions/>
+            <adminClients/>
+            <txStore/>
+            <voStore/>
+        </fileStore>
+
+        <qdl name="qdl-default"
+             enabled="true"
+             debug="info"
+             strict_acls="false"
+             script_path="vfs#/scripts/">
+            <virtual_file_systems>
+                <vfs type="pass_through"
+                     access="rw">
+                    <root_dir>{{- .ScitokensServerLocation -}}/var/qdl</root_dir>
+                    <scheme><![CDATA[vfs]]></scheme>
+                    <mount_point>/scripts</mount_point>
+                </vfs>
+            </virtual_file_systems>
+            <modules>
+                <module type="java"
+                        import_on_start="true">
+                    <class_name>edu.uiuc.ncsa.myproxy.oa4mp.qdl.OA2QDLLoader</class_name>
+                </module>
+            </modules>
+        </qdl>
+
+        <mail enabled="false"/>
+    </service>
+</config>
diff --git a/oa4mp/resources/server.xml b/oa4mp/resources/server.xml
new file mode 100644
index 000000000..6b6d2334c
--- /dev/null
+++ b/oa4mp/resources/server.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * Copyright (C) 2023, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+-->
+<Server port="-1" shutdown="SHUTDOWN">
+  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
+
+  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+  <GlobalNamingResources>
+    <Resource name="UserDatabase" auth="Container"
+              type="org.apache.catalina.UserDatabase"
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+              pathname="conf/tomcat-users.xml" />
+  </GlobalNamingResources>
+
+  <Service name="Catalina">
+
+    <Connector
+            protocol="org.apache.coyote.http11.Http11NioProtocol"
+            unixDomainSocketPath="/opt/scitokens-server/var/http.sock" />
+
+    <Engine name="Catalina" defaultHost="localhost">
+
+      <Realm className="org.apache.catalina.realm.LockOutRealm">
+        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+               resourceName="UserDatabase"/>
+      </Realm>
+
+      <Host name="localhost"  appBase="webapps"
+            unpackWARs="true" autoDeploy="true"/>
+    </Engine>
+  </Service>
+</Server>
diff --git a/oa4mp/serve.go b/oa4mp/serve.go
new file mode 100644
index 000000000..f11c008d2
--- /dev/null
+++ b/oa4mp/serve.go
@@ -0,0 +1,334 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package oa4mp
+
+import (
+	"bufio"
+	"bytes"
+	_ "embed"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"text/template"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/daemon"
+	"github.com/pelicanplatform/pelican/oauth2"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+type (
+	oa4mpConfig struct {
+		ClientID                string
+		ClientSecret            string
+		IssuerURL               string
+		JwksLocation            string
+		ScitokensServerLocation string
+		ScopesRequested         map[string]bool
+		OIDCIssuerURL           string
+		OIDCAuthorizationURL    string
+		OIDCTokenEndpointURL    string
+		OIDCDeviceAuthURL       string
+		OIDCUserInfoURL         string
+		OIDCAuthnReqs           []oidcAuthenticationRequirements
+		OIDCAuthnUserClaim      string
+		GroupSource             string
+		GroupFile               string
+		GroupRequirements       []string
+		GroupAuthzTemplates     []authzTemplate
+		UserAuthzTemplates      []authzTemplate
+	}
+
+	oidcAuthenticationRequirements struct {
+		Claim string `mapstructure:"claim"`
+		Value string `mapstructure:"value"`
+	}
+
+	authzTemplate struct {
+		Actions []string `mapstructure:"actions"`
+		Prefix  string   `mapstructure:"prefix"`
+	}
+)
+
+var (
+	//go:embed resources/server-config.xml
+	serverConfigTmpl string
+
+	//go:embed resources/proxy-config.xml
+	proxyConfigTmpl string
+
+	//go:embed resources/policies.qdl
+	policiesQdlTmpl string
+
+	//go:embed resources/id_token_policies.qdl
+	idTokenPoliciesQdlTmpl string
+)
+
+func writeOA4MPFile(fname string, data []byte, perm os.FileMode) error {
+	user, err := config.GetOA4MPUser()
+	if err != nil {
+		return err
+	}
+
+	file, err := os.OpenFile(fname, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	if err = os.Chown(fname, -1, user.Gid); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of configuration file %v"+
+			" to desired daemon gid %v", fname, user.Gid)
+	}
+
+	if _, err = file.Write(data); err != nil {
+		err = errors.Wrapf(err, "Failed to write OA4MP configuration file at %v", fname)
+	}
+	return err
+}
+
+func writeOA4MPConfig(oconf oa4mpConfig, fname, templateInput string) error {
+	user, err := config.GetOA4MPUser()
+	if err != nil {
+		return err
+	}
+
+	templ := template.Must(template.New(fname).Parse(templateInput))
+
+	file, err := os.OpenFile(fname, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	if err = os.Chown(fname, -1, user.Gid); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of configuration file %v"+
+			" to desired daemon gid %v", fname, user.Gid)
+	}
+
+	return templ.Execute(file, oconf)
+}
+
+func ConfigureOA4MP() (launcher daemon.Launcher, err error) {
+	var oauth2Client oauth2.Config
+	oauth2Client, err = oauth2.ServerOIDCClient()
+	if err != nil {
+		err = errors.Wrap(err, "Unable to launch token issuer component because OIDC is not configured")
+		return
+	}
+
+	// For now, we only request the openid scope -- but OA4MP requires us to list all the ones we
+	// don't want as well.
+	scopesSupported, err := config.GetOIDCSupportedScopes()
+	if err != nil {
+		err = errors.Wrap(err, "Unable to launch token issuer due to OIDC configuration issue")
+		return
+	}
+	scopesRequested := make(map[string]bool, len(scopesSupported))
+	for _, scope := range scopesSupported {
+		switch scope {
+		case "openid":
+			scopesRequested[scope] = true
+		default:
+			scopesRequested[scope] = false
+		}
+	}
+
+	oidcIssuerURL := param.OIDC_Issuer.GetString()
+	if oidcIssuerURL == "" {
+		err = errors.New("OIDC.Issuer not set in the configuration")
+		return
+	}
+	oidcAuthzURL, err := config.GetOIDCAuthorizationEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "OIDC authorization endpoint not available")
+		return
+	}
+	oidcTokenURL, err := config.GetOIDCTokenEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "OIDC token endpoint not available")
+		return
+	}
+	oidcDeviceAuthURL, err := config.GetOIDCDeviceAuthEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "OIDC device auth endpoint not available")
+		return
+	}
+	oidcUserInfoURL, err := config.GetOIDCUserInfoEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "OIDC user info endpoint not available")
+		return
+	}
+
+	oidcAuthnReqs := []oidcAuthenticationRequirements{}
+	if err = param.Issuer_OIDCAuthenticationRequirements.Unmarshal(&oidcAuthnReqs); err != nil {
+		err = errors.Wrap(err, "Failed to parse the Issuer.OIDCAuthenticationRequirements config")
+		return
+	}
+
+	oidcAuthnUserClaim := param.Issuer_OIDCAuthenticationUserClaim.GetString()
+	groupSource := param.Issuer_GroupSource.GetString()
+	groupFile := param.Issuer_GroupFile.GetString()
+	if groupFile == "" && groupSource == "file" {
+		err = errors.New("Issuer.GroupFile must be set to use the 'file' group source")
+		return
+	}
+	groupReqs := param.Issuer_GroupRequirements.GetStringSlice()
+
+	authzTemplates := []authzTemplate{}
+	if err = param.Issuer_AuthorizationTemplates.Unmarshal(&authzTemplates); err != nil {
+		err = errors.Wrap(err, "Failed to parse the Issuer.AuthorizationTemplates config")
+		return
+	}
+	groupAuthzTemplates := []authzTemplate{}
+	userAuthzTemplates := []authzTemplate{}
+	for _, authz := range authzTemplates {
+		scope_actions := []string{}
+		for _, scope := range authz.Actions {
+			switch scope {
+			case "read":
+				scope_actions = append(scope_actions, "storage.read")
+			case "write":
+				scope_actions = append(scope_actions, "storage.modify")
+			case "create":
+				scope_actions = append(scope_actions, "storage.create")
+			case "modify":
+				scope_actions = append(scope_actions, "storage.modify")
+			default:
+				scope_actions = append(scope_actions, scope)
+			}
+		}
+		authz.Actions = scope_actions
+		if strings.Contains(authz.Prefix, "$GROUP") {
+			groupAuthzTemplates = append(groupAuthzTemplates, authz)
+		} else {
+			// If it's not a group template, we assume there's an entry per user
+			// (regardless of whether or not $USER is in the prefix template).
+			userAuthzTemplates = append(userAuthzTemplates, authz)
+		}
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		err = errors.Wrap(err, "Failed to load the private issuer key for running issuer")
+		return
+	}
+	if err = key.Set("use", "sig"); err != nil {
+		err = errors.Wrap(err, "Failed to configure private issuer key")
+		return
+	}
+	jwks := jwk.NewSet()
+	if err = jwks.AddKey(key); err != nil {
+		return
+	}
+
+	buf, err := json.MarshalIndent(jwks, "", " ")
+	if err != nil {
+		err = errors.Wrap(err, "Failed to marshal issuer private key to JSON")
+		return
+	}
+	etcPath := filepath.Join(param.Issuer_ScitokensServerLocation.GetString(), "etc")
+	keyPath := filepath.Join(etcPath, "keys.jwk")
+	if err = writeOA4MPFile(keyPath, buf, 0640); err != nil {
+		return
+	}
+
+	oconf := oa4mpConfig{
+		ClientID:                oauth2Client.ClientID,
+		ClientSecret:            oauth2Client.ClientSecret,
+		IssuerURL:               param.Server_ExternalWebUrl.GetString() + "/api/v1.0/issuer",
+		JwksLocation:            keyPath,
+		ScitokensServerLocation: param.Issuer_ScitokensServerLocation.GetString(),
+		ScopesRequested:         scopesRequested,
+		OIDCIssuerURL:           oidcIssuerURL,
+		OIDCAuthorizationURL:    oidcAuthzURL,
+		OIDCTokenEndpointURL:    oidcTokenURL,
+		OIDCDeviceAuthURL:       oidcDeviceAuthURL,
+		OIDCUserInfoURL:         oidcUserInfoURL,
+		OIDCAuthnReqs:           oidcAuthnReqs,
+		OIDCAuthnUserClaim:      oidcAuthnUserClaim,
+		GroupSource:             groupSource,
+		GroupFile:               groupFile,
+		GroupRequirements:       groupReqs,
+		GroupAuthzTemplates:     groupAuthzTemplates,
+		UserAuthzTemplates:      userAuthzTemplates,
+	}
+
+	varQdlScitokensPath := filepath.Join(param.Issuer_ScitokensServerLocation.GetString(), "var",
+		"qdl", "scitokens")
+
+	err = writeOA4MPConfig(oconf, filepath.Join(etcPath, "server-config.xml"), serverConfigTmpl)
+	if err != nil {
+		return
+	}
+	err = writeOA4MPConfig(oconf, filepath.Join(etcPath, "proxy-config.xml"), proxyConfigTmpl)
+	if err != nil {
+		return
+	}
+	if err = writeOA4MPConfig(oconf, filepath.Join(varQdlScitokensPath, "policies.qdl"), policiesQdlTmpl); err != nil {
+		return
+	}
+	if err = writeOA4MPConfig(oconf, filepath.Join(varQdlScitokensPath, "id_token_policies.qdl"), idTokenPoliciesQdlTmpl); err != nil {
+		return
+	}
+
+	user, err := config.GetOA4MPUser()
+	if err != nil {
+		return
+	}
+
+	qdlBoot := filepath.Join(param.Issuer_QDLLocation.GetString(), "var", "scripts", "boot.qdl")
+	cmd := exec.Command(qdlBoot)
+	cmd.Env = []string{
+		"PATH=/bin:/usr/bin/:" + filepath.Join(param.Issuer_QDLLocation.GetString(), "bin"),
+		"ST_HOME=" + param.Issuer_ScitokensServerLocation.GetString(),
+		"QDL_HOME=" + param.Issuer_QDLLocation.GetString()}
+
+	if err = customizeCmd(cmd); err != nil {
+		return
+	}
+
+	stdoutErr, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Errorln("Failed to bootstrap the issuer environment")
+		cmd_logger := log.WithFields(log.Fields{"daemon": "boot.qdl"})
+		stdoutErrScanner := bufio.NewScanner(bytes.NewReader(stdoutErr))
+		for stdoutErrScanner.Scan() {
+			cmd_logger.Errorln("QDL Failure:", stdoutErrScanner.Text())
+		}
+		err = errors.Wrap(err, "Failed to bootstrap the issuer environment")
+		return
+		//err = nil
+	}
+	log.Debugln("Output from issuer environment bootstrap script:", string(stdoutErr))
+
+	tomcatPath := filepath.Join(param.Issuer_TomcatLocation.GetString(), "bin", "catalina.sh")
+	launcher = daemon.DaemonLauncher{
+		DaemonName: "oa4mp",
+		Args:       []string{tomcatPath, "run"},
+		Uid:        user.Uid,
+		Gid:        user.Gid,
+	}
+
+	return
+}
diff --git a/oa4mp/serve_default.go b/oa4mp/serve_default.go
new file mode 100644
index 000000000..227535cc1
--- /dev/null
+++ b/oa4mp/serve_default.go
@@ -0,0 +1,34 @@
+//go:build windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package oa4mp
+
+import (
+	"os/exec"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pkg/errors"
+)
+
+func customizeCmd(cmd *exec.Cmd) error {
+	if config.IsRootExecution() {
+		return errors.New("Root usage is not supported on Windows")
+	}
+	return nil
+}
diff --git a/oa4mp/serve_unix.go b/oa4mp/serve_unix.go
new file mode 100644
index 000000000..29b44df7c
--- /dev/null
+++ b/oa4mp/serve_unix.go
@@ -0,0 +1,41 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package oa4mp
+
+import (
+	"os/exec"
+	"syscall"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pkg/errors"
+)
+
+func customizeCmd(cmd *exec.Cmd) error {
+	if config.IsRootExecution() {
+		user, err := config.GetOA4MPUser()
+		if err != nil {
+			return errors.Wrap(err, "Unable to launch bootstrap script as OA4MP user")
+		}
+
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+		cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(user.Uid), Gid: uint32(user.Gid)}
+	}
+	return nil
+}
diff --git a/oauth2/deviceauth.go b/oauth2/device_auth.go
similarity index 99%
rename from oauth2/deviceauth.go
rename to oauth2/device_auth.go
index eb62d4948..be778547e 100644
--- a/oauth2/deviceauth.go
+++ b/oauth2/device_auth.go
@@ -98,6 +98,7 @@ type Endpoint struct {
 	AuthURL       string
 	DeviceAuthURL string
 	TokenURL      string
+	UserInfoURL   string
 }
 
 func retrieveDeviceAuth(ctx context.Context, c *Config, v url.Values) (*DeviceAuth, error) {
diff --git a/oauth2/oauth2.go b/oauth2/oauth2.go
index 11eef5a6e..227c1c64e 100644
--- a/oauth2/oauth2.go
+++ b/oauth2/oauth2.go
@@ -20,7 +20,6 @@ package oauth2
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -28,6 +27,7 @@ import (
 
 	config "github.com/pelicanplatform/pelican/config"
 	namespaces "github.com/pelicanplatform/pelican/namespaces"
+	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -64,13 +64,13 @@ func trimPath(pathName string, maxDepth int) string {
 	return "/" + path.Join(pathComponents[0:maxLength]...)
 }
 
-func AcquireToken(issuerUrl string, entry *config.PrefixEntry, credentialGen *namespaces.CredentialGeneration, osdfPath string, isWrite bool) (*config.TokenEntry, error) {
+func AcquireToken(issuerUrl string, entry *config.PrefixEntry, credentialGen *namespaces.CredentialGeneration, osdfPath string, opts config.TokenGenerationOpts) (*config.TokenEntry, error) {
 
-	if fileInfo, _ := os.Stdout.Stat(); (fileInfo.Mode() & os.ModeCharDevice) == 0 {
+	if fileInfo, _ := os.Stdout.Stat(); (len(os.Getenv(config.GetPreferredPrefix()+"_SKIP_TERMINAL_CHECK")) == 0) && ((fileInfo.Mode() & os.ModeCharDevice) == 0) {
 		return nil, errors.New("This program must be run in a terminal to acquire a new token")
 	}
 
-	issuerInfo, err := GetIssuerMetadata(issuerUrl)
+	issuerInfo, err := config.GetIssuerMetadata(issuerUrl)
 	if err != nil {
 		return nil, err
 	}
@@ -92,13 +92,13 @@ func AcquireToken(issuerUrl string, entry *config.PrefixEntry, credentialGen *na
 		}
 
 		// Potentially increase the coarseness of the token
-		if credentialGen.MaxScopeDepth != nil && *credentialGen.MaxScopeDepth >= 0 {
+		if opts.Operation != config.TokenSharedWrite && opts.Operation != config.TokenSharedRead && credentialGen.MaxScopeDepth != nil && *credentialGen.MaxScopeDepth >= 0 {
 			pathCleaned = trimPath(pathCleaned, *credentialGen.MaxScopeDepth)
 		}
 	}
 
 	var storageScope string
-	if isWrite {
+	if opts.Operation == config.TokenSharedWrite || opts.Operation == config.TokenWrite {
 		storageScope = "storage.create:"
 	} else {
 		storageScope = "storage.read:"
@@ -118,7 +118,7 @@ func AcquireToken(issuerUrl string, entry *config.PrefixEntry, credentialGen *na
 	ctx := context.Background()
 	deviceAuth, err := oauth2Config.AuthDevice(ctx)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrapf(err, "Failed to perform device code flow with URL %s", issuerInfo.DeviceAuthURL)
 	}
 
 	if len(deviceAuth.VerificationURIComplete) > 0 {
diff --git a/oauth2/oidc_client.go b/oauth2/oidc_client.go
new file mode 100644
index 000000000..ca6019cb7
--- /dev/null
+++ b/oauth2/oidc_client.go
@@ -0,0 +1,123 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package oauth2
+
+import (
+	"net/url"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pkg/errors"
+)
+
+// ServerOIDCClient loads the OIDC client configuration for
+// the pelican server
+func ServerOIDCClient() (result Config, err error) {
+	// Load OIDC.ClientID
+	if result.ClientID, err = config.GetOIDCClientID(); err != nil {
+		return
+	}
+
+	if result.ClientID == "" {
+		err = errors.New("OIDC.ClientID is empty")
+		return
+	}
+
+	// load OIDC.ClientSecret
+	if result.ClientSecret, err = config.GetOIDCClientSecret(); err != nil {
+		return
+	}
+
+	if result.ClientSecret == "" {
+		err = errors.New("OIDC.ClientSecret is empty")
+		return
+	}
+
+	// Load OIDC.AuthorizationEndpoint
+	authorizationEndpoint, err := config.GetOIDCAuthorizationEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "Unable to get authorization endpoint for OIDC issuer")
+		return
+	}
+	if authorizationEndpoint == "" {
+		err = errors.New("Nothing set for config parameter OIDC.DeviceAuthEndpoint")
+		return
+	}
+	authorizationEndpointURL, err := url.Parse(authorizationEndpoint)
+	if err != nil {
+		err = errors.New("Failed to parse URL for parameter OIDC.DeviceAuthEndpoint")
+		return
+	}
+	result.Endpoint.AuthURL = authorizationEndpointURL.String()
+
+	// Load OIDC.DeviceAuthEndpoint
+	deviceAuthEndpoint, err := config.GetOIDCDeviceAuthEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "Unable to get device authentication endpoint for OIDC issuer")
+		return
+	}
+	if deviceAuthEndpoint == "" {
+		err = errors.New("Nothing set for config parameter OIDC.DeviceAuthEndpoint")
+		return
+	}
+	deviceAuthEndpointURL, err := url.Parse(deviceAuthEndpoint)
+	if err != nil {
+		err = errors.New("Failed to parse URL for parameter OIDC.DeviceAuthEndpoint")
+		return
+	}
+	result.Endpoint.DeviceAuthURL = deviceAuthEndpointURL.String()
+
+	// Load OIDC.TokenEndpoint
+	tokenEndpoint, err := config.GetOIDCTokenEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "Unable to get token endpoint for OIDC issuer")
+		return
+	}
+	if tokenEndpoint == "" {
+		err = errors.New("Nothing set for config parameter OIDC.TokenEndpoint")
+		return
+	}
+	tokenAuthEndpointURL, err := url.Parse(tokenEndpoint)
+	if err != nil {
+		err = errors.New("Failed to parse URL for parameter OIDC.TokenEndpoint")
+		return
+	}
+	result.Endpoint.TokenURL = tokenAuthEndpointURL.String()
+
+	// Load OIDC.UserInfoEndpoint
+	userInfoEndpoint, err := config.GetOIDCUserInfoEndpoint()
+	if err != nil {
+		err = errors.Wrap(err, "Unable to get user info endpoint for OIDC issuer")
+		return
+	}
+	if userInfoEndpoint == "" {
+		err = errors.New("Nothing set for config parameter OIDC.UserInfoEndpoint")
+		return
+	}
+	userInfoEndpointURL, err := url.Parse(userInfoEndpoint)
+	if err != nil {
+		err = errors.New("Failed to parse URL for parameter OIDC.UserInfoEndpoint")
+		return
+	}
+	result.Endpoint.UserInfoURL = userInfoEndpointURL.String()
+
+	// Set the scope
+	result.Scopes = []string{"openid", "profile", "email", "org.cilogon.userinfo"}
+
+	return
+}
diff --git a/origin_ui/advertise.go b/origin_ui/advertise.go
index 25fc4c322..bf2df6103 100644
--- a/origin_ui/advertise.go
+++ b/origin_ui/advertise.go
@@ -19,91 +19,67 @@
 package origin_ui
 
 import (
-	"bytes"
-	"crypto/tls"
-	"encoding/json"
 	"fmt"
-	"net/http"
 	"net/url"
-	"time"
 
+	"github.com/pelicanplatform/pelican/config"
 	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
 	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
 )
 
-func PeriodicAdvertiseOrigin() error {
-	ticker := time.NewTicker(1 * time.Minute)
-	go func() {
-		err := AdvertiseOrigin()
-		if err != nil {
-			log.Warningln("Origin advertise failed:", err)
-		}
-		for {
-			<-ticker.C
-			err := AdvertiseOrigin()
-			if err != nil {
-				log.Warningln("Origin advertise failed:", err)
-			}
-		}
-	}()
+type (
+	OriginServer struct {
+		server_utils.NamespaceHolder
+	}
+)
 
-	return nil
+func (server *OriginServer) GetServerType() config.ServerType {
+	return config.OriginType
 }
 
-func AdvertiseOrigin() error {
-	name := viper.GetString("Sitename")
-	if name == "" {
-		return errors.New("Origin name isn't set")
-	}
-	// TODO: waiting on a different branch to merge origin URL generation
-	originUrl := "https://localhost:8444"
+func (server *OriginServer) CreateAdvertisement(name string, originUrl string, originWebUrl string) (director.OriginAdvertise, error) {
+	ad := director.OriginAdvertise{}
 
-	ad := director.OriginAdvertise{
-		Name:       name,
-		URL:        originUrl,
-		Namespaces: make([]director.NamespaceAd, 0),
-	}
+	// Here we instantiate the namespaceAd slice, but we still need to define the namespace
+	issuerUrl := url.URL{}
+	issuerUrl.Scheme = "https"
+	issuerUrl.Host = fmt.Sprintf("%v:%v", param.Server_Hostname.GetString(), param.Xrootd_Port.GetInt())
 
-	body, err := json.Marshal(ad)
-	if err != nil {
-		return errors.Wrap(err, "Failed to generate JSON description of origin")
+	if issuerUrl.String() == "" {
+		return ad, errors.New("No IssuerUrl is set")
 	}
 
-	directorUrlStr := viper.GetString("DirectorURL")
-	if directorUrlStr == "" {
-		return errors.New("Director endpoint URL is not known")
-	}
-	directorUrl, err := url.Parse(directorUrlStr)
-	if err != nil {
-		return errors.Wrap(err, "Failed to parse DirectorURL")
-	}
-	directorUrl.Path = "/api/v1.0/director/registerOrigin"
+	prefix := param.Origin_NamespacePrefix.GetString()
 
-	req, err := http.NewRequest("POST", directorUrl.String(), bytes.NewBuffer(body))
-	if err != nil {
-		return errors.Wrap(err, "Failed to create POST request for director registration")
+	// TODO: Need to figure out where to get some of these values
+	// 		 so that they aren't hardcoded...
+	nsAd := director.NamespaceAd{
+		RequireToken:  true,
+		Path:          prefix,
+		Issuer:        issuerUrl,
+		MaxScopeDepth: 3,
+		Strategy:      "OAuth2",
+		BasePath:      prefix,
 	}
-
-	req.Header.Set("Content-Type", "application/json")
-
-	client := http.Client{}
-	if viper.GetBool("TLSSkipVerify") {
-		tr := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
-		client = http.Client{Transport: tr}
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		return errors.Wrap(err, "Failed to start request for director registration")
+	ad = director.OriginAdvertise{
+		Name:               name,
+		URL:                originUrl,
+		WebURL:             originWebUrl,
+		Namespaces:         []director.NamespaceAd{nsAd},
+		EnableWrite:        param.Origin_EnableWrite.GetBool(),
+		EnableFallbackRead: param.Origin_EnableFallbackRead.GetBool(),
 	}
-	defer resp.Body.Close()
 
-	if resp.StatusCode > 299 {
-		return fmt.Errorf("Error response %v from director registration: %v", resp.StatusCode, resp.Status)
-	}
+	return ad, nil
+}
 
-	return nil
+// Return a list of paths where the origin's issuer is authoritative.
+//
+// Used to calculate the base_paths in the scitokens.cfg, for eaxmple
+func (server *OriginServer) GetAuthorizedPrefixes() []string {
+	// For now, just a single path.  In the future, we will allow
+	// multiple.
+	return []string{param.Origin_NamespacePrefix.GetString()}
 }
diff --git a/origin_ui/origin.go b/origin_ui/origin.go
index 1a7d75d47..da051913c 100644
--- a/origin_ui/origin.go
+++ b/origin_ui/origin.go
@@ -19,397 +19,74 @@
 package origin_ui
 
 import (
-	"bufio"
-	"crypto/ecdsa"
-	"embed"
-	"fmt"
-	"math/rand"
-	"mime"
+	"encoding/json"
 	"net/http"
 	"net/url"
 	"os"
-	"os/signal"
-	"path"
 	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"syscall"
-	"time"
 
-	"github.com/gin-gonic/gin"
-	"github.com/lestrrat-go/jwx/v2/jwa"
-	"github.com/lestrrat-go/jwx/v2/jwt"
 	"github.com/pelicanplatform/pelican/config"
-	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
-	"github.com/tg123/go-htpasswd"
-	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/term"
-)
-
-type (
-	Login struct {
-		User     string `form:"user"`
-		Password string `form:"password"`
-	}
-
-	InitLogin struct {
-		Code string `form:"code"`
-	}
+	"github.com/pelicanplatform/pelican/param"
 
-	PasswordReset struct {
-		Password string `form:"password"`
-	}
-)
-
-var (
-	authDB       atomic.Pointer[htpasswd.File]
-	currentCode  atomic.Pointer[string]
-	previousCode atomic.Pointer[string]
-
-	//go:embed src/out/*
-	webAssets embed.FS
+	"github.com/gin-gonic/gin"
+	"github.com/pkg/errors"
 )
 
-func doReload() error {
-	db := authDB.Load()
-	if db == nil {
-		log.Debug("Cannot reload auth database - not configured")
-		return nil
-	}
-	err := db.Reload(nil)
-	if err != nil {
-		log.Warningln("Failed to reload auth database:", err)
-		return err
-	}
-	log.Debug("Successfully reloaded the auth database")
-	return nil
-}
-
-func periodicReload() {
-	for {
-		time.Sleep(30 * time.Second)
-		log.Debug("Reloading the auth database")
-		_ = doReload()
-	}
-}
-
-func WaitUntilLogin() error {
-	if authDB.Load() != nil {
-		return nil
-	}
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
-
-	hostname := viper.GetString("Hostname")
-	webPort := viper.GetInt("WebPort")
-	isTTY := false
-	if term.IsTerminal(int(os.Stdout.Fd())) {
-		isTTY = true
-		fmt.Printf("\n\n\n\n")
-	}
-
-	for {
-		previousCode.Store(currentCode.Load())
-		newCode := fmt.Sprintf("%06v", rand.Intn(1000000))
-		currentCode.Store(&newCode)
-		if isTTY {
-			fmt.Printf("\033[A\033[A\033[A\033[A")
-			fmt.Printf("\033[2K\n")
-			fmt.Printf("\033[2K\rPelican admin interface is not initialized\n\033[2KTo initialize, "+
-				"login at \033[1;34mhttps://%v:%v/view/initialization/code/\033[0m with the following code:\n",
-				hostname, webPort)
-			fmt.Printf("\033[2K\r\033[1;34m%v\033[0m\n", *currentCode.Load())
-		} else {
-			fmt.Printf("Pelican admin interface is not initialized\n To initialize, login at https://%v:%v/view/initialization/code/ with the following code:\n", hostname, webPort)
-			fmt.Println(*currentCode.Load())
-		}
-		start := time.Now()
-		for time.Since(start) < 30*time.Second {
-			select {
-			case <-sigs:
-				return errors.New("Process terminated...")
-			default:
-				time.Sleep(100 * time.Millisecond)
-			}
-			if authDB.Load() != nil {
-				return nil
-			}
-		}
-	}
-}
+// Configure XrootD directory for both self-based and director-based file transfer tests
+func ConfigureXrootdMonitoringDir() error {
+	pelicanMonitoringPath := filepath.Join(param.Xrootd_RunLocation.GetString(),
+		"export", "pelican", "monitoring")
 
-func writePasswordEntry(user, password string) error {
-	fileName := viper.GetString("OriginUI.PasswordFile")
-	passwordBytes := []byte(password)
-	if len(passwordBytes) > 72 {
-		return errors.New("Password too long")
-	}
-	hashed, err := bcrypt.GenerateFromPassword(passwordBytes, bcrypt.DefaultCost)
+	uid, err := config.GetDaemonUID()
 	if err != nil {
 		return err
 	}
-	entry := user + ":" + string(hashed) + "\n"
-
-	directory := filepath.Dir(fileName)
-	err = os.MkdirAll(directory, 0750)
+	gid, err := config.GetDaemonGID()
 	if err != nil {
 		return err
 	}
-	fp, err := os.OpenFile(fileName, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0600)
+	username, err := config.GetDaemonUser()
 	if err != nil {
 		return err
 	}
-	defer fp.Close()
-	if _, err = fp.Write([]byte(entry)); err != nil {
-		return err
-	}
-
-	db := authDB.Load()
-	if db != nil {
-		if db.Reload(nil) != nil {
-			return err
-		}
-	}
-	return nil
-}
 
-func configureAuthDB() error {
-	fileName := viper.GetString("OriginUI.PasswordFile")
-	if fileName == "" {
-		return errors.New("Location of password file not set")
-	}
-	fp, err := os.Open(fileName)
+	err = config.MkdirAll(pelicanMonitoringPath, 0755, uid, gid)
 	if err != nil {
-		return err
-	}
-	defer fp.Close()
-	scanner := bufio.NewScanner(fp)
-	scanner.Split(bufio.ScanLines)
-	hasAdmin := false
-	for scanner.Scan() {
-		user := strings.Split(scanner.Text(), ":")[0]
-		if user == "admin" {
-			hasAdmin = true
-			break
-		}
-	}
-	if !hasAdmin {
-		return errors.New("AuthDB does not have 'admin' user")
+		return errors.Wrapf(err, "Unable to create pelican file trasnfer monitoring directory %v",
+			pelicanMonitoringPath)
 	}
-
-	auth, err := htpasswd.New(fileName, []htpasswd.PasswdParser{htpasswd.AcceptBcrypt}, nil)
-	if err != nil {
-		return err
+	if err = os.Chown(pelicanMonitoringPath, uid, -1); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of pelican file trasnfer monitoring directory %v"+
+			" to desired daemon user %v", pelicanMonitoringPath, username)
 	}
-	authDB.Store(auth)
 
 	return nil
 }
 
-func setLoginCookie(ctx *gin.Context, user string) {
-	key, err := config.GetOriginJWK()
-	if err != nil {
-		log.Errorln("Failure when loading the cookie signing key:", err)
-		ctx.JSON(500, gin.H{"error": "Unable to create login cookies"})
-		return
-	}
-
-	issuerURL := url.URL{}
-	issuerURL.Scheme = "https"
-	issuerURL.Host = ctx.Request.URL.Host
-	now := time.Now()
-	tok, err := jwt.NewBuilder().
-		Issuer(issuerURL.String()).
-		IssuedAt(now).
-		Expiration(now.Add(30 * time.Minute)).
-		NotBefore(now).
-		Subject(user).
-		Build()
-	if err != nil {
-		ctx.JSON(500, gin.H{"error": "Failed to build token"})
-		return
-	}
-	log.Debugf("Type of *key: %T\n", key)
-	var raw ecdsa.PrivateKey
-	if err = (*key).Raw(&raw); err != nil {
-		ctx.JSON(500, gin.H{"error": "Unable to sign login cookie"})
-		return
-	}
-	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES512, raw))
-	if err != nil {
-		log.Errorln("Failure when signing the login cookie:", err)
-		ctx.JSON(500, gin.H{"error": "Unable to sign login cookie"})
-		return
-	}
-
-	ctx.SetCookie("login", string(signed), 30*60, "/api/v1.0/origin-ui",
-		ctx.Request.URL.Host, true, true)
-	ctx.SetSameSite(http.SameSiteStrictMode)
-}
-
-func getUser(ctx *gin.Context) (string, error) {
-	token, err := ctx.Cookie("login")
-	if err != nil {
-		return "", nil
-	}
-	key, err := config.GetOriginJWK()
-	if err != nil {
-		return "", err
-	}
-	var raw ecdsa.PrivateKey
-	if err = (*key).Raw(&raw); err != nil {
-		return "", errors.New("Failed to extract cookie signing key")
-	}
-	parsed, err := jwt.Parse([]byte(token), jwt.WithKey(jwa.ES512, raw.PublicKey))
-	if err != nil {
-		return "", err
-	}
-	if err = jwt.Validate(parsed); err != nil {
-		return "", err
-	}
-	return parsed.Subject(), nil
-}
-
-func authHandler(ctx *gin.Context) {
-	user, err := getUser(ctx)
-	if err != nil {
-		log.Errorln("Unable to parse user cookie:", err)
-	} else {
-		ctx.Set("User", user)
-	}
-	ctx.Next()
-}
-
-func loginHandler(ctx *gin.Context) {
-	db := authDB.Load()
-	if db == nil {
-		newPath := path.Join(ctx.Request.URL.Path, "..", "initLogin")
-		initUrl := ctx.Request.URL
-		initUrl.Path = newPath
-		ctx.Redirect(307, initUrl.String())
-		return
-	}
-
-	login := Login{}
-	if ctx.ShouldBind(&login) != nil {
-		ctx.JSON(400, gin.H{"error": "Missing user/password in form data"})
-		return
-	}
-	if !db.Match(login.User, login.Password) {
-		ctx.JSON(401, gin.H{"error": "Login failed"})
-		return
-	}
-
-	setLoginCookie(ctx, login.User)
-	ctx.JSON(200, gin.H{"msg": "Success"})
-}
-
-func initLoginHandler(ctx *gin.Context) {
-	db := authDB.Load()
-	if db != nil {
-		ctx.JSON(400, gin.H{"error": "Authentication is already initialized"})
-		return
-	}
-	curCode := currentCode.Load()
-	if curCode == nil {
-		ctx.JSON(400, gin.H{"error": "Code-based login is not available"})
-		return
-	}
-	prevCode := previousCode.Load()
-
-	code := InitLogin{}
-	if ctx.ShouldBind(&code) != nil {
-		ctx.JSON(400, gin.H{"error": "Login code not provided"})
-		return
-	}
-
-	if code.Code != *curCode && (prevCode == nil || code.Code != *prevCode) {
-		ctx.JSON(401, gin.H{"error": "Invalid login code"})
-		return
+func ConfigIssJWKS(router *gin.RouterGroup) error {
+	if router == nil {
+		return errors.New("Origin configuration passed a nil pointer")
 	}
 
-	setLoginCookie(ctx, "admin")
+	router.GET("/openid-configuration", ExportOpenIDConfig)
+	router.GET("/issuer.jwks", ExportIssuerJWKS)
+	return nil
 }
 
-func resetLoginHandler(ctx *gin.Context) {
-	passwordReset := PasswordReset{}
-	if ctx.ShouldBind(&passwordReset) != nil {
-		ctx.JSON(400, gin.H{"error": "Invalid password reset request"})
-		return
-	}
-
-	user := ctx.GetString("User")
-	if user == "" {
-		ctx.JSON(403, gin.H{"error": "Password reset only available to logged-in users"})
-		return
+func ExportOpenIDConfig(c *gin.Context) {
+	issuerURL, _ := url.Parse(param.Server_ExternalWebUrl.GetString())
+	jwksUri, _ := url.JoinPath(issuerURL.String(), "/.well-known/issuer.jwks")
+	jsonData := gin.H{
+		"issuer":   issuerURL.String(),
+		"jwks_uri": jwksUri,
 	}
 
-	if err := writePasswordEntry(user, passwordReset.Password); err != nil {
-		log.Errorf("Password reset for user %s failed: %s", user, err)
-		ctx.JSON(500, gin.H{"error": "Failed to reset password"})
-	} else {
-		log.Infof("Password reset for user %s was successful", user)
-		ctx.JSON(200, gin.H{"msg": "Success"})
-	}
-	if err := configureAuthDB(); err != nil {
-		log.Errorln("Error in reloading authDB:", err)
-	}
+	c.JSON(http.StatusOK, jsonData)
 }
 
-func ConfigureOriginUI(router *gin.Engine) error {
-	if router == nil {
-		return errors.New("Origin configuration passed a nil pointer")
-	}
-
-	if err := configureAuthDB(); err != nil {
-		log.Infoln("Authorization not configured (non-fatal):", err)
-	}
-
-	group := router.Group("/api/v1.0/origin-ui", authHandler)
-	group.POST("/login", loginHandler)
-	group.POST("/initLogin", initLoginHandler)
-	group.POST("/resetLogin", resetLoginHandler)
-	group.GET("/whoami", func(ctx *gin.Context) {
-		user := ctx.GetString("User")
-		if user == "" {
-			ctx.JSON(200, gin.H{"authenticated": false})
-		} else {
-			ctx.JSON(200, gin.H{"authenticated": true, "user": user})
-		}
-	})
-	group.GET("/loginInitialized", func(ctx *gin.Context) {
-		db := authDB.Load()
-		if db == nil {
-			ctx.JSON(200, gin.H{"initialized": false})
-		} else {
-			ctx.JSON(200, gin.H{"initialized": true})
-		}
-	})
+func ExportIssuerJWKS(c *gin.Context) {
+	keys, _ := config.GetIssuerPublicJWKS()
+	buf, _ := json.MarshalIndent(keys, "", " ")
 
-	router.GET("/view/*path", func(ctx *gin.Context) {
-		path := ctx.Param("path")
-
-		if strings.HasSuffix(path, "/") {
-			path += "index.html"
-		}
-
-		filePath := "src/out" + path
-		file, _ := webAssets.ReadFile(filePath)
-		ctx.Data(
-			http.StatusOK,
-			mime.TypeByExtension(filePath),
-			file,
-		)
-	})
-
-	// Redirect root to /view for now
-	router.GET("/", func(c *gin.Context) {
-		c.Redirect(http.StatusFound, "/view/")
-	})
-
-	go periodicReload()
-
-	return nil
+	c.Data(http.StatusOK, "application/json; charset=utf-8", buf)
 }
diff --git a/origin_ui/origin_api.go b/origin_ui/origin_api.go
new file mode 100644
index 000000000..b77e632f6
--- /dev/null
+++ b/origin_ui/origin_api.go
@@ -0,0 +1,162 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package origin_ui
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+var (
+	// Duration to wait before timeout
+	directorTimeoutDuration = 30 * time.Second
+
+	notifyResponseOnce sync.Once
+	notifyChannel      chan bool
+)
+
+// Notify the periodic ticker that we have received a new response and it
+// should reset
+func notifyNewDirectorResponse(ctx context.Context) {
+	nChan := getNotifyChannel()
+	select {
+	case <-ctx.Done():
+		return
+	case nChan <- true:
+		return
+	}
+}
+
+// Get the notification channel in a thread-safe manner
+func getNotifyChannel() chan bool {
+	notifyResponseOnce.Do(func() {
+		notifyChannel = make(chan bool)
+	})
+	return notifyChannel
+}
+
+// Check the Bearer token from requests sent from the director to ensure
+// it's has correct authorization
+func directorRequestAuthHandler(ctx *gin.Context) {
+	authHeader := ctx.Request.Header.Get("Authorization")
+
+	// Check if the Authorization header was provided
+	if authHeader == "" {
+		// Use AbortWithStatusJSON to stop invoking the next chain
+		ctx.AbortWithStatusJSON(401, gin.H{"error": "Authorization header is missing"})
+		return
+	}
+
+	// Check if the Authorization type is Bearer
+	if !strings.HasPrefix(authHeader, "Bearer ") {
+		ctx.AbortWithStatusJSON(401, gin.H{"error": "Authorization header is not Bearer type"})
+		return
+	}
+
+	// Extract the token from the Authorization header
+	token := strings.TrimPrefix(authHeader, "Bearer ")
+	valid, err := director.VerifyDirectorTestReportToken(token)
+
+	if err != nil {
+		log.Warningln(fmt.Sprintf("Error when verifying Bearer token: %s", err))
+		ctx.AbortWithStatusJSON(401, gin.H{"error": fmt.Sprintf("Error when verifying Bearer token: %s", err)})
+		return
+	}
+
+	if !valid {
+		log.Warningln("Can't validate Bearer token")
+		ctx.AbortWithStatusJSON(401, gin.H{"error": "Can't validate Bearer token"})
+		return
+	}
+	ctx.Next()
+}
+
+// Reset the timer safely
+func LaunchPeriodicDirectorTimeout(ctx context.Context, egrp *errgroup.Group) {
+	directorTimeoutTicker := time.NewTicker(directorTimeoutDuration)
+	nChan := getNotifyChannel()
+
+	egrp.Go(func() error {
+		for {
+			select {
+			case <-directorTimeoutTicker.C:
+				// Timer fired because no message was received in time.
+				log.Warningln("No director test report received within the time limit")
+				metrics.SetComponentHealthStatus(metrics.OriginCache_Director, metrics.StatusCritical, "No director test report received within the time limit")
+			case <-nChan:
+				log.Debugln("Got notification from director")
+				directorTimeoutTicker.Reset(directorTimeoutDuration)
+			case <-ctx.Done():
+				log.Infoln("Director health test timeout loop has been terminated")
+				return nil
+			}
+		}
+	})
+}
+
+// Director will periodically upload/download files to/from all connected
+// origins and test the health status of origins. It will send a request
+// reporting such status to this endpoint, and we will update origin internal
+// health status metric to reflect the director connection status.
+func directorTestResponse(ctx *gin.Context) {
+	dt := director.DirectorTest{}
+	if err := ctx.ShouldBind(&dt); err != nil {
+		log.Errorf("Invalid director test response")
+		ctx.JSON(400, gin.H{"error": "Invalid director test response"})
+		return
+	}
+	// We will let the timer go timeout if director didn't send a valid json request
+	notifyNewDirectorResponse(ctx)
+	if dt.Status == "ok" {
+		metrics.SetComponentHealthStatus(metrics.OriginCache_Director, metrics.StatusOK, fmt.Sprintf("Director timestamp: %v", dt.Timestamp))
+		ctx.JSON(200, gin.H{"msg": "Success"})
+	} else if dt.Status == "error" {
+		metrics.SetComponentHealthStatus(metrics.OriginCache_Director, metrics.StatusCritical, dt.Message)
+		ctx.JSON(200, gin.H{"msg": "Success"})
+	} else {
+		log.Errorf("Invalid director test response, status: %s", dt.Status)
+		ctx.JSON(400, gin.H{"error": fmt.Sprintf("Invalid director test response status: %s", dt.Status)})
+	}
+}
+
+// Configure API endpoints for origin that are not tied to UI
+func ConfigureOriginAPI(router *gin.Engine, ctx context.Context, egrp *errgroup.Group) error {
+	if router == nil {
+		return errors.New("Origin configuration passed a nil pointer")
+	}
+
+	metrics.SetComponentHealthStatus(metrics.OriginCache_Director, metrics.StatusWarning, "Initializing origin, unknown status for director")
+	// start the timer for the director test report timeout
+	LaunchPeriodicDirectorTimeout(ctx, egrp)
+
+	group := router.Group("/api/v1.0/origin-api")
+	group.POST("/directorTest", directorRequestAuthHandler, directorTestResponse)
+
+	return nil
+}
diff --git a/origin_ui/self_monitor.go b/origin_ui/self_monitor.go
new file mode 100644
index 000000000..71bf482d2
--- /dev/null
+++ b/origin_ui/self_monitor.go
@@ -0,0 +1,60 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package origin_ui
+
+import (
+	"context"
+	"time"
+
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+func doSelfMonitor(ctx context.Context) {
+	log.Debug("Starting a new self-test monitoring cycle")
+	fileTests := utils.TestFileTransferImpl{}
+	ok, err := fileTests.RunTests(ctx, param.Origin_Url.GetString(), param.Origin_Url.GetString(), utils.OriginSelfFileTest)
+	if ok && err == nil {
+		log.Debugln("Self-test monitoring cycle succeeded at", time.Now().Format(time.UnixDate))
+		metrics.SetComponentHealthStatus(metrics.OriginCache_XRootD, metrics.StatusOK, "Self-test monitoring cycle succeeded at "+time.Now().Format(time.RFC3339))
+	} else {
+		log.Warningln("Self-test monitoring cycle failed: ", err)
+		metrics.SetComponentHealthStatus(metrics.OriginCache_XRootD, metrics.StatusCritical, "Self-test monitoring cycle failed: "+err.Error())
+	}
+}
+
+// Start self-test monitoring of the origin.  This will upload, download, and delete
+// a generated filename every 15 seconds to the local origin.  On failure, it will
+// set the xrootd component's status to critical.
+func PeriodicSelfTest(ctx context.Context) error {
+	firstRound := time.After(5 * time.Second)
+	ticker := time.NewTicker(15 * time.Second)
+	for {
+		select {
+		case <-firstRound:
+			doSelfMonitor(ctx)
+		case <-ticker.C:
+			doSelfMonitor(ctx)
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
diff --git a/origin_ui/src/README.md b/origin_ui/src/README.md
deleted file mode 100644
index d07cf4ff4..000000000
--- a/origin_ui/src/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# Origin UI
-
-This ui is generated with Next.js. 
-
-## Development
-
-```shell
-docker build -t origin-ui .
-```
-
-```shell
-docker run -it -p 3000:3000 -v $(pwd):/webapp origin-ui npm run dev
-```
-
-You can also run if you have node installed locally via `npm install && npm run dev`.
\ No newline at end of file
diff --git a/origin_ui/src/app/(dashboard)/Sidebar.tsx b/origin_ui/src/app/(dashboard)/Sidebar.tsx
deleted file mode 100644
index 9df7a5779..000000000
--- a/origin_ui/src/app/(dashboard)/Sidebar.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-import Image from 'next/image'
-import styles from "../../app/page.module.css"
-import {Poppins} from "next/font/google";
-
-import PelicanLogo from "../../public/static/images/PelicanPlatformLogo_Icon.png"
-import GithubIcon from "../../public/static/images/github-mark.png"
-import {Typography, Box} from "@mui/material";
-
-export const Sidebar = () => {
-
-    return (
-        <Box>
-            <div className={styles.header} style={{display: "flex", flexDirection: "column", justifyContent:"space-between", padding:"1rem", top:0, position:"relative", zIndex:"1", overflow: "hidden", height: "100vh"}}>
-                <div style={{display:"flex"}}>
-                    <Image
-                        src={PelicanLogo}
-                        alt={"Pelican Logo"}
-                        width={32}
-                        height={32}
-                    />
-                </div>
-                <div>
-                    <a href={"https://github.com/PelicanPlatform"}>
-                        <Image
-                            src={GithubIcon}
-                            alt={"Github Mark"}
-                            width={32}
-                            height={32}
-                        />
-                    </a>
-                </div>
-            </div>
-        </Box>
-
-    )
-}
diff --git a/origin_ui/src/app/(dashboard)/page.tsx b/origin_ui/src/app/(dashboard)/page.tsx
deleted file mode 100644
index ae1c00809..000000000
--- a/origin_ui/src/app/(dashboard)/page.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-import RateGraph from "@/components/graphs/RateGraph";
-import LineGraph from "@/components/graphs/LineGraph";
-
-import {Box, Grid} from "@mui/material";
-import Image from 'next/image'
-import styles from './page.module.css'
-
-
-export default function Home() {
-
-
-
-    return (
-        <Box width={"100%"}>
-            <Grid container spacing={2}>
-                <Grid item xs={12} lg={6}>
-                    <Box sx={{backgroundColor: "#F6F6F6", borderRadius: "1rem"}} p={2}>
-                        <Box minHeight={"200px"}>
-                            <RateGraph
-                                rate={"10m"}
-                                duration={"24h"}
-                                resolution={"10m"}
-                                metric={"xrootd_monitoring_packets_received"}
-                                datasetOptions={{label: "xrootd_monitoring_packets_received rate over 10m", borderColor: "#0071ff"}}
-                                boxProps={{
-                                    maxHeight:"400px",
-                                    flexGrow:1,
-                                    justifyContent:"center",
-                                    display:"flex"
-                                }}
-                            />
-                        </Box>
-                    </Box>
-                </Grid>
-                <Grid item xs={12} lg={6}>
-                    <Box sx={{backgroundColor: "#F6F6F6", borderRadius: "1rem"}} p={2}>
-                        <Box minHeight={"200px"}>
-                            <LineGraph
-                                metric={"xrootd_server_connection_count"}
-                                duration={"24h"}
-                                resolution={"10m"}
-                                datasetOptions={{label: "xrootd_server_connection_count", borderColor: "#0071ff"}}
-                                boxProps={{
-                                    maxHeight:"400px",
-                                    flexGrow:1,
-                                    justifyContent:"center",
-                                    display:"flex"
-                                }}
-                            />
-                        </Box>
-                    </Box>
-                </Grid>
-            </Grid>
-
-        </Box>
-    )
-}
diff --git a/origin_ui/src/app/favicon.ico b/origin_ui/src/app/favicon.ico
deleted file mode 100644
index 718d6fea4..000000000
Binary files a/origin_ui/src/app/favicon.ico and /dev/null differ
diff --git a/origin_ui/src/components/graphs/LineGraph.tsx b/origin_ui/src/components/graphs/LineGraph.tsx
deleted file mode 100644
index 9270e653e..000000000
--- a/origin_ui/src/components/graphs/LineGraph.tsx
+++ /dev/null
@@ -1,120 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-"use client"
-
-import {useEffect, useState} from "react";
-import {
-    Chart as ChartJS,
-    CategoryScale,
-    LinearScale,
-    PointElement,
-    LineElement,
-    Title,
-    Tooltip,
-    Legend,
-    ChartOptions,
-    ChartDataset,
-} from 'chart.js';
-
-import {Line} from "react-chartjs-2";
-import {Skeleton, Box, BoxProps, Typography} from "@mui/material";
-
-
-import {query_basic, DataPoint} from "@/components/graphs/prometheus";
-import {ChartData} from "chart.js";
-
-ChartJS.register(
-    CategoryScale,
-    LinearScale,
-    PointElement,
-    LineElement,
-    Title,
-    Tooltip,
-    Legend
-);
-
-interface LineGraphProps {
-    boxProps?: BoxProps;
-    metric: string;
-    duration?: string;
-    resolution?: string;
-    options?: ChartOptions<"line">
-    datasetOptions?: Partial<ChartDataset<"line">>
-}
-
-export default function LineGraph({ boxProps, metric, duration, resolution, options, datasetOptions}: LineGraphProps) {
-
-    let [data, setData] = useState<DataPoint[]>([])
-    let [loading, setLoading] = useState<boolean>(true)
-    let [error, setError] = useState<string>("")
-    let [_duration, setDuration] = useState(duration ? duration : "24h")
-    let [_resolution, setResolution] = useState(resolution ? resolution : "1h")
-
-    let chartData: ChartData<"line", any, any> = {
-        datasets: [{
-            "data": data,
-            ...datasetOptions
-        }]
-    }
-
-    async function _setData(){
-        query_basic(metric, _duration, _resolution)
-            .then((response) => {
-                setData(response)
-                setLoading(false)
-                if(response.length === 0){
-                    let date = new Date(Date.now()).toLocaleTimeString()
-                    setError(`No data returned by database as of ${date}; plot will auto-refresh`)
-                } else {
-                    setError("")
-                }
-            })
-    }
-
-    useEffect(() => {
-
-        // Do the initial data fetch
-        _setData()
-
-        // Refetch the data every 1 minute
-        const interval = setInterval(() => _setData(), 60000);
-        return () => clearInterval(interval);
-
-    }, [])
-
-
-    if(loading){
-        return <Skeleton sx={{borderRadius: "1"}} variant={"rectangular"} width={"100%"} height={"100%"} />
-    }
-
-    return (
-        <Box>
-            <Box  {...boxProps}>
-                <Line
-                    data={chartData}
-                    options={options}
-                />
-            </Box>
-            <Box display={"flex"}>
-                <Typography m={"auto"} color={"red"} variant={"body2"}>{error}</Typography>
-            </Box>
-        </Box>
-    )
-
-}
diff --git a/origin_ui/src/components/graphs/RateGraph.tsx b/origin_ui/src/components/graphs/RateGraph.tsx
deleted file mode 100644
index 84136f44a..000000000
--- a/origin_ui/src/components/graphs/RateGraph.tsx
+++ /dev/null
@@ -1,125 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-"use client"
-
-import {useEffect, useState} from "react";
-import {
-    Chart as ChartJS,
-    CategoryScale,
-    LinearScale,
-    PointElement,
-    LineElement,
-    Title,
-    Tooltip,
-    Legend,
-    ChartOptions,
-    ChartDataset,
-} from 'chart.js';
-
-import {BoxProps} from "@mui/material";
-
-import {Line} from "react-chartjs-2";
-import {Box, Skeleton, Typography} from "@mui/material";
-
-import {query_rate, DataPoint} from "@/components/graphs/prometheus";
-import {ChartData} from "chart.js";
-import {Simulate} from "react-dom/test-utils";
-import error = Simulate.error;
-
-ChartJS.register(
-    CategoryScale,
-    LinearScale,
-    PointElement,
-    LineElement,
-    Title,
-    Tooltip,
-    Legend
-);
-
-interface RateGraphProps {
-    boxProps?: BoxProps;
-    metric: string;
-    rate?: string;
-    duration?: string;
-    resolution?: string;
-    options?: ChartOptions<"line">
-    datasetOptions?: Partial<ChartDataset<"line">>
-}
-
-export default function RateGraph({boxProps, metric, rate, duration, resolution, options, datasetOptions}: RateGraphProps) {
-
-    let [data, setData] = useState<DataPoint[]>([])
-    let [loading, setLoading] = useState<boolean>(true)
-    let [error, setError] = useState<string>("")
-    let [_rate, setRate] = useState(rate ? rate : "1h")
-    let [_duration, setDuration] = useState(duration ? duration : "24h")
-    let [_resolution, setResolution] = useState(resolution ? resolution : "1h")
-
-    let chartData: ChartData<"line", any, any> = {
-        datasets: [{
-            "data": data,
-            ...datasetOptions
-        }]
-    }
-
-    function _setData(){
-        query_rate(metric, _rate, _duration, _resolution)
-            .then((response) => {
-                setData(response)
-                setLoading(false)
-                if(response.length === 0){
-                    let date = new Date(Date.now()).toLocaleTimeString()
-                    setError(`No data returned by database as of ${date}; plot will auto-refresh`)
-                } else {
-                    setError("")
-                }
-            })
-    }
-
-    useEffect(() => {
-
-        // Do the initial data fetch
-        _setData()
-
-        // Refetch the data every minute
-        const interval = setInterval(() => _setData(), 60000);
-        return () => clearInterval(interval);
-
-    }, [])
-
-
-    if(loading){
-        return <Skeleton sx={{borderRadius: "1"}} variant={"rectangular"} width={"100%"} height={"100%"} />
-    }
-
-    return (
-        <Box>
-            <Box m={"auto"} {...boxProps}>
-                <Line
-                    data={chartData}
-                    options={options}
-                />
-            </Box>
-            <Box display={"flex"}>
-                <Typography m={"auto"} color={"red"} variant={"body2"}>{error}</Typography>
-            </Box>
-        </Box>
-    )
-
-}
diff --git a/origin_ui/src/components/graphs/prometheus.tsx b/origin_ui/src/components/graphs/prometheus.tsx
deleted file mode 100644
index 48c6a30f7..000000000
--- a/origin_ui/src/components/graphs/prometheus.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-/***************************************************************
- *
- * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you
- * may not use this file except in compliance with the License.  You may
- * obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ***************************************************************/
-
-"use client"
-
-import {ChartData} from "chart.js";
-
-import {isLoggedIn} from "@/helpers/login";
-
-const USEFUL_METRICS = ["xrootd_server_connection_count", "xrootd_monitoring_packets_received"]
-
-export interface DataPoint {
-    x: any;
-    y: any;
-}
-
-export async function query_raw(query: string): Promise<DataPoint[]> {
-
-    //Check if the user is logged in
-    if(!(await isLoggedIn())){
-        window.location.replace("/view/initialization/code/")
-    }
-
-    let response = await fetch(`/api/v1.0/prometheus/query?query=${query}`)
-
-    if (response.status !== 200) {
-        throw new Error(`Prometheus query returned status ${response.status}`)
-    }
-
-    let json = await response.json()
-
-    if (json.status !== "success") {
-        throw new Error(`Prometheus query returned status ${json.status}`)
-    }
-
-
-    if(json.data.result.length == 0){
-        return []
-    }
-
-    // This will return the list of time and value tuples [1693918800,"0"],[1693919100,"0"]...
-    let label_data_tuples = json.data.result[0].values
-    let data: DataPoint[] = []
-    label_data_tuples.forEach((tuple: any) => {
-
-        // Decompose the epoch time to a Date object
-        let d = new Date(0)
-        d.setUTCSeconds(tuple[0])
-
-        data.push({x: d.toLocaleTimeString(), y: tuple[1]})
-    })
-
-    return data
-}
-
-export async function query_basic(metric: string, duration: string, resolution: string): Promise<DataPoint[]> {
-    let query = `${metric}[${duration}:${resolution}]`
-    return query_raw(query)
-}
-
-export async function query_rate(metric: string, rate: string, duration: string, resolution: string): Promise<DataPoint[]>  {
-    let query = `rate(${metric}[${rate}])[${duration}:${resolution}]`
-    return query_raw(query)
-}
diff --git a/origin_ui/src/helpers/login.tsx b/origin_ui/src/helpers/login.tsx
deleted file mode 100644
index 5dad43e95..000000000
--- a/origin_ui/src/helpers/login.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-export async function isLoggedIn() {
-    let response = await fetch("/api/v1.0/origin-ui/whoami")
-    if(!response.ok){
-        return false
-    }
-    let json = await response.json()
-    return json['authenticated']
-}
diff --git a/param/param.go b/param/param.go
new file mode 100644
index 000000000..5417c1e35
--- /dev/null
+++ b/param/param.go
@@ -0,0 +1,105 @@
+package param
+
+import (
+	"reflect"
+	"sync"
+
+	"github.com/pkg/errors"
+	"github.com/spf13/viper"
+)
+
+var (
+	viperConfig *config
+	configMutex sync.RWMutex
+)
+
+// Unmarshal Viper config into a struct viperConfig and returns it
+func UnmarshalConfig() (*config, error) {
+	configMutex.Lock()
+	defer configMutex.Unlock()
+	viperConfig = new(config)
+	err := viper.Unmarshal(viperConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	return viperConfig, nil
+}
+
+// Return the unmarshaled viper config struct as a pointer
+func GetUnmarshaledConfig() (*config, error) {
+	configMutex.RLock()
+	defer configMutex.RUnlock()
+	if viperConfig == nil {
+		return nil, errors.New("Config hasn't been unmarshaled yet.")
+	}
+	return viperConfig, nil
+}
+
+// Helper function to set a parameter field entry in configWithType
+func setField(fieldType reflect.Type, value interface{}) reflect.Value {
+	field := reflect.New(fieldType).Elem()
+	sliceInterfaceType := reflect.TypeOf([]interface{}(nil))
+
+	// Check if the type of the value is nil
+	if reflect.TypeOf(value) == nil {
+		// If the value is nil, it is a object-type config without value
+		field.FieldByName("Type").SetString("[]object")
+	} else {
+		if reflect.TypeOf(value) == sliceInterfaceType {
+			field.FieldByName("Type").SetString("[]object")
+		} else {
+			field.FieldByName("Type").SetString(reflect.TypeOf(value).String())
+		}
+		field.FieldByName("Value").Set(reflect.ValueOf(value))
+	}
+
+	return field
+}
+
+// Helper function to convert config struct to configWithType struct using reflection
+func convertStruct(srcVal, destVal reflect.Value) {
+	// If the source or destination is a pointer, get the underlying element
+	if srcVal.Kind() == reflect.Ptr {
+		srcVal = srcVal.Elem()
+	}
+	if destVal.Kind() == reflect.Ptr {
+		destVal = destVal.Elem()
+	}
+
+	for i := 0; i < srcVal.NumField(); i++ {
+		srcField := srcVal.Field(i)
+		destField := destVal.FieldByName(srcVal.Type().Field(i).Name)
+
+		// Check if the field is a struct and handle recursively
+		if srcField.Kind() == reflect.Struct {
+			nestedSrc := srcField
+			nestedDest := destField
+
+			// Make sure nestedDest is addressable
+			if !nestedDest.CanSet() {
+				nestedDest = reflect.New(nestedDest.Type()).Elem()
+			}
+
+			convertStruct(nestedSrc, nestedDest)
+			destField.Set(nestedDest) // Set the converted struct back
+		} else {
+			// Handle non-struct fields
+			if destField.CanSet() {
+				destFieldType := destField.Type()
+				convertedField := setField(destFieldType, srcField.Interface())
+				destField.Set(convertedField)
+			}
+		}
+	}
+}
+
+// Convert a config struct to configWithType struct
+func ConvertToConfigWithType(rawConfig *config) *configWithType {
+	typedConfig := configWithType{}
+
+	srcVal := reflect.ValueOf(rawConfig).Elem()
+	destVal := reflect.ValueOf(&typedConfig).Elem()
+	convertStruct(srcVal, destVal)
+	return &typedConfig
+}
diff --git a/param/parameters.go b/param/parameters.go
new file mode 100644
index 000000000..0fc1d6aba
--- /dev/null
+++ b/param/parameters.go
@@ -0,0 +1,210 @@
+// Code generated by go generate; DO NOT EDIT.
+
+package param
+
+import (
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+type StringParam struct {
+	name string
+}
+
+type StringSliceParam struct {
+	name string
+}
+
+type BoolParam struct {
+	name string
+}
+
+type IntParam struct {
+	name string
+}
+
+type DurationParam struct {
+	name string
+}
+
+type ObjectParam struct {
+	name string
+}
+
+func (sP StringParam) GetString() string {
+	return viper.GetString(sP.name)
+}
+
+func (slP StringSliceParam) GetStringSlice() []string {
+	return viper.GetStringSlice(slP.name)
+}
+
+func (iP IntParam) GetInt() int {
+	return viper.GetInt(iP.name)
+}
+
+func (bP BoolParam) GetBool() bool {
+	return viper.GetBool(bP.name)
+}
+
+func (bP DurationParam) GetDuration() time.Duration {
+	return viper.GetDuration(bP.name)
+}
+
+func (bP ObjectParam) Unmarshal(rawVal any) error {
+	return viper.UnmarshalKey(bP.name, rawVal)
+}
+
+var (
+	Cache_DataLocation = StringParam{"Cache.DataLocation"}
+	Cache_ExportLocation = StringParam{"Cache.ExportLocation"}
+	Cache_XRootDPrefix = StringParam{"Cache.XRootDPrefix"}
+	Director_DefaultResponse = StringParam{"Director.DefaultResponse"}
+	Director_GeoIPLocation = StringParam{"Director.GeoIPLocation"}
+	Director_MaxMindKeyFile = StringParam{"Director.MaxMindKeyFile"}
+	Federation_DirectorUrl = StringParam{"Federation.DirectorUrl"}
+	Federation_DiscoveryUrl = StringParam{"Federation.DiscoveryUrl"}
+	Federation_JwkUrl = StringParam{"Federation.JwkUrl"}
+	Federation_NamespaceUrl = StringParam{"Federation.NamespaceUrl"}
+	Federation_RegistryUrl = StringParam{"Federation.RegistryUrl"}
+	Federation_TopologyNamespaceUrl = StringParam{"Federation.TopologyNamespaceUrl"}
+	IssuerKey = StringParam{"IssuerKey"}
+	Issuer_AuthenticationSource = StringParam{"Issuer.AuthenticationSource"}
+	Issuer_GroupFile = StringParam{"Issuer.GroupFile"}
+	Issuer_GroupSource = StringParam{"Issuer.GroupSource"}
+	Issuer_OIDCAuthenticationUserClaim = StringParam{"Issuer.OIDCAuthenticationUserClaim"}
+	Issuer_QDLLocation = StringParam{"Issuer.QDLLocation"}
+	Issuer_ScitokensServerLocation = StringParam{"Issuer.ScitokensServerLocation"}
+	Issuer_TomcatLocation = StringParam{"Issuer.TomcatLocation"}
+	Logging_Level = StringParam{"Logging.Level"}
+	Logging_LogLocation = StringParam{"Logging.LogLocation"}
+	Monitoring_DataLocation = StringParam{"Monitoring.DataLocation"}
+	OIDC_AuthorizationEndpoint = StringParam{"OIDC.AuthorizationEndpoint"}
+	OIDC_ClientID = StringParam{"OIDC.ClientID"}
+	OIDC_ClientIDFile = StringParam{"OIDC.ClientIDFile"}
+	OIDC_ClientRedirectHostname = StringParam{"OIDC.ClientRedirectHostname"}
+	OIDC_ClientSecretFile = StringParam{"OIDC.ClientSecretFile"}
+	OIDC_DeviceAuthEndpoint = StringParam{"OIDC.DeviceAuthEndpoint"}
+	OIDC_Issuer = StringParam{"OIDC.Issuer"}
+	OIDC_TokenEndpoint = StringParam{"OIDC.TokenEndpoint"}
+	OIDC_UserInfoEndpoint = StringParam{"OIDC.UserInfoEndpoint"}
+	Origin_ExportVolume = StringParam{"Origin.ExportVolume"}
+	Origin_Mode = StringParam{"Origin.Mode"}
+	Origin_NamespacePrefix = StringParam{"Origin.NamespacePrefix"}
+	Origin_S3AccessKeyfile = StringParam{"Origin.S3AccessKeyfile"}
+	Origin_S3Bucket = StringParam{"Origin.S3Bucket"}
+	Origin_S3Region = StringParam{"Origin.S3Region"}
+	Origin_S3SecretKeyfile = StringParam{"Origin.S3SecretKeyfile"}
+	Origin_S3ServiceName = StringParam{"Origin.S3ServiceName"}
+	Origin_S3ServiceUrl = StringParam{"Origin.S3ServiceUrl"}
+	Origin_ScitokensDefaultUser = StringParam{"Origin.ScitokensDefaultUser"}
+	Origin_ScitokensNameMapFile = StringParam{"Origin.ScitokensNameMapFile"}
+	Origin_ScitokensUsernameClaim = StringParam{"Origin.ScitokensUsernameClaim"}
+	Origin_Url = StringParam{"Origin.Url"}
+	Origin_XRootDPrefix = StringParam{"Origin.XRootDPrefix"}
+	Plugin_Token = StringParam{"Plugin.Token"}
+	Registry_DbLocation = StringParam{"Registry.DbLocation"}
+	Registry_InstitutionsUrl = StringParam{"Registry.InstitutionsUrl"}
+	Server_ExternalWebUrl = StringParam{"Server.ExternalWebUrl"}
+	Server_Hostname = StringParam{"Server.Hostname"}
+	Server_IssuerHostname = StringParam{"Server.IssuerHostname"}
+	Server_IssuerJwks = StringParam{"Server.IssuerJwks"}
+	Server_IssuerUrl = StringParam{"Server.IssuerUrl"}
+	Server_SessionSecretFile = StringParam{"Server.SessionSecretFile"}
+	Server_TLSCACertificateDirectory = StringParam{"Server.TLSCACertificateDirectory"}
+	Server_TLSCACertificateFile = StringParam{"Server.TLSCACertificateFile"}
+	Server_TLSCAKey = StringParam{"Server.TLSCAKey"}
+	Server_TLSCertificate = StringParam{"Server.TLSCertificate"}
+	Server_TLSKey = StringParam{"Server.TLSKey"}
+	Server_UIActivationCodeFile = StringParam{"Server.UIActivationCodeFile"}
+	Server_UIPasswordFile = StringParam{"Server.UIPasswordFile"}
+	Server_WebHost = StringParam{"Server.WebHost"}
+	StagePlugin_MountPrefix = StringParam{"StagePlugin.MountPrefix"}
+	StagePlugin_OriginPrefix = StringParam{"StagePlugin.OriginPrefix"}
+	StagePlugin_ShadowOriginPrefix = StringParam{"StagePlugin.ShadowOriginPrefix"}
+	Xrootd_Authfile = StringParam{"Xrootd.Authfile"}
+	Xrootd_DetailedMonitoringHost = StringParam{"Xrootd.DetailedMonitoringHost"}
+	Xrootd_LocalMonitoringHost = StringParam{"Xrootd.LocalMonitoringHost"}
+	Xrootd_MacaroonsKeyFile = StringParam{"Xrootd.MacaroonsKeyFile"}
+	Xrootd_ManagerHost = StringParam{"Xrootd.ManagerHost"}
+	Xrootd_Mount = StringParam{"Xrootd.Mount"}
+	Xrootd_RobotsTxtFile = StringParam{"Xrootd.RobotsTxtFile"}
+	Xrootd_RunLocation = StringParam{"Xrootd.RunLocation"}
+	Xrootd_ScitokensConfig = StringParam{"Xrootd.ScitokensConfig"}
+	Xrootd_Sitename = StringParam{"Xrootd.Sitename"}
+	Xrootd_SummaryMonitoringHost = StringParam{"Xrootd.SummaryMonitoringHost"}
+)
+
+var (
+	Director_CacheResponseHostnames = StringSliceParam{"Director.CacheResponseHostnames"}
+	Director_OriginResponseHostnames = StringSliceParam{"Director.OriginResponseHostnames"}
+	Issuer_GroupRequirements = StringSliceParam{"Issuer.GroupRequirements"}
+	Monitoring_AggregatePrefixes = StringSliceParam{"Monitoring.AggregatePrefixes"}
+	Origin_ScitokensRestrictedPaths = StringSliceParam{"Origin.ScitokensRestrictedPaths"}
+	Registry_AdminUsers = StringSliceParam{"Registry.AdminUsers"}
+	Server_Modules = StringSliceParam{"Server.Modules"}
+)
+
+var (
+	Cache_Port = IntParam{"Cache.Port"}
+	Client_MinimumDownloadSpeed = IntParam{"Client.MinimumDownloadSpeed"}
+	Client_SlowTransferRampupTime = IntParam{"Client.SlowTransferRampupTime"}
+	Client_SlowTransferWindow = IntParam{"Client.SlowTransferWindow"}
+	Client_StoppedTransferTimeout = IntParam{"Client.StoppedTransferTimeout"}
+	MinimumDownloadSpeed = IntParam{"MinimumDownloadSpeed"}
+	Monitoring_PortHigher = IntParam{"Monitoring.PortHigher"}
+	Monitoring_PortLower = IntParam{"Monitoring.PortLower"}
+	Server_IssuerPort = IntParam{"Server.IssuerPort"}
+	Server_WebPort = IntParam{"Server.WebPort"}
+	Transport_MaxIdleConns = IntParam{"Transport.MaxIdleConns"}
+	Xrootd_Port = IntParam{"Xrootd.Port"}
+)
+
+var (
+	Cache_EnableVoms = BoolParam{"Cache.EnableVoms"}
+	Client_DisableHttpProxy = BoolParam{"Client.DisableHttpProxy"}
+	Client_DisableProxyFallback = BoolParam{"Client.DisableProxyFallback"}
+	Debug = BoolParam{"Debug"}
+	DisableHttpProxy = BoolParam{"DisableHttpProxy"}
+	DisableProxyFallback = BoolParam{"DisableProxyFallback"}
+	Logging_DisableProgressBars = BoolParam{"Logging.DisableProgressBars"}
+	Monitoring_MetricAuthorization = BoolParam{"Monitoring.MetricAuthorization"}
+	Origin_EnableCmsd = BoolParam{"Origin.EnableCmsd"}
+	Origin_EnableDirListing = BoolParam{"Origin.EnableDirListing"}
+	Origin_EnableFallbackRead = BoolParam{"Origin.EnableFallbackRead"}
+	Origin_EnableIssuer = BoolParam{"Origin.EnableIssuer"}
+	Origin_EnableUI = BoolParam{"Origin.EnableUI"}
+	Origin_EnableVoms = BoolParam{"Origin.EnableVoms"}
+	Origin_EnableWrite = BoolParam{"Origin.EnableWrite"}
+	Origin_Multiuser = BoolParam{"Origin.Multiuser"}
+	Origin_ScitokensMapSubject = BoolParam{"Origin.ScitokensMapSubject"}
+	Origin_SelfTest = BoolParam{"Origin.SelfTest"}
+	Registry_RequireKeyChaining = BoolParam{"Registry.RequireKeyChaining"}
+	Server_EnableUI = BoolParam{"Server.EnableUI"}
+	StagePlugin_Hook = BoolParam{"StagePlugin.Hook"}
+	TLSSkipVerify = BoolParam{"TLSSkipVerify"}
+)
+
+var (
+	Director_AdvertisementTTL = DurationParam{"Director.AdvertisementTTL"}
+	Director_OriginCacheHealthTestInterval = DurationParam{"Director.OriginCacheHealthTestInterval"}
+	Federation_TopologyReloadInterval = DurationParam{"Federation.TopologyReloadInterval"}
+	Monitoring_TokenExpiresIn = DurationParam{"Monitoring.TokenExpiresIn"}
+	Monitoring_TokenRefreshInterval = DurationParam{"Monitoring.TokenRefreshInterval"}
+	Registry_InstitutionsUrlReloadMinutes = DurationParam{"Registry.InstitutionsUrlReloadMinutes"}
+	Server_RegistrationRetryInterval = DurationParam{"Server.RegistrationRetryInterval"}
+	Transport_DialerKeepAlive = DurationParam{"Transport.DialerKeepAlive"}
+	Transport_DialerTimeout = DurationParam{"Transport.DialerTimeout"}
+	Transport_ExpectContinueTimeout = DurationParam{"Transport.ExpectContinueTimeout"}
+	Transport_IdleConnTimeout = DurationParam{"Transport.IdleConnTimeout"}
+	Transport_ResponseHeaderTimeout = DurationParam{"Transport.ResponseHeaderTimeout"}
+	Transport_TLSHandshakeTimeout = DurationParam{"Transport.TLSHandshakeTimeout"}
+)
+
+var (
+	GeoIPOverrides = ObjectParam{"GeoIPOverrides"}
+	Issuer_AuthorizationTemplates = ObjectParam{"Issuer.AuthorizationTemplates"}
+	Issuer_OIDCAuthenticationRequirements = ObjectParam{"Issuer.OIDCAuthenticationRequirements"}
+	Registry_Institutions = ObjectParam{"Registry.Institutions"}
+)
diff --git a/param/parameters_struct.go b/param/parameters_struct.go
new file mode 100644
index 000000000..ea066ff6c
--- /dev/null
+++ b/param/parameters_struct.go
@@ -0,0 +1,346 @@
+// Code generated by go generate; DO NOT EDIT.
+
+package param
+
+import (
+	"time"
+)
+
+type config struct {
+	Cache struct {
+		DataLocation string
+		EnableVoms bool
+		ExportLocation string
+		Port int
+		XRootDPrefix string
+	}
+	Client struct {
+		DisableHttpProxy bool
+		DisableProxyFallback bool
+		MinimumDownloadSpeed int
+		SlowTransferRampupTime int
+		SlowTransferWindow int
+		StoppedTransferTimeout int
+	}
+	ConfigDir string
+	Debug bool
+	Director struct {
+		AdvertisementTTL time.Duration
+		CacheResponseHostnames []string
+		DefaultResponse string
+		GeoIPLocation string
+		MaxMindKeyFile string
+		OriginCacheHealthTestInterval time.Duration
+		OriginResponseHostnames []string
+	}
+	DisableHttpProxy bool
+	DisableProxyFallback bool
+	Federation struct {
+		DirectorUrl string
+		DiscoveryUrl string
+		JwkUrl string
+		NamespaceUrl string
+		RegistryUrl string
+		TopologyNamespaceUrl string
+		TopologyReloadInterval time.Duration
+	}
+	GeoIPOverrides interface{}
+	Issuer struct {
+		AuthenticationSource string
+		AuthorizationTemplates interface{}
+		GroupFile string
+		GroupRequirements []string
+		GroupSource string
+		OIDCAuthenticationRequirements interface{}
+		OIDCAuthenticationUserClaim string
+		QDLLocation string
+		ScitokensServerLocation string
+		TomcatLocation string
+	}
+	IssuerKey string
+	Logging struct {
+		DisableProgressBars bool
+		Level string
+		LogLocation string
+	}
+	MinimumDownloadSpeed int
+	Monitoring struct {
+		AggregatePrefixes []string
+		DataLocation string
+		MetricAuthorization bool
+		PortHigher int
+		PortLower int
+		TokenExpiresIn time.Duration
+		TokenRefreshInterval time.Duration
+	}
+	OIDC struct {
+		AuthorizationEndpoint string
+		ClientID string
+		ClientIDFile string
+		ClientRedirectHostname string
+		ClientSecretFile string
+		DeviceAuthEndpoint string
+		Issuer string
+		TokenEndpoint string
+		UserInfoEndpoint string
+	}
+	Origin struct {
+		EnableCmsd bool
+		EnableDirListing bool
+		EnableFallbackRead bool
+		EnableIssuer bool
+		EnableUI bool
+		EnableVoms bool
+		EnableWrite bool
+		ExportVolume string
+		Mode string
+		Multiuser bool
+		NamespacePrefix string
+		S3AccessKeyfile string
+		S3Bucket string
+		S3Region string
+		S3SecretKeyfile string
+		S3ServiceName string
+		S3ServiceUrl string
+		ScitokensDefaultUser string
+		ScitokensMapSubject bool
+		ScitokensNameMapFile string
+		ScitokensRestrictedPaths []string
+		ScitokensUsernameClaim string
+		SelfTest bool
+		Url string
+		XRootDPrefix string
+	}
+	Plugin struct {
+		Token string
+	}
+	Registry struct {
+		AdminUsers []string
+		DbLocation string
+		Institutions interface{}
+		InstitutionsUrl string
+		InstitutionsUrlReloadMinutes time.Duration
+		RequireKeyChaining bool
+	}
+	Server struct {
+		EnableUI bool
+		ExternalWebUrl string
+		Hostname string
+		IssuerHostname string
+		IssuerJwks string
+		IssuerPort int
+		IssuerUrl string
+		Modules []string
+		RegistrationRetryInterval time.Duration
+		SessionSecretFile string
+		TLSCACertificateDirectory string
+		TLSCACertificateFile string
+		TLSCAKey string
+		TLSCertificate string
+		TLSKey string
+		UIActivationCodeFile string
+		UIPasswordFile string
+		WebHost string
+		WebPort int
+	}
+	StagePlugin struct {
+		Hook bool
+		MountPrefix string
+		OriginPrefix string
+		ShadowOriginPrefix string
+	}
+	TLSSkipVerify bool
+	Transport struct {
+		DialerKeepAlive time.Duration
+		DialerTimeout time.Duration
+		ExpectContinueTimeout time.Duration
+		IdleConnTimeout time.Duration
+		MaxIdleConns int
+		ResponseHeaderTimeout time.Duration
+		TLSHandshakeTimeout time.Duration
+	}
+	Xrootd struct {
+		Authfile string
+		DetailedMonitoringHost string
+		LocalMonitoringHost string
+		MacaroonsKeyFile string
+		ManagerHost string
+		Mount string
+		Port int
+		RobotsTxtFile string
+		RunLocation string
+		ScitokensConfig string
+		Sitename string
+		SummaryMonitoringHost string
+	}
+}
+
+
+type configWithType struct {
+	Cache struct {
+		DataLocation struct { Type string; Value string }
+		EnableVoms struct { Type string; Value bool }
+		ExportLocation struct { Type string; Value string }
+		Port struct { Type string; Value int }
+		XRootDPrefix struct { Type string; Value string }
+	}
+	Client struct {
+		DisableHttpProxy struct { Type string; Value bool }
+		DisableProxyFallback struct { Type string; Value bool }
+		MinimumDownloadSpeed struct { Type string; Value int }
+		SlowTransferRampupTime struct { Type string; Value int }
+		SlowTransferWindow struct { Type string; Value int }
+		StoppedTransferTimeout struct { Type string; Value int }
+	}
+	ConfigDir struct { Type string; Value string }
+	Debug struct { Type string; Value bool }
+	Director struct {
+		AdvertisementTTL struct { Type string; Value time.Duration }
+		CacheResponseHostnames struct { Type string; Value []string }
+		DefaultResponse struct { Type string; Value string }
+		GeoIPLocation struct { Type string; Value string }
+		MaxMindKeyFile struct { Type string; Value string }
+		OriginCacheHealthTestInterval struct { Type string; Value time.Duration }
+		OriginResponseHostnames struct { Type string; Value []string }
+	}
+	DisableHttpProxy struct { Type string; Value bool }
+	DisableProxyFallback struct { Type string; Value bool }
+	Federation struct {
+		DirectorUrl struct { Type string; Value string }
+		DiscoveryUrl struct { Type string; Value string }
+		JwkUrl struct { Type string; Value string }
+		NamespaceUrl struct { Type string; Value string }
+		RegistryUrl struct { Type string; Value string }
+		TopologyNamespaceUrl struct { Type string; Value string }
+		TopologyReloadInterval struct { Type string; Value time.Duration }
+	}
+	GeoIPOverrides struct { Type string; Value interface{} }
+	Issuer struct {
+		AuthenticationSource struct { Type string; Value string }
+		AuthorizationTemplates struct { Type string; Value interface{} }
+		GroupFile struct { Type string; Value string }
+		GroupRequirements struct { Type string; Value []string }
+		GroupSource struct { Type string; Value string }
+		OIDCAuthenticationRequirements struct { Type string; Value interface{} }
+		OIDCAuthenticationUserClaim struct { Type string; Value string }
+		QDLLocation struct { Type string; Value string }
+		ScitokensServerLocation struct { Type string; Value string }
+		TomcatLocation struct { Type string; Value string }
+	}
+	IssuerKey struct { Type string; Value string }
+	Logging struct {
+		DisableProgressBars struct { Type string; Value bool }
+		Level struct { Type string; Value string }
+		LogLocation struct { Type string; Value string }
+	}
+	MinimumDownloadSpeed struct { Type string; Value int }
+	Monitoring struct {
+		AggregatePrefixes struct { Type string; Value []string }
+		DataLocation struct { Type string; Value string }
+		MetricAuthorization struct { Type string; Value bool }
+		PortHigher struct { Type string; Value int }
+		PortLower struct { Type string; Value int }
+		TokenExpiresIn struct { Type string; Value time.Duration }
+		TokenRefreshInterval struct { Type string; Value time.Duration }
+	}
+	OIDC struct {
+		AuthorizationEndpoint struct { Type string; Value string }
+		ClientID struct { Type string; Value string }
+		ClientIDFile struct { Type string; Value string }
+		ClientRedirectHostname struct { Type string; Value string }
+		ClientSecretFile struct { Type string; Value string }
+		DeviceAuthEndpoint struct { Type string; Value string }
+		Issuer struct { Type string; Value string }
+		TokenEndpoint struct { Type string; Value string }
+		UserInfoEndpoint struct { Type string; Value string }
+	}
+	Origin struct {
+		EnableCmsd struct { Type string; Value bool }
+		EnableDirListing struct { Type string; Value bool }
+		EnableFallbackRead struct { Type string; Value bool }
+		EnableIssuer struct { Type string; Value bool }
+		EnableUI struct { Type string; Value bool }
+		EnableVoms struct { Type string; Value bool }
+		EnableWrite struct { Type string; Value bool }
+		ExportVolume struct { Type string; Value string }
+		Mode struct { Type string; Value string }
+		Multiuser struct { Type string; Value bool }
+		NamespacePrefix struct { Type string; Value string }
+		S3AccessKeyfile struct { Type string; Value string }
+		S3Bucket struct { Type string; Value string }
+		S3Region struct { Type string; Value string }
+		S3SecretKeyfile struct { Type string; Value string }
+		S3ServiceName struct { Type string; Value string }
+		S3ServiceUrl struct { Type string; Value string }
+		ScitokensDefaultUser struct { Type string; Value string }
+		ScitokensMapSubject struct { Type string; Value bool }
+		ScitokensNameMapFile struct { Type string; Value string }
+		ScitokensRestrictedPaths struct { Type string; Value []string }
+		ScitokensUsernameClaim struct { Type string; Value string }
+		SelfTest struct { Type string; Value bool }
+		Url struct { Type string; Value string }
+		XRootDPrefix struct { Type string; Value string }
+	}
+	Plugin struct {
+		Token struct { Type string; Value string }
+	}
+	Registry struct {
+		AdminUsers struct { Type string; Value []string }
+		DbLocation struct { Type string; Value string }
+		Institutions struct { Type string; Value interface{} }
+		InstitutionsUrl struct { Type string; Value string }
+		InstitutionsUrlReloadMinutes struct { Type string; Value time.Duration }
+		RequireKeyChaining struct { Type string; Value bool }
+	}
+	Server struct {
+		EnableUI struct { Type string; Value bool }
+		ExternalWebUrl struct { Type string; Value string }
+		Hostname struct { Type string; Value string }
+		IssuerHostname struct { Type string; Value string }
+		IssuerJwks struct { Type string; Value string }
+		IssuerPort struct { Type string; Value int }
+		IssuerUrl struct { Type string; Value string }
+		Modules struct { Type string; Value []string }
+		RegistrationRetryInterval struct { Type string; Value time.Duration }
+		SessionSecretFile struct { Type string; Value string }
+		TLSCACertificateDirectory struct { Type string; Value string }
+		TLSCACertificateFile struct { Type string; Value string }
+		TLSCAKey struct { Type string; Value string }
+		TLSCertificate struct { Type string; Value string }
+		TLSKey struct { Type string; Value string }
+		UIActivationCodeFile struct { Type string; Value string }
+		UIPasswordFile struct { Type string; Value string }
+		WebHost struct { Type string; Value string }
+		WebPort struct { Type string; Value int }
+	}
+	StagePlugin struct {
+		Hook struct { Type string; Value bool }
+		MountPrefix struct { Type string; Value string }
+		OriginPrefix struct { Type string; Value string }
+		ShadowOriginPrefix struct { Type string; Value string }
+	}
+	TLSSkipVerify struct { Type string; Value bool }
+	Transport struct {
+		DialerKeepAlive struct { Type string; Value time.Duration }
+		DialerTimeout struct { Type string; Value time.Duration }
+		ExpectContinueTimeout struct { Type string; Value time.Duration }
+		IdleConnTimeout struct { Type string; Value time.Duration }
+		MaxIdleConns struct { Type string; Value int }
+		ResponseHeaderTimeout struct { Type string; Value time.Duration }
+		TLSHandshakeTimeout struct { Type string; Value time.Duration }
+	}
+	Xrootd struct {
+		Authfile struct { Type string; Value string }
+		DetailedMonitoringHost struct { Type string; Value string }
+		LocalMonitoringHost struct { Type string; Value string }
+		MacaroonsKeyFile struct { Type string; Value string }
+		ManagerHost struct { Type string; Value string }
+		Mount struct { Type string; Value string }
+		Port struct { Type string; Value int }
+		RobotsTxtFile struct { Type string; Value string }
+		RunLocation struct { Type string; Value string }
+		ScitokensConfig struct { Type string; Value string }
+		Sitename struct { Type string; Value string }
+		SummaryMonitoringHost struct { Type string; Value string }
+	}
+}
diff --git a/namespace-registry/client_commands.go b/registry/client_commands.go
similarity index 69%
rename from namespace-registry/client_commands.go
rename to registry/client_commands.go
index 1d5b0759b..07ff3a919 100644
--- a/namespace-registry/client_commands.go
+++ b/registry/client_commands.go
@@ -16,30 +16,27 @@
  *
  ***************************************************************/
 
-package nsregistry
+package registry
 
 import (
-	"crypto/tls"
-
-	"github.com/pkg/errors"
-
 	"bufio"
-	"bytes"
+	"crypto/ecdsa"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
-	"io"
-	"net/http"
 	"os"
 	"time"
 
 	"github.com/lestrrat-go/jwx/v2/jwa"
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+
 	"github.com/pelicanplatform/pelican/config"
 	"github.com/pelicanplatform/pelican/director"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/pelicanplatform/pelican/utils"
 )
 
 type clientResponseData struct {
@@ -50,44 +47,11 @@ type clientResponseData struct {
 	ServerNonce     string `json:"server_nonce"`
 	ServerPayload   string `json:"server_payload"`
 	ServerSignature string `json:"server_signature"`
+	Message         string `json:"message"`
 	Error           string `json:"error"`
 }
 
-func makeRequest(url string, method string, data map[string]interface{}, headers map[string]string) ([]byte, error) {
-	payload, _ := json.Marshal(data)
-	req, err := http.NewRequest(method, url, bytes.NewBuffer(payload))
-	if err != nil {
-		return nil, err
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	for key, val := range headers {
-		req.Header.Set(key, val)
-	}
-
-	client := &http.Client{}
-	if viper.GetBool("TLSSkipVerify") {
-		tr := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
-		client = &http.Client{Transport: tr}
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	// Check HTTP response -- should be 200, else something went wrong
-	body, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode != 200 {
-		return body, errors.Errorf("The URL %s replied with status code %d", url, resp.StatusCode)
-	}
-
-	return body, nil
-}
-
-func NamespaceRegisterWithIdentity(privateKeyPath string, namespaceRegistryEndpoint string, prefix string) error {
+func NamespaceRegisterWithIdentity(privateKey jwk.Key, namespaceRegistryEndpoint string, prefix string) error {
 	identifiedPayload := map[string]interface{}{
 		"identity_required": "true",
 		"prefix":            prefix,
@@ -95,7 +59,7 @@ func NamespaceRegisterWithIdentity(privateKeyPath string, namespaceRegistryEndpo
 		// it's also registered already
 
 	}
-	resp, err := makeRequest(namespaceRegistryEndpoint, "POST", identifiedPayload, nil)
+	resp, err := utils.MakeRequest(namespaceRegistryEndpoint, "POST", identifiedPayload, nil)
 
 	var respData clientResponseData
 	// Handle case where there was an error encoded in the body
@@ -118,7 +82,7 @@ func NamespaceRegisterWithIdentity(privateKeyPath string, namespaceRegistryEndpo
 			"identity_required": "true",
 			"device_code":       respData.DeviceCode,
 		}
-		resp, err = makeRequest(namespaceRegistryEndpoint, "POST", identifiedPayload, nil)
+		resp, err = utils.MakeRequest(namespaceRegistryEndpoint, "POST", identifiedPayload, nil)
 		if err != nil {
 			return errors.Wrap(err, "Failed to make request")
 		}
@@ -135,40 +99,35 @@ func NamespaceRegisterWithIdentity(privateKeyPath string, namespaceRegistryEndpo
 			_, _ = reader.ReadString('\n')
 		}
 	}
-	return NamespaceRegister(privateKeyPath, namespaceRegistryEndpoint, respData.AccessToken, prefix)
+	return NamespaceRegister(privateKey, namespaceRegistryEndpoint, respData.AccessToken, prefix)
 }
 
-func NamespaceRegister(privateKeyPath string, namespaceRegistryEndpoint string, accessToken string, prefix string) error {
-	publicKey, err := config.LoadPublicKey("", privateKeyPath)
+func NamespaceRegister(privateKey jwk.Key, namespaceRegistryEndpoint string, accessToken string, prefix string) error {
+	publicKey, err := privateKey.PublicKey()
 	if err != nil {
-		return errors.Wrap(err, "Failed to retrieve public key")
+		return errors.Wrapf(err, "Failed to generate public key for namespace registration")
 	}
-
-	/*
-	 * TODO: For now, we only allow namespace registration to occur with a single key, but
-	 *       at some point we should expose an API for adding additional pubkeys to each
-	 *       namespace. There is a similar TODO listed in registry.go, as the choices made
-	 *       there mirror the choices made here.
-	 * To enforce that we're only trying to register one key, we check the length here
-	 */
-	if (*publicKey).Len() > 1 {
-		return errors.Errorf("Only one public key can be registered in this step, but %d were provided\n", (*publicKey).Len())
+	err = jwk.AssignKeyID(publicKey)
+	if err != nil {
+		return errors.Wrap(err, "Failed to assign key ID to public key")
+	}
+	if err = publicKey.Set("alg", "ES256"); err != nil {
+		return errors.Wrap(err, "Failed to assign signature algorithm to public key")
+	}
+	keySet := jwk.NewSet()
+	if err = keySet.AddKey(publicKey); err != nil {
+		return errors.Wrap(err, "Failed to add public key to new JWKS")
 	}
 
 	if log.IsLevelEnabled(log.DebugLevel) {
 		// Let's check that we can convert to JSON and get the right thing...
-		jsonbuf, err := json.Marshal(publicKey)
+		jsonbuf, err := json.Marshal(keySet)
 		if err != nil {
 			return errors.Wrap(err, "failed to marshal the public key into JWKS JSON")
 		}
 		log.Debugln("Constructed JWKS from loading public key:", string(jsonbuf))
 	}
 
-	privateKey, err := config.LoadPrivateKey(privateKeyPath)
-	if err != nil {
-		return errors.Wrap(err, "Failed to load private key")
-	}
-
 	clientNonce, err := generateNonce()
 	if err != nil {
 		return errors.Wrap(err, "Failed to generate client nonce")
@@ -176,16 +135,16 @@ func NamespaceRegister(privateKeyPath string, namespaceRegistryEndpoint string,
 
 	data := map[string]interface{}{
 		"client_nonce": clientNonce,
-		"pubkey":       publicKey,
+		"pubkey":       keySet,
 	}
 
-	resp, err := makeRequest(namespaceRegistryEndpoint, "POST", data, nil)
+	resp, err := utils.MakeRequest(namespaceRegistryEndpoint, "POST", data, nil)
 
 	var respData clientResponseData
 	// Handle case where there was an error encoded in the body
 	if err != nil {
 		if unmarshalErr := json.Unmarshal(resp, &respData); unmarshalErr == nil { // Error creating json
-			return errors.Wrapf(err, "Failed to make request: %v", respData.Error)
+			return errors.Wrapf(err, "Failed to make request (server message is '%v')", respData.Error)
 		}
 		return errors.Wrap(err, "Failed to make request")
 	}
@@ -199,7 +158,11 @@ func NamespaceRegister(privateKeyPath string, namespaceRegistryEndpoint string,
 	clientPayload := clientNonce + respData.ServerNonce
 
 	// Sign the payload
-	signature, err := signPayload([]byte(clientPayload), privateKey)
+	privateKeyRaw := &ecdsa.PrivateKey{}
+	if err = privateKey.Raw(privateKeyRaw); err != nil {
+		return errors.Wrap(err, "Failed to get an ECDSA private key")
+	}
+	signature, err := signPayload([]byte(clientPayload), privateKeyRaw)
 	if err != nil {
 		return errors.Wrap(err, "Failed to sign payload")
 	}
@@ -208,7 +171,7 @@ func NamespaceRegister(privateKeyPath string, namespaceRegistryEndpoint string,
 	unidentifiedPayload := map[string]interface{}{
 		"client_nonce":      clientNonce,
 		"server_nonce":      respData.ServerNonce,
-		"pubkey":            publicKey,
+		"pubkey":            keySet,
 		"client_payload":    clientPayload,
 		"client_signature":  hex.EncodeToString(signature),
 		"server_payload":    respData.ServerPayload,
@@ -219,22 +182,26 @@ func NamespaceRegister(privateKeyPath string, namespaceRegistryEndpoint string,
 	}
 
 	// Send the second POST request
-	resp, err = makeRequest(namespaceRegistryEndpoint, "POST", unidentifiedPayload, nil)
+	resp, err = utils.MakeRequest(namespaceRegistryEndpoint, "POST", unidentifiedPayload, nil)
 
-	var respData2 clientResponseData
 	// Handle case where there was an error encoded in the body
-	if err != nil {
-		if unmarshalErr := json.Unmarshal(resp, &respData2); unmarshalErr == nil {
-			return errors.Wrapf(err, "Failed to make request: %v", respData2.Error)
+	if unmarshalErr := json.Unmarshal(resp, &respData); unmarshalErr == nil {
+		if err != nil {
+			return errors.Wrapf(err, "Failed to make request: %v", respData.Error)
 		}
-		return errors.Wrap(err, "Failed to make request")
+		fmt.Println(respData.Message)
+	} else {
+		if err != nil {
+			return errors.Wrapf(err, "Failed to make request: %s", resp)
+		}
+		return errors.Wrapf(unmarshalErr, "Failed to unmarshall request response: %v", respData.Error)
 	}
 
 	return nil
 }
 
 func NamespaceList(endpoint string) error {
-	respData, err := makeRequest(endpoint, "GET", nil, nil)
+	respData, err := utils.MakeRequest(endpoint, "GET", nil, nil)
 	var respErr clientResponseData
 	if err != nil {
 		if jsonErr := json.Unmarshal(respData, &respErr); jsonErr == nil { // Error creating json
@@ -247,7 +214,7 @@ func NamespaceList(endpoint string) error {
 }
 
 func NamespaceGet(endpoint string) error {
-	respData, err := makeRequest(endpoint, "GET", nil, nil)
+	respData, err := utils.MakeRequest(endpoint, "GET", nil, nil)
 	var respErr clientResponseData
 	if err != nil {
 		if jsonErr := json.Unmarshal(respData, &respErr); jsonErr == nil { // Error creating json
@@ -263,10 +230,10 @@ func NamespaceDelete(endpoint string, prefix string) error {
 	// First we create a token for the registry to check that the deletion
 	// request is valid
 
-	// TODO: We might consider moving widely-useful functions like `GetIssuerURL`
+	// TODO: We might consider moving widely-useful functions like `GetRegistryIssuerURL`
 	//       to a more generic `pelican/utils` package so that they're easier to find
 	//       and more likely to be used.
-	issuerURL, err := director.GetIssuerURL(prefix)
+	issuerURL, err := director.GetRegistryIssuerURL(prefix)
 	if err != nil {
 		return errors.Wrap(err, "Failed to determine issuer URL for creating deletion token")
 	}
@@ -278,7 +245,7 @@ func NamespaceDelete(endpoint string, prefix string) error {
 	now := time.Now()
 	tok, err := jwt.NewBuilder().
 		Issuer(issuerURL).
-		Claim("scope", "pelican.namespace_delete").
+		Claim("scope", token_scopes.Pelican_NamespaceDelete.String()).
 		IssuedAt(now).
 		Expiration(now.Add(1 * time.Minute)).
 		NotBefore(now).
@@ -289,18 +256,18 @@ func NamespaceDelete(endpoint string, prefix string) error {
 	}
 
 	// Now that we have a token, it needs signing
-	key, err := config.GetOriginJWK()
+	key, err := config.GetIssuerPrivateJWK()
 	if err != nil {
-		return errors.Wrap(err, "failed to load the origin's JWK")
+		return errors.Wrap(err, "failed to load the registry's JWK")
 	}
 
 	// Get/assign the kid, needed for verification by the client
-	err = jwk.AssignKeyID(*key)
+	err = jwk.AssignKeyID(key)
 	if err != nil {
 		return errors.Wrap(err, "Failed to assign kid to the token")
 	}
 
-	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES512, *key))
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
 	if err != nil {
 		return errors.Wrap(err, "Failed to sign the deletion token")
 	}
@@ -315,7 +282,7 @@ func NamespaceDelete(endpoint string, prefix string) error {
 		"Authorization": "Bearer " + string(signed),
 	}
 
-	respData, err := makeRequest(endpoint, "DELETE", nil, authHeader)
+	respData, err := utils.MakeRequest(endpoint, "DELETE", nil, authHeader)
 	var respErr clientResponseData
 	if err != nil {
 		if unmarshalErr := json.Unmarshal(respData, &respErr); unmarshalErr == nil { // Error creating json
diff --git a/registry/client_commands_test.go b/registry/client_commands_test.go
new file mode 100644
index 000000000..f0a7e72d1
--- /dev/null
+++ b/registry/client_commands_test.go
@@ -0,0 +1,259 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package registry
+
+import (
+	"context"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func registryMockup(ctx context.Context, t *testing.T, testName string) *httptest.Server {
+
+	issuerTempDir := filepath.Join(t.TempDir(), testName)
+
+	ikey := filepath.Join(issuerTempDir, "issuer.jwk")
+	viper.Set("IssuerKey", ikey)
+	viper.Set("Registry.DbLocation", filepath.Join(issuerTempDir, "test.sql"))
+	err := config.InitServer(ctx, config.RegistryType)
+	require.NoError(t, err)
+
+	setupMockRegistryDB(t)
+
+	gin.SetMode(gin.TestMode)
+	engine := gin.Default()
+
+	//Configure registry
+	RegisterRegistryAPI(engine.Group("/"))
+
+	//Set up a server to use for testing
+	svr := httptest.NewServer(engine)
+	viper.Set("Federation.RegistryUrl", svr.URL)
+	return svr
+}
+
+func TestServeNamespaceRegistry(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+
+	svr := registryMockup(ctx, t, "serveregistry")
+	defer func() {
+		err := ShutdownDB()
+		assert.NoError(t, err)
+		svr.CloseClientConnections()
+		svr.Close()
+	}()
+
+	_, err := config.GetIssuerPublicJWKS()
+	require.NoError(t, err)
+	privKey, err := config.GetIssuerPrivateJWK()
+	require.NoError(t, err)
+
+	//Test functionality of registering a namespace (without identity)
+	err = NamespaceRegister(privKey, svr.URL+"/api/v1.0/registry", "", "/foo/bar")
+	require.NoError(t, err)
+
+	//Test we can list the namespace without an error
+	t.Run("Test namespace list", func(t *testing.T) {
+		//Set up a buffer to capture stdout
+		var stdoutCapture string
+		oldStdout := os.Stdout
+		r, w, _ := os.Pipe()
+		os.Stdout = w
+
+		//List the namespaces
+		err = NamespaceList(svr.URL + "/api/v1.0/registry")
+		require.NoError(t, err)
+		w.Close()
+		os.Stdout = oldStdout
+
+		capturedOutput := make([]byte, 1024)
+		n, _ := r.Read(capturedOutput)
+		stdoutCapture = string(capturedOutput[:n])
+		assert.Contains(t, stdoutCapture, `"prefix":"/foo/bar"`)
+	})
+
+	t.Run("Test namespace delete", func(t *testing.T) {
+		//Test functionality of namespace delete
+		err = NamespaceDelete(svr.URL+"/api/v1.0/registry/foo/bar", "/foo/bar")
+		require.NoError(t, err)
+		var stdoutCapture string
+		oldStdout := os.Stdout
+		r, w, _ := os.Pipe()
+		os.Stdout = w
+		err = NamespaceGet(svr.URL + "/api/v1.0/registry")
+		require.NoError(t, err)
+		w.Close()
+		os.Stdout = oldStdout
+
+		capturedOutput := make([]byte, 1024)
+		n, _ := r.Read(capturedOutput)
+		stdoutCapture = string(capturedOutput[:n])
+		assert.Equal(t, "[]\n", stdoutCapture)
+	})
+	viper.Reset()
+}
+
+func TestRegistryKeyChainingOSDF(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	_ = config.SetPreferredPrefix("OSDF")
+	// On by default, but just to make things explicit
+	viper.Set("Registry.RequireKeyChaining", true)
+
+	registrySvr := registryMockup(ctx, t, "OSDFkeychaining")
+	topoSvr := topologyMockup(t, []string{"/topo/foo"})
+	viper.Set("Federation.TopologyNamespaceURL", topoSvr.URL)
+	err := PopulateTopology()
+	require.NoError(t, err)
+
+	defer func() {
+		err := ShutdownDB()
+		assert.NoError(t, err)
+		registrySvr.CloseClientConnections()
+		registrySvr.Close()
+		topoSvr.CloseClientConnections()
+		topoSvr.Close()
+	}()
+
+	_, err = config.GetIssuerPublicJWKS()
+	require.NoError(t, err)
+	privKey, err := config.GetIssuerPrivateJWK()
+	require.NoError(t, err)
+
+	// Start by registering /foo/bar with the default key
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar")
+	require.NoError(t, err)
+
+	// Perform one test with a subspace and the same key -- should succeed
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar/test")
+	require.NoError(t, err)
+
+	// For now, we simply don't allow further super/sub spacing of namespaces from topo, because how
+	// can we validate via a key if there is none?
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/topo/foo/bar")
+	require.Error(t, err)
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/topo")
+	require.Error(t, err)
+
+	// Now we create a new key and try to use it to register a super/sub space. These shouldn't succeed
+	viper.Set("IssuerKey", t.TempDir()+"/keychaining")
+	_, err = config.GetIssuerPublicJWKS()
+	require.NoError(t, err)
+	privKey, err = config.GetIssuerPrivateJWK()
+	require.NoError(t, err)
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar/baz")
+	require.ErrorContains(t, err, "Cannot register a namespace that is suffixed or prefixed")
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo")
+	require.ErrorContains(t, err, "Cannot register a namespace that is suffixed or prefixed")
+
+	// Make sure we can register things similar but distinct in prefix and suffix
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/fo")
+	require.NoError(t, err)
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/barz")
+	require.NoError(t, err)
+
+	// Now turn off token chaining and retry -- no errors should occur
+	viper.Set("Registry.RequireKeyChaining", false)
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar/baz")
+	require.NoError(t, err)
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo")
+	require.NoError(t, err)
+
+	// Finally, test with one value for topo
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/topo")
+	require.NoError(t, err)
+
+	config.SetPreferredPrefix("pelican")
+	viper.Reset()
+}
+
+func TestRegistryKeyChaining(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	// On by default, but just to make things explicit
+	viper.Set("Registry.RequireKeyChaining", true)
+
+	registrySvr := registryMockup(ctx, t, "keychaining")
+	defer func() {
+		err := ShutdownDB()
+		assert.NoError(t, err)
+		registrySvr.CloseClientConnections()
+		registrySvr.Close()
+	}()
+
+	_, err := config.GetIssuerPublicJWKS()
+	require.NoError(t, err)
+	privKey, err := config.GetIssuerPrivateJWK()
+	require.NoError(t, err)
+
+	// Start by registering /foo/bar with the default key
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar")
+	require.NoError(t, err)
+
+	// Perform one test with a subspace and the same key -- should succeed
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar/test")
+	require.NoError(t, err)
+
+	// Now we create a new key and try to use it to register a super/sub space. These shouldn't succeed
+	viper.Set("IssuerKey", t.TempDir()+"/keychaining")
+	_, err = config.GetIssuerPublicJWKS()
+	require.NoError(t, err)
+	privKey, err = config.GetIssuerPrivateJWK()
+	require.NoError(t, err)
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar/baz")
+	require.ErrorContains(t, err, "Cannot register a namespace that is suffixed or prefixed")
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo")
+	require.ErrorContains(t, err, "Cannot register a namespace that is suffixed or prefixed")
+
+	// Now turn off token chaining and retry -- no errors should occur
+	viper.Set("Registry.RequireKeyChaining", false)
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo/bar/baz")
+	require.NoError(t, err)
+
+	err = NamespaceRegister(privKey, registrySvr.URL+"/api/v1.0/registry", "", "/foo")
+	require.NoError(t, err)
+
+	viper.Reset()
+}
diff --git a/namespace-registry/registry.go b/registry/registry.go
similarity index 62%
rename from namespace-registry/registry.go
rename to registry/registry.go
index 37b63b28e..be16ccbc0 100644
--- a/namespace-registry/registry.go
+++ b/registry/registry.go
@@ -16,7 +16,15 @@
  *
  ***************************************************************/
 
-package nsregistry
+// Package registry handles namespace registration in Pelican ecosystem.
+//
+//   - It handles the logic to spin up a "registry" server for namespace management,
+//     including a web UI for interactive namespace registration, approval, and browsing.
+//   - It provides a CLI tool `./pelican namespace <command> <args>` to list, register, and delete a namespace
+//
+// To register a namespace, first spin up registry server by `./pelican registry serve -p <your-port-number>`, and then use either
+// the CLI tool or go to registry web UI at `https://localhost:<your-port-number>/view/`, and follow instructions for next steps.
+package registry
 
 import (
 	"context"
@@ -26,10 +34,10 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
-	"os"
 	"strings"
 	"sync"
 
@@ -37,9 +45,11 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/lestrrat-go/jwx/v2/jwt"
 	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/oauth2"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
 
 	// use this sqlite driver instead of the one from
 	// github.com/mattn/go-sqlite3, because this one
@@ -74,9 +84,19 @@ type TokenResponse struct {
 	Error       string `json:"error"`
 }
 
-/*
-Various auxiliary functions used for client-server security handshakes
-*/
+type checkNamespaceExistsReq struct {
+	Prefix string `json:"prefix"`
+	PubKey string `json:"pubkey"`
+}
+
+type checkNamespaceExistsRes struct {
+	PrefixExists bool   `json:"prefix_exists"`
+	KeyMatch     bool   `json:"key_match"`
+	Message      string `json:"message"`
+	Error        string `json:"error"`
+}
+
+// Various auxiliary functions used for client-server security handshakes
 type registrationData struct {
 	ClientNonce     string `json:"client_nonce"`
 	ClientPayload   string `json:"client_payload"`
@@ -94,6 +114,42 @@ type registrationData struct {
 	Prefix           string          `json:"prefix"`
 }
 
+func matchKeys(incomingKey jwk.Key, registeredNamespaces []string) (bool, error) {
+	// If this is the case, we want to make sure that at least one of the superspaces has the
+	// same registration key as the incoming. This guarantees the owner of the superspace is
+	// permitting the action (assuming their keys haven't been stolen!)
+	foundMatch := false
+	for _, ns := range registeredNamespaces {
+		keyset, err := getNamespaceJwksByPrefix(ns, false)
+		if err != nil {
+			return false, errors.Wrapf(err, "Cannot get keyset for %s from the database", ns)
+		}
+
+		// A super inelegant way to compare keys, but for whatever reason the keyset.Index(key) method
+		// doesn't seem to actually recognize when a key is in the keyset, even if that key decodes to
+		// the exact same JSON as a key in the set...
+		for it := (keyset).Keys(context.Background()); it.Next(context.Background()); {
+			pair := it.Pair()
+			registeredKey := pair.Value.(jwk.Key)
+			registeredKeyBuf, err := json.Marshal(registeredKey)
+			if err != nil {
+				return false, errors.Wrapf(err, "failed to marshal a key registered to %s into JSON", ns)
+			}
+			incomingKeyBuf, err := json.Marshal(incomingKey)
+			if err != nil {
+				return false, errors.Wrap(err, "failed to marshal the incoming key into JSON")
+			}
+
+			if string(registeredKeyBuf) == string(incomingKeyBuf) {
+				foundMatch = true
+				break
+			}
+		}
+	}
+
+	return foundMatch, nil
+}
+
 func keySignChallenge(ctx *gin.Context, data *registrationData, action string) error {
 	if data.ClientNonce != "" && data.ClientPayload != "" && data.ClientSignature != "" &&
 		data.ServerNonce != "" && data.ServerPayload != "" && data.ServerSignature != "" {
@@ -127,86 +183,12 @@ func loadServerKeys() (*ecdsa.PrivateKey, error) {
 	// Note: go 1.21 introduces `OnceValues` which automates this procedure.
 	// TODO: Reimplement the function once we switch to a minimum of 1.21
 	serverCredsLoad.Do(func() {
-		issuerFileName := viper.GetString("IssuerKey")
+		issuerFileName := param.IssuerKey.GetString()
 		serverCredsPrivKey, serverCredsErr = config.LoadPrivateKey(issuerFileName)
 	})
 	return serverCredsPrivKey, serverCredsErr
 }
 
-func loadOIDC() error {
-	// Load OIDC.ClientID
-	OIDCClientIDFile := viper.GetString("OIDC.ClientIDFile")
-	OIDCClientIDFromEnv := viper.GetString("OIDCCLIENTID")
-	if OIDCClientIDFile != "" {
-		contents, err := os.ReadFile(OIDCClientIDFile)
-		if err != nil {
-			return errors.Wrapf(err, "Failed reading provided OIDC.ClientIDFile %s", OIDCClientIDFile)
-		}
-		OIDC.ClientID = strings.TrimSpace(string(contents))
-	} else if OIDCClientIDFromEnv != "" {
-		OIDC.ClientID = OIDCClientIDFromEnv
-	} else {
-		return errors.New("An OIDC Client Identity file must be specified in the config (OIDC.ClientIDFile)," +
-			" or the identity must be provided via the environment variable PELICAN_OIDCCLIENTID")
-	}
-
-	// load OIDC.ClientSecret
-	OIDCClientSecretFile := viper.GetString("OIDC.ClientSecretFile")
-	OIDCClientSecretFromEnv := viper.GetString("OIDCCLIENTSECRET")
-	if OIDCClientSecretFile != "" {
-		contents, err := os.ReadFile(OIDCClientSecretFile)
-		if err != nil {
-			return errors.Wrapf(err, "Failed reading provided OIDCClientSecretFile %s", OIDCClientSecretFile)
-		}
-		OIDC.ClientSecret = strings.TrimSpace(string(contents))
-	} else if OIDCClientSecretFromEnv != "" {
-		OIDC.ClientSecret = OIDCClientSecretFromEnv
-	} else {
-		return errors.New("An OIDC Client Secret file must be specified in the config (OIDC.ClientSecretFile)," +
-			" or the secret must be provided via the environment variable PELICAN_OIDCCLIENTSECRET")
-	}
-
-	// Load OIDC.DeviceAuthEndpoint
-	deviceAuthEndpoint := viper.GetString("OIDC.DeviceAuthEndpoint")
-	if deviceAuthEndpoint == "" {
-		return errors.New("Nothing set for config parameter OIDC.DeviceAuthEndpoint, so registration with identity not supported")
-	}
-	deviceAuthEndpointURL, err := url.Parse(deviceAuthEndpoint)
-	if err != nil {
-		return errors.New("Failed to parse URL for parameter OIDC.DeviceAuthEndpoint")
-	}
-	OIDC.DeviceAuthEndpoint = deviceAuthEndpointURL.String()
-
-	// Load OIDC.TokenEndpoint
-	tokenEndpoint := viper.GetString("OIDC.TokenEndpoint")
-	if tokenEndpoint == "" {
-		return errors.New("Nothing set for config parameter OIDC.TokenEndpoint, so registration with identity not supported")
-	}
-	tokenAuthEndpointURL, err := url.Parse(tokenEndpoint)
-	if err != nil {
-		return errors.New("Failed to parse URL for parameter OIDC.TokenEndpoint")
-	}
-	OIDC.TokenEndpoint = tokenAuthEndpointURL.String()
-
-	// Load OIDC.UserInfoEndpoint
-	userInfoEndpoint := viper.GetString("OIDC.UserInfoEndpoint")
-	if userInfoEndpoint == "" {
-		return errors.New("Nothing set for config parameter OIDC.UserInfoEndpoint, so registration with identity not supported")
-	}
-	userInfoEndpointURL, err := url.Parse(userInfoEndpoint)
-	if err != nil {
-		return errors.New("Failed to parse URL for parameter OIDC.UserInfoEndpoint")
-	}
-	OIDC.UserInfoEndpoint = userInfoEndpointURL.String()
-
-	// Set the scope
-	OIDC.Scope = "openid profile email org.cilogon.userinfo"
-
-	// Set the grant type
-	OIDC.GrantType = "urn:ietf:params:oauth:grant-type:device_code"
-	return nil
-}
-
 func signPayload(payload []byte, privateKey *ecdsa.PrivateKey) ([]byte, error) {
 	hash := sha256.Sum256(payload)
 	signature, err := privateKey.Sign(rand.Reader, hash[:], crypto.SHA256) // Use crypto.SHA256 instead of the hash[:]
@@ -252,31 +234,10 @@ func keySignChallengeInit(ctx *gin.Context, data *registrationData) error {
 }
 
 func keySignChallengeCommit(ctx *gin.Context, data *registrationData, action string) error {
-	// Parse the client's jwks as a set here
-	clientJwks, err := jwk.Parse(data.Pubkey)
+	// Validate the client's jwks as a set here
+	key, err := validateJwks(string(data.Pubkey))
 	if err != nil {
-		return errors.Wrap(err, "Couldn't parse the pubkey from the client")
-	}
-
-	if log.IsLevelEnabled(log.DebugLevel) {
-		// Let's check that we can convert to JSON and get the right thing...
-		jsonbuf, err := json.Marshal(clientJwks)
-		if err != nil {
-			return errors.Wrap(err, "failed to marshal the client's keyset into JSON")
-		}
-		log.Debugln("Client JWKS as seen by the registry server:", string(jsonbuf))
-	}
-
-	/*
-	 * TODO: This section makes the assumption that the incoming jwks only contains a single
-	 *       key, a property that is enforced by the client at the origin. Eventually we need
-	 *       to support the addition of other keys in the jwks stored for the origin. There is
-	 *       a similar TODO listed in client_commands.go, as the choices made there mirror the
-	 *       choices made here.
-	 */
-	key, exists := clientJwks.Key(0)
-	if !exists {
-		return errors.New("There was no key at index 0 in the client's JWKS. Something is wrong")
+		return err
 	}
 
 	var rawkey interface{} // This is the raw key, like *rsa.PrivateKey or *ecdsa.PrivateKey
@@ -322,9 +283,15 @@ func keySignChallengeCommit(ctx *gin.Context, data *registrationData, action str
 				return errors.Wrap(err, "Server encountered an error checking if namespace already exists")
 			}
 			if exists {
-				return errors.New("The prefix already is registered")
+				returnMsg := map[string]interface{}{
+					"message": fmt.Sprintf("The prefix %s is already registered -- nothing else to do!", data.Prefix),
+				}
+				ctx.AbortWithStatusJSON(200, returnMsg)
+				log.Infof("Skipping registration of prefix %s because it's already registered.", data.Prefix)
+				return nil
 			}
-			reqPrefix, err := validateNSPath(data.Prefix)
+
+			reqPrefix, err := validatePrefix(data.Prefix)
 			if err != nil {
 				err = errors.Wrapf(err, "Requested namespace %s failed validation", reqPrefix)
 				log.Errorln(err)
@@ -332,13 +299,19 @@ func keySignChallengeCommit(ctx *gin.Context, data *registrationData, action str
 			}
 			data.Prefix = reqPrefix
 
-			// Verify the requested path is a valid prefix
-			if err != nil {
-				ctx.JSON(http.StatusForbidden, gin.H{"error": "Namespace prefix cannot be registered as it is invalid"})
-				return errors.Wrapf(err, "Namespace prefix %s cannot be registered as it is invalid", data.Prefix)
+			valErr, sysErr := validateKeyChaining(reqPrefix, key)
+			if valErr != nil {
+				log.Errorln(err)
+				ctx.JSON(http.StatusForbidden, gin.H{"error": valErr})
+				return valErr
+			}
+			if sysErr != nil {
+				log.Errorln(err)
+				ctx.JSON(http.StatusInternalServerError, gin.H{"error": sysErr})
+				return sysErr
 			}
 
-			err = dbAddNamespace(ctx, data)
+			err = addNamespaceHandler(ctx, data)
 			if err != nil {
 				ctx.JSON(500, gin.H{"error": "The server encountered an error while attempting to add the prefix to its database"})
 				return errors.Wrapf(err, "Failed while trying to add to database")
@@ -353,46 +326,9 @@ func keySignChallengeCommit(ctx *gin.Context, data *registrationData, action str
 	return nil
 }
 
-func validateNSPath(nspath string) (string, error) {
-	if len(nspath) == 0 {
-		return "", errors.New("Path prefix may not be empty")
-	}
-	if nspath[0] != '/' {
-		return "", errors.New("Path prefix must be absolute - relative paths are not allowed")
-	}
-	components := strings.Split(nspath, "/")[1:]
-	if len(components) == 0 {
-		return "", errors.New("Cannot register the prefix '/' for an origin")
-	} else if components[0] == "api" {
-		return "", errors.New("Cannot register a prefix starting with '/api'")
-	} else if components[0] == "view" {
-		return "", errors.New("Cannot register a prefix starting with '/view'")
-	} else if components[0] == "pelican" {
-		return "", errors.New("Cannot register a prefix starting with '/pelican'")
-	}
-	result := ""
-	for _, component := range components {
-		if len(component) == 0 {
-			continue
-		} else if component == "." {
-			return "", errors.New("Path component cannot be '.'")
-		} else if component == ".." {
-			return "", errors.New("Path component cannot be '..'")
-		} else if component[0] == '.' {
-			return "", errors.New("Path component cannot begin with a '.'")
-		}
-		result += "/" + component
-	}
-	if result == "/" || len(result) == 0 {
-		return "", errors.New("Cannot register the prefix '/' for an origin")
-	}
-	return result, nil
-}
-
-/*
-Handler functions called upon by the gin router
-*/
+// Handler functions called upon by the gin router
 func cliRegisterNamespace(ctx *gin.Context) {
+
 	var reqData registrationData
 	if err := ctx.BindJSON(&reqData); err != nil {
 		log.Errorln("Bad request: ", err)
@@ -400,21 +336,23 @@ func cliRegisterNamespace(ctx *gin.Context) {
 		return
 	}
 
+	client := http.Client{Transport: config.GetTransport()}
+
 	if reqData.AccessToken != "" {
 		payload := url.Values{}
 		payload.Set("access_token", reqData.AccessToken)
 
-		err := loadOIDC()
+		oidcConfig, err := oauth2.ServerOIDCClient()
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server has malformed OIDC configuration"})
 			log.Errorf("Failed to load OIDC information for registration with identity: %v", err)
 			return
 		}
 
-		resp, err := http.PostForm(OIDC.UserInfoEndpoint, payload)
+		resp, err := client.PostForm(oidcConfig.Endpoint.UserInfoURL, payload)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error making request to user info endpoint"})
-			log.Errorf("Failed to execute post form to user info endpoint %s: %v", OIDC.UserInfoEndpoint, err)
+			log.Errorf("Failed to execute post form to user info endpoint %s: %v", oidcConfig.Endpoint.UserInfoURL, err)
 			return
 		}
 		defer resp.Body.Close()
@@ -422,22 +360,22 @@ func cliRegisterNamespace(ctx *gin.Context) {
 		// Check the status code
 		if resp.StatusCode != 200 {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server received non-200 status from user info endpoint"})
-			log.Errorf("The user info endpoint %s responded with status code %d", OIDC.UserInfoEndpoint, resp.StatusCode)
+			log.Errorf("The user info endpoint %s responded with status code %d", oidcConfig.Endpoint.UserInfoURL, resp.StatusCode)
 			return
 		}
 
 		body, err := io.ReadAll(resp.Body)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Server encountered an error reading response from user info endpoint"})
-			log.Errorf("Failed to read body from user info endpoint %s: %v", OIDC.UserInfoEndpoint, err)
+			log.Errorf("Failed to read body from user info endpoint %s: %v", oidcConfig.Endpoint.UserInfoURL, err)
 			return
 		}
 
 		reqData.Identity = string(body)
 		err = keySignChallenge(ctx, &reqData, "register")
 		if err != nil {
-			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error during key-sign challenge"})
-			log.Errorf("Failed to complete key sign challenge with identity requirement: %v", err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error during key-sign challenge: " + err.Error()})
+			log.Warningf("Failed to complete key sign challenge with identity requirement: %v", err)
 		}
 		return
 	}
@@ -445,13 +383,13 @@ func cliRegisterNamespace(ctx *gin.Context) {
 	if reqData.IdentityRequired == "false" || reqData.IdentityRequired == "" {
 		err := keySignChallenge(ctx, &reqData, "register")
 		if err != nil {
-			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error during key-sign challenge"})
-			log.Errorf("Failed to complete key sign challenge without identity requirement: %v", err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error during key-sign challenge: " + err.Error()})
+			log.Warningf("Failed to complete key sign challenge without identity requirement: %v", err)
 		}
 		return
 	}
 
-	err := loadOIDC()
+	oidcConfig, err := oauth2.ServerOIDCClient()
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server has malformed OIDC configuration"})
 		log.Errorf("Failed to load OIDC information for registration with identity: %v", err)
@@ -461,14 +399,14 @@ func cliRegisterNamespace(ctx *gin.Context) {
 	if reqData.DeviceCode == "" {
 		log.Debug("Getting Device Code")
 		payload := url.Values{}
-		payload.Set("client_id", OIDC.ClientID)
-		payload.Set("client_secret", OIDC.ClientSecret)
-		payload.Set("scope", OIDC.Scope)
+		payload.Set("client_id", oidcConfig.ClientID)
+		payload.Set("client_secret", oidcConfig.ClientSecret)
+		payload.Set("scope", strings.Join(oidcConfig.Scopes, " "))
 
-		response, err := http.PostForm(OIDC.DeviceAuthEndpoint, payload)
+		response, err := client.PostForm(oidcConfig.Endpoint.DeviceAuthURL, payload)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered error requesting device code"})
-			log.Errorf("Failed to execute post form to device auth endpoint %s: %v", OIDC.DeviceAuthEndpoint, err)
+			log.Errorf("Failed to execute post form to device auth endpoint %s: %v", oidcConfig.Endpoint.DeviceAuthURL, err)
 			return
 		}
 		defer response.Body.Close()
@@ -476,20 +414,20 @@ func cliRegisterNamespace(ctx *gin.Context) {
 		// Check the response code
 		if response.StatusCode != 200 {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server received non-200 status code from OIDC device auth endpoint"})
-			log.Errorf("The device auth endpoint %s responded with status code %d", OIDC.DeviceAuthEndpoint, response.StatusCode)
+			log.Errorf("The device auth endpoint %s responded with status code %d", oidcConfig.Endpoint.DeviceAuthURL, response.StatusCode)
 			return
 		}
 		body, err := io.ReadAll(response.Body)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered error reading response from device auth endpoint"})
-			log.Errorf("Failed to read body from device auth endpoint %s: %v", OIDC.DeviceAuthEndpoint, err)
+			log.Errorf("Failed to read body from device auth endpoint %s: %v", oidcConfig.Endpoint.DeviceAuthURL, err)
 			return
 		}
 		var res Response
 		err = json.Unmarshal(body, &res)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server could not parse response from device auth endpoint"})
-			log.Errorf("Failed to unmarshal body from device auth endpoint %s: %v", OIDC.DeviceAuthEndpoint, err)
+			log.Errorf("Failed to unmarshal body from device auth endpoint %s: %v", oidcConfig.Endpoint.DeviceAuthURL, err)
 			return
 		}
 		verificationURL := res.VerificationURLComplete
@@ -502,15 +440,15 @@ func cliRegisterNamespace(ctx *gin.Context) {
 	} else {
 		log.Debug("Verifying Device Code")
 		payload := url.Values{}
-		payload.Set("client_id", OIDC.ClientID)
-		payload.Set("client_secret", OIDC.ClientSecret)
+		payload.Set("client_id", oidcConfig.ClientID)
+		payload.Set("client_secret", oidcConfig.ClientSecret)
 		payload.Set("device_code", reqData.DeviceCode)
-		payload.Set("grant_type", OIDC.GrantType)
+		payload.Set("grant_type", "urn:ietf:params:oauth:grant-type:device_code")
 
-		response, err := http.PostForm(OIDC.TokenEndpoint, payload)
+		response, err := client.PostForm(oidcConfig.Endpoint.TokenURL, payload)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error while making request to token endpoint"})
-			log.Errorf("Failed to execute post form to token endpoint %s: %v", OIDC.TokenEndpoint, err)
+			log.Errorf("Failed to execute post form to token endpoint %s: %v", oidcConfig.Endpoint.TokenURL, err)
 			return
 		}
 		defer response.Body.Close()
@@ -519,14 +457,14 @@ func cliRegisterNamespace(ctx *gin.Context) {
 		// We accept either a 200, or a 400.
 		if response.StatusCode != 200 && response.StatusCode != 400 {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server received bad status code from token endpoint"})
-			log.Errorf("The token endpoint %s responded with status code %d", OIDC.TokenEndpoint, response.StatusCode)
+			log.Errorf("The token endpoint %s responded with status code %d", oidcConfig.Endpoint.TokenURL, response.StatusCode)
 			return
 		}
 
 		body, err := io.ReadAll(response.Body)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error reading response from token endpoint"})
-			log.Errorf("Failed to read body from token endpoint %s: %v", OIDC.TokenEndpoint, err)
+			log.Errorf("Failed to read body from token endpoint %s: %v", oidcConfig.Endpoint.TokenURL, err)
 			return
 		}
 
@@ -534,7 +472,7 @@ func cliRegisterNamespace(ctx *gin.Context) {
 		err = json.Unmarshal(body, &tokenResponse)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server could not parse error from token endpoint"})
-			log.Errorf("Failed to unmarshal body from token endpoint %s: %v", OIDC.TokenEndpoint, err)
+			log.Errorf("Failed to unmarshal body from token endpoint %s: %v", oidcConfig.Endpoint.TokenURL, err)
 			return
 		}
 
@@ -560,7 +498,7 @@ func cliRegisterNamespace(ctx *gin.Context) {
 	}
 }
 
-func dbAddNamespace(ctx *gin.Context, data *registrationData) error {
+func addNamespaceHandler(ctx *gin.Context, data *registrationData) error {
 	var ns Namespace
 	ns.Prefix = data.Prefix
 
@@ -573,16 +511,19 @@ func dbAddNamespace(ctx *gin.Context, data *registrationData) error {
 		ns.Identity = data.Identity
 	}
 
+	// Overwrite status to Pending to filter malicious request
+	ns.AdminMetadata.Status = Pending
+
 	err = addNamespace(&ns)
 	if err != nil {
 		return errors.Wrapf(err, "Failed to add prefix %s", ns.Prefix)
 	}
 
-	ctx.JSON(http.StatusOK, gin.H{"status": "success"})
+	ctx.JSON(http.StatusCreated, gin.H{"status": "success"})
 	return nil
 }
 
-func dbDeleteNamespace(ctx *gin.Context) {
+func deleteNamespaceHandler(ctx *gin.Context) {
 	/*
 		A weird feature of gin is that wildcards always
 		add a preceding /. Since the URL parsing that happens
@@ -592,6 +533,10 @@ func dbDeleteNamespace(ctx *gin.Context) {
 	*/
 	prefix := ctx.Param("wildcard")
 	log.Debug("Attempting to delete namespace prefix ", prefix)
+	if prefix == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "prefix is required to delete"})
+		return
+	}
 
 	// Check if prefix exists before trying to delete it
 	exists, err := namespaceExists(prefix)
@@ -614,7 +559,7 @@ func dbDeleteNamespace(ctx *gin.Context) {
 	delTokenStr := strings.TrimPrefix(authHeader, "Bearer ")
 
 	// Have the token, now we need to load the JWKS for the prefix
-	originJwks, err := getPrefixJwks(prefix)
+	originJwks, err := getNamespaceJwksByPrefix(prefix, false)
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error loading the prefix's stored jwks"})
 		log.Errorf("Failed to get prefix's stored jwks: %v", err)
@@ -622,7 +567,7 @@ func dbDeleteNamespace(ctx *gin.Context) {
 	}
 
 	// Use the JWKS to verify the token -- verification means signature integrity
-	parsed, err := jwt.Parse([]byte(delTokenStr), jwt.WithKeySet(*originJwks))
+	parsed, err := jwt.Parse([]byte(delTokenStr), jwt.WithKeySet(originJwks))
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server could not verify/parse the provided deletion token"})
 		log.Errorf("Failed to parse the token: %v", err)
@@ -646,7 +591,7 @@ func dbDeleteNamespace(ctx *gin.Context) {
 		}
 
 		for _, scope := range strings.Split(scope, " ") {
-			if scope == "pelican.namespace_delete" {
+			if scope == token_scopes.Pelican_NamespaceDelete.String() {
 				return nil
 			}
 		}
@@ -684,64 +629,143 @@ func cliListNamespaces(c *gin.Context) {
 }
 */
 
-func dbGetAllNamespaces(ctx *gin.Context) {
+func getAllNamespacesHandler(ctx *gin.Context) {
 	nss, err := getAllNamespaces()
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error trying to list all namespaces"})
+		log.Errorln("Failed to get all namespaces: ", err)
 		return
 	}
 	ctx.JSON(http.StatusOK, nss)
 }
 
-// func metadataHandler(ctx *gin.Context) {
-// 	path := ctx.Param("wildcard")
-
-// 	// A weird feature of gin is that wildcards always
-// 	// add a preceding /. We need to trim it here...
-// 	path = strings.TrimPrefix(path, "/")
-// 	log.Debug("Working with path ", path)
-
-// 	// Get JWKS
-// 	if filepath.Base(path) == "issuer.jwks" {
-// 		// do something
-// 	}
-
-// 	// Get OpenID config info
-// 	match, err := filepath.Match("*/\\.well-known/openid-configuration", path)
-// 	if err != nil {
-// 		log.Errorf("Failed to check incoming path for match: %v", err)
-//		return
-// 	}
-// 	if match {
-// 		// do something
-// 	} else {
-// 		log.Errorln("Unknown request")
-//		return
-// 	}
-
-// }
+// Gin requires no wildcard match and exact match fall under the same
+// parent path, so we need to handle all routing under "/" route ourselves.
+//
+// See https://github.com/PelicanPlatform/pelican/issues/566
+func wildcardHandler(ctx *gin.Context) {
+	// A weird feature of gin is that wildcards always
+	// add a preceding /. Since the prefix / was trimmed
+	// out during the url parsing, we can just leave the
+	// new / here!
+	path := ctx.Param("wildcard")
+
+	// Get the prefix's JWKS
+	// Avoid using filepath.Base for path matching, as filepath format depends on OS
+	// while HTTP path is always slash (/)
+	if strings.HasSuffix(path, "/.well-known/issuer.jwks") {
+		prefix := strings.TrimSuffix(path, "/.well-known/issuer.jwks")
+		found, err := namespaceExistsByPrefix(prefix)
+		if err != nil {
+			log.Error("Error checking if prefix ", prefix, " exists: ", err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error trying to check if the namespace exists"})
+			return
+		}
+		if !found {
+			ctx.JSON(http.StatusNotFound, gin.H{"error": fmt.Sprintf("namespace prefix '%s', was not found", prefix)})
+			return
+		}
+
+		jwks, err := getNamespaceJwksByPrefix(prefix, true)
+		if err != nil {
+			if err == serverCredsErr {
+				// Use 403 to distinguish between server error
+				ctx.JSON(http.StatusForbidden, gin.H{"error": "cache has not been approved by federation administrator"})
+				return
+			}
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "server encountered an error trying to get jwks for prefix"})
+			log.Errorf("Failed to load jwks for prefix %s: %v", prefix, err)
+			return
+		}
+		ctx.JSON(http.StatusOK, jwks)
+		return
+	}
 
-/**
- * Commenting out until we're ready to use it.  -BB
-func getJwks(c *gin.Context) {
-	prefix := c.Param("prefix")
-	c.JSON(http.StatusOK, gin.H{"status": "Get JWKS is not implemented", "prefix": prefix})
+	// No match found, return 404
+	ctx.String(http.StatusNotFound, "404 Not Found")
 }
 
-func getOpenIDConfiguration(c *gin.Context) {
-	prefix := c.Param("prefix")
-	c.JSON(http.StatusOK, gin.H{"status": "getOpenIDConfiguration is not implemented", "prefix": prefix})
+// Check if a namespace prefix exists and its public key matches the registry record
+func checkNamespaceExistsHandler(ctx *gin.Context) {
+	req := checkNamespaceExistsReq{}
+	if err := ctx.ShouldBind(&req); err != nil {
+		log.Debug("Failed to parse request body for namespace exits check: ", err)
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Failed to parse request body"})
+		return
+	}
+	if req.Prefix == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "prefix is required"})
+		return
+	}
+	if req.PubKey == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "pubkey is required"})
+		return
+	}
+	jwksReq, err := jwk.ParseString(req.PubKey)
+	if err != nil {
+		log.Debug("pubkey is not a valid JWK string:", req.PubKey, err)
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("pubkey is not a valid JWK string: %s", req.PubKey)})
+		return
+	}
+	if jwksReq.Len() != 1 {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("pubkey is a jwks with multiple or zero key: %s", req.PubKey)})
+		return
+	}
+	jwkReq, exists := jwksReq.Key(0)
+	if !exists {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("the first key from the pubkey does not exist: %s", req.PubKey)})
+		return
+	}
+
+	found, err := namespaceExistsByPrefix(req.Prefix)
+	if err != nil {
+		log.Debugln("Failed to check if namespace exists by prefix", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check if the namespace exists"})
+		return
+	}
+	if !found {
+		// We return 200 even with prefix not found so that 404 can be used to check if the route exists (OSDF)
+		// and fallback to OSDF way of checking if we do get 404
+		res := checkNamespaceExistsRes{PrefixExists: false, Message: "Prefix was not found in database"}
+		ctx.JSON(http.StatusOK, res)
+		return
+	}
+	// Just to check if the key matches. We don't care about approval status
+	jwksDb, err := getNamespaceJwksByPrefix(req.Prefix, false)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	registryKey, isPresent := jwksDb.LookupKeyID(jwkReq.KeyID())
+	if !isPresent {
+		res := checkNamespaceExistsRes{PrefixExists: true, KeyMatch: false, Message: "Given JWK is not present in the JWKS from database"}
+		ctx.JSON(http.StatusOK, res)
+		return
+	} else if jwk.Equal(registryKey, jwkReq) {
+		res := checkNamespaceExistsRes{PrefixExists: true, KeyMatch: true}
+		ctx.JSON(http.StatusOK, res)
+		return
+	} else {
+		res := checkNamespaceExistsRes{PrefixExists: true, KeyMatch: false, Message: "Given JWK does not equal to the JWK from database"}
+		ctx.JSON(http.StatusOK, res)
+		return
+	}
 }
-*/
 
-func RegisterNamespaceRegistry(router *gin.RouterGroup) {
-	registry := router.Group("/api/v1.0/registry")
+func RegisterRegistryAPI(router *gin.RouterGroup) {
+	registryAPI := router.Group("/api/v1.0/registry")
+
+	// DO NOT add any other GET route with path starts with "/" to registryAPI
+	// It will cause duplicated route error. Use wildcardHandler to handle such
+	// routing if needed.
 	{
-		registry.POST("", cliRegisterNamespace)
-		registry.GET("", dbGetAllNamespaces)
-		// Will handle getting jwks, openid config, and listing namespaces
-		// registry.GET("/*wildcard", metadataHandler)
+		registryAPI.POST("", cliRegisterNamespace)
+		registryAPI.GET("", getAllNamespacesHandler)
 
-		registry.DELETE("/*wildcard", dbDeleteNamespace)
+		// Handle everything under "/" route with GET method
+		registryAPI.GET("/*wildcard", wildcardHandler)
+		registryAPI.POST("/checkNamespaceExists", checkNamespaceExistsHandler)
+		registryAPI.DELETE("/*wildcard", deleteNamespaceHandler)
 	}
 }
diff --git a/registry/registry_db.go b/registry/registry_db.go
new file mode 100644
index 000000000..354d28606
--- /dev/null
+++ b/registry/registry_db.go
@@ -0,0 +1,863 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package registry
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+
+	// commented sqlite driver requires CGO
+	// _ "github.com/mattn/go-sqlite3" // SQLite driver
+	_ "modernc.org/sqlite"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/utils"
+)
+
+type RegistrationStatus string
+
+// The AdminMetadata is used in [Namespace] as a marshalled JSON string
+// to be stored in registry DB.
+//
+// The *UserID are meant to correspond to the "sub" claim of the user token that
+// the OAuth client issues if the user is logged in using OAuth, or it should be
+// "admin" from local password-based authentication.
+//
+// To prevent users from writing to certain fields (readonly), you may use "post" tag
+// with value "exclude". This will exclude the field from user's create/update requests
+// and the field will also be excluded from field discovery endpoint (OPTION method).
+//
+// We use validator package to validate struct fields from user requests. If a field is
+// required, add `validate:"required"` to that field. This tag will also be used by fields discovery
+// endpoint to tell the UI if a field is required. For other validator tags,
+// visit: https://pkg.go.dev/github.com/go-playground/validator/v10
+type AdminMetadata struct {
+	UserID                string             `json:"user_id" post:"exclude"` // "sub" claim of user JWT who requested registration
+	Description           string             `json:"description"`
+	SiteName              string             `json:"site_name"`
+	Institution           string             `json:"institution" validate:"required"` // the unique identifier of the institution
+	SecurityContactUserID string             `json:"security_contact_user_id"`        // "sub" claim of user who is responsible for taking security concern
+	Status                RegistrationStatus `json:"status" post:"exclude"`
+	ApproverID            string             `json:"approver_id" post:"exclude"` // "sub" claim of user JWT who approved registration
+	ApprovedAt            time.Time          `json:"approved_at" post:"exclude"`
+	CreatedAt             time.Time          `json:"created_at" post:"exclude"`
+	UpdatedAt             time.Time          `json:"updated_at" post:"exclude"`
+}
+
+type Namespace struct {
+	ID            int           `json:"id" post:"exclude"`
+	Prefix        string        `json:"prefix" validate:"required"`
+	Pubkey        string        `json:"pubkey" validate:"required"`
+	Identity      string        `json:"identity" post:"exclude"`
+	AdminMetadata AdminMetadata `json:"admin_metadata"`
+}
+
+type NamespaceWOPubkey struct {
+	ID            int           `json:"id"`
+	Prefix        string        `json:"prefix"`
+	Pubkey        string        `json:"-"` // Don't include pubkey in this case
+	Identity      string        `json:"identity"`
+	AdminMetadata AdminMetadata `json:"admin_metadata"`
+}
+
+type ServerType string
+
+const (
+	OriginType ServerType = "origin"
+	CacheType  ServerType = "cache"
+)
+
+const (
+	Pending  RegistrationStatus = "Pending"
+	Approved RegistrationStatus = "Approved"
+	Denied   RegistrationStatus = "Denied"
+	Unknown  RegistrationStatus = "Unknown"
+)
+
+/*
+Declare the DB handle as an unexported global so that all
+functions in the package can access it without having to
+pass it around. This simplifies the HTTP handlers, and
+the handle is already thread-safe! The approach being used
+is based off of 1.b from
+https://www.alexedwards.net/blog/organising-database-access
+*/
+var db *sql.DB
+
+func (st ServerType) String() string {
+	return string(st)
+}
+
+func (rs RegistrationStatus) String() string {
+	return string(rs)
+}
+
+func (a AdminMetadata) Equal(b AdminMetadata) bool {
+	return a.UserID == b.UserID &&
+		a.Description == b.Description &&
+		a.SiteName == b.SiteName &&
+		a.Institution == b.Institution &&
+		a.SecurityContactUserID == b.SecurityContactUserID &&
+		a.Status == b.Status &&
+		a.ApproverID == b.ApproverID &&
+		a.ApprovedAt.Equal(b.ApprovedAt) &&
+		a.CreatedAt.Equal(b.CreatedAt) &&
+		a.UpdatedAt.Equal(b.UpdatedAt)
+}
+
+func createNamespaceTable() {
+	//We put a size limit on admin_metadata to guard against potentially future
+	//malicious large inserts
+	query := `
+    CREATE TABLE IF NOT EXISTS namespace (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        prefix TEXT NOT NULL UNIQUE,
+        pubkey TEXT NOT NULL,
+        identity TEXT,
+        admin_metadata TEXT CHECK (length("admin_metadata") <= 4000)
+    );`
+
+	_, err := db.Exec(query)
+	if err != nil {
+		log.Fatalf("Failed to create namespace table: %v", err)
+	}
+}
+
+func createTopologyTable() {
+	query := `
+    CREATE TABLE IF NOT EXISTS topology (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        prefix TEXT NOT NULL UNIQUE
+    );`
+
+	_, err := db.Exec(query)
+	if err != nil {
+		log.Fatalf("Failed to create topology table: %v", err)
+	}
+}
+
+func namespaceExists(prefix string) (bool, error) {
+	var checkQuery string
+	var args []interface{}
+	if config.GetPreferredPrefix() == "OSDF" {
+		checkQuery = `
+		SELECT prefix FROM namespace WHERE prefix = ?
+		UNION
+		SELECT prefix FROM topology WHERE prefix = ?
+		`
+		args = []interface{}{prefix, prefix}
+	} else {
+		checkQuery = `SELECT prefix FROM namespace WHERE prefix = ?`
+		args = []interface{}{prefix}
+	}
+
+	result, err := db.Query(checkQuery, args...)
+	if err != nil {
+		return false, err
+	}
+	defer result.Close()
+
+	found := false
+	for result.Next() {
+		found = true
+		break
+	}
+	return found, nil
+}
+
+func namespaceSupSubChecks(prefix string) (superspaces []string, subspaces []string, inTopo bool, err error) {
+	// The very first thing we do is check if there's a match in topo -- if there is, for now
+	// we simply refuse to allow registration of a superspace or a subspace, assuming the registrant
+	// has to go through topology
+	if config.GetPreferredPrefix() == "OSDF" {
+		topoSuperSubQuery := `
+		SELECT prefix FROM topology WHERE (? || '/') LIKE (prefix || '/%')
+		UNION
+		SELECT prefix FROM topology WHERE (prefix || '/') LIKE (? || '/%')
+		`
+		args := []interface{}{prefix, prefix}
+		topoSuperSubResults, tmpErr := db.Query(topoSuperSubQuery, args...)
+		if tmpErr != nil {
+			err = tmpErr
+			return
+		}
+		defer topoSuperSubResults.Close()
+
+		for topoSuperSubResults.Next() {
+			// if we make it here, there was a match -- it's a trap!
+			inTopo = true
+			return
+		}
+		topoSuperSubResults.Close()
+	}
+
+	// Check if any registered namespaces already superspace the incoming namespace,
+	// eg if /foo is already registered, this will be true for an incoming /foo/bar because
+	// /foo is logically above /foo/bar (according to my logic, anyway)
+	superspaceQuery := `SELECT prefix FROM namespace WHERE (? || '/') LIKE (prefix || '/%')`
+	superspaceResults, err := db.Query(superspaceQuery, prefix)
+	if err != nil {
+		return
+	}
+	defer superspaceResults.Close()
+
+	for superspaceResults.Next() {
+		var foundSuperspace string
+		if err := superspaceResults.Scan(&foundSuperspace); err == nil {
+			superspaces = append(superspaces, foundSuperspace)
+		}
+	}
+
+	// Check if any registered namespaces already subspace the incoming namespace,
+	// eg if /foo/bar is already registered, this will be true for an incoming /foo because
+	// /foo/bar is logically below /foo
+	subspaceQuery := `SELECT prefix FROM namespace WHERE (prefix || '/') LIKE (? || '/%')`
+	subspaceResults, err := db.Query(subspaceQuery, prefix)
+	if err != nil {
+		return
+	}
+	defer subspaceResults.Close()
+
+	for subspaceResults.Next() {
+		var foundSubspace string
+		if err := subspaceResults.Scan(&foundSubspace); err == nil {
+			subspaces = append(subspaces, foundSubspace)
+		}
+	}
+
+	return
+}
+
+func namespaceExistsById(id int) (bool, error) {
+	checkQuery := `SELECT id FROM namespace WHERE id = ?`
+	result, err := db.Query(checkQuery, id)
+	if err != nil {
+		return false, err
+	}
+	defer result.Close()
+
+	found := false
+	for result.Next() {
+		found = true
+		break
+	}
+	return found, nil
+}
+
+func namespaceExistsByPrefix(prefix string) (bool, error) {
+	checkQuery := `SELECT prefix FROM namespace WHERE prefix = ?`
+	result, err := db.Query(checkQuery, prefix)
+	if err != nil {
+		return false, err
+	}
+	defer result.Close()
+
+	found := false
+	for result.Next() {
+		found = true
+		break
+	}
+	return found, nil
+}
+
+func namespaceBelongsToUserId(id int, userId string) (bool, error) {
+	query := `SELECT admin_metadata FROM namespace where id = ?`
+	rows, err := db.Query(query, id)
+	if err != nil {
+		return false, err
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		ns := &Namespace{}
+		adminMetadataStr := ""
+		if err := rows.Scan(&adminMetadataStr); err != nil {
+			return false, err
+		}
+		// For backward compatibility, if adminMetadata is an empty string, don't unmarshall json
+		if adminMetadataStr != "" {
+			if err := json.Unmarshal([]byte(adminMetadataStr), &ns.AdminMetadata); err != nil {
+				return false, err
+			}
+		} else {
+			return false, nil // If adminMetadata is an empty string, no userId is present
+		}
+		if ns.AdminMetadata.UserID == userId {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func getNamespaceJwksById(id int) (jwk.Set, error) {
+	jwksQuery := `SELECT pubkey FROM namespace WHERE id = ?`
+	var pubkeyStr string
+	err := db.QueryRow(jwksQuery, id).Scan(&pubkeyStr)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, errors.New("prefix not found in database")
+		}
+		return nil, errors.Wrap(err, "error performing origin pubkey query")
+	}
+
+	set, err := jwk.ParseString(pubkeyStr)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to parse pubkey as a jwks")
+	}
+
+	return set, nil
+}
+
+func getNamespaceJwksByPrefix(prefix string, approvalRequired bool) (jwk.Set, error) {
+	var jwksQuery string
+	var pubkeyStr string
+	if strings.HasPrefix(prefix, "/caches/") && approvalRequired {
+		adminMetadataStr := ""
+		jwksQuery = `SELECT pubkey, admin_metadata FROM namespace WHERE prefix = ?`
+		err := db.QueryRow(jwksQuery, prefix).Scan(&pubkeyStr, &adminMetadataStr)
+		if err != nil {
+			if err == sql.ErrNoRows {
+				return nil, errors.New("prefix not found in database")
+			}
+			return nil, errors.Wrap(err, "error performing cache pubkey query")
+		}
+		if adminMetadataStr != "" { // Older version didn't have admin_metadata populated, skip checking
+			adminMetadata := AdminMetadata{}
+			if err = json.Unmarshal([]byte(adminMetadataStr), &adminMetadata); err != nil {
+				return nil, errors.Wrap(err, "Failed to unmarshall admin_metadata")
+			}
+			// TODO: Move this to upper functions that handles business logic to keep db access functions simple
+			if adminMetadata.Status != Approved {
+				return nil, serverCredsErr
+			}
+		}
+	} else {
+		jwksQuery := `SELECT pubkey FROM namespace WHERE prefix = ?`
+		err := db.QueryRow(jwksQuery, prefix).Scan(&pubkeyStr)
+		if err != nil {
+			if err == sql.ErrNoRows {
+				return nil, errors.New("prefix not found in database")
+			}
+			return nil, errors.Wrap(err, "error performing origin pubkey query")
+		}
+	}
+
+	set, err := jwk.ParseString(pubkeyStr)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to parse pubkey as a jwks")
+	}
+
+	return set, nil
+}
+
+func getNamespaceStatusById(id int) (RegistrationStatus, error) {
+	if id < 1 {
+		return "", errors.New("Invalid id. id must be a positive integer")
+	}
+	adminMetadata := AdminMetadata{}
+	adminMetadataStr := ""
+	query := `SELECT admin_metadata FROM namespace WHERE id = ?`
+	err := db.QueryRow(query, id).Scan(&adminMetadataStr)
+	if err != nil {
+		return "", err
+	}
+	// For backward compatibility, if adminMetadata is an empty string, don't unmarshall json
+	if adminMetadataStr != "" {
+		if err := json.Unmarshal([]byte(adminMetadataStr), &adminMetadata); err != nil {
+			return "", err
+		}
+		// This should never happen in non-testing environment, but if it does, we want to
+		// decode it to known enumeration for this field
+		if adminMetadata.Status == "" {
+			return Unknown, nil
+		}
+		return adminMetadata.Status, nil
+	} else {
+		return Unknown, nil
+	}
+}
+
+func getNamespaceById(id int) (*Namespace, error) {
+	if id < 1 {
+		return nil, errors.New("Invalid id. id must be a positive number")
+	}
+	ns := &Namespace{}
+	adminMetadataStr := ""
+	query := `SELECT id, prefix, pubkey, identity, admin_metadata FROM namespace WHERE id = ?`
+	err := db.QueryRow(query, id).Scan(&ns.ID, &ns.Prefix, &ns.Pubkey, &ns.Identity, &adminMetadataStr)
+	if err != nil {
+		return nil, err
+	}
+	// For backward compatibility, if adminMetadata is an empty string, don't unmarshall json
+	if adminMetadataStr != "" {
+		if err := json.Unmarshal([]byte(adminMetadataStr), &ns.AdminMetadata); err != nil {
+			return nil, err
+		}
+	}
+	return ns, nil
+}
+
+func getNamespaceByPrefix(prefix string) (*Namespace, error) {
+	if prefix == "" {
+		return nil, errors.New("Invalid prefix. Prefix must not be empty")
+	}
+	ns := &Namespace{}
+	adminMetadataStr := ""
+	query := `SELECT id, prefix, pubkey, identity, admin_metadata FROM namespace WHERE prefix = ?`
+	err := db.QueryRow(query, prefix).Scan(&ns.ID, &ns.Prefix, &ns.Pubkey, &ns.Identity, &adminMetadataStr)
+	if err != nil {
+		return nil, err
+	}
+	// For backward compatibility, if adminMetadata is an empty string, don't unmarshall json
+	if adminMetadataStr != "" {
+		if err := json.Unmarshal([]byte(adminMetadataStr), &ns.AdminMetadata); err != nil {
+			return nil, err
+		}
+	}
+	return ns, nil
+}
+
+// Get a collection of namespaces by filtering against various non-default namespace fields
+// excluding Namespace.ID, Namespace.Identity, Namespace.Pubkey, and various dates
+//
+// For filterNs.AdminMetadata.Description and filterNs.AdminMetadata.SiteName,
+// the string will be matched using `strings.Contains`. This is too mimic a SQL style `like` match.
+// The rest of the AdminMetadata fields is matched by `==`
+func getNamespacesByFilter(filterNs Namespace, serverType ServerType) ([]*Namespace, error) {
+	query := `SELECT id, prefix, pubkey, identity, admin_metadata FROM namespace WHERE 1=1 `
+	if serverType == CacheType {
+		// Refer to the cache prefix name in cmd/cache_serve
+		query += ` AND prefix LIKE '/caches/%'`
+	} else if serverType == OriginType {
+		query += ` AND NOT prefix LIKE '/caches/%'`
+	} else if serverType != "" {
+		return nil, errors.New(fmt.Sprint("Can't get namespace: unsupported server type: ", serverType))
+	}
+
+	if filterNs.ID != 0 {
+		return nil, errors.New("Unsupported operation: Can't filter against ID field.")
+	}
+	if filterNs.Identity != "" {
+		return nil, errors.New("Unsupported operation: Can't filter against Identity field.")
+	}
+	if filterNs.Pubkey != "" {
+		return nil, errors.New("Unsupported operation: Can't filter against Pubkey field.")
+	}
+	if filterNs.Prefix != "" {
+		query += fmt.Sprintf(" AND prefix like '%%%s%%' ", filterNs.Prefix)
+	}
+	if !filterNs.AdminMetadata.ApprovedAt.Equal(time.Time{}) || !filterNs.AdminMetadata.UpdatedAt.Equal(time.Time{}) || !filterNs.AdminMetadata.CreatedAt.Equal(time.Time{}) {
+		return nil, errors.New("Unsupported operation: Can't filter against date.")
+	}
+	// Always sort by id by default
+	query += " ORDER BY id ASC"
+	// For now, we need to execute the query first and manually filter out fields for AdminMetadata
+	rows, err := db.Query(query)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	namespaces := make([]*Namespace, 0)
+	for rows.Next() {
+		ns := &Namespace{}
+		adminMetadataStr := ""
+		if err := rows.Scan(&ns.ID, &ns.Prefix, &ns.Pubkey, &ns.Identity, &adminMetadataStr); err != nil {
+			return nil, err
+		}
+		// For backward compatibility, if adminMetadata is an empty string, don't unmarshall json
+		if adminMetadataStr == "" {
+			// If we apply any filter against the AdminMetadata field but the
+			// entry didn't populate this field, skip it
+			if !filterNs.AdminMetadata.Equal(AdminMetadata{}) {
+				continue
+			} else {
+				// If we don't filter against AdminMetadata, just add it to result
+				namespaces = append(namespaces, ns)
+			}
+		} else {
+			if err := json.Unmarshal([]byte(adminMetadataStr), &ns.AdminMetadata); err != nil {
+				return nil, err
+			}
+			if filterNs.AdminMetadata.UserID != "" && filterNs.AdminMetadata.UserID != ns.AdminMetadata.UserID {
+				continue
+			}
+			if filterNs.AdminMetadata.Description != "" && !strings.Contains(ns.AdminMetadata.Description, filterNs.AdminMetadata.Description) {
+				continue
+			}
+			if filterNs.AdminMetadata.SiteName != "" && !strings.Contains(ns.AdminMetadata.SiteName, filterNs.AdminMetadata.SiteName) {
+				continue
+			}
+			if filterNs.AdminMetadata.Institution != "" && filterNs.AdminMetadata.Institution != ns.AdminMetadata.Institution {
+				continue
+			}
+			if filterNs.AdminMetadata.SecurityContactUserID != "" && filterNs.AdminMetadata.SecurityContactUserID != ns.AdminMetadata.SecurityContactUserID {
+				continue
+			}
+			if filterNs.AdminMetadata.Status != "" {
+				if filterNs.AdminMetadata.Status == Unknown {
+					if ns.AdminMetadata.Status != "" && ns.AdminMetadata.Status != Unknown {
+						continue
+					}
+				} else if filterNs.AdminMetadata.Status != ns.AdminMetadata.Status {
+					continue
+				}
+			}
+			if filterNs.AdminMetadata.ApproverID != "" && filterNs.AdminMetadata.ApproverID != ns.AdminMetadata.ApproverID {
+				continue
+			}
+			// Congrats! You passed all the filter check and this namespace matches what you want
+			namespaces = append(namespaces, ns)
+		}
+	}
+
+	return namespaces, nil
+}
+
+/*
+Some generic functions for CRUD actions on namespaces,
+used BY the registry (as opposed to the parallel
+functions) used by the client.
+*/
+
+func addNamespace(ns *Namespace) error {
+	query := `INSERT INTO namespace (prefix, pubkey, identity, admin_metadata) VALUES (?, ?, ?, ?)`
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+
+	// Adding default values to the field. Note that you need to pass other fields
+	// including user_id before this function
+	ns.AdminMetadata.CreatedAt = time.Now()
+	ns.AdminMetadata.UpdatedAt = time.Now()
+	// We only set status to pending when it's empty to allow tests to add a namespace with
+	// desired status
+	if ns.AdminMetadata.Status == "" {
+		ns.AdminMetadata.Status = Pending
+	}
+
+	strAdminMetadata, err := json.Marshal(ns.AdminMetadata)
+	if err != nil {
+		return errors.Wrap(err, "Fail to marshall AdminMetadata")
+	}
+
+	_, err = tx.Exec(query, ns.Prefix, ns.Pubkey, ns.Identity, strAdminMetadata)
+	if err != nil {
+		if errRoll := tx.Rollback(); errRoll != nil {
+			log.Errorln("Failed to rollback transaction:", errRoll)
+		}
+		return err
+	}
+	return tx.Commit()
+}
+
+func updateNamespace(ns *Namespace) error {
+	existingNs, err := getNamespaceById(ns.ID)
+	if err != nil || existingNs == nil {
+		return errors.Wrap(err, "Failed to get namespace")
+	}
+	if ns.Prefix == "" {
+		ns.Prefix = existingNs.Prefix
+	}
+	if ns.Pubkey == "" {
+		ns.Pubkey = existingNs.Pubkey
+	}
+	existingNsAdmin := existingNs.AdminMetadata
+	// We prevent the following fields from being modified by the user for now.
+	// They are meant for "internal" use only and we don't support changing
+	// UserID on the fly. We also don't allow changing Status other than explicitly
+	// call updateNamespaceStatusById
+	ns.AdminMetadata.UserID = existingNsAdmin.UserID
+	ns.AdminMetadata.CreatedAt = existingNsAdmin.CreatedAt
+	ns.AdminMetadata.Status = existingNsAdmin.Status
+	ns.AdminMetadata.ApprovedAt = existingNsAdmin.ApprovedAt
+	ns.AdminMetadata.ApproverID = existingNsAdmin.ApproverID
+	ns.AdminMetadata.UpdatedAt = time.Now()
+	strAdminMetadata, err := json.Marshal(ns.AdminMetadata)
+	if err != nil {
+		return errors.Wrap(err, "Fail to marshall AdminMetadata")
+	}
+
+	// We intentionally exclude updating "identity" as this should only be updated
+	// when user registered through Pelican client with identity
+	query := `UPDATE namespace SET prefix = ?, pubkey = ?, admin_metadata = ? WHERE id = ?`
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+	_, err = tx.Exec(query, ns.Prefix, ns.Pubkey, strAdminMetadata, ns.ID)
+	if err != nil {
+		if errRoll := tx.Rollback(); errRoll != nil {
+			log.Errorln("Failed to rollback transaction:", errRoll)
+		}
+		return errors.Wrap(err, "Failed to execute update query")
+	}
+	return tx.Commit()
+}
+
+func updateNamespaceStatusById(id int, status RegistrationStatus, approverId string) error {
+	ns, err := getNamespaceById(id)
+	if err != nil {
+		return errors.Wrap(err, "Error getting namespace by id")
+	}
+
+	ns.AdminMetadata.Status = status
+	ns.AdminMetadata.UpdatedAt = time.Now()
+	if status == Approved {
+		if approverId == "" {
+			return errors.New("approverId can't be empty to approve")
+		}
+		ns.AdminMetadata.ApproverID = approverId
+		ns.AdminMetadata.ApprovedAt = time.Now()
+	}
+
+	adminMetadataByte, err := json.Marshal(ns.AdminMetadata)
+	if err != nil {
+		return errors.Wrap(err, "Error marshalling admin metadata")
+	}
+
+	query := `UPDATE namespace SET admin_metadata = ? WHERE id = ?`
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+	_, err = tx.Exec(query, string(adminMetadataByte), ns.ID)
+	if err != nil {
+		if errRoll := tx.Rollback(); errRoll != nil {
+			log.Errorln("Failed to rollback transaction:", errRoll)
+		}
+		return errors.Wrap(err, "Failed to execute update query")
+	}
+	return tx.Commit()
+}
+
+func deleteNamespace(prefix string) error {
+	deleteQuery := `DELETE FROM namespace WHERE prefix = ?`
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+	_, err = tx.Exec(deleteQuery, prefix)
+	if err != nil {
+		if errRoll := tx.Rollback(); errRoll != nil {
+			log.Errorln("Failed to rollback transaction:", errRoll)
+		}
+		return errors.Wrap(err, "Failed to execute deletion query")
+	}
+	return tx.Commit()
+}
+
+func getAllNamespaces() ([]*Namespace, error) {
+	query := `SELECT id, prefix, pubkey, identity, admin_metadata FROM namespace ORDER BY id ASC`
+	rows, err := db.Query(query)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	namespaces := make([]*Namespace, 0)
+	for rows.Next() {
+		ns := &Namespace{}
+		adminMetadataStr := ""
+		if err := rows.Scan(&ns.ID, &ns.Prefix, &ns.Pubkey, &ns.Identity, &adminMetadataStr); err != nil {
+			return nil, err
+		}
+		// For backward compatibility, if adminMetadata is an empty string, don't unmarshall json
+		if adminMetadataStr != "" {
+			if err := json.Unmarshal([]byte(adminMetadataStr), &ns.AdminMetadata); err != nil {
+				return nil, err
+			}
+		}
+		namespaces = append(namespaces, ns)
+	}
+
+	return namespaces, nil
+}
+
+func InitializeDB(ctx context.Context) error {
+	dbPath := param.Registry_DbLocation.GetString()
+	if dbPath == "" {
+		err := errors.New("Could not get path for the namespace registry database.")
+		log.Fatal(err)
+		return err
+	}
+
+	// Before attempting to create the database, the path
+	// must exist or sql.Open will panic.
+	err := os.MkdirAll(filepath.Dir(dbPath), 0755)
+	if err != nil {
+		return errors.Wrap(err, "Failed to create directory for namespace registry database")
+	}
+
+	if len(filepath.Ext(dbPath)) == 0 { // No fp extension, let's add .sqlite so it's obvious what the file is
+		dbPath += ".sqlite"
+	}
+
+	dbName := "file:" + dbPath + "?_busy_timeout=5000&_journal_mode=WAL"
+	log.Debugln("Opening connection to sqlite DB", dbName)
+	db, err = sql.Open("sqlite", dbName)
+	if err != nil {
+		return errors.Wrapf(err, "Failed to open the database with path: %s", dbPath)
+	}
+
+	createNamespaceTable()
+	return db.Ping()
+}
+
+func modifyTopologyTable(prefixes []string, mode string) error {
+	if len(prefixes) == 0 {
+		return nil // nothing to do!
+	}
+
+	var query string
+	switch mode {
+	case "add":
+		query = `INSERT INTO topology (prefix) VALUES (?)`
+	case "del":
+		query = `DELETE FROM topology WHERE prefix = ?`
+	default:
+		return errors.New("invalid mode, use 'add' or 'del'")
+	}
+
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+
+	stmt, err := tx.Prepare(query)
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+
+	for _, prefix := range prefixes {
+		_, err := stmt.Exec(prefix)
+		if err != nil {
+			if errRoll := tx.Rollback(); errRoll != nil {
+				log.Errorln("Failed to rollback transaction:", errRoll)
+			}
+			return err
+		}
+	}
+
+	// One nice batch commit
+	err = tx.Commit()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Create a table in the registry to store namespace prefixes from topology
+func PopulateTopology() error {
+	// Create the toplogy table
+	createTopologyTable()
+
+	// The topology table may already exist from before, it may not. Because of this
+	// we need to add to the table any prefixes that are in topology, delete from the
+	// table any that aren't in topology, and skip any that exist in both.
+
+	// First get all that are in the table. At time of writing, this is ~57 entries,
+	// and that number should be monotonically decreasing. We're safe to load into mem.
+	retrieveQuery := "SELECT prefix FROM topology"
+	rows, err := db.Query(retrieveQuery)
+	if err != nil {
+		return errors.Wrap(err, "Could not construct topology database query")
+	}
+	defer rows.Close()
+
+	nsFromTopoTable := make(map[string]bool)
+	for rows.Next() {
+		var existingPrefix string
+		if err := rows.Scan(&existingPrefix); err != nil {
+			return errors.Wrap(err, "Error while scanning rows from topology table")
+		}
+		nsFromTopoTable[existingPrefix] = true
+	}
+	rows.Close()
+
+	// Next, get the values from topology
+	namespaces, err := utils.GetTopologyJSON()
+	if err != nil {
+		return errors.Wrapf(err, "Failed to get topology JSON")
+	}
+
+	// Be careful here, the ns object we iterate over is from topology,
+	// and it's not the same ns object we use elsewhere in this file.
+	nsFromTopoJSON := make(map[string]bool)
+	for _, ns := range namespaces.Namespaces {
+		nsFromTopoJSON[ns.Path] = true
+	}
+
+	toAdd := []string{}
+	toDelete := []string{}
+	// If in topo and not in the table, add
+	for prefix := range nsFromTopoJSON {
+		if found := nsFromTopoTable[prefix]; !found {
+			toAdd = append(toAdd, prefix)
+		}
+	}
+	// If in table and not in topo, delete
+	for prefix := range nsFromTopoTable {
+		if found := nsFromTopoJSON[prefix]; !found {
+			toDelete = append(toDelete, prefix)
+		}
+	}
+
+	if err := modifyTopologyTable(toAdd, "add"); err != nil {
+		return errors.Wrap(err, "Failed to update topology table with new values")
+	}
+	if err := modifyTopologyTable(toDelete, "del"); err != nil {
+		return errors.Wrap(err, "Failed to clean old values from topology table")
+	}
+
+	return nil
+}
+
+func PeriodicTopologyReload() {
+	for {
+		time.Sleep(param.Federation_TopologyReloadInterval.GetDuration())
+		err := PopulateTopology()
+		if err != nil {
+			log.Warningf("Failed to re-populate topology table: %s. Will try again later",
+				err)
+		}
+	}
+}
+
+func ShutdownDB() error {
+	err := db.Close()
+	if err != nil {
+		log.Errorln("Failure when shutting down the database:", err)
+	}
+	return err
+}
diff --git a/registry/registry_db_test.go b/registry/registry_db_test.go
new file mode 100644
index 000000000..b4e2df8c8
--- /dev/null
+++ b/registry/registry_db_test.go
@@ -0,0 +1,920 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package registry
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+
+	_ "modernc.org/sqlite"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+)
+
+func setupMockRegistryDB(t *testing.T) {
+	mockDB, err := sql.Open("sqlite", ":memory:")
+	db = mockDB
+	require.NoError(t, err, "Error setting up mock namespace DB")
+	createNamespaceTable()
+}
+
+func resetNamespaceDB(t *testing.T) {
+	_, err := db.Exec(`DELETE FROM namespace`)
+	require.NoError(t, err, "Error resetting namespace DB")
+}
+
+func teardownMockNamespaceDB(t *testing.T) {
+	err := db.Close()
+	require.NoError(t, err, "Error tearing down mock namespace DB")
+}
+
+func insertMockDBData(nss []Namespace) error {
+	query := `INSERT INTO namespace (prefix, pubkey, identity, admin_metadata) VALUES (?, ?, ?, ?)`
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+	for _, ns := range nss {
+		adminMetaStr, err := json.Marshal(ns.AdminMetadata)
+		if err != nil {
+			if errRoll := tx.Rollback(); errRoll != nil {
+				return errors.Wrap(errRoll, "Failed to rollback transaction")
+			}
+			return err
+		}
+
+		_, err = tx.Exec(query, ns.Prefix, ns.Pubkey, ns.Identity, adminMetaStr)
+		if err != nil {
+			if errRoll := tx.Rollback(); errRoll != nil {
+				return errors.Wrap(errRoll, "Failed to rollback transaction")
+			}
+			return err
+		}
+	}
+	return tx.Commit()
+}
+
+func getLastNamespaceId() (int, error) {
+	var lastID int
+	err := db.QueryRow("SELECT id FROM namespace ORDER BY id DESC LIMIT 1").Scan(&lastID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return 0, errors.New("Empty database table.")
+		} else {
+			return 0, err
+		}
+	}
+	return lastID, nil
+}
+
+// Compares expected Namespace slice against either a slice of Namespace ptr or just Namespace
+func compareNamespaces(execpted []Namespace, returned interface{}, woPubkey bool) bool {
+	var normalizedReturned []Namespace
+
+	switch v := returned.(type) {
+	case []Namespace:
+		normalizedReturned = v
+	case []*Namespace:
+		for _, ptr := range v {
+			if ptr != nil {
+				normalizedReturned = append(normalizedReturned, *ptr)
+			} else {
+				// Handle nil pointers if necessary
+				normalizedReturned = append(normalizedReturned, Namespace{}) // or some default value
+			}
+		}
+	default:
+		return false
+	}
+
+	if len(execpted) != len(normalizedReturned) {
+		return false
+	}
+	for idx, nssEx := range execpted {
+		nssRt := normalizedReturned[idx]
+		if nssEx.Prefix != nssRt.Prefix ||
+			(!woPubkey && nssEx.Pubkey != nssRt.Pubkey) ||
+			nssEx.Identity != nssRt.Identity ||
+			nssEx.AdminMetadata != nssRt.AdminMetadata {
+			return false
+		}
+	}
+	return true
+}
+
+func mockNamespace(prefix, pubkey, identity string, adminMetadata AdminMetadata) Namespace {
+	return Namespace{
+		Prefix:        prefix,
+		Pubkey:        pubkey,
+		Identity:      identity,
+		AdminMetadata: adminMetadata,
+	}
+}
+
+// Some genertic mock data function to be shared with other test
+// functinos in this package. Please treat them as "constants"
+var (
+	mockNssWithOrigins []Namespace = []Namespace{
+		mockNamespace("/test1", "pubkey1", "", AdminMetadata{Status: Approved}),
+		mockNamespace("/test2", "pubkey2", "", AdminMetadata{Status: Approved}),
+	}
+	mockNssWithCaches []Namespace = []Namespace{
+		mockNamespace("/caches/random1", "pubkey1", "", AdminMetadata{Status: Approved}),
+		mockNamespace("/caches/random2", "pubkey2", "", AdminMetadata{Status: Approved}),
+	}
+	mockNssWithOriginsNotApproved []Namespace = []Namespace{
+		mockNamespace("/pending1", "pubkey1", "", AdminMetadata{Status: Pending}),
+		mockNamespace("/pending2", "pubkey2", "", AdminMetadata{Status: Pending}),
+	}
+	mockNssWithCachesNotApproved []Namespace = []Namespace{
+		mockNamespace("/caches/pending1", "pubkey1", "", AdminMetadata{Status: Pending}),
+		mockNamespace("/caches/pending2", "pubkey2", "", AdminMetadata{Status: Pending}),
+	}
+	mockNssWithMixed []Namespace = func() (mixed []Namespace) {
+		mixed = append(mixed, mockNssWithOrigins...)
+		mixed = append(mixed, mockNssWithCaches...)
+		return
+	}()
+
+	mockNssWithMixedNotApproved []Namespace = func() (mixed []Namespace) {
+		mixed = append(mixed, mockNssWithOriginsNotApproved...)
+		mixed = append(mixed, mockNssWithCachesNotApproved...)
+		return
+	}()
+)
+
+func TestNamespaceExistsByPrefix(t *testing.T) {
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	t.Run("return-false-for-prefix-dne", func(t *testing.T) {
+		found, err := namespaceExistsByPrefix("/non-existed-namespace")
+		require.NoError(t, err)
+		assert.False(t, found)
+	})
+
+	t.Run("return-true-for-existing-ns", func(t *testing.T) {
+		resetNamespaceDB(t)
+		err := insertMockDBData([]Namespace{{Prefix: "/foo"}})
+		require.NoError(t, err)
+		found, err := namespaceExistsByPrefix("/foo")
+		require.NoError(t, err)
+		assert.True(t, found)
+	})
+}
+
+func TestGetNamespacesById(t *testing.T) {
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	t.Run("return-error-with-empty-db", func(t *testing.T) {
+		_, err := getNamespaceById(1)
+		assert.Error(t, err)
+	})
+
+	t.Run("return-error-with-invalid-id", func(t *testing.T) {
+		_, err := getNamespaceById(0)
+		assert.Error(t, err)
+
+		_, err = getNamespaceById(-1)
+		assert.Error(t, err)
+	})
+
+	t.Run("return-namespace-with-correct-id", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		mockNs := mockNamespace("/test", "", "", AdminMetadata{UserID: "foo"})
+		err := insertMockDBData([]Namespace{mockNs})
+		require.NoError(t, err)
+		nss, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(nss))
+
+		got, err := getNamespaceById(nss[0].ID)
+		require.NoError(t, err, "Error getting namespace by ID")
+		mockNs.ID = nss[0].ID
+		assert.Equal(t, mockNs, *got)
+	})
+
+	t.Run("return-error-with-id-dne", func(t *testing.T) {
+		err := insertMockDBData(mockNssWithOrigins)
+		require.NoError(t, err)
+		defer resetNamespaceDB(t)
+		_, err = getNamespaceById(100)
+		assert.Error(t, err)
+	})
+}
+
+func TestGetNamespaceStatusById(t *testing.T) {
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	t.Run("invalid-id", func(t *testing.T) {
+		_, err := getNamespaceStatusById(0)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "Invalid id")
+	})
+
+	t.Run("db-query-error", func(t *testing.T) {
+		resetNamespaceDB(t)
+		// Simulate a DB error. You need to mock the db.QueryRow function to return an error
+		_, err := getNamespaceStatusById(1)
+		require.Error(t, err)
+	})
+
+	t.Run("valid-id-empty-admin-metadata", func(t *testing.T) {
+		resetNamespaceDB(t)
+		err := insertMockDBData([]Namespace{mockNamespace("/foo", "", "", AdminMetadata{})})
+		require.NoError(t, err)
+		lastId, err := getLastNamespaceId()
+		require.NoError(t, err)
+		status, err := getNamespaceStatusById(lastId)
+		require.NoError(t, err)
+		assert.Equal(t, Unknown, status)
+	})
+
+	t.Run("valid-id-non-empty-admin-metadata", func(t *testing.T) {
+		resetNamespaceDB(t)
+		err := insertMockDBData([]Namespace{mockNamespace("/foo", "", "", AdminMetadata{Status: Approved})})
+		require.NoError(t, err)
+		lastId, err := getLastNamespaceId()
+		require.NoError(t, err)
+		status, err := getNamespaceStatusById(lastId)
+		require.NoError(t, err)
+		assert.Equal(t, Approved, status)
+	})
+}
+
+func TestAddNamespace(t *testing.T) {
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	t.Run("set-default-fields", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		mockNs := mockNamespace("/test", "pubkey", "identity", AdminMetadata{UserID: "someone"})
+		err := addNamespace(&mockNs)
+		require.NoError(t, err)
+		got, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		// We can do this becuase we pass the pointer of mockNs to addNamespce which
+		// then modify the fields and insert into database
+		assert.Equal(t, mockNs.AdminMetadata.CreatedAt.Unix(), got[0].AdminMetadata.CreatedAt.Unix())
+		assert.Equal(t, mockNs.AdminMetadata.UpdatedAt.Unix(), got[0].AdminMetadata.UpdatedAt.Unix())
+		assert.Equal(t, mockNs.AdminMetadata.Status, got[0].AdminMetadata.Status)
+	})
+
+	t.Run("override-restricted-fields", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		mockCreateAt := time.Now().Add(time.Hour * 10)
+		mockUpdatedAt := time.Now().Add(time.Minute * 20)
+		mockNs := mockNamespace("/test", "pubkey", "identity", AdminMetadata{UserID: "someone", CreatedAt: mockCreateAt, UpdatedAt: mockUpdatedAt})
+		err := addNamespace(&mockNs)
+		require.NoError(t, err)
+		got, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+
+		assert.NotEqual(t, mockCreateAt.Unix(), mockNs.AdminMetadata.CreatedAt.Unix())
+		assert.NotEqual(t, mockUpdatedAt.Unix(), mockNs.AdminMetadata.UpdatedAt.Unix())
+		// We can do this becuase we pass the pointer of mockNs to addNamespce which
+		// then modify the fields and insert into database
+		assert.Equal(t, mockNs.AdminMetadata.CreatedAt.Unix(), got[0].AdminMetadata.CreatedAt.Unix())
+		assert.Equal(t, mockNs.AdminMetadata.UpdatedAt.Unix(), got[0].AdminMetadata.UpdatedAt.Unix())
+		assert.Equal(t, mockNs.AdminMetadata.Status, got[0].AdminMetadata.Status)
+	})
+
+	t.Run("insert-data-integrity", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		mockNs := mockNamespace("/test", "pubkey", "identity", AdminMetadata{UserID: "someone", Description: "Some description", SiteName: "OSG", SecurityContactUserID: "security-001"})
+		err := addNamespace(&mockNs)
+		require.NoError(t, err)
+		got, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		assert.Equal(t, mockNs.Pubkey, got[0].Pubkey)
+		assert.Equal(t, mockNs.Identity, got[0].Identity)
+		assert.Equal(t, mockNs.AdminMetadata.Description, got[0].AdminMetadata.Description)
+		assert.Equal(t, mockNs.AdminMetadata.SiteName, got[0].AdminMetadata.SiteName)
+		assert.Equal(t, mockNs.AdminMetadata.SecurityContactUserID, got[0].AdminMetadata.SecurityContactUserID)
+	})
+}
+
+func TestUpdateNamespace(t *testing.T) {
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	t.Run("update-on-dne-entry-returns-error", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		mockNs := mockNamespace("/test", "", "", AdminMetadata{})
+		err := updateNamespace(&mockNs)
+		assert.Error(t, err)
+	})
+
+	t.Run("update-preserve-internal-fields", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		mockNs := mockNamespace("/test", "", "", AdminMetadata{UserID: "foo"})
+		err := insertMockDBData([]Namespace{mockNs})
+		require.NoError(t, err)
+		initialNss, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(initialNss))
+		initialNs := initialNss[0]
+		assert.Equal(t, mockNs.Prefix, initialNs.Prefix)
+		initialNs.AdminMetadata.UserID = "bar"
+		initialNs.AdminMetadata.CreatedAt = time.Now().Add(10 * time.Hour)
+		initialNs.AdminMetadata.UpdatedAt = time.Now().Add(10 * time.Hour)
+		initialNs.AdminMetadata.Status = Approved
+		initialNs.AdminMetadata.ApproverID = "hacker"
+		initialNs.AdminMetadata.ApprovedAt = time.Now().Add(10 * time.Hour)
+		err = updateNamespace(initialNs)
+		require.NoError(t, err)
+		finalNss, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(finalNss))
+		finalNs := finalNss[0]
+		assert.Equal(t, mockNs.Prefix, finalNs.Prefix)
+		assert.Equal(t, mockNs.AdminMetadata.UserID, finalNs.AdminMetadata.UserID)
+		assert.Equal(t, mockNs.AdminMetadata.CreatedAt.Unix(), finalNs.AdminMetadata.CreatedAt.Unix())
+		assert.Equal(t, mockNs.AdminMetadata.Status, finalNs.AdminMetadata.Status)
+		assert.Equal(t, mockNs.AdminMetadata.ApprovedAt.Unix(), finalNs.AdminMetadata.ApprovedAt.Unix())
+		assert.Equal(t, mockNs.AdminMetadata.ApproverID, finalNs.AdminMetadata.ApproverID)
+		// DB first changes initialNs.AdminMetadata.UpdatedAt then commit
+		assert.Equal(t, initialNs.AdminMetadata.UpdatedAt.Unix(), finalNs.AdminMetadata.UpdatedAt.Unix())
+	})
+}
+
+func TestUpdateNamespaceStatusById(t *testing.T) {
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+	t.Run("return-error-if-id-dne", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+		err := insertMockDBData(mockNssWithOrigins)
+		require.NoError(t, err)
+		err = updateNamespaceStatusById(100, Approved, "random")
+		assert.Error(t, err)
+	})
+
+	t.Run("return-error-if-invalid-approver-userId", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+
+		mockNs := mockNamespace("/test", "pubkey", "identity", AdminMetadata{UserID: "someone"})
+		err := insertMockDBData([]Namespace{mockNs})
+		require.NoError(t, err)
+		got, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		err = updateNamespaceStatusById(got[0].ID, Approved, "")
+		assert.Error(t, err)
+	})
+
+	t.Run("update-status-with-valid-input-for-approval", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+
+		mockNs := mockNamespace("/test", "pubkey", "identity", AdminMetadata{UserID: "someone"})
+		err := insertMockDBData([]Namespace{mockNs})
+		require.NoError(t, err)
+		got, err := getAllNamespaces()
+		require.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		err = updateNamespaceStatusById(got[0].ID, Approved, "approver1")
+		assert.NoError(t, err)
+		got, err = getAllNamespaces()
+		assert.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		assert.Equal(t, Approved, got[0].AdminMetadata.Status)
+		assert.Equal(t, "approver1", got[0].AdminMetadata.ApproverID)
+		assert.NotEqual(t, time.Time{}, got[0].AdminMetadata.ApprovedAt)
+	})
+
+	t.Run("deny-does-not-modify-approval-fields", func(t *testing.T) {
+		defer resetNamespaceDB(t)
+
+		mockNs := mockNamespace("/test", "pubkey", "identity", AdminMetadata{UserID: "someone"})
+		err := insertMockDBData([]Namespace{mockNs})
+		assert.NoError(t, err)
+		got, err := getAllNamespaces()
+		assert.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		err = updateNamespaceStatusById(got[0].ID, Denied, "approver1")
+		assert.NoError(t, err)
+		got, err = getAllNamespaces()
+		assert.NoError(t, err)
+		require.Equal(t, 1, len(got))
+		assert.Equal(t, mockNs.Prefix, got[0].Prefix)
+		assert.Equal(t, Denied, got[0].AdminMetadata.Status)
+		assert.Equal(t, "", got[0].AdminMetadata.ApproverID)
+		assert.Equal(t, time.Time{}, got[0].AdminMetadata.ApprovedAt)
+	})
+}
+
+func TestGetNamespacesByFilter(t *testing.T) {
+	_, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	t.Run("return-error-for-unsupported-operations", func(t *testing.T) {
+		filterNsID := Namespace{
+			ID: 123,
+		}
+
+		_, err := getNamespacesByFilter(filterNsID, "")
+		require.Error(t, err, "Should return error for filtering against unsupported field ID")
+
+		filterNsIdentity := Namespace{
+			Identity: "someIdentity",
+		}
+
+		_, err = getNamespacesByFilter(filterNsIdentity, "")
+		require.Error(t, err, "Should return error for filtering against unsupported field Identity")
+
+		filterNsPubKey := Namespace{
+			Pubkey: "somePubkey",
+		}
+
+		_, err = getNamespacesByFilter(filterNsPubKey, "")
+		require.Error(t, err, "Should return error for filtering against unsupported field PubKey")
+
+		// Now, for AdminMetadata filters to work, we need to have a valid object
+		resetNamespaceDB(t)
+		err = insertMockDBData([]Namespace{{
+			Prefix: "/bar",
+			AdminMetadata: AdminMetadata{
+				Description:           "Mock description",
+				SiteName:              "UW-Madison",
+				Institution:           "123456",
+				SecurityContactUserID: "contactUserID",
+				ApproverID:            "mockApproverID",
+				Status:                Pending,
+			},
+		}})
+		require.NoError(t, err)
+
+		filterNsCreateAt := Namespace{
+			AdminMetadata: AdminMetadata{
+				CreatedAt: time.Now(),
+			},
+		}
+
+		_, err = getNamespacesByFilter(filterNsCreateAt, "")
+		require.Error(t, err, "Should return error for filtering against unsupported field CreatedAt")
+
+		filterNsUpdateAt := Namespace{
+			AdminMetadata: AdminMetadata{
+				UpdatedAt: time.Now(),
+			},
+		}
+
+		_, err = getNamespacesByFilter(filterNsUpdateAt, "")
+		require.Error(t, err, "Should return error for filtering against unsupported field UpdatedAt")
+
+		filterNsApproveAt := Namespace{
+			AdminMetadata: AdminMetadata{
+				ApprovedAt: time.Now(),
+			},
+		}
+
+		_, err = getNamespacesByFilter(filterNsApproveAt, "")
+		require.Error(t, err, "Should return error for filtering against unsupported field ApprovedAt")
+	})
+
+	t.Run("filter-by-server-type", func(t *testing.T) {
+		// Assuming mock data and insertMockDBData function exist
+		resetNamespaceDB(t)
+		err := insertMockDBData(append(mockNssWithOrigins, mockNssWithCaches...))
+		require.NoError(t, err)
+
+		filterNs := Namespace{}
+		nssOrigins, err := getNamespacesByFilter(filterNs, OriginType)
+		require.NoError(t, err)
+		assert.NotEmpty(t, nssOrigins, "Should return non-empty result for OriginType")
+		assert.True(t, compareNamespaces(mockNssWithOrigins, nssOrigins, true))
+
+		nssCaches, err := getNamespacesByFilter(filterNs, CacheType)
+		require.NoError(t, err)
+		assert.NotEmpty(t, nssCaches, "Should return non-empty result for CacheType")
+		assert.True(t, compareNamespaces(mockNssWithCaches, nssCaches, true))
+	})
+
+	t.Run("filter-by-admin-metadata", func(t *testing.T) {
+		resetNamespaceDB(t)
+		err := insertMockDBData([]Namespace{{
+			Prefix: "/bar",
+			AdminMetadata: AdminMetadata{
+				Description:           "Mock description",
+				SiteName:              "UW-Madison",
+				UserID:                "mockUserID",
+				Institution:           "123456",
+				SecurityContactUserID: "contactUserID",
+				ApproverID:            "mockApproverID",
+				Status:                Pending,
+			},
+		}})
+		require.NoError(t, err)
+
+		filterNs := Namespace{
+			AdminMetadata: AdminMetadata{
+				Description: "description",
+			},
+		}
+
+		namespaces, err := getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for Description")
+
+		filterNs = Namespace{
+			AdminMetadata: AdminMetadata{
+				SiteName: "Madison",
+			},
+		}
+		namespaces, err = getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for SiteName")
+
+		filterNs = Namespace{
+			AdminMetadata: AdminMetadata{
+				Institution: "123456",
+			},
+		}
+		namespaces, err = getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for Institution")
+
+		filterNs = Namespace{
+			AdminMetadata: AdminMetadata{
+				SecurityContactUserID: "contactUserID",
+			},
+		}
+		namespaces, err = getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for SecurityContactUserID")
+
+		filterNs = Namespace{
+			AdminMetadata: AdminMetadata{
+				ApproverID: "mockApproverID",
+			},
+		}
+		namespaces, err = getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for ApproverID")
+
+		filterNs = Namespace{
+			AdminMetadata: AdminMetadata{
+				Status: Pending,
+			},
+		}
+		namespaces, err = getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for Status")
+
+		filterNs = Namespace{
+			AdminMetadata: AdminMetadata{
+				UserID: "mockUserID",
+			},
+		}
+		namespaces, err = getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for UserID")
+	})
+
+	t.Run("multiple-AND-match", func(t *testing.T) {
+		resetNamespaceDB(t)
+		err := insertMockDBData([]Namespace{{
+			Prefix: "/bar",
+			AdminMetadata: AdminMetadata{
+				Description:           "Mock description",
+				SiteName:              "UW-Madison",
+				Institution:           "123456",
+				SecurityContactUserID: "contactUserID",
+				ApproverID:            "mockApproverID",
+				Status:                Pending,
+			},
+		}})
+		require.NoError(t, err)
+
+		filterNs := Namespace{
+			Prefix: "/bar",
+			AdminMetadata: AdminMetadata{
+				SecurityContactUserID: "contactUserID",
+				ApproverID:            "mockApproverID",
+				Status:                Pending,
+			},
+		}
+		namespaces, err := getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for non-empty database without condition")
+	})
+
+	t.Run("fully-match", func(t *testing.T) {
+		resetNamespaceDB(t)
+		mockNs := Namespace{
+			Prefix: "/bar",
+			AdminMetadata: AdminMetadata{
+				Description:           "Mock description",
+				SiteName:              "UW-Madison",
+				UserID:                "mockUserID",
+				Institution:           "123456",
+				SecurityContactUserID: "contactUserID",
+				ApproverID:            "mockApproverID",
+				Status:                Pending,
+			},
+		}
+		err := insertMockDBData([]Namespace{mockNs})
+		require.NoError(t, err)
+
+		filterNs := mockNs
+		namespaces, err := getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.NotEmpty(t, namespaces, "Should return non-empty result for non-empty database without condition")
+	})
+
+	t.Run("no-match", func(t *testing.T) {
+		resetNamespaceDB(t)
+		mockNs := Namespace{
+			Prefix: "/bar",
+			AdminMetadata: AdminMetadata{
+				Description:           "Mock description",
+				UserID:                "mockUserID",
+				SiteName:              "UW-Madison",
+				Institution:           "123456",
+				SecurityContactUserID: "contactUserID",
+				ApproverID:            "mockApproverID",
+				Status:                Pending,
+			},
+		}
+		err := insertMockDBData([]Namespace{mockNs})
+		require.NoError(t, err)
+
+		filterNs := mockNs
+		filterNs.AdminMetadata.Status = Denied
+		namespaces, err := getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.Empty(t, namespaces, "Should return non-empty result for non-empty database without condition")
+	})
+
+	t.Run("empty-db-returns-empty-results", func(t *testing.T) {
+		resetNamespaceDB(t)
+
+		filterNs := Namespace{}
+		namespaces, err := getNamespacesByFilter(filterNs, "")
+		require.NoError(t, err)
+		assert.Empty(t, namespaces, "Should return empty result for empty database")
+	})
+}
+
+func topologyMockup(t *testing.T, namespaces []string) *httptest.Server {
+	svr := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var namespaceList []map[string]string
+		for _, ns := range namespaces {
+			namespaceList = append(namespaceList, map[string]string{"path": ns})
+		}
+
+		jsonData, err := json.Marshal(map[string][]map[string]string{"namespaces": namespaceList})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(jsonData))
+	}))
+
+	return svr
+}
+
+func TestRegistryTopology(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+
+	topoNamespaces := []string{"/topo/foo", "/topo/bar"}
+	svr := topologyMockup(t, topoNamespaces)
+	defer svr.Close()
+
+	registryDB := t.TempDir()
+	viper.Set("Registry.DbLocation", filepath.Join(registryDB, "test.sqlite"))
+	viper.Set("Federation.TopologyNamespaceURL", svr.URL)
+	config.InitConfig()
+
+	err := InitializeDB(ctx)
+	require.NoError(t, err)
+	defer func() {
+		err := ShutdownDB()
+		assert.NoError(t, err)
+	}()
+
+	// Set value so that config.GetPreferredPrefix() returns "OSDF"
+	config.SetPreferredPrefix("OSDF")
+
+	//Test topology table population
+	err = PopulateTopology()
+	require.NoError(t, err)
+
+	// Check that topology namespace exists
+	exists, err := namespaceExists("/topo/foo")
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	// Check that topology namespace exists
+	exists, err = namespaceExists("/topo/bar")
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	// Add a test namespace so we can test that checkExists still works
+	ns := Namespace{
+		ID:            0,
+		Prefix:        "/regular/foo",
+		Pubkey:        "",
+		Identity:      "",
+		AdminMetadata: AdminMetadata{},
+	}
+	err = addNamespace(&ns)
+	require.NoError(t, err)
+
+	// Check that the regular namespace exists
+	exists, err = namespaceExists("/regular/foo")
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	// Check that a bad namespace doesn't exist
+	exists, err = namespaceExists("/bad/namespace")
+	require.NoError(t, err)
+	require.False(t, exists)
+
+	// No kill the old topo server, and remove a namespace
+	svr.Close()
+	svr.CloseClientConnections()
+
+	topoNamespaces = []string{"/topo/foo", "/topo/baz"}
+	svr = topologyMockup(t, topoNamespaces)
+	viper.Set("Federation.TopologyNamespaceURL", svr.URL)
+	defer svr.Close()
+
+	// Re-populate topo
+	//Test topology table population
+	err = PopulateTopology()
+	require.NoError(t, err)
+
+	// Check that /topo/foo still exists
+	exists, err = namespaceExists("/topo/foo")
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	// And that /topo/baz was added
+	exists, err = namespaceExists("/topo/baz")
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	// Check that /topo/bar is gone
+	exists, err = namespaceExists("/topo/bar")
+	require.NoError(t, err)
+	require.False(t, exists)
+
+	// Finally, check that /regular/foo survived
+	exists, err = namespaceExists("/regular/foo")
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	viper.Reset()
+}
+
+func TestCacheAdminTrue(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	registryDBDir := t.TempDir()
+	viper.Set("Registry.DbLocation", registryDBDir)
+
+	err := InitializeDB(ctx)
+	defer func() {
+		err := ShutdownDB()
+		assert.NoError(t, err)
+	}()
+
+	require.NoError(t, err, "error initializing registry database")
+
+	adminTester := func(ns Namespace) func(t *testing.T) {
+		return func(t *testing.T) {
+			err = addNamespace(&ns)
+
+			require.NoError(t, err, "error adding test cache to registry database")
+
+			// This will return a serverCredsError if the AdminMetadata.Status != Approved, which we don't want to happen
+			// For these tests, otherwise it will get a key parsing error as ns.Pubkey isn't a real jwk
+			_, err = getNamespaceJwksByPrefix(ns.Prefix, true)
+			require.NotErrorIsf(t, err, serverCredsErr, "error chain contains serverCredErr")
+
+			require.ErrorContainsf(t, err, "Failed to parse pubkey as a jwks: failed to unmarshal JWK set: invalid character 'k' in literal true (expecting 'r')", "error doesn't contain jwks parsing error")
+		}
+	}
+
+	var ns Namespace
+	ns.Prefix = "/caches/test3"
+	ns.Identity = "testident3"
+	ns.Pubkey = "tkey"
+	ns.AdminMetadata.Status = Approved
+
+	t.Run("WithApproval", adminTester(ns))
+
+	ns.Prefix = "/orig/test1"
+	ns.Identity = "testident4"
+	ns.Pubkey = "tkey"
+	ns.AdminMetadata.Status = Pending
+
+	t.Run("OriginNoApproval", adminTester(ns))
+
+	ns.Prefix = "/orig/test2"
+	ns.Identity = "testident5"
+	ns.Pubkey = "tkey"
+	ns.AdminMetadata = AdminMetadata{}
+
+	t.Run("OriginEmptyApproval", adminTester(ns))
+
+	viper.Reset()
+}
+
+func TestCacheAdminFalse(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	registryDBDir := t.TempDir()
+	viper.Set("Registry.DbLocation", registryDBDir)
+
+	err := InitializeDB(ctx)
+	defer func() {
+		err := ShutdownDB()
+		assert.NoError(t, err)
+	}()
+
+	require.NoError(t, err, "error initializing registry database")
+
+	adminTester := func(ns Namespace) func(t *testing.T) {
+		return func(t *testing.T) {
+			err = addNamespace(&ns)
+			require.NoError(t, err, "error adding test cache to registry database")
+
+			// This will return a serverCredsError if the admin_approval == false check is triggered, which we want to happen
+			_, err = getNamespaceJwksByPrefix(ns.Prefix, true)
+
+			require.ErrorIs(t, err, serverCredsErr)
+		}
+	}
+
+	var ns Namespace
+	ns.Prefix = "/caches/test1"
+	ns.Identity = "testident1"
+	ns.Pubkey = "tkey"
+	ns.AdminMetadata.Status = Pending
+
+	t.Run("NoAdmin", adminTester(ns))
+
+	ns.Prefix = "/caches/test2"
+	ns.Identity = "testident2"
+	ns.AdminMetadata = AdminMetadata{}
+
+	t.Run("EmptyAdmin", adminTester(ns))
+
+	viper.Reset()
+}
diff --git a/registry/registry_test.go b/registry/registry_test.go
new file mode 100644
index 000000000..b9bb2b497
--- /dev/null
+++ b/registry/registry_test.go
@@ -0,0 +1,60 @@
+package registry
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandleWildcard(t *testing.T) {
+	// Set up the router
+	r := gin.New()
+	group := r.Group("/registry")
+
+	group.GET("/*wildcard", wildcardHandler)
+
+	t.Run("return-404-for-unmatched-route", func(t *testing.T) {
+		// Create a test request
+		req, _ := http.NewRequest("GET", "/registry/no-match", nil)
+		w := httptest.NewRecorder()
+
+		// Perform the request
+		r.ServeHTTP(w, req)
+
+		// Should return 404 for an unmatched route
+		assert.Equal(t, http.StatusNotFound, w.Code)
+	})
+
+	t.Run("match-wildcard-metadataHandler", func(t *testing.T) {
+		mockPrefix := "/testnamespace/foo"
+
+		setupMockRegistryDB(t)
+		defer teardownMockNamespaceDB(t)
+
+		mockJWKS := jwk.NewSet()
+		mockJWKSBytes, err := json.Marshal(mockJWKS)
+		require.NoError(t, err)
+		err = insertMockDBData([]Namespace{{Prefix: mockPrefix, Pubkey: string(mockJWKSBytes)}})
+		require.NoError(t, err)
+		mockNs, err := getNamespaceByPrefix(mockPrefix)
+
+		require.NoError(t, err)
+		require.NotNil(t, mockNs)
+
+		req, _ := http.NewRequest("GET", fmt.Sprintf("/registry%s/.well-known/issuer.jwks", mockPrefix), nil)
+		w := httptest.NewRecorder()
+
+		r.ServeHTTP(w, req)
+
+		// Should return 200 for matched metadataHandler since the db is empty
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, string(mockJWKSBytes), w.Body.String())
+	})
+}
diff --git a/registry/registry_ui.go b/registry/registry_ui.go
new file mode 100644
index 000000000..f3b03837a
--- /dev/null
+++ b/registry/registry_ui.go
@@ -0,0 +1,748 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package registry
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/web_ui"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+type (
+	listNamespaceRequest struct {
+		ServerType string `form:"server_type"`
+		Status     string `form:"status"`
+	}
+
+	listNamespacesForUserRequest struct {
+		Status string `form:"status"`
+	}
+
+	registrationFieldType string
+	registrationField     struct {
+		Name     string                `json:"name"`
+		Type     registrationFieldType `json:"type"`
+		Required bool                  `json:"required"`
+		Options  []interface{}         `json:"options"`
+	}
+
+	Institution struct {
+		Name string `mapstructure:"name" json:"name" yaml:"name"`
+		ID   string `mapstructure:"id" json:"id" yaml:"id"`
+	}
+)
+
+const (
+	String   registrationFieldType = "string"
+	Int      registrationFieldType = "int"
+	Enum     registrationFieldType = "enum"
+	DateTime registrationFieldType = "datetime"
+)
+
+var (
+	registrationFields     []registrationField
+	institutionsCache      *ttlcache.Cache[string, []Institution]
+	institutionsCacheMutex = sync.RWMutex{}
+)
+
+func init() {
+	registrationFields = make([]registrationField, 0)
+	registrationFields = append(registrationFields, populateRegistrationFields("", Namespace{})...)
+}
+
+// Populate registrationFields array to provide available namespace registration fields
+// for UI to render registration form
+func populateRegistrationFields(prefix string, data interface{}) []registrationField {
+	var fields []registrationField
+
+	val := reflect.ValueOf(data)
+	typ := val.Type()
+	for i := 0; i < val.NumField(); i++ {
+		field := typ.Field(i)
+
+		// Check for the "post" tag, it can be "exlude" or "required"
+		if tag := field.Tag.Get("post"); tag == "exclude" {
+			continue
+		}
+
+		name := ""
+		if prefix != "" {
+			name += prefix + "."
+		}
+		// If the field has a json tag. Use the name from json tag
+		tempName := field.Name
+		jsonTag := field.Tag.Get("json")
+		if jsonTag != "" {
+			splitJson := strings.Split(jsonTag, ",")[0]
+			if splitJson != "-" {
+				tempName = splitJson
+			} else {
+				// `json:"-"` means this field should be removed from any marshalling
+				continue
+			}
+		}
+
+		regField := registrationField{
+			Name:     name + tempName,
+			Required: strings.Contains(field.Tag.Get("validate"), "required"),
+		}
+
+		switch field.Type.Kind() {
+		case reflect.Int:
+			regField.Type = Int
+			fields = append(fields, regField)
+		case reflect.String:
+			regField.Type = String
+			fields = append(fields, regField)
+		case reflect.Struct:
+			// Check if the struct is of type time.Time
+			if field.Type == reflect.TypeOf(time.Time{}) {
+				regField.Type = DateTime
+				fields = append(fields, regField)
+				break
+			}
+			// If it's AdminMetadata, add prefix and recursively call to parse fields
+			if field.Type == reflect.TypeOf(AdminMetadata{}) {
+				existing_prefix := ""
+				if prefix != "" {
+					existing_prefix = prefix + "."
+				}
+				fields = append(fields, populateRegistrationFields(existing_prefix+"admin_metadata", AdminMetadata{})...)
+			}
+		}
+
+		if field.Type == reflect.TypeOf(RegistrationStatus("")) {
+			regField.Type = Enum
+			options := make([]interface{}, 3)
+			options[0] = Pending
+			options[1] = Approved
+			options[2] = Denied
+			regField.Options = options
+			fields = append(fields, regField)
+		} else {
+			// Skip the field if it's not in the types listed above
+			continue
+		}
+	}
+	return fields
+}
+
+// Helper function to exclude pubkey field from marshalling into json
+func excludePubKey(nss []*Namespace) (nssNew []NamespaceWOPubkey) {
+	nssNew = make([]NamespaceWOPubkey, 0)
+	for _, ns := range nss {
+		nsNew := NamespaceWOPubkey{
+			ID:            ns.ID,
+			Prefix:        ns.Prefix,
+			Pubkey:        ns.Pubkey,
+			AdminMetadata: ns.AdminMetadata,
+			Identity:      ns.Identity,
+		}
+		nssNew = append(nssNew, nsNew)
+	}
+
+	return
+}
+
+func checkUniqueInstitutions(insts []Institution) bool {
+	repeatMap := make(map[string]bool)
+	for _, inst := range insts {
+		if repeatMap[inst.ID] {
+			return false
+		} else {
+			repeatMap[inst.ID] = true
+		}
+	}
+	return true
+}
+
+func getCachedInstitutions() (inst []Institution, intError error, extError error) {
+	if institutionsCache == nil {
+		return nil, errors.New("institutionsCache isn't initialized"), errors.New("Internal institution cache wasn't initialized")
+	}
+	instUrlStr := param.Registry_InstitutionsUrl.GetString()
+	if instUrlStr == "" {
+		intError = errors.New("Bad server configuration. Registry.InstitutionsUrl is unset")
+		extError = errors.New("Bad server configuration. Registry.InstitutionsUrl is unset")
+		return
+	}
+	instUrl, err := url.Parse(instUrlStr)
+	if err != nil {
+		intError = errors.Wrap(err, "Bad server configuration. Registry.InstitutionsUrl is invalid")
+		extError = errors.New("Bad server configuration. Registry.InstitutionsUrl is invalid")
+		return
+	}
+	if !institutionsCache.Has(instUrl.String()) {
+		log.Info("Cache miss for institutions TTL cache. Will fetch from source.")
+		client := &http.Client{Transport: config.GetTransport()}
+		req, err := http.NewRequest("GET", instUrl.String(), nil)
+		if err != nil {
+			intError = errors.Wrap(err, "Error making a request when fetching institution list")
+			extError = errors.New("Error when creating a request to fetch institution from remote url.")
+			return
+		}
+		res, err := client.Do(req)
+		if err != nil {
+			intError = errors.Wrap(err, "Error response when fetching institution list")
+			extError = errors.New("Error from response when fetching institution from remote url.")
+			return
+		}
+		if res.StatusCode != 200 {
+			intError = errors.Wrap(err, fmt.Sprintf("Error response when fetching institution list with code %d", res.StatusCode))
+			extError = errors.New(fmt.Sprint("Error when fetching institution from remote url, remote server error with code: ", res.StatusCode))
+			return
+		}
+		resBody, err := io.ReadAll(res.Body)
+		if err != nil {
+			intError = errors.Wrap(err, "Error reading response body when fetching institution list")
+			extError = errors.New("Error read response when fetching institution from remote url.")
+			return
+		}
+		institutions := []Institution{}
+		if err = json.Unmarshal(resBody, &institutions); err != nil {
+			intError = errors.Wrap(err, "Error parsing response body when fetching institution list")
+			extError = errors.New("Error parsing response when fetching institution from remote url.")
+			return
+		}
+		institutionsCacheMutex.Lock()
+		defer institutionsCacheMutex.Unlock()
+		institutionsCache.Set(instUrl.String(), institutions, ttlcache.DefaultTTL)
+		return institutions, nil, nil
+	} else {
+		institutionsCacheMutex.RLock()
+		defer institutionsCacheMutex.RUnlock()
+		institutions := institutionsCache.Get(instUrl.String())
+		if institutions.Value() == nil {
+			intError = errors.New(fmt.Sprint("Fail to get institutions from internal TTL cache, value is nil from key: ", instUrl))
+			extError = errors.New("Fail to get institutions from internal TTL cache")
+			return
+		}
+		if institutions.IsExpired() {
+			intError = errors.New(fmt.Sprintf("Cached institution with key %q is expired at %v", institutions.Key(), institutions.ExpiresAt()))
+			extError = errors.New("Expired institution cache")
+			return
+		}
+		return institutions.Value(), nil, nil
+	}
+}
+
+// List all namespaces in the registry.
+// For authenticated users, it returns all namespaces.
+// For non-authenticated users, it returns namespaces with AdminMetadata.Status = Approved
+//
+// Query against server_type, status
+//
+// GET /namespaces
+func listNamespaces(ctx *gin.Context) {
+	// Directly call GetUser as we want this endpoint to also be able to serve unauthed users
+	user, err := web_ui.GetUser(ctx)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check user login status"})
+		return
+	}
+	ctx.Set("User", user)
+	isAuthed := user != ""
+	queryParams := listNamespaceRequest{}
+	if ctx.ShouldBindQuery(&queryParams) != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	// For unauthed user with non-empty Status query != Approved, return 403
+	if !isAuthed && queryParams.Status != "" && queryParams.Status != Approved.String() {
+		ctx.JSON(http.StatusForbidden, gin.H{"error": "You don't have permission to filter non-approved namespace registrations"})
+		return
+	}
+
+	// Filter ns by server type
+	if queryParams.ServerType != "" && queryParams.ServerType != string(OriginType) && queryParams.ServerType != string(CacheType) {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid server type"})
+		return
+	}
+
+	filterNs := Namespace{}
+
+	// For authenticated users, it returns all namespaces.
+	// For unauthenticated users, it returns namespaces with AdminMetadata.Status = Approved
+	if isAuthed {
+		if queryParams.Status != "" {
+			filterNs.AdminMetadata.Status = RegistrationStatus(queryParams.Status)
+		}
+	} else {
+		filterNs.AdminMetadata.Status = Approved
+	}
+
+	namespaces, err := getNamespacesByFilter(filterNs, ServerType(queryParams.ServerType))
+	if err != nil {
+		log.Error("Failed to get namespaces by server type: ", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Server encountered an error trying to list namespaces"})
+		return
+	}
+	nssWOPubkey := excludePubKey(namespaces)
+	ctx.JSON(http.StatusOK, nssWOPubkey)
+}
+
+// List namespaces for the currently authenticated user
+//
+// # Query against status
+//
+// GET /namespaces/user
+func listNamespacesForUser(ctx *gin.Context) {
+	user := ctx.GetString("User")
+	if user == "" {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "You need to login to perform this action"})
+		return
+	}
+	queryParams := listNamespacesForUserRequest{}
+	if ctx.ShouldBindQuery(&queryParams) != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	filterNs := Namespace{AdminMetadata: AdminMetadata{UserID: user}}
+
+	if queryParams.Status != "" {
+		filterNs.AdminMetadata.Status = RegistrationStatus(queryParams.Status)
+	}
+
+	namespaces, err := getNamespacesByFilter(filterNs, "")
+	if err != nil {
+		log.Error("Error getting namespaces for user ", user)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error getting namespaces by user ID"})
+		return
+	}
+	ctx.JSON(http.StatusOK, namespaces)
+}
+
+func getNamespaceRegFields(ctx *gin.Context) {
+	ctx.JSON(http.StatusOK, registrationFields)
+}
+
+// Create a new namespace registration or update existing namespace registration.
+//
+// For update, only admin-user can update an existing registration if it's been approved already.
+//
+// One caveat in updating is that if the namespace to update was a legacy registration, i.e. It doesn't have
+// AdminMetaData populated, an update __will__ populate the AdminMetaData field and update
+// AdminMetaData based on user input. However, internal fields are still preserved.
+//
+// POST /namespaces
+// PUT /namespaces/:id
+func createUpdateNamespace(ctx *gin.Context, isUpdate bool) {
+	user := ctx.GetString("User")
+	id := 0 // namespace ID when doing update, will be populated later
+	if user == "" {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "You need to login to perform this action"})
+		return
+	}
+	if isUpdate {
+		idStr := ctx.Param("id")
+		var err error
+		id, err = strconv.Atoi(idStr)
+		if err != nil || id <= 0 {
+			// Handle the error if id is not a valid integer
+			ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID format. ID must a non-zero integer"})
+			return
+		}
+	}
+
+	ns := Namespace{}
+	if ctx.ShouldBindJSON(&ns) != nil {
+		ctx.JSON(400, gin.H{"error": "Invalid create or update namespace request"})
+		return
+	}
+	// Assign ID from path param because the request data doesn't have ID set
+	ns.ID = id
+	// Basic validation (type, required, etc)
+	errs := config.GetValidate().Struct(ns)
+	if errs != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint(errs)})
+		return
+	}
+	// Check that Prefix is a valid prefix
+	updated_prefix, err := validatePrefix(ns.Prefix)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint("Error: Field validation for prefix failed:", err)})
+		return
+	}
+	ns.Prefix = updated_prefix
+
+	if !isUpdate {
+		// Check if prefix exists before doing anything else. Skip check if it's update operation
+		exists, err := namespaceExists(ns.Prefix)
+		if err != nil {
+			log.Errorf("Failed to check if namespace already exists: %v", err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Server encountered an error checking if namespace already exists"})
+			return
+		}
+		if exists {
+			ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("The prefix %s is already registered", ns.Prefix)})
+			return
+		}
+	}
+	// Check if pubKey is a valid JWK
+	pubkey, err := validateJwks(ns.Pubkey)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint("Error: Field validation for pubkey failed:", err)})
+		return
+	}
+
+	// Check if the parent or child path along the prefix has been registered
+	valErr, sysErr := validateKeyChaining(ns.Prefix, pubkey)
+	if valErr != nil {
+		log.Errorln(valErr)
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": valErr})
+		return
+	}
+	if sysErr != nil {
+		log.Errorln(sysErr)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": sysErr})
+		return
+	}
+
+	if validInst, err := validateInstitution(ns.AdminMetadata.Institution); !validInst {
+		if err != nil {
+			ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("Error validating institution: %v", err)})
+			return
+		}
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("Institution \"%s\" is not in the list of available institutions to register.", ns.AdminMetadata.Institution)})
+		return
+	}
+
+	if !isUpdate { // Create
+		ns.AdminMetadata.UserID = user
+		// Overwrite status to Pending to filter malicious request
+		ns.AdminMetadata.Status = Pending
+		if err := addNamespace(&ns); err != nil {
+			log.Errorf("Failed to insert namespace with id %d. %v", ns.ID, err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Fail to insert namespace"})
+			return
+		}
+		ctx.JSON(http.StatusOK, gin.H{"msg": "success"})
+	} else { // Update
+		// First check if the namespace exists
+		exists, err := namespaceExistsById(ns.ID)
+		if err != nil {
+			log.Error("Failed to get namespace by ID:", err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Fail to find if namespace exists"})
+			return
+		}
+
+		if !exists { // Return 404 is the namespace does not exists
+			ctx.JSON(http.StatusNotFound, gin.H{"error": "Can't update namespace: namespace not found"})
+			return
+		}
+
+		// Then check if the user has previlege to update
+		isAdmin, _ := web_ui.CheckAdmin(user)
+		if !isAdmin { // Not admin, need to check if the namespace belongs to the user
+			found, err := namespaceBelongsToUserId(ns.ID, user)
+			if err != nil {
+				log.Error("Error checking if namespace belongs to the user: ", err)
+				ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error checking if namespace belongs to the user"})
+				return
+			}
+			if !found {
+				log.Errorf("Namespace not found for id: %d", ns.ID)
+				ctx.JSON(http.StatusNotFound, gin.H{"error": "Namespace not found. Check the id or if you own the namespace"})
+				return
+			}
+			existingStatus, err := getNamespaceStatusById(ns.ID)
+			if err != nil {
+				log.Error("Error checking namespace status: ", err)
+				ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error checking namespace status"})
+				return
+			}
+			if existingStatus == Approved {
+				log.Errorf("User '%s' is trying to modify approved namespace registration with id=%d", user, ns.ID)
+				ctx.JSON(http.StatusForbidden, gin.H{"error": "You don't have permission to modify an approved registration. Please contact your federation administrator"})
+				return
+			}
+		}
+		// If the user has previlege to udpate, go ahead
+		if err := updateNamespace(&ns); err != nil {
+			log.Errorf("Failed to update namespace with id %d. %v", ns.ID, err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Fail to update namespace"})
+			return
+		}
+	}
+}
+
+// Get one namespace by id.
+// Admin can see any namespace detail while non-admin can only see his/her namespace
+//
+// GET /namesapces/:id
+func getNamespace(ctx *gin.Context) {
+	user := ctx.GetString("User")
+	idStr := ctx.Param("id")
+	id, err := strconv.Atoi(idStr)
+	if err != nil || id <= 0 {
+		// Handle the error if id is not a valid integer
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID format. ID must a non-zero integer"})
+		return
+	}
+	exists, err := namespaceExistsById(id)
+	if err != nil {
+		log.Error("Error checking if namespace exists: ", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error checking if namespace exists"})
+		return
+	}
+	if !exists {
+		log.Errorf("Namespace not found for id: %d", id)
+		ctx.JSON(http.StatusNotFound, gin.H{"error": "Namespace not found"})
+		return
+	}
+
+	isAdmin, _ := web_ui.CheckAdmin(user)
+	if !isAdmin { // Not admin, need to check if the namespace belongs to the user
+		found, err := namespaceBelongsToUserId(id, user)
+		if err != nil {
+			log.Error("Error checking if namespace belongs to the user: ", err)
+			ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error checking if namespace belongs to the user"})
+			return
+		}
+		if !found { // If the user doen's own the namespace, they can't update it
+			log.Errorf("Namespace not found for id: %d", id)
+			ctx.JSON(http.StatusForbidden, gin.H{"error": "Namespace not found. Check the id or if you own the namespace"})
+			return
+		}
+	}
+
+	ns, err := getNamespaceById(id)
+	if err != nil {
+		log.Error("Error getting namespace: ", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error getting namespace"})
+		return
+	}
+	ctx.JSON(http.StatusOK, ns)
+}
+
+func updateNamespaceStatus(ctx *gin.Context, status RegistrationStatus) {
+	user := ctx.GetString("User")
+	idStr := ctx.Param("id")
+	id, err := strconv.Atoi(idStr)
+	if err != nil || id <= 0 {
+		// Handle the error if id is not a valid integer
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID format. ID must a non-zero integer"})
+		return
+	}
+	exists, err := namespaceExistsById(id)
+	if err != nil {
+		log.Error("Error checking if namespace exists: ", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error checking if namespace exists"})
+		return
+	}
+	if !exists {
+		log.Errorf("Namespace not found for id: %d", id)
+		ctx.JSON(http.StatusNotFound, gin.H{"error": "Namespace not found"})
+		return
+	}
+
+	if err = updateNamespaceStatusById(id, status, user); err != nil {
+		log.Error("Error updating namespace status by ID:", id, " to status:", status)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update namespace"})
+		return
+	}
+	ctx.JSON(http.StatusOK, gin.H{"msg": "ok"})
+}
+
+func getNamespaceJWKS(ctx *gin.Context) {
+	idStr := ctx.Param("id")
+	id, err := strconv.Atoi(idStr)
+	if err != nil || id <= 0 {
+		// Handle the error if id is not a valid integer
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID format. ID must a non-zero integer"})
+		return
+	}
+	found, err := namespaceExistsById(id)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprint("Error checking id:", err)})
+		return
+	}
+	if !found {
+		ctx.JSON(http.StatusNotFound, gin.H{"error": "Namespace not found"})
+		return
+	}
+	jwks, err := getNamespaceJwksById(id)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprint("Error getting jwks by id:", err)})
+		return
+	}
+	jsonData, err := json.MarshalIndent(jwks, "", "  ")
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to marshal JWKS"})
+		return
+	}
+	// Append a new line to the JSON data
+	jsonData = append(jsonData, '\n')
+	ctx.Header("Content-Disposition", fmt.Sprintf("attachment; filename=public-key-server-%v.jwks", id))
+	ctx.Data(200, "application/json", jsonData)
+}
+
+func listInstitutions(ctx *gin.Context) {
+	// When Registry.InstitutionsUrl is set and Registry.Institutions is unset
+	if institutionsCache != nil {
+		insts, intErr, extErr := getCachedInstitutions()
+		if intErr != nil || extErr != nil {
+			if intErr != nil {
+				log.Error(intErr)
+			}
+			if extErr != nil {
+				ctx.JSON(http.StatusInternalServerError, gin.H{"error": extErr.Error()})
+			}
+			return
+		}
+		ctx.JSON(http.StatusOK, insts)
+		return
+	}
+	// When Registry.Institutions is set
+	institutions := []Institution{}
+	if err := param.Registry_Institutions.Unmarshal(&institutions); err != nil {
+		log.Error("Fail to read server configuration of institutions", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Fail to read server configuration of institutions"})
+		return
+	}
+
+	if len(institutions) == 0 {
+		log.Error("Server didn't configure Registry.Institutions")
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Server didn't configure Registry.Institutions"})
+		return
+	}
+	ctx.JSON(http.StatusOK, institutions)
+}
+
+// Define Gin APIs for registry Web UI. All endpoints are user-facing
+func RegisterRegistryWebAPI(router *gin.RouterGroup) error {
+	registryWebAPI := router.Group("/api/v1.0/registry_ui")
+	csrfHandler, err := config.GetCSRFHandler()
+	if err != nil {
+		return err
+	}
+	// Add CSRF middleware to all the routes below. CSRF middleware will look for
+	// any update methods (post/delete/patch, etc) and automatically check if a
+	// X-CSRF-Token header is present and the token matches
+	registryWebAPI.Use(csrfHandler)
+	// Follow RESTful schema
+	{
+		registryWebAPI.GET("/namespaces", listNamespaces)
+		registryWebAPI.OPTIONS("/namespaces", web_ui.AuthHandler, getNamespaceRegFields)
+		registryWebAPI.POST("/namespaces", web_ui.AuthHandler, func(ctx *gin.Context) {
+			createUpdateNamespace(ctx, false)
+		})
+
+		registryWebAPI.GET("/namespaces/user", web_ui.AuthHandler, listNamespacesForUser)
+
+		registryWebAPI.GET("/namespaces/:id", web_ui.AuthHandler, getNamespace)
+		registryWebAPI.PUT("/namespaces/:id", web_ui.AuthHandler, func(ctx *gin.Context) {
+			createUpdateNamespace(ctx, true)
+		})
+		registryWebAPI.GET("/namespaces/:id/pubkey", getNamespaceJWKS)
+		registryWebAPI.PATCH("/namespaces/:id/approve", web_ui.AuthHandler, web_ui.AdminAuthHandler, func(ctx *gin.Context) {
+			updateNamespaceStatus(ctx, Approved)
+		})
+		registryWebAPI.PATCH("/namespaces/:id/deny", web_ui.AuthHandler, web_ui.AdminAuthHandler, func(ctx *gin.Context) {
+			updateNamespaceStatus(ctx, Denied)
+		})
+	}
+	{
+		registryWebAPI.GET("/institutions", web_ui.AuthHandler, listInstitutions)
+	}
+	return nil
+}
+
+// Initialize institutions list
+func InitInstConfig(ctx context.Context, egrp *errgroup.Group) error {
+	institutions := []Institution{}
+	if err := param.Registry_Institutions.Unmarshal(&institutions); err != nil {
+		log.Error("Fail to read Registry.Institutions. Make sure you had the correct format", err)
+		return errors.Wrap(err, "Fail to read Registry.Institutions. Make sure you had the correct format")
+	}
+
+	if param.Registry_InstitutionsUrl.GetString() != "" {
+		// Read from Registry.Institutions if Registry.InstitutionsUrl is empty
+		// or Registry.Institutions and Registry.InstitutionsUrl are both set
+		if len(institutions) > 0 {
+			log.Warning("Registry.Institutions and Registry.InstitutionsUrl are both set. Registry.InstitutionsUrl is ignored")
+			if !checkUniqueInstitutions(institutions) {
+				return errors.Errorf("Institution IDs read from config are not unique")
+			}
+			// return here so that we don't init the institution url cache
+			return nil
+		}
+
+		_, err := url.Parse(param.Registry_InstitutionsUrl.GetString())
+		if err != nil {
+			log.Error("Invalid Registry.InstitutionsUrl: ", err)
+			return errors.Wrap(err, "Invalid Registry.InstitutionsUrl")
+		}
+		instCacheTTL := param.Registry_InstitutionsUrlReloadMinutes.GetDuration()
+
+		institutionsCache = ttlcache.New[string, []Institution](ttlcache.WithTTL[string, []Institution](instCacheTTL))
+
+		go institutionsCache.Start()
+
+		egrp.Go(func() error {
+			<-ctx.Done()
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			log.Info("Gracefully stopping institution TTL cache eviction...")
+			if institutionsCache != nil {
+				institutionsCache.DeleteAll()
+				institutionsCache.Stop()
+			} else {
+				log.Info("Institution TTL cache is nil, stop clean up process.")
+			}
+			return nil
+		})
+
+		// Try to populate the cache at the server start. If error occured, it's non-blocking
+		cachedInsts, intErr, _ := getCachedInstitutions()
+		if intErr != nil {
+			log.Warning("Failed to populate institution cache. Error: ", intErr)
+		} else {
+			if !checkUniqueInstitutions(cachedInsts) {
+				return errors.Errorf("Institution IDs read from config are not unique")
+			}
+			log.Infof("Successfully populated institution TTL cache with %d entries", len(institutionsCache.Get(institutionsCache.Keys()[0]).Value()))
+		}
+	}
+
+	if !checkUniqueInstitutions(institutions) {
+		return errors.Errorf("Institution IDs read from config are not unique")
+	}
+	// Else we will read from Registry.Institutions. No extra action needed.
+	return nil
+}
diff --git a/registry/registry_ui_test.go b/registry/registry_ui_test.go
new file mode 100644
index 000000000..f8db61a38
--- /dev/null
+++ b/registry/registry_ui_test.go
@@ -0,0 +1,589 @@
+package registry
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jellydator/ttlcache/v3"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+// Mock wrong data fields for Institution
+type mockBadInstitutionFormat struct {
+	RORID string `yaml:"ror_id"`
+	Inst  string `yaml:"institution"`
+}
+
+func GenerateMockJWKS() (string, error) {
+	// Create a private key to use for the test
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return "", errors.Wrap(err, "Error generating private key")
+	}
+
+	// Convert from raw ecdsa to jwk.Key
+	pKey, err := jwk.FromRaw(privateKey)
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to convert ecdsa.PrivateKey to jwk.Key")
+	}
+
+	//Assign Key id to the private key
+	err = jwk.AssignKeyID(pKey)
+	if err != nil {
+		return "", errors.Wrap(err, "Error assigning kid to private key")
+	}
+
+	//Set an algorithm for the key
+	err = pKey.Set(jwk.AlgorithmKey, jwa.ES256)
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to set algorithm for pKey")
+	}
+
+	publicKey, err := pKey.PublicKey()
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to get the public key from private key")
+	}
+
+	jwks := jwk.NewSet()
+	err = jwks.AddKey(publicKey)
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to add public key to the jwks")
+	}
+
+	jsonData, err := json.MarshalIndent(jwks, "", "  ")
+	if err != nil {
+		return "", errors.Wrap(err, "Unable to marshall the json into string")
+	}
+	// Append a new line to the JSON data
+	jsonData = append(jsonData, '\n')
+
+	return string(jsonData), nil
+}
+
+func TestListNamespaces(t *testing.T) {
+	_, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	// Initialize the mock database
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	router := gin.Default()
+
+	router.GET("/namespaces", listNamespaces)
+
+	tests := []struct {
+		description  string
+		serverType   string
+		expectedCode int
+		emptyDB      bool
+		notApproved  bool
+		expectedData []Namespace
+	}{
+		{
+			description:  "valid-request-with-empty-db",
+			serverType:   string(OriginType),
+			expectedCode: http.StatusOK,
+			emptyDB:      true,
+			expectedData: []Namespace{},
+		},
+		{
+			description:  "valid-request-with-origin-type",
+			serverType:   string(OriginType),
+			expectedCode: http.StatusOK,
+			expectedData: mockNssWithOrigins,
+		},
+		{
+			description:  "valid-request-with-cache-type",
+			serverType:   string(CacheType),
+			expectedCode: http.StatusOK,
+			expectedData: mockNssWithCaches,
+		},
+		{
+			description:  "valid-request-without-type",
+			serverType:   "",
+			expectedCode: http.StatusOK,
+			expectedData: mockNssWithMixed,
+		},
+		{
+			description:  "unauthed-not-approved-without-type-returns-empty",
+			serverType:   "",
+			expectedCode: http.StatusOK,
+			expectedData: []Namespace{},
+			notApproved:  true,
+		},
+		{
+			description:  "invalid-request-parameters",
+			serverType:   "random_type", // some invalid query string
+			expectedCode: http.StatusBadRequest,
+			expectedData: nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			if !tc.emptyDB {
+				if tc.notApproved {
+					err := insertMockDBData(mockNssWithMixedNotApproved)
+					if err != nil {
+						t.Fatalf("Failed to set up mock data: %v", err)
+					}
+				} else {
+					err := insertMockDBData(mockNssWithMixed)
+					if err != nil {
+						t.Fatalf("Failed to set up mock data: %v", err)
+					}
+				}
+			}
+			defer func() {
+				resetNamespaceDB(t)
+			}()
+
+			// Create a request to the endpoint
+			w := httptest.NewRecorder()
+			requestURL := ""
+			if tc.serverType != "" {
+				requestURL = "/namespaces?server_type=" + tc.serverType
+			} else {
+				requestURL = "/namespaces"
+			}
+			req, _ := http.NewRequest("GET", requestURL, nil)
+			router.ServeHTTP(w, req)
+
+			// Check the response
+			assert.Equal(t, tc.expectedCode, w.Code)
+
+			if tc.expectedCode == http.StatusOK {
+				var got []Namespace
+				err := json.Unmarshal(w.Body.Bytes(), &got)
+				if err != nil {
+					t.Fatalf("Failed to unmarshal response body: %v", err)
+				}
+				assert.True(t, compareNamespaces(tc.expectedData, got, true), "Response data does not match expected")
+			}
+		})
+	}
+}
+
+func TestGetNamespaceJWKS(t *testing.T) {
+	_, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	mockPublicKey, err := GenerateMockJWKS()
+	if err != nil {
+		t.Fatalf("Failed to set up mock public key: %v", err)
+	}
+	// Initialize the mock database
+	setupMockRegistryDB(t)
+	defer teardownMockNamespaceDB(t)
+
+	router := gin.Default()
+
+	router.GET("/test/:id/pubkey", getNamespaceJWKS)
+
+	tests := []struct {
+		description  string
+		requestId    string
+		expectedCode int
+		emptyDB      bool
+		expectedData string
+	}{
+		{
+			description:  "valid-request-with-empty-key",
+			requestId:    "1",
+			expectedCode: http.StatusOK,
+			expectedData: mockPublicKey,
+		},
+		{
+			description:  "invalid-request-with-str-id",
+			requestId:    "crazy-id",
+			expectedCode: http.StatusBadRequest,
+			expectedData: "",
+		},
+		{
+			description:  "invalid-request-with-0-id",
+			requestId:    "0",
+			expectedCode: http.StatusBadRequest,
+		},
+		{
+			description:  "invalid-request-with-neg-id",
+			requestId:    "-10000",
+			expectedCode: http.StatusBadRequest,
+		},
+		{
+			description:  "invalid-request-with-empty-id",
+			requestId:    "",
+			expectedCode: http.StatusBadRequest,
+		},
+		{
+			description:  "invalid-request-with-id-not-found",
+			requestId:    "100",
+			expectedCode: http.StatusNotFound,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			if !tc.emptyDB {
+				err := insertMockDBData([]Namespace{
+					{
+						ID:     1,
+						Prefix: "/origin1",
+						Pubkey: mockPublicKey,
+					},
+				})
+				if err != nil {
+					t.Fatalf("Failed to set up mock data: %v", err)
+				}
+
+			}
+			defer resetNamespaceDB(t)
+
+			// Create a request to the endpoint
+			w := httptest.NewRecorder()
+			requestURL := fmt.Sprint("/test/", tc.requestId, "/pubkey")
+			req, _ := http.NewRequest("GET", requestURL, nil)
+			router.ServeHTTP(w, req)
+
+			// Check the response
+			require.Equal(t, tc.expectedCode, w.Code)
+
+			if tc.expectedCode == http.StatusOK {
+				assert.Equal(t, tc.expectedData, w.Body.String())
+			}
+		})
+	}
+}
+
+func TestPopulateRegistrationFields(t *testing.T) {
+	result := populateRegistrationFields("", Namespace{})
+	assert.NotEqual(t, 0, len(result))
+}
+
+func TestGetCachedInstitutions(t *testing.T) {
+	t.Run("nil-cache-returns-error", func(t *testing.T) {
+		institutionsCache = nil
+
+		_, intErr, extErr := getCachedInstitutions()
+		assert.Error(t, intErr)
+		assert.Error(t, extErr)
+		assert.Equal(t, "institutionsCache isn't initialized", intErr.Error())
+	})
+
+	t.Run("unset-config-val-returns-error", func(t *testing.T) {
+		viper.Reset()
+		institutionsCache = ttlcache.New[string, []Institution]()
+		_, intErr, extErr := getCachedInstitutions()
+		assert.Error(t, intErr)
+		assert.Error(t, extErr)
+		assert.Contains(t, intErr.Error(), "Registry.InstitutionsUrl is unset")
+	})
+
+	t.Run("random-config-val-returns-error", func(t *testing.T) {
+		viper.Reset()
+		viper.Set("Registry.InstitutionsUrl", "random-url")
+		institutionsCache = ttlcache.New[string, []Institution]()
+		_, intErr, extErr := getCachedInstitutions()
+		assert.Error(t, intErr)
+		assert.Error(t, extErr)
+		// See url.URL for why it won't return error
+		assert.Contains(t, intErr.Error(), "Error response when fetching institution list")
+	})
+
+	t.Run("cache-hit-with-invalid-ns-returns-error", func(t *testing.T) {
+		viper.Reset()
+		mockUrl := url.URL{Scheme: "https", Host: "example.com"}
+		viper.Set("Registry.InstitutionsUrl", mockUrl.String())
+		institutionsCache = ttlcache.New[string, []Institution]()
+
+		func() {
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			institutionsCache.Set(mockUrl.String(), nil, ttlcache.NoTTL)
+		}()
+
+		_, intErr, extErr := getCachedInstitutions()
+		require.Error(t, intErr)
+		require.Error(t, extErr)
+		assert.Contains(t, intErr.Error(), "value is nil from key")
+
+		func() {
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			institutionsCache.DeleteAll()
+		}()
+	})
+
+	t.Run("cache-hit-with-valid-ns", func(t *testing.T) {
+		viper.Reset()
+		mockUrl := url.URL{Scheme: "https", Host: "example.com"}
+		viper.Set("Registry.InstitutionsUrl", mockUrl.String())
+		institutionsCache = ttlcache.New[string, []Institution]()
+		mockInsts := []Institution{{Name: "Foo", ID: "001"}}
+
+		func() {
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			institutionsCache.Set(mockUrl.String(), mockInsts, ttlcache.NoTTL)
+		}()
+
+		getInsts, intErr, extErr := getCachedInstitutions()
+		require.NoError(t, intErr)
+		require.NoError(t, extErr)
+		assert.Equal(t, mockInsts, getInsts)
+
+		func() {
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			institutionsCache.DeleteAll()
+		}()
+	})
+
+	t.Run("cache-miss-with-success-fetch", func(t *testing.T) {
+		viper.Reset()
+		logrus.SetLevel(logrus.InfoLevel)
+		hook := test.NewGlobal()
+		defer hook.Reset()
+
+		// This is dangerous as we rely on external API to decide if the test succeeds,
+		// but this is the one way to test with our custom http client
+		viper.Set("Registry.InstitutionsUrl", "https://topology.opensciencegrid.org/institution_ids")
+		institutionsCache = ttlcache.New[string, []Institution]()
+
+		getInsts, intErr, extErr := getCachedInstitutions()
+		require.NoError(t, intErr)
+		require.NoError(t, extErr)
+		assert.Greater(t, len(getInsts), 0)
+		assert.Equal(t, 1, len(hook.Entries))
+		assert.Contains(t, hook.LastEntry().Message, "Cache miss for institutions TTL cache")
+
+		func() {
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			institutionsCache.DeleteAll()
+		}()
+	})
+
+	t.Run("cache-hit-with-two-success-fetch", func(t *testing.T) {
+		viper.Reset()
+		logrus.SetLevel(logrus.InfoLevel)
+		hook := test.NewGlobal()
+		defer hook.Reset()
+
+		// This is dangerous as we rely on external API to decide if the test succeeds,
+		// but this is the one way to test with our custom http client
+		viper.Set("Registry.InstitutionsUrl", "https://topology.opensciencegrid.org/institution_ids")
+		institutionsCache = ttlcache.New[string, []Institution]()
+
+		getInsts, intErr, extErr := getCachedInstitutions()
+		require.NoError(t, intErr)
+		require.NoError(t, extErr)
+		assert.Greater(t, len(getInsts), 0)
+		assert.Equal(t, 1, len(hook.Entries))
+		assert.Contains(t, hook.LastEntry().Message, "Cache miss for institutions TTL cache")
+
+		hook.Reset()
+
+		getInsts2, intErr, extErr := getCachedInstitutions()
+		require.NoError(t, intErr)
+		require.NoError(t, extErr)
+		assert.Greater(t, len(getInsts2), 0)
+		assert.Equal(t, getInsts, getInsts2)
+		// No cache miss
+		assert.Equal(t, 0, len(hook.Entries))
+
+		func() {
+			institutionsCacheMutex.Lock()
+			defer institutionsCacheMutex.Unlock()
+			institutionsCache.DeleteAll()
+		}()
+	})
+}
+
+func TestCheckUniqueInstitutions(t *testing.T) {
+	t.Run("empty-gives-true", func(t *testing.T) {
+		unique := checkUniqueInstitutions([]Institution{})
+		assert.True(t, unique)
+	})
+
+	t.Run("unique-gives-true", func(t *testing.T) {
+		unique := checkUniqueInstitutions([]Institution{{ID: "1"}, {ID: "2"}})
+		assert.True(t, unique)
+	})
+
+	t.Run("duplicated-gives-false", func(t *testing.T) {
+		unique := checkUniqueInstitutions([]Institution{{ID: "1"}, {ID: "1"}})
+		assert.False(t, unique)
+	})
+
+	t.Run("large-entries", func(t *testing.T) {
+		unique := checkUniqueInstitutions([]Institution{
+			{ID: "1"}, {ID: "2"}, {ID: "3"}, {ID: "4"}, {ID: "1"},
+		})
+		assert.False(t, unique)
+	})
+}
+
+func TestInitInstConfig(t *testing.T) {
+	institutionsCache = ttlcache.New[string, []Institution]()
+	t.Run("wrong-inst-config-returns-error", func(t *testing.T) {
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+		viper.Reset()
+		mockWrongInst := []mockBadInstitutionFormat{{RORID: "mockID", Inst: "mockInst"}}
+		// YAML is also incorrect format, viper is expecting mapstructure
+		mockWrongInstByte, err := yaml.Marshal(mockWrongInst)
+		require.NoError(t, err)
+		viper.Set("Registry.Institutions", mockWrongInstByte)
+		err = InitInstConfig(ctx, egrp)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "Fail to read Registry.Institutions.")
+	})
+
+	t.Run("valid-inst-config-with-dup-ids-returns-err", func(t *testing.T) {
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+		viper.Reset()
+		mockMap := make(map[string]string)
+		mockMap["ID"] = "mockID"
+		mockMap["Name"] = "mockName"
+		viper.Set("Registry.Institutions", []map[string]string{mockMap, mockMap})
+		err := InitInstConfig(ctx, egrp)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "Institution IDs read from config are not unique")
+	})
+
+	t.Run("valid-inst-config-with-unique-ids", func(t *testing.T) {
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+		viper.Reset()
+		mockMap1 := make(map[string]string)
+		mockMap1["ID"] = "mockID"
+		mockMap1["Name"] = "mockName"
+		mockMap2 := make(map[string]string)
+		mockMap2["ID"] = "mockID2"
+		mockMap2["Name"] = "mockName"
+		viper.Set("Registry.Institutions", []map[string]string{mockMap1, mockMap2})
+		err := InitInstConfig(ctx, egrp)
+		require.NoError(t, err)
+	})
+
+	t.Run("config-val-url-both-set-gives-config", func(t *testing.T) {
+		institutionsCache = nil
+		defer func() {
+			institutionsCache = ttlcache.New[string, []Institution]()
+		}()
+
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+
+		viper.Reset()
+		logrus.SetLevel(logrus.InfoLevel)
+		hook := test.NewGlobal()
+		defer hook.Reset()
+
+		mockMap1 := make(map[string]string)
+		mockMap1["ID"] = "mockID"
+		mockMap1["Name"] = "mockName"
+		mockMap2 := make(map[string]string)
+		mockMap2["ID"] = "mockID2"
+		mockMap2["Name"] = "mockName"
+		viper.Set("Registry.Institutions", []map[string]string{mockMap1, mockMap2})
+		viper.Set("Registry.InstitutionsUrl", "https://example.com")
+		err := InitInstConfig(ctx, egrp)
+		require.NoError(t, err)
+		// This means we didn't config ttl cache
+		require.Nil(t, institutionsCache)
+		require.Equal(t, 1, len(hook.Entries))
+		assert.Equal(t, "Registry.Institutions and Registry.InstitutionsUrl are both set. Registry.InstitutionsUrl is ignored", hook.LastEntry().Message)
+	})
+
+	t.Run("valid-inst-config-with-dup-ids-and-url-returns-err", func(t *testing.T) {
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+		viper.Reset()
+		mockMap := make(map[string]string)
+		mockMap["ID"] = "mockID"
+		mockMap["Name"] = "mockName"
+		viper.Set("Registry.Institutions", []map[string]string{mockMap, mockMap})
+		viper.Set("Registry.InstitutionsUrl", "https://example.com")
+		err := InitInstConfig(ctx, egrp)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "Institution IDs read from config are not unique")
+	})
+
+	t.Run("only-url-set-with-invalid-data-is-non-blocking", func(t *testing.T) {
+		institutionsCache = nil
+		defer func() {
+			institutionsCache = ttlcache.New[string, []Institution]()
+		}()
+
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+
+		viper.Reset()
+		logrus.SetLevel(logrus.WarnLevel)
+		hook := test.NewGlobal()
+		defer hook.Reset()
+
+		// Invalid URL
+		viper.Set("Registry.InstitutionsUrl", "https://example.com")
+		err := InitInstConfig(ctx, egrp)
+		// No error should return, this is non-blcoking
+		require.NoError(t, err)
+		require.Equal(t, 1, len(hook.Entries))
+		assert.Contains(t, hook.LastEntry().Message, "Failed to populate institution cache.")
+		assert.NotNil(t, institutionsCache)
+	})
+
+	t.Run("only-url-set-with-valid-data", func(t *testing.T) {
+		institutionsCache = nil
+		defer func() {
+			institutionsCache = ttlcache.New[string, []Institution]()
+		}()
+		ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+		defer func() { require.NoError(t, egrp.Wait()) }()
+		defer cancel()
+
+		viper.Reset()
+		logrus.SetLevel(logrus.InfoLevel)
+		hook := test.NewGlobal()
+		defer hook.Reset()
+
+		// Valid URL, Although very dangerous to do so
+		viper.Set("Registry.InstitutionsUrl", "https://topology.opensciencegrid.org/institution_ids")
+		err := InitInstConfig(ctx, egrp)
+		// No error should return, this is non-blcoking
+		require.NoError(t, err)
+		require.GreaterOrEqual(t, len(hook.Entries), 1)
+		assert.Contains(t, hook.LastEntry().Message, "Successfully populated institution TTL cache")
+		assert.NotNil(t, institutionsCache)
+		assert.GreaterOrEqual(t, institutionsCache.Len(), 1)
+	})
+}
diff --git a/registry/registry_validation.go b/registry/registry_validation.go
new file mode 100644
index 000000000..bf1fb46b3
--- /dev/null
+++ b/registry/registry_validation.go
@@ -0,0 +1,171 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package registry
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+// This file has all custom validator logic for registry struct
+// data validation besides the ones already included in validator package
+
+func validatePrefix(nspath string) (string, error) {
+	if len(nspath) == 0 {
+		return "", errors.New("Path prefix may not be empty")
+	}
+	if nspath[0] != '/' {
+		return "", errors.New("Path prefix must be absolute - relative paths are not allowed")
+	}
+	components := strings.Split(nspath, "/")[1:]
+	if len(components) == 0 {
+		return "", errors.New("Cannot register the prefix '/' for an origin")
+	} else if components[0] == "api" {
+		return "", errors.New("Cannot register a prefix starting with '/api'")
+	} else if components[0] == "view" {
+		return "", errors.New("Cannot register a prefix starting with '/view'")
+	} else if components[0] == "pelican" {
+		return "", errors.New("Cannot register a prefix starting with '/pelican'")
+	}
+	result := ""
+	for _, component := range components {
+		if len(component) == 0 {
+			continue
+		} else if component == "." {
+			return "", errors.New("Path component cannot be '.'")
+		} else if component == ".." {
+			return "", errors.New("Path component cannot be '..'")
+		} else if component[0] == '.' {
+			return "", errors.New("Path component cannot begin with a '.'")
+		}
+		result += "/" + component
+	}
+	if result == "/" || len(result) == 0 {
+		return "", errors.New("Cannot register the prefix '/' for an origin")
+	}
+
+	return result, nil
+}
+
+func validateKeyChaining(prefix string, pubkey jwk.Key) (validationError error, serverError error) {
+	if param.Registry_RequireKeyChaining.GetBool() {
+		superspaces, subspaces, inTopo, err := namespaceSupSubChecks(prefix)
+		if err != nil {
+			serverError = errors.Wrap(err, "Server encountered an error checking if namespace already exists")
+			return
+		}
+
+		// if not in OSDF mode, this will be false
+		if inTopo {
+			validationError = errors.New("Cannot register a super or subspace of a namespace already registered in topology")
+			return
+		}
+		// If we make the assumption that namespace prefixes are hierarchical, eg that the owner of /foo should own
+		// everything under /foo (/foo/bar, /foo/baz, etc), then it makes sense to check for superspaces first. If any
+		// superspace is found, they logically "own" the incoming namespace.
+		if len(superspaces) > 0 {
+			// If this is the case, we want to make sure that at least one of the superspaces has the
+			// same registration key as the incoming. This guarantees the owner of the superspace is
+			// permitting the action (assuming their keys haven't been stolen!)
+			matched, err := matchKeys(pubkey, superspaces)
+			if err != nil {
+				serverError = errors.Errorf("%v: Unable to check if the incoming key for %s matched any public keys for %s", err, prefix, subspaces)
+				return
+			}
+			if !matched {
+				validationError = errors.New("Cannot register a namespace that is suffixed or prefixed by an already-registered namespace unless the incoming public key matches a registered key")
+				return
+			}
+
+		} else if len(subspaces) > 0 {
+			// If there are no superspaces, we can check the subspaces.
+
+			// TODO: Eventually we might want to check only the highest level subspaces and use those keys for matching. For example,
+			// if /foo/bar and /foo/bar/baz are registered with two keysets such that the complement of their intersections is not null,
+			// it may be the case that the only key we match against belongs to /foo/bar/baz. If we go ahead with registration at that
+			// point, we're essentially saying /foo/bar/baz, the logical subspace of /foo/bar, has authorized a superspace for both.
+			// More interestingly, if /foo/bar and /foo/baz are both registered, should they both be consulted before adding /foo?
+
+			// For now, we'll just check for any key match.
+			matched, err := matchKeys(pubkey, subspaces)
+			if err != nil {
+				serverError = errors.Errorf("%v: Unable to check if the incoming key for %s matched any public keys for %s", err, prefix, subspaces)
+				return
+			}
+			if !matched {
+				validationError = errors.New("Cannot register a namespace that is suffixed or prefixed by an already-registered namespace unless the incoming public key matches a registered key")
+				return
+			}
+		}
+	}
+	return
+}
+
+func validateJwks(jwksStr string) (jwk.Key, error) {
+	clientJwks, err := jwk.ParseString(jwksStr)
+	if err != nil {
+		return nil, errors.Wrap(err, "Couldn't parse the pubkey from the request")
+	}
+
+	if log.IsLevelEnabled(log.DebugLevel) {
+		// Let's check that we can convert to JSON and get the right thing...
+		jsonbuf, err := json.Marshal(clientJwks)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to marshal the reuqest pubKey's keyset into JSON")
+		}
+		log.Debugln("Client JWKS as seen by the registry server:", string(jsonbuf))
+	}
+
+	/*
+	 * TODO: This section makes the assumption that the incoming jwks only contains a single
+	 *       key, a property that is enforced by the client at the origin. Eventually we need
+	 *       to support the addition of other keys in the jwks stored for the origin. There is
+	 *       a similar TODO listed in client_commands.go, as the choices made there mirror the
+	 *       choices made here.
+	 */
+	key, exists := clientJwks.Key(0)
+	if !exists {
+		return nil, errors.New("There was no key at index 0 in the reuqest pubKey's JWKS. Something is wrong")
+	}
+	return key, nil
+}
+
+// Validates if the instID, the id of the institution, matches the provided Registy.Institutions items.
+func validateInstitution(instID string) (bool, error) {
+	institutions := []Institution{}
+	if err := param.Registry_Institutions.Unmarshal(&institutions); err != nil {
+		return false, err
+	}
+	// We don't check if config was populated
+	if len(institutions) == 0 {
+		return true, nil
+	}
+	for _, availableInst := range institutions {
+		// We required full equality, as we expect the value is from the institution API
+		if instID == availableInst.ID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/server_ui/advertise.go b/server_ui/advertise.go
new file mode 100644
index 000000000..38c4b5afc
--- /dev/null
+++ b/server_ui/advertise.go
@@ -0,0 +1,160 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package server_ui
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+type directorResponse struct {
+	Error string `json:"error"`
+}
+
+func LaunchPeriodicAdvertise(ctx context.Context, egrp *errgroup.Group, servers []server_utils.XRootDServer) error {
+	ticker := time.NewTicker(1 * time.Minute)
+	egrp.Go(func() error {
+		log.Debugf("About to advertise %d XRootD servers", len(servers))
+		err := Advertise(ctx, servers)
+		if err != nil {
+			log.Warningln("XRootD server advertise failed:", err)
+			metrics.SetComponentHealthStatus(metrics.OriginCache_Federation, metrics.StatusCritical, fmt.Sprintf("XRootD server advertise failed: %v", err))
+		} else {
+			metrics.SetComponentHealthStatus(metrics.OriginCache_Federation, metrics.StatusOK, "")
+		}
+
+		for {
+			select {
+			case <-ticker.C:
+				err := Advertise(ctx, servers)
+				if err != nil {
+					log.Warningln("XRootD server advertise failed:", err)
+					metrics.SetComponentHealthStatus(metrics.OriginCache_Federation, metrics.StatusCritical, fmt.Sprintf("XRootD server advertise failed: %v", err))
+				} else {
+					metrics.SetComponentHealthStatus(metrics.OriginCache_Federation, metrics.StatusOK, "")
+				}
+			case <-ctx.Done():
+				log.Infoln("Periodic advertisement loop has been terminated")
+				return nil
+			}
+		}
+	})
+
+	return nil
+}
+
+func Advertise(ctx context.Context, servers []server_utils.XRootDServer) error {
+	var firstErr error
+	for _, server := range servers {
+		err := advertiseInternal(ctx, server)
+		if firstErr == nil {
+			firstErr = err
+		}
+	}
+	return firstErr
+}
+
+func advertiseInternal(ctx context.Context, server server_utils.XRootDServer) error {
+	name := param.Xrootd_Sitename.GetString()
+	if name == "" {
+		return errors.New(fmt.Sprintf("%s name isn't set", server.GetServerType()))
+	}
+
+	originUrl := param.Origin_Url.GetString()
+	originWebUrl := param.Server_ExternalWebUrl.GetString()
+
+	ad, err := server.CreateAdvertisement(name, originUrl, originWebUrl)
+	if err != nil {
+		return err
+	}
+
+	body, err := json.Marshal(ad)
+	if err != nil {
+		return errors.Wrap(err, fmt.Sprintf("Failed to generate JSON description of %s", server.GetServerType()))
+	}
+
+	directorUrlStr := param.Federation_DirectorUrl.GetString()
+	if directorUrlStr == "" {
+		return errors.New("Director endpoint URL is not known")
+	}
+	directorUrl, err := url.Parse(directorUrlStr)
+	if err != nil {
+		return errors.Wrap(err, "Failed to parse Federation.DirectorURL")
+	}
+
+	directorUrl.Path = "/api/v1.0/director/register" + server.GetServerType().String()
+
+	prefix := param.Origin_NamespacePrefix.GetString()
+
+	token, err := director.CreateAdvertiseToken(prefix)
+	if err != nil {
+		return errors.Wrap(err, "Failed to generate advertise token")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", directorUrl.String(), bytes.NewBuffer(body))
+	if err != nil {
+		return errors.Wrap(err, "Failed to create POST request for director registration")
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+token)
+	userAgent := "pelican-" + strings.ToLower(server.GetServerType().String()) + "/" + config.PelicanVersion
+	req.Header.Set("User-Agent", userAgent)
+
+	// We should switch this over to use the common transport, but for that to happen
+	// that function needs to be exported from pelican
+	tr := config.GetTransport()
+	client := http.Client{Transport: tr}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return errors.Wrap(err, "Failed to start request for director registration")
+	}
+	defer resp.Body.Close()
+
+	body, _ = io.ReadAll(resp.Body)
+	if resp.StatusCode > 299 {
+		var respErr directorResponse
+		if unmarshalErr := json.Unmarshal(body, &respErr); unmarshalErr != nil { // Error creating json
+			return errors.Wrapf(unmarshalErr, "Could not unmarshall the director's response, which responded %v from director registration: %v", resp.StatusCode, resp.Status)
+		}
+		if resp.StatusCode == http.StatusForbidden {
+			return errors.Errorf("Error during director advertisement: Cache has not been approved by administrator.")
+		}
+		return errors.Errorf("Error during director registration: %v\n", respErr.Error)
+	}
+
+	return nil
+}
diff --git a/server_ui/register_namespace.go b/server_ui/register_namespace.go
new file mode 100644
index 000000000..99239c7dd
--- /dev/null
+++ b/server_ui/register_namespace.go
@@ -0,0 +1,307 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package server_ui
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/registry"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+type (
+	keyStatus int
+)
+
+type checkNamespaceExistsReq struct {
+	Prefix string `json:"prefix"`
+	PubKey string `json:"pubkey"` // Pass a JWK
+}
+
+type checkNamespaceExistsRes struct {
+	PrefixExists bool   `json:"prefix_exists"`
+	KeyMatch     bool   `json:"key_match"`
+	Message      string `json:"message"`
+	Error        string `json:"error"`
+}
+
+const (
+	noKeyPresent keyStatus = iota
+	keyMismatch
+	keyMatch
+)
+
+// Check if a namespace private JWK with namespace prefix from the origin is registered at the given registry.
+//
+// registryUrlStr is the URL with base path to the registry's API. For Pelican registry,
+// this should be https://<registry-host>/api/v1.0/registry
+//
+// If the prefix is not found in the registry, it returns noKeyPresent with error == nil
+// If the prefix is found, but the public key of the private key doesn't match what's in the registry,
+// it will return keyMismatch with error == nil. Otherwise, it returns keyMatch
+//
+// Note that this function will first send a POST request to /api/v1.0/registry/checkNamespaceExists,
+// which is the current Pelican registry endpoint. However, OSDF registry and Pelican registry < v7.4.0 doesn't
+// have this endpoint, so if calling it returns 404, we will then check using /api/v1.0/registry/<prefix>/.well-known/issuer.jwks,
+// which should always give the jwks if it exists.
+func keyIsRegistered(privkey jwk.Key, registryUrlStr string, prefix string) (keyStatus, error) {
+	registryUrl, err := url.Parse(registryUrlStr)
+	if err != nil {
+		return noKeyPresent, errors.Wrap(err, "Error parsing registryUrlStr")
+	}
+	keyId := privkey.KeyID()
+	if keyId == "" {
+		return noKeyPresent, errors.New("Provided key is missing a key ID")
+	}
+	key, err := privkey.PublicKey()
+	if err != nil {
+		return noKeyPresent, err
+	}
+
+	// We first check against Pelican's registry at /api/v1.0/registry/checkNamespaceExists
+	// so that the registry won't give out the public key
+	pelicanReqURL := registryUrl.JoinPath("/checkNamespaceExists")
+	pubkeyStr, err := json.Marshal(key)
+	if err != nil {
+		return noKeyPresent, err
+	}
+
+	keyCheckReq := checkNamespaceExistsReq{Prefix: prefix, PubKey: string(pubkeyStr)}
+	jsonData, err := json.Marshal(keyCheckReq)
+	if err != nil {
+		return noKeyPresent, errors.Wrap(err, "Error marshalling request to json string")
+	}
+
+	req, err := http.NewRequest("POST", pelicanReqURL.String(), bytes.NewBuffer(jsonData))
+
+	if err != nil {
+		return noKeyPresent, err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	tr := config.GetTransport()
+	client := &http.Client{Transport: tr}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return noKeyPresent, err
+	}
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+
+	// For Pelican's registry at /api/v1.0/registry/checkNamespaceExists, it only returns 200, 400, and 500.
+	// If it returns 404, that means we are not hitting Pelican's registry but OSDF's registry or Pelican registry < v7.4.0
+	if resp.StatusCode != http.StatusNotFound {
+		resData := checkNamespaceExistsRes{}
+		if err := json.Unmarshal(body, &resData); err != nil {
+			log.Warningln("Failed to unmarshal error message response from namespace registry", err)
+		}
+		switch resp.StatusCode {
+		case http.StatusInternalServerError:
+			return noKeyPresent, errors.Errorf("Failed to query registry for public key with server error (status code %v): %v", resp.StatusCode, resData.Error)
+		case http.StatusBadRequest:
+			return noKeyPresent, errors.Errorf("Failed to query registry for public key with a bad request (status code %v): %v", resp.StatusCode, resData.Error)
+		case http.StatusOK:
+			if !resData.PrefixExists {
+				return noKeyPresent, nil
+			}
+			if !resData.KeyMatch {
+				return keyMismatch, nil
+			} else {
+				return keyMatch, nil
+			}
+		default:
+			return noKeyPresent, errors.Errorf("Failed to query registry for public key with unknown server response (status code %v)", resp.StatusCode)
+		}
+	}
+
+	// In this case, we got 404 from the first request, so we will try to check against legacy OSDF endpoint at
+	// "/api/v1.0/registry/<prefix>/.well-known/issuer.jwks"
+	log.Warningf("Getting 404 from checking if key is registered at: %s Fall back to check issuer.jwks", pelicanReqURL.String())
+
+	OSDFReqUrl := registryUrl.JoinPath(prefix, ".well-known", "issuer.jwks")
+
+	OSDFReq, err := http.NewRequest("GET", OSDFReqUrl.String(), nil)
+
+	if err != nil {
+		return noKeyPresent, err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	OSDFResp, err := client.Do(OSDFReq)
+	if err != nil {
+		return noKeyPresent, err
+	}
+	defer OSDFResp.Body.Close()
+
+	// Check HTTP response -- should be 200, else something went wrong
+	OSDFBody, _ := io.ReadAll(OSDFResp.Body)
+
+	// 404 is from Pelican issuer.jwks endpoint while 500 is from OSDF endpoint
+	if resp.StatusCode == 404 || resp.StatusCode == 500 {
+		return noKeyPresent, nil
+	} else if resp.StatusCode != 200 {
+		resData := checkNamespaceExistsRes{}
+		if err := json.Unmarshal(OSDFBody, &resData); err != nil {
+			log.Warningln("Failed to unmarshal error message response from namespace registry", err)
+		}
+		if resData.Error != "" {
+			return noKeyPresent, errors.Errorf("Failed to query registry for public key (status code %v): %v", resp.StatusCode, resData.Error)
+		} else {
+			return noKeyPresent, errors.Errorf("Failed to query registry for public key: status code %v", resp.StatusCode)
+		}
+	}
+
+	var ns *registry.Namespace
+	err = json.Unmarshal(OSDFBody, &ns)
+	if err != nil {
+		log.Error(fmt.Sprintf("Failed unmarshal namespace from response: %v, body: %v, response code: %v, URL: %v", err, OSDFBody, resp.StatusCode, registryUrl))
+		return noKeyPresent, errors.Errorf("Failed unmarshal namespace from response")
+	}
+
+	registrySet, err := jwk.ParseString(ns.Pubkey)
+	if err != nil {
+		log.Debugln("Failed to parse registry response:", string(OSDFBody))
+		return noKeyPresent, errors.Wrap(err, "Failed to parse registry response as a JWKS")
+	}
+
+	registryKey, isPresent := registrySet.LookupKeyID(keyId)
+	if !isPresent {
+		return keyMismatch, nil
+	} else if jwk.Equal(registryKey, key) {
+		return keyMatch, nil
+	} else {
+		return keyMismatch, nil
+	}
+}
+
+func registerNamespacePrep() (key jwk.Key, prefix string, registrationEndpointURL string, isRegistered bool, err error) {
+	// TODO: We eventually want to be able to export multiple prefixes; at that point, we'll
+	// refactor to loop around all the namespaces
+	prefix = param.Origin_NamespacePrefix.GetString()
+	if prefix == "" {
+		err = errors.New("Invalid empty prefix for registration")
+		return
+	}
+	if prefix[0] != '/' {
+		err = errors.New("Prefix specified for registration must start with a '/'")
+		return
+	}
+
+	namespaceEndpoint := param.Federation_RegistryUrl.GetString()
+	if namespaceEndpoint == "" {
+		err = errors.New("No namespace registry specified; try passing the `-f` flag specifying the federation name")
+		return
+	}
+
+	registrationEndpointURL, err = url.JoinPath(namespaceEndpoint, "api", "v1.0", "registry")
+	if err != nil {
+		err = errors.Wrap(err, "Failed to construct registration endpoint URL: %v")
+		return
+	}
+	key, err = config.GetIssuerPrivateJWK()
+	if err != nil {
+		err = errors.Wrap(err, "failed to load the origin's JWK")
+		return
+	}
+	if key.KeyID() == "" {
+		if err = jwk.AssignKeyID(key); err != nil {
+			err = errors.Wrap(err, "Error when generating a key ID for registration")
+			return
+		}
+	}
+	keyStatus, err := keyIsRegistered(key, registrationEndpointURL, prefix)
+	if err != nil {
+		err = errors.Wrap(err, "Failed to determine whether namespace is already registered")
+		return
+	}
+	switch keyStatus {
+	case keyMatch:
+		isRegistered = true
+		return
+	case keyMismatch:
+		err = errors.Errorf("Namespace %v already registered under a different key", prefix)
+		return
+	case noKeyPresent:
+		log.Infof("Namespace %v not registered; new registration will proceed\n", prefix)
+	}
+	return
+}
+
+func registerNamespaceImpl(key jwk.Key, prefix string, registrationEndpointURL string) error {
+	if err := registry.NamespaceRegister(key, registrationEndpointURL, "", prefix); err != nil {
+		return errors.Wrapf(err, "Failed to register prefix %s", prefix)
+	}
+	return nil
+}
+
+func RegisterNamespaceWithRetry(ctx context.Context, egrp *errgroup.Group) error {
+	metrics.SetComponentHealthStatus(metrics.OriginCache_Federation, metrics.StatusCritical, "Origin not registered with federation")
+	retryInterval := param.Server_RegistrationRetryInterval.GetDuration()
+	if retryInterval == 0 {
+		log.Warning("Server.RegistrationRetryInterval is 0. Fall back to 10s")
+		retryInterval = 10 * time.Second
+	}
+
+	key, prefix, url, isRegistered, err := registerNamespacePrep()
+	if err != nil {
+		return err
+	}
+	if isRegistered {
+		log.Debugf("Origin already has prefix %v registered\n", prefix)
+		return nil
+	}
+
+	if err = registerNamespaceImpl(key, prefix, url); err == nil {
+		return nil
+	}
+	log.Errorf("Failed to register with namespace service: %v; will automatically retry in 10 seconds\n", err)
+
+	egrp.Go(func() error {
+		ticker := time.NewTicker(retryInterval)
+		for {
+			select {
+			case <-ticker.C:
+				if err := registerNamespaceImpl(key, prefix, url); err == nil {
+					return nil
+				}
+				log.Errorf("Failed to register with namespace service: %v; will automatically retry in 10 seconds\n", err)
+			case <-ctx.Done():
+				return nil
+			}
+		}
+	})
+	return nil
+}
diff --git a/server_ui/register_namespace_test.go b/server_ui/register_namespace_test.go
new file mode 100644
index 000000000..06e15c5b3
--- /dev/null
+++ b/server_ui/register_namespace_test.go
@@ -0,0 +1,163 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package server_ui
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/registry"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type (
+	namespaceEntry struct {
+		ID            int    `json:"ID"`
+		Prefix        string `json:"Prefix"`
+		Pubkey        string `json:"Pubkey"`
+		Identity      string `json:"Identity"`
+		AdminMetadata string `json:"AdminMetadata"`
+	}
+)
+
+func TestRegistration(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	tempConfigDir := t.TempDir()
+	viper.Set("ConfigDir", tempConfigDir)
+
+	config.InitConfig()
+	viper.Set("Registry.DbLocation", filepath.Join(tempConfigDir, "test.sql"))
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+
+	err = registry.InitializeDB(ctx)
+	require.NoError(t, err)
+	defer func() {
+		err := registry.ShutdownDB()
+		assert.NoError(t, err)
+	}()
+
+	gin.SetMode(gin.TestMode)
+	engine := gin.Default()
+
+	// Ensure we have a issuer key
+	_, err = config.GetIssuerPublicJWKS()
+	require.NoError(t, err)
+	privKey, err := config.GetIssuerPrivateJWK()
+	require.NoError(t, err)
+	key, err := privKey.PublicKey()
+	require.NoError(t, err)
+	assert.NoError(t, jwk.AssignKeyID(key))
+	keyId := key.KeyID()
+	require.NotEmpty(t, keyId)
+
+	//Configure registry
+	registry.RegisterRegistryAPI(engine.Group("/"))
+
+	//Create a test HTTP server that sends requests to gin
+	svr := httptest.NewServer(engine)
+	defer svr.CloseClientConnections()
+	defer svr.Close()
+
+	viper.Set("Federation.RegistryUrl", svr.URL)
+	viper.Set("Origin.NamespacePrefix", "/test123")
+
+	// Test registration succeeds
+	key, prefix, registerURL, isRegistered, err := registerNamespacePrep()
+	require.NoError(t, err)
+	assert.False(t, isRegistered)
+	assert.Equal(t, registerURL, svr.URL+"/api/v1.0/registry")
+	assert.Equal(t, prefix, "/test123")
+	err = registerNamespaceImpl(key, prefix, registerURL)
+	require.NoError(t, err)
+
+	// Test we can query for the new key
+	req, err := http.NewRequest("GET", svr.URL+"/api/v1.0/registry", nil)
+	require.NoError(t, err)
+	req.Header.Set("Content-Type", "application/json")
+	tr := config.GetTransport()
+	client := &http.Client{Transport: tr}
+
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, 200, resp.StatusCode)
+
+	// Test new key is the same one we registered.
+	entries := []namespaceEntry{}
+	err = json.Unmarshal(body, &entries)
+	require.NoError(t, err)
+	require.Equal(t, len(entries), 1)
+	assert.Equal(t, entries[0].Prefix, "/test123")
+	keySet, err := jwk.Parse([]byte(entries[0].Pubkey))
+	require.NoError(t, err)
+	registryKey, isPresent := keySet.LookupKeyID(keyId)
+	assert.True(t, isPresent)
+	assert.True(t, jwk.Equal(registryKey, key))
+
+	// Test the functionality of the keyIsRegistered function
+	keyStatus, err := keyIsRegistered(key, svr.URL+"/api/v1.0/registry", "/test123")
+	assert.NoError(t, err)
+	require.Equal(t, keyStatus, keyMatch)
+
+	// Generate a new key, test we get mismatch
+	privKeyAltRaw, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	privKeyAlt, err := jwk.FromRaw(privKeyAltRaw)
+	require.NoError(t, err)
+	keyAlt, err := privKeyAlt.PublicKey()
+	require.NoError(t, err)
+	assert.NoError(t, jwk.AssignKeyID(keyAlt))
+	keyStatus, err = keyIsRegistered(keyAlt, svr.URL+"/api/v1.0/registry", "/test123")
+	assert.NoError(t, err)
+	assert.Equal(t, keyStatus, keyMismatch)
+
+	// Verify that no key is present for an alternate prefix
+	keyStatus, err = keyIsRegistered(key, svr.URL, "test456")
+	assert.NoError(t, err)
+	assert.Equal(t, keyStatus, noKeyPresent)
+
+	// Redo the namespace prep, ensure that isPresent is true
+	_, prefix, registerURL, isRegistered, err = registerNamespacePrep()
+	assert.Equal(t, svr.URL+"/api/v1.0/registry", registerURL)
+	assert.NoError(t, err)
+	assert.Equal(t, prefix, "/test123")
+	assert.True(t, isRegistered)
+}
diff --git a/server_ui/xrootd_servers.go b/server_ui/xrootd_servers.go
new file mode 100644
index 000000000..4ac32e557
--- /dev/null
+++ b/server_ui/xrootd_servers.go
@@ -0,0 +1,91 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package server_ui
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/xrootd"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+)
+
+func checkConfigFileReadable(fileName string, errMsg string) error {
+	if _, err := os.Open(fileName); errors.Is(err, os.ErrNotExist) {
+		return errors.New(fmt.Sprintf("%v: the specified path in the configuration (%v) "+
+			"does not exist", errMsg, fileName))
+	} else if err != nil {
+		return errors.New(fmt.Sprintf("%v; an error occurred when reading %v: %v", errMsg,
+			fileName, err.Error()))
+	}
+	return nil
+}
+
+func CheckDefaults(server server_utils.XRootDServer) error {
+	requiredConfigs := []param.StringParam{param.Server_TLSCertificate, param.Server_TLSKey, param.Xrootd_RunLocation, param.Xrootd_RobotsTxtFile}
+	for _, configName := range requiredConfigs {
+		mgr := configName.GetString()
+		if mgr == "" {
+			return errors.New(fmt.Sprintf("Required value of '%v' is not set in config",
+				configName))
+		}
+	}
+
+	if managerHost := param.Xrootd_ManagerHost.GetString(); managerHost == "" {
+		log.Debug("No manager host specified for the cmsd process in origin; assuming no xrootd protocol support")
+		viper.SetDefault("Origin.EnableCmsd", false)
+		metrics.DeleteComponentHealthStatus("cmsd")
+	} else {
+		viper.SetDefault("Origin.EnableCmsd", true)
+	}
+
+	// TODO: Could upgrade this to a check for a cert in the file...
+	if err := checkConfigFileReadable(param.Server_TLSCertificate.GetString(),
+		"A TLS certificate is required to serve HTTPS"); err != nil {
+		return err
+	}
+	if err := checkConfigFileReadable(param.Server_TLSKey.GetString(),
+		"A TLS key is required to serve HTTPS"); err != nil {
+		return err
+	}
+
+	if err := xrootd.CheckXrootdEnv(server); err != nil {
+		return err
+	}
+
+	// Check that OriginUrl is defined in the config file. Make sure it parses.
+	// Fail if either condition isn't met, although note that url.Parse doesn't
+	// generate errors for many things that are not recognizable urls.
+	originUrlStr := param.Origin_Url.GetString()
+	if originUrlStr == "" {
+		return errors.New("OriginUrl must be configured to serve an origin")
+	}
+
+	if _, err := url.Parse(originUrlStr); err != nil {
+		return errors.Wrapf(err, "Could not parse the provided OriginUrl (%v)", originUrlStr)
+	}
+
+	return nil
+}
diff --git a/server_utils/server_struct.go b/server_utils/server_struct.go
new file mode 100644
index 000000000..4343d2c6f
--- /dev/null
+++ b/server_utils/server_struct.go
@@ -0,0 +1,45 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package server_utils
+
+import (
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+)
+
+type (
+	XRootDServer interface {
+		GetServerType() config.ServerType
+		SetNamespaceAds([]director.NamespaceAd)
+		GetNamespaceAds() []director.NamespaceAd
+		CreateAdvertisement(name string, serverUrl string, serverWebUrl string) (director.OriginAdvertise, error)
+	}
+
+	NamespaceHolder struct {
+		namespaceAds []director.NamespaceAd
+	}
+)
+
+func (ns *NamespaceHolder) SetNamespaceAds(ads []director.NamespaceAd) {
+	ns.namespaceAds = ads
+}
+
+func (ns *NamespaceHolder) GetNamespaceAds() []director.NamespaceAd {
+	return ns.namespaceAds
+}
diff --git a/server_utils/server_utils.go b/server_utils/server_utils.go
new file mode 100644
index 000000000..a6d416ce7
--- /dev/null
+++ b/server_utils/server_utils.go
@@ -0,0 +1,176 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package server_utils
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"reflect"
+	"time"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+// Wait until given `reqUrl` returns a HTTP 200.
+// Logging messages emitted will refer to `server` (e.g., origin, cache, director)
+func WaitUntilWorking(ctx context.Context, method, reqUrl, server string, expectedStatus int) error {
+	expiry := time.Now().Add(10 * time.Second)
+	ctx, cancel := context.WithDeadline(ctx, expiry)
+	defer cancel()
+	ticker := time.NewTicker(50 * time.Millisecond)
+	success := false
+	logged := false
+	for !(success || time.Now().After(expiry)) {
+		select {
+		case <-ticker.C:
+			req, err := http.NewRequestWithContext(ctx, method, reqUrl, nil)
+			if err != nil {
+				return err
+			}
+			httpClient := http.Client{
+				Transport: config.GetTransport(),
+				Timeout:   50 * time.Millisecond,
+			}
+			resp, err := httpClient.Do(req)
+			if err != nil {
+				if !logged {
+					log.Infoln("Failed to send request to "+server+"; likely server is not up (will retry in 50ms):", err)
+					logged = true
+				}
+			} else {
+				if resp.StatusCode == expectedStatus {
+					log.Debugln(server + " server appears to be functioning")
+					return nil
+				}
+				// We didn't get the expected status
+				return errors.Errorf("Received bad status code in reply to server ping: %d. Expected %d,", resp.StatusCode, expectedStatus)
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+
+	return errors.Errorf("Server %s at %s did not startup after 10s of waiting", server, reqUrl)
+}
+
+// For calling from within the server. Returns the server's issuer URL/port
+func GetServerIssuerURL() (*url.URL, error) {
+	if param.Server_IssuerUrl.GetString() == "" {
+		return nil, errors.New("The server failed to determine its own issuer url. Something is wrong!")
+	}
+
+	issuerUrl, err := url.Parse(param.Server_IssuerUrl.GetString())
+	if err != nil {
+		return nil, errors.Wrapf(err, "The server's issuer URL is malformed: %s. Something is wrong!", param.Server_IssuerUrl.GetString())
+	}
+
+	return issuerUrl, nil
+}
+
+// Launch a maintenance goroutine.
+// The maintenance routine will watch the directory `dirPath`, invoking `maintenanceFunc` whenever
+// an event occurs in the directory.  Note the behavior of directory watching differs across platforms;
+// for example, an atomic rename might be one or two events for the destination file depending on Mac OS X or Linux.
+//
+// Even if the filesystem watcher fails, this will invoke `maintenanceFunc` every `sleepTime` duration.
+// The maintenance function will be called with `true` if invoked due to a directory change, false otherwise
+// When generating error messages, `description` will be used to describe the task.
+func LaunchWatcherMaintenance(ctx context.Context, dirPaths []string, description string, sleepTime time.Duration, maintenanceFunc func(notifyEvent bool) error) {
+	select_count := 4
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		log.Warningf("%s routine failed to create new watcher", description)
+		select_count -= 2
+	} else {
+		uniquePaths := map[string]bool{}
+		for _, dirPath := range dirPaths {
+			uniquePaths[dirPath] = true
+		}
+		for dirPath := range uniquePaths {
+			if err = watcher.Add(dirPath); err != nil {
+				log.Warningf("%s routine failed to add directory %s to watch: %v", description, dirPath, err)
+				select_count -= 2
+				break
+			}
+		}
+	}
+	cases := make([]reflect.SelectCase, select_count)
+	ticker := time.NewTicker(sleepTime)
+	cases[0].Dir = reflect.SelectRecv
+	cases[0].Chan = reflect.ValueOf(ticker.C)
+	cases[1].Dir = reflect.SelectRecv
+	cases[1].Chan = reflect.ValueOf(ctx.Done())
+	if err == nil {
+		cases[2].Dir = reflect.SelectRecv
+		cases[2].Chan = reflect.ValueOf(watcher.Events)
+		cases[3].Dir = reflect.SelectRecv
+		cases[3].Chan = reflect.ValueOf(watcher.Errors)
+	}
+	egrp, ok := ctx.Value(config.EgrpKey).(*errgroup.Group)
+	if !ok {
+		egrp = &errgroup.Group{}
+	}
+	egrp.Go(func() error {
+		defer watcher.Close()
+		for {
+			chosen, recv, ok := reflect.Select(cases)
+			if chosen == 0 {
+				if !ok {
+					return errors.Errorf("Ticker failed in the %s routine; exiting", description)
+				}
+				err := maintenanceFunc(false)
+				if err != nil {
+					log.Warningf("Failure during %s routine: %v", description, err)
+				}
+			} else if chosen == 1 {
+				log.Infof("%s routine has been cancelled. Shutting down", description)
+				return nil
+			} else if chosen == 2 { // watcher.Events
+				if !ok {
+					return errors.Errorf("Watcher events failed in %s routine; exiting", description)
+				}
+				if event, ok := recv.Interface().(fsnotify.Event); ok {
+					log.Debugf("Got filesystem event (%v); will run %s", event, description)
+					err := maintenanceFunc(true)
+					if err != nil {
+						log.Warningf("Failure during %s routine: %v", description, err)
+					}
+				} else {
+					return errors.New("Watcher returned an unknown event")
+				}
+			} else if chosen == 3 { // watcher.Errors
+				if !ok {
+					return errors.Errorf("Watcher error channel closed in %s routine; exiting", description)
+				}
+				if err, ok := recv.Interface().(error); ok {
+					log.Errorf("Watcher failure in the %s routine: %v", description, err)
+				} else {
+					return errors.New("Watcher error channel has internal error; exiting")
+				}
+				time.Sleep(time.Second)
+			}
+		}
+	})
+}
diff --git a/test_utils/utils.go b/test_utils/utils.go
new file mode 100644
index 000000000..ed92d2819
--- /dev/null
+++ b/test_utils/utils.go
@@ -0,0 +1,38 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package test_utils
+
+import (
+	"context"
+	"testing"
+
+	"github.com/pelicanplatform/pelican/config"
+	"golang.org/x/sync/errgroup"
+)
+
+func TestContext(ictx context.Context, t *testing.T) (ctx context.Context, cancel context.CancelFunc, egrp *errgroup.Group) {
+	if deadline, ok := t.Deadline(); ok {
+		ctx, cancel = context.WithDeadline(ictx, deadline)
+	} else {
+		ctx, cancel = context.WithCancel(ictx)
+	}
+	egrp, ctx = errgroup.WithContext(ctx)
+	ctx = context.WithValue(ctx, config.EgrpKey, egrp)
+	return
+}
diff --git a/token_scopes/token_scope_utils.go b/token_scopes/token_scope_utils.go
new file mode 100644
index 000000000..a690cecd9
--- /dev/null
+++ b/token_scopes/token_scope_utils.go
@@ -0,0 +1,81 @@
+package token_scopes
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/lestrrat-go/jwx/v2/jwt"
+)
+
+// Get a string representation of a list of scopes, which can then be passed
+// to the Claim builder of JWT constructor
+func GetScopeString(scopes []TokenScope) (scopeString string) {
+	scopeString = ""
+	if len(scopes) == 0 {
+		return
+	}
+	if len(scopes) == 1 {
+		scopeString = string(scopes[0])
+		return
+	}
+	for _, scope := range scopes {
+		scopeString += scope.String() + " "
+	}
+	scopeString = strings.TrimRight(scopeString, " ")
+	return
+}
+
+// Return if expectedScopes contains the tokenScope and it's case-insensitive.
+// If all=false, it checks if the tokenScopes have any one scope in expectedScopes;
+// If all=true, it checks if tokenScopes is the same set as expectedScopes
+func ScopeContains(tokenScopes []string, expectedScopes []string, all bool) bool {
+	if !all { // Any tokenScope in desiredScopes is OK
+		for _, tokenScope := range tokenScopes {
+			for _, sc := range expectedScopes {
+				if strings.EqualFold(sc, tokenScope) {
+					return true
+				}
+			}
+		}
+		return false
+	} else { // All tokenScope must be in desiredScopes
+		if len(tokenScopes) != len(expectedScopes) {
+			return false
+		}
+		sort.Strings(tokenScopes)
+		sort.Strings(expectedScopes)
+		for i := 0; i < len(tokenScopes); i++ {
+			if tokenScopes[i] != expectedScopes[i] {
+				return false
+			}
+		}
+		return true
+	}
+}
+
+// Creates a validator that checks if a token's scope matches the given scope: expectedScopes.
+// See `scopeContains` for detailed checking mechanism
+func CreateScopeValidator(expectedScopes []string, all bool) jwt.ValidatorFunc {
+
+	return jwt.ValidatorFunc(func(_ context.Context, tok jwt.Token) jwt.ValidationError {
+		// If no scope is present, always return true
+		if len(expectedScopes) == 0 {
+			return nil
+		}
+		scope_any, present := tok.Get("scope")
+		if !present {
+			return jwt.NewValidationError(errors.New("No scope is present; required for authorization"))
+		}
+		scope, ok := scope_any.(string)
+		if !ok {
+			return jwt.NewValidationError(errors.New("scope claim in token is not string-valued"))
+		}
+		if ScopeContains(strings.Split(scope, " "), expectedScopes, all) {
+			return nil
+		}
+		return jwt.NewValidationError(errors.New(fmt.Sprint("Token does not contain any of the scopes: ", expectedScopes)))
+	})
+}
diff --git a/token_scopes/token_scope_utils_test.go b/token_scopes/token_scope_utils_test.go
new file mode 100644
index 000000000..9b9fa64ff
--- /dev/null
+++ b/token_scopes/token_scope_utils_test.go
@@ -0,0 +1,65 @@
+package token_scopes
+
+import (
+	"strconv"
+	"testing"
+)
+
+func TestGetScopeString(t *testing.T) {
+	tests := []struct {
+		name   string
+		scopes []TokenScope
+		want   string
+	}{
+		{"no-scope", []TokenScope{}, ""},
+		{"single-scope", []TokenScope{"read"}, "read"},
+		{"multiple-scopes", []TokenScope{"read", "write", "delete"}, "read write delete"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GetScopeString(tt.scopes)
+			if got != tt.want {
+				t.Errorf("GetScopeString() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func largeInputSet() []string {
+	var scopes []string
+	for i := 0; i < 1000; i++ {
+		scopes = append(scopes, "scope"+strconv.Itoa(i))
+	}
+	return scopes
+}
+
+func TestScopeContains(t *testing.T) {
+	tests := []struct {
+		name           string
+		tokenScopes    []string
+		expectedScopes []string
+		all            bool
+		want           bool
+	}{
+		{"empty-scopes", []string{}, []string{}, false, false},
+		{"single-match", []string{"read"}, []string{"read"}, false, true},
+		{"no-match", []string{"read"}, []string{"write"}, false, false},
+		{"multiple-matches", []string{"read", "write"}, []string{"read", "write"}, false, true},
+		{"partial-match-all-false", []string{"read", "write"}, []string{"read"}, false, true},
+		{"partial-match-all-true", []string{"read", "write"}, []string{"read"}, true, false},
+		{"case-insensitivity", []string{"Read"}, []string{"read"}, false, true},
+		{"different-lengths-all-true", []string{"read", "write"}, []string{"read"}, true, false},
+		{"exact-match-all-true", []string{"read", "write"}, []string{"write", "read"}, true, true},
+		{"large-input-sets", largeInputSet(), largeInputSet(), false, true},
+		{"nil-inputs", nil, nil, false, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ScopeContains(tt.tokenScopes, tt.expectedScopes, tt.all); got != tt.want {
+				t.Errorf("ScopeContains() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/token_scopes/token_scopes.go b/token_scopes/token_scopes.go
new file mode 100644
index 000000000..cbf562833
--- /dev/null
+++ b/token_scopes/token_scopes.go
@@ -0,0 +1,19 @@
+// Code generated by go generate; DO NOT EDIT.
+
+package token_scopes
+
+type TokenScope string
+
+const (
+	Pelican_Advertise TokenScope = "pelican.advertise"
+	Pelican_DirectorTestReport TokenScope = "pelican.director_test_report"
+	Pelican_DirectorServiceDiscovery TokenScope = "pelican.director_service_discovery"
+	Pelican_NamespaceDelete TokenScope = "pelican.namespace_delete"
+	WebUi_Access TokenScope = "web_ui.access"
+	Monitoring_Scrape TokenScope = "monitoring.scrape"
+	Monitoring_Query TokenScope = "monitoring.query"
+)
+
+func (s TokenScope) String() string {
+	return string(s)
+}
diff --git a/utils/ca_utils.go b/utils/ca_utils.go
new file mode 100644
index 000000000..48ec962ad
--- /dev/null
+++ b/utils/ca_utils.go
@@ -0,0 +1,239 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package utils
+
+import (
+	"context"
+	"crypto/x509"
+	"encoding/pem"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
+)
+
+// Write out all the trusted CAs as a CA bundle on disk.  This is useful
+// for components that do not use go's trusted CA store
+func WriteCABundle(filename string) (int, error) {
+	roots, err := loadSystemRoots()
+	if err != nil {
+		return -1, errors.Wrap(err, "Unable to write CA bundle due to failure when loading system trust roots")
+	}
+
+	// Append in any custom CAs we might have
+	caFile := param.Server_TLSCACertificateFile.GetString()
+	pemContents, err := os.ReadFile(caFile)
+	if err == nil {
+		roots = append(roots, getCertsFromPEM(pemContents)...)
+	}
+
+	if len(roots) == 0 {
+		return 0, nil
+	}
+
+	dir := filepath.Dir(filename)
+	base := filepath.Base(filename)
+	file, err := os.CreateTemp(dir, base)
+	if err != nil {
+		return -1, errors.Wrap(err, "Unable to create CA bundle temporary file")
+	}
+	defer file.Close()
+	if err = os.Chmod(file.Name(), 0644); err != nil {
+		return -1, errors.Wrap(err, "Failed to chmod CA bundle temporary file")
+	}
+
+	for _, root := range roots {
+		if err = pem.Encode(file, &pem.Block{Type: "CERTIFICATE", Bytes: root.Raw}); err != nil {
+			return -1, errors.Wrap(err, "Failed to write CA into bundle")
+		}
+	}
+
+	if err := os.Rename(file.Name(), filename); err != nil {
+		return -1, errors.Wrapf(err, "Failed to move temporary CA bundle to final location (%v)", filename)
+	}
+
+	return len(roots), nil
+}
+
+// Periodically write out the system CAs, updating them if the system updates.
+// Returns an error if the first attempt at writing fails.  Otherwise, it will
+// launch a goroutine and update the entire CA bundle every specified duration.
+//
+// If we're on a platform (Mac, Windows) that does not provide a CA bundle, we return
+// a count of 0 and do not launch the go routine.
+func LaunchPeriodicWriteCABundle(ctx context.Context, filename string, sleepTime time.Duration) (count int, err error) {
+	count, err = WriteCABundle(filename)
+	if err != nil || count == 0 {
+		return
+	}
+
+	egrp, ok := ctx.Value(config.EgrpKey).(*errgroup.Group)
+	if !ok {
+		egrp = &errgroup.Group{}
+	}
+	egrp.Go(func() error {
+		ticker := time.NewTicker(sleepTime)
+		for {
+			select {
+			case <-ticker.C:
+				_, err := WriteCABundle(filename)
+				if err != nil {
+					log.Warningln("Failure during periodic CA bundle update:", err)
+				}
+			case <-ctx.Done():
+				return nil
+			}
+		}
+	})
+
+	return
+}
+
+// NOTE: Code below is taken from src/crypto/x509/root_unix.go in the go runtime.  Since the
+// runtime is BSD-licensed, it is compatible with its inclusion in Pelican
+const (
+	certFileEnv = "SSL_CERT_FILE"
+	certDirEnv  = "SSL_CERT_DIR"
+)
+
+var certFiles = []string{
+	"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
+	"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
+	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
+	"/etc/pki/tls/cacert.pem",                           // OpenELEC
+	"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
+	"/etc/ssl/cert.pem",                                 // Alpine Linux
+}
+
+var certDirectories = []string{
+	"/etc/ssl/certs",     // SLES10/SLES11, https://golang.org/issue/12139
+	"/etc/pki/tls/certs", // Fedora/RHEL
+}
+
+func getCertsFromPEM(pemCerts []byte) []*x509.Certificate {
+	result := make([]*x509.Certificate, 0)
+	for len(pemCerts) > 0 {
+		var block *pem.Block
+		block, pemCerts = pem.Decode(pemCerts)
+		if block == nil {
+			break
+		}
+		if block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
+			continue
+		}
+		certBytes := block.Bytes
+		cert, err := x509.ParseCertificate(certBytes)
+		if err != nil {
+			continue
+		}
+		result = append(result, cert)
+	}
+	return result
+}
+
+func loadSystemRoots() ([]*x509.Certificate, error) {
+	// The code below only works on Linux; other platforms require syscalls
+	// On those, we simply return no system CAs.
+	roots := make([]*x509.Certificate, 0)
+	if os := runtime.GOOS; os != "linux" {
+		return roots, nil
+	}
+
+	files := certFiles
+	if f := os.Getenv(certFileEnv); f != "" {
+		files = []string{f}
+	}
+
+	var firstErr error
+	for _, file := range files {
+		pemCerts, err := os.ReadFile(file)
+		if err == nil {
+			roots = append(roots, getCertsFromPEM(pemCerts)...)
+			break
+		}
+		if firstErr == nil && !os.IsNotExist(err) {
+			firstErr = err
+		}
+	}
+
+	dirs := certDirectories
+	if d := os.Getenv(certDirEnv); d != "" {
+		// OpenSSL and BoringSSL both use ":" as the SSL_CERT_DIR separator.
+		// See:
+		//  * https://golang.org/issue/35325
+		//  * https://www.openssl.org/docs/man1.0.2/man1/c_rehash.html
+		dirs = strings.Split(d, ":")
+	}
+
+	for _, directory := range dirs {
+		fis, err := readUniqueDirectoryEntries(directory)
+		if err != nil {
+			if firstErr == nil && !os.IsNotExist(err) {
+				firstErr = err
+			}
+			continue
+		}
+		for _, fi := range fis {
+			data, err := os.ReadFile(directory + "/" + fi.Name())
+			if err == nil {
+				roots = append(roots, getCertsFromPEM(data)...)
+			}
+		}
+	}
+
+	if len(roots) > 0 || firstErr == nil {
+		return roots, nil
+	}
+
+	return nil, firstErr
+}
+
+// readUniqueDirectoryEntries is like os.ReadDir but omits
+// symlinks that point within the directory.
+func readUniqueDirectoryEntries(dir string) ([]fs.DirEntry, error) {
+	files, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, err
+	}
+	uniq := files[:0]
+	for _, f := range files {
+		if !isSameDirSymlink(f, dir) {
+			uniq = append(uniq, f)
+		}
+	}
+	return uniq, nil
+}
+
+// isSameDirSymlink reports whether a file in a dir is a symlink with a
+// target not containing a slash.
+func isSameDirSymlink(f fs.DirEntry, dir string) bool {
+	if f.Type()&fs.ModeSymlink == 0 {
+		return false
+	}
+	target, err := os.Readlink(filepath.Join(dir, f.Name()))
+	return err == nil && !strings.Contains(target, "/")
+}
diff --git a/utils/server_auth.go b/utils/server_auth.go
new file mode 100644
index 000000000..3ae49196e
--- /dev/null
+++ b/utils/server_auth.go
@@ -0,0 +1,323 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+package utils
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/lestrrat-go/httprc"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+type (
+	TokenSource int
+	TokenIssuer int
+	AuthOption  struct {
+		Sources   []TokenSource
+		Issuers   []TokenIssuer
+		Scopes    []string
+		AllScopes bool
+	}
+	AuthChecker interface {
+		FederationCheck(ctx *gin.Context, token string, expectedScopes []string, allScopes bool) error
+		IssuerCheck(ctx *gin.Context, token string, expectedScopes []string, allScopes bool) error
+	}
+	AuthCheckImpl     struct{}
+	DiscoveryResponse struct { // This is a duplicate from director/authentication to ensure we don't have cyclic import
+		Issuer  string `json:"issuer"`
+		JwksUri string `json:"jwks_uri"`
+	}
+)
+
+const (
+	Header TokenSource = iota // "Authorization" header
+	Cookie                    // "login" cookie
+	Authz                     // "authz" query parameter
+)
+
+const (
+	Federation TokenIssuer = iota
+	Issuer
+)
+
+var (
+	federationJWK    *jwk.Cache
+	directorJWK      *jwk.Cache
+	directorMetadata *httprc.Cache
+	authChecker      AuthChecker
+)
+
+func init() {
+	authChecker = &AuthCheckImpl{}
+}
+
+// [Deprecated] This function is expected to be removed very soon, after
+// https://github.com/PelicanPlatform/pelican/issues/559 is implemented
+//
+// Return director's public JWK for token verification. This function can be called
+// on any server (director/origin/registry) as long as the Federation_DirectorUrl is set
+//
+// The director's metadata discovery endpoint and JWKS endpoint are cached
+func LoadDirectorPublicKey() (jwk.Key, error) {
+	directorUrlStr := param.Federation_DirectorUrl.GetString()
+	if len(directorUrlStr) == 0 {
+		return nil, errors.Errorf("Director URL is unset; Can't load director's public key")
+	}
+	log.Debugln("Director's discovery URL:", directorUrlStr)
+	directorUrl, err := url.Parse(directorUrlStr)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintln("Invalid director URL:", directorUrlStr))
+	}
+	directorUrl.Scheme = "https"
+	directorUrl.Path = directorUrl.Path + "/.well-known/openid-configuration"
+
+	directorMetadataCtx := context.Background()
+	if directorMetadata == nil {
+		client := &http.Client{Transport: config.GetTransport()}
+		directorMetadata = httprc.NewCache(directorMetadataCtx)
+		if err := directorMetadata.Register(directorUrl.String(), httprc.WithMinRefreshInterval(15*time.Minute), httprc.WithHTTPClient(client)); err != nil {
+			return nil, errors.Wrap(err, "Failed to register httprc cache for director's metadata")
+		}
+	}
+
+	payload, err := directorMetadata.Get(directorMetadataCtx, directorUrl.String())
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to get director's metadata")
+	}
+
+	metadata := DiscoveryResponse{}
+
+	err = json.Unmarshal(payload.([]byte), &metadata)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintln("Failure when parsing director metadata at: ", directorUrl))
+	}
+
+	jwksUri := metadata.JwksUri
+
+	directorJwkCtx := context.Background()
+	if directorJWK == nil {
+		client := &http.Client{Transport: config.GetTransport()}
+		directorJWK = jwk.NewCache(directorJwkCtx)
+		if err := directorJWK.Register(jwksUri, jwk.WithRefreshInterval(15*time.Minute), jwk.WithHTTPClient(client)); err != nil {
+			return nil, errors.Wrap(err, "Failed to register internal JWKS cache for director's public JWKS")
+		}
+	}
+
+	jwks, err := directorJWK.Get(directorJwkCtx, jwksUri)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to get director's public JWKS")
+	}
+	key, ok := jwks.Key(0)
+	if !ok {
+		return nil, errors.Wrap(err, fmt.Sprintln("Failure when getting director's first public key: ", jwksUri))
+	}
+
+	return key, nil
+}
+
+// Checks that the given token was signed by the federation jwk and also checks that the token has the expected scope
+func (a AuthCheckImpl) FederationCheck(c *gin.Context, strToken string, expectedScopes []string, allScopes bool) error {
+	fedURL := param.Federation_DiscoveryUrl.GetString()
+	token, err := jwt.Parse([]byte(strToken), jwt.WithVerify(false))
+
+	if err != nil {
+		return err
+	}
+
+	if fedURL != token.Issuer() {
+		return errors.New(fmt.Sprint("Issuer is not a federation: ", token.Issuer()))
+	}
+
+	fedURIFile := param.Federation_JwkUrl.GetString()
+	ctx := context.Background()
+	if federationJWK == nil {
+		client := &http.Client{Transport: config.GetTransport()}
+		federationJWK = jwk.NewCache(ctx)
+		if err := federationJWK.Register(fedURIFile, jwk.WithRefreshInterval(15*time.Minute), jwk.WithHTTPClient(client)); err != nil {
+			return errors.Wrap(err, "Failed to register cache for federation's public JWKS")
+		}
+	}
+
+	jwks, err := federationJWK.Get(ctx, fedURIFile)
+	if err != nil {
+		return errors.Wrap(err, "Failed to get federation's public JWKS")
+	}
+
+	parsed, err := jwt.Parse([]byte(strToken), jwt.WithKeySet(jwks))
+
+	if err != nil {
+		return errors.Wrap(err, "Failed to verify JWT by federation's key")
+	}
+
+	scopeValidator := token_scopes.CreateScopeValidator(expectedScopes, allScopes)
+	if err = jwt.Validate(parsed, jwt.WithValidator(scopeValidator)); err != nil {
+		return errors.Wrap(err, "Failed to verify the scope of the token")
+	}
+
+	c.Set("User", "Federation")
+	return nil
+}
+
+// Checks that the given token was signed by the issuer jwk (the one from the server itself) and also checks that
+// the token has the expected scope
+//
+// Note that this means the issuer jwk MUST be the one server created. It can't be provided by
+// the user if they want to use a different issuer than the server. This can be changed in the future.
+func (a AuthCheckImpl) IssuerCheck(c *gin.Context, strToken string, expectedScopes []string, allScopes bool) error {
+	token, err := jwt.Parse([]byte(strToken), jwt.WithVerify(false))
+	if err != nil {
+		return errors.Wrap(err, "Invalid JWT")
+	}
+
+	serverURL := param.Server_ExternalWebUrl.GetString()
+	if serverURL != token.Issuer() {
+		if param.Origin_Url.GetString() == token.Issuer() {
+			return errors.New(fmt.Sprint("Wrong issuer; expect the issuer to be the server's web address but got Origin.URL, " + token.Issuer()))
+		} else {
+			return errors.New(fmt.Sprint("Issuer is not server itself: ", token.Issuer()))
+		}
+	}
+
+	bKey, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return errors.Wrap(err, "Failed to load issuer server's private key")
+	}
+
+	var raw ecdsa.PrivateKey
+	if err = bKey.Raw(&raw); err != nil {
+		return errors.Wrap(err, "Failed to get raw key of the issuer's JWK")
+	}
+
+	parsed, err := jwt.Parse([]byte(strToken), jwt.WithKey(jwa.ES256, raw.PublicKey))
+
+	if err != nil {
+		return errors.Wrap(err, "Failed to verify JWT by issuer's key")
+	}
+
+	scopeValidator := token_scopes.CreateScopeValidator(expectedScopes, allScopes)
+	if err = jwt.Validate(parsed, jwt.WithValidator(scopeValidator)); err != nil {
+		return errors.Wrap(err, "Failed to verify the scope of the token")
+	}
+
+	c.Set("User", "Origin")
+	return nil
+}
+
+// Check token authentication with token obtained from authOption.Sources, found the first
+// token available and proceed to check against a list of authOption.Issuers with
+// authOption.Scopes, return true and set "User" context to the issuer if any of the issuer check succeed
+//
+// Scope check will pass if your token has ANY of the scopes in authOption.Scopes
+func CheckAnyAuth(ctx *gin.Context, authOption AuthOption) bool {
+	token := ""
+	errMsg := ""
+	// Find token from the provided sources list, stop when found the first token
+	tokenFound := false
+	for _, opt := range authOption.Sources {
+		if tokenFound {
+			break
+		}
+		switch opt {
+		case Cookie:
+			cookieToken, err := ctx.Cookie("login")
+			if err != nil || cookieToken == "" {
+				errMsg += fmt.Sprintln("No 'login' cookie present: ", err)
+				continue
+			} else {
+				token = cookieToken
+				tokenFound = true
+				break
+			}
+		case Header:
+			headerToken := ctx.Request.Header["Authorization"]
+			if len(headerToken) <= 0 {
+				errMsg += fmt.Sprintln("No Authorization header present")
+				continue
+			} else {
+				token = strings.TrimPrefix(headerToken[0], "Bearer ")
+				tokenFound = true
+				break
+			}
+		case Authz:
+			authzToken := ctx.Request.URL.Query()["authz"]
+			if len(authzToken) <= 0 {
+				errMsg += fmt.Sprintln("No Authz query parameter present")
+				continue
+			} else {
+				token = authzToken[0]
+				tokenFound = true
+				break
+			}
+		default:
+			log.Info("Authentication failed. Invalid/unsupported token source")
+			return false
+		}
+	}
+
+	if token == "" {
+		log.Info("Authentication failed. No token is present from the list of potential token positions")
+		return false
+	}
+
+	for _, iss := range authOption.Issuers {
+		switch iss {
+		case Federation:
+			err := authChecker.FederationCheck(ctx, token, authOption.Scopes, authOption.AllScopes)
+			if _, exists := ctx.Get("User"); err != nil || !exists {
+				errMsg += fmt.Sprintln("Token validation failed with federation issuer: ", err)
+				log.Debug("Token validation failed with federation issuer: ", err)
+				break
+			} else {
+				log.Debug("Token validation succeeded with federation issuer")
+				return exists
+			}
+		case Issuer:
+			err := authChecker.IssuerCheck(ctx, token, authOption.Scopes, authOption.AllScopes)
+			if _, exists := ctx.Get("User"); err != nil || !exists {
+				errMsg += fmt.Sprintln("Token validation failed with server issuer: ", err)
+				log.Debug("Token validation failed with server issuer: ", err)
+				break
+			} else {
+				log.Debug("Token validation succeeded with server issuer")
+				return exists
+			}
+		default:
+			log.Info("Authentication failed. Invalid/unsupported token issuer")
+			return false
+		}
+	}
+
+	// If the function reaches here, it means no token check passed
+	log.Info("Authentication failed. Didn't pass the chain of checking:\n", errMsg)
+	return false
+}
diff --git a/utils/server_auth_test.go b/utils/server_auth_test.go
new file mode 100644
index 000000000..7444fbfc1
--- /dev/null
+++ b/utils/server_auth_test.go
@@ -0,0 +1,269 @@
+package utils
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/require"
+)
+
+// MockAuthChecker is the mock implementation of AuthChecker.
+type MockAuthChecker struct {
+	FederationCheckFunc func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error
+	IssuerCheckFunc     func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error
+}
+
+func (m *MockAuthChecker) FederationCheck(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+	return m.FederationCheckFunc(ctx, token, expectedScopes, allScope)
+}
+
+func (m *MockAuthChecker) IssuerCheck(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+	return m.IssuerCheckFunc(ctx, token, expectedScopes, allScope)
+}
+
+// Helper function to create a gin context with different token sources
+func createContextWithToken(cookieToken, headerToken, queryToken string) *gin.Context {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+
+	if cookieToken != "" {
+		r.AddCookie(&http.Cookie{Name: "login", Value: cookieToken})
+	}
+	if headerToken != "" {
+		r.Header.Add("Authorization", "Bearer "+headerToken)
+	}
+	if queryToken != "" {
+		q := r.URL.Query()
+		q.Add("authz", queryToken)
+		r.URL.RawQuery = q.Encode()
+	}
+
+	w := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(w)
+	ctx.Request = r
+
+	return ctx
+}
+
+func TestCheckAnyAuth(t *testing.T) {
+	// Use a mock instance of authChecker to simplify testing
+	originalAuthChecker := authChecker
+	defer func() { authChecker = originalAuthChecker }()
+
+	// Create the mock for varioud checkers
+	mock := &MockAuthChecker{
+		FederationCheckFunc: func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+			if token != "" {
+				ctx.Set("User", "Federation")
+				return nil
+			} else {
+				return errors.New("No token is present")
+			}
+		},
+		IssuerCheckFunc: func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+			if token != "" {
+				ctx.Set("User", "Issuer")
+				return nil
+			} else {
+				return errors.New("No token is present")
+			}
+		},
+	}
+
+	authChecker = mock
+
+	// Batch-create test cases, see "name" section for the purpose of each test case
+	tests := []struct {
+		name       string
+		setupMock  func()
+		tokenSetup func() *gin.Context
+		authOption AuthOption
+		want       bool
+	}{
+		{
+			name: "valid-token-from-cookie-source",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie},
+				Issuers: []TokenIssuer{Federation},
+			},
+			tokenSetup: func() *gin.Context {
+				return createContextWithToken("valid-cookie-token", "", "")
+			},
+			want: true,
+		},
+		{
+			name: "valid-token-from-header-source",
+			authOption: AuthOption{
+				Sources: []TokenSource{Header},
+				Issuers: []TokenIssuer{Federation},
+			},
+			tokenSetup: func() *gin.Context {
+				return createContextWithToken("", "valid-header-token", "")
+			},
+			want: true,
+		},
+		{
+			name: "valid-token-from-authz-query-parameter",
+			authOption: AuthOption{
+				Sources: []TokenSource{Authz},
+				Issuers: []TokenIssuer{Federation},
+			},
+			tokenSetup: func() *gin.Context {
+				return createContextWithToken("", "", "valid-query-token")
+			},
+			want: true,
+		},
+		{
+			name: "no-token-present",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie, Header, Authz},
+				Issuers: []TokenIssuer{},
+			},
+			tokenSetup: func() *gin.Context {
+				return createContextWithToken("", "", "")
+			},
+			want: false,
+		},
+		{
+			name: "get-first-available-token-from-multiple-sources",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie, Header, Authz},
+				Issuers: []TokenIssuer{Federation},
+			},
+			setupMock: func() {
+				mock.FederationCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "valid-cookie" {
+						ctx.Set("User", "Federation")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Token is not from cookie: ", token))
+				}
+			},
+			tokenSetup: func() *gin.Context {
+				// Set token in both cookie and header, but function should stop at the first valid source
+				return createContextWithToken("valid-cookie", "valid-header", "valid-authz")
+			},
+			want: true,
+		},
+		{
+			name: "valid-token-with-single-issuer",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie},
+				Issuers: []TokenIssuer{Federation},
+			},
+			setupMock: func() {
+				mock.FederationCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "valid-cookie" {
+						ctx.Set("User", "Federation")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Token is not from cookie: ", token))
+				}
+			},
+			tokenSetup: func() *gin.Context {
+				// Set token in both cookie and header, but function should stop at the first valid source
+				return createContextWithToken("valid-cookie", "", "")
+			},
+			want: true,
+		},
+		{
+			name: "invalid-token-with-single-issuer",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie},
+				Issuers: []TokenIssuer{Federation},
+			},
+			setupMock: func() {
+				mock.FederationCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "valid-cookie" {
+						ctx.Set("User", "Federation")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Invalid token: ", token))
+				}
+			},
+			tokenSetup: func() *gin.Context {
+				// Set token in both cookie and header, but function should stop at the first valid source
+				return createContextWithToken("invalid-cookie", "", "")
+			},
+			want: false,
+		},
+		{
+			name: "valid-token-with-multiple-issuer",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie},
+				Issuers: []TokenIssuer{Federation, Issuer},
+			},
+			setupMock: func() {
+				mock.FederationCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "for-federation" {
+						ctx.Set("User", "Federation")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Invalid Token: ", token))
+				}
+				mock.IssuerCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "for-issuer" {
+						ctx.Set("User", "Issuer")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Invalid Token: ", token))
+				}
+			},
+			tokenSetup: func() *gin.Context {
+				// Set token in both cookie and header, but function should stop at the first valid source
+				return createContextWithToken("for-issuer", "", "")
+			},
+			want: true,
+		},
+		{
+			name: "invalid-token-with-multiple-issuer",
+			authOption: AuthOption{
+				Sources: []TokenSource{Cookie},
+				Issuers: []TokenIssuer{Federation, Issuer},
+			},
+			setupMock: func() {
+				mock.FederationCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "for-federation" {
+						ctx.Set("User", "Federation")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Invalid Token: ", token))
+				}
+				mock.IssuerCheckFunc = func(ctx *gin.Context, token string, expectedScopes []string, allScope bool) error {
+					if token == "for-issuer" {
+						ctx.Set("User", "Issuer")
+						return nil
+					}
+					return errors.New(fmt.Sprint("Invalid Token: ", token))
+				}
+			},
+			tokenSetup: func() *gin.Context {
+				// Set token in both cookie and header, but function should stop at the first valid source
+				return createContextWithToken("for-nobody", "", "")
+			},
+			want: false,
+		},
+	}
+
+	// Batch-run the test cases
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.setupMock != nil {
+				// We might have different mocks to the checker function,
+				// so we have this flexibility by calling setupmock if there is such function
+				tc.setupMock()
+			}
+			require.NotNil(t, tc.tokenSetup, "tokenSetup function can't be nil")
+
+			ctx := tc.tokenSetup()
+
+			if got := CheckAnyAuth(ctx, tc.authOption); got != tc.want {
+				t.Errorf("CheckAnyAuth() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+
+}
diff --git a/utils/test_file_transfers_utils.go b/utils/test_file_transfers_utils.go
new file mode 100644
index 000000000..4ade0418e
--- /dev/null
+++ b/utils/test_file_transfers_utils.go
@@ -0,0 +1,256 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+// This is a utility file that provides a TestFileTransferImpl struct with a `RunTests` function
+// to allow any Pelican server to issue a file transfer test to a XRootD server
+
+package utils
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+)
+
+type (
+	TestType         string
+	TestFileTransfer interface {
+		generateFileTestScitoken(audienceUrl string) (string, error)
+		UploadTestfile(ctx context.Context, baseUrl string, testType TestType) (string, error)
+		DownloadTestfile(ctx context.Context, downloadUrl string) error
+		DeleteTestfile(ctx context.Context, fileUrl string) error
+		RunTests(ctx context.Context, baseUrl string, testType TestType) (bool, error)
+	}
+	TestFileTransferImpl struct {
+		audienceUrl string
+		issuerUrl   string
+		testType    TestType
+		testBody    string
+	}
+)
+
+const (
+	OriginSelfFileTest TestType = "self-test"
+	DirectorFileTest   TestType = "director-test"
+)
+
+const (
+	selfTestBody     string = "This object was created by the Pelican self-test functionality"
+	directorTestBody string = "This object was created by the Pelican director-test functionality"
+)
+
+func (t TestType) String() string {
+	return string(t)
+}
+
+// TODO: Replace by CreateEncodedToken once it's free from main package #320
+func (t TestFileTransferImpl) generateFileTestScitoken() (string, error) {
+	// Issuer is whichever server that initiates the test, so it's the server itself
+	issuerUrl := param.Server_ExternalWebUrl.GetString()
+	if t.issuerUrl != "" { // Get from param if it's not empty
+		issuerUrl = t.issuerUrl
+	}
+	if issuerUrl == "" { // if both are empty, then error
+		return "", errors.New("Failed to create token: Invalid iss, Server_ExternalWebUrl is empty")
+	}
+	jti_bytes := make([]byte, 16)
+	if _, err := rand.Read(jti_bytes); err != nil {
+		return "", err
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jti_bytes)
+
+	tok, err := jwt.NewBuilder().
+		Claim("scope", "storage.read:/ storage.modify:/").
+		Claim("wlcg.ver", "1.0").
+		JwtID(jti).
+		Issuer(issuerUrl).
+		Audience([]string{t.audienceUrl}).
+		Subject("origin").
+		Expiration(time.Now().Add(time.Minute)).
+		IssuedAt(time.Now()).
+		Build()
+	if err != nil {
+		return "", err
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to load server's issuer key")
+	}
+
+	if err := jwk.AssignKeyID(key); err != nil {
+		return "", errors.Wrap(err, "Failed to assign kid to the token")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", err
+	}
+
+	return string(signed), nil
+}
+
+// Private function to upload a test file to the `baseUrl` of an exported xrootd file direcotry
+// the test file content is based on the `testType` attribute
+func (t TestFileTransferImpl) uploadTestfile(ctx context.Context, baseUrl string) (string, error) {
+	tkn, err := t.generateFileTestScitoken()
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to create a token for test file transfer")
+	}
+
+	uploadURL, err := url.Parse(baseUrl)
+	if err != nil {
+		return "", errors.Wrap(err, "The baseUrl is not parseable as a URL")
+	}
+	uploadURL.Path = "/pelican/monitoring/" + t.testType.String() + "-" + time.Now().Format(time.RFC3339) + ".txt"
+
+	req, err := http.NewRequestWithContext(ctx, "PUT", uploadURL.String(), bytes.NewBuffer([]byte(t.testBody)))
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to create POST request for monitoring upload")
+	}
+
+	req.Header.Set("Authorization", "Bearer "+tkn)
+
+	client := http.Client{Transport: config.GetTransport()}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to start request for test file upload")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode > 299 {
+		return "", errors.Errorf("Error response %v from test file upload: %v", resp.StatusCode, resp.Status)
+	}
+
+	return uploadURL.String(), nil
+}
+
+// Private function to download a file from downloadUrl and make sure it matches the test file
+// content based on the `testBody` attribute
+func (t TestFileTransferImpl) downloadTestfile(ctx context.Context, downloadUrl string) error {
+	tkn, err := t.generateFileTestScitoken()
+	if err != nil {
+		return errors.Wrap(err, "Failed to create a token for test file transfer download")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", downloadUrl, nil)
+	if err != nil {
+		return errors.Wrap(err, "Failed to create GET request for test file transfer download")
+	}
+	req.Header.Set("Authorization", "Bearer "+tkn)
+
+	client := http.Client{Transport: config.GetTransport()}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return errors.Wrap(err, "Failed to start request for test file transfer download")
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return errors.Wrap(err, "Failed to get response body from test file transfer download")
+	}
+	if string(body) != t.testBody {
+		return errors.Errorf("Contents of test file transfer body do not match upload: %v", body)
+	}
+
+	if resp.StatusCode > 299 {
+		return errors.Errorf("Error response %v from test file transfer download: %v", resp.StatusCode, resp.Status)
+	}
+
+	return nil
+}
+
+// Private function to delete a test file from `fileUrl`
+func (t TestFileTransferImpl) deleteTestfile(ctx context.Context, fileUrl string) error {
+	tkn, err := t.generateFileTestScitoken()
+	if err != nil {
+		return errors.Wrap(err, "Failed to create a token for the test file transfer deletion")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "DELETE", fileUrl, nil)
+	if err != nil {
+		return errors.Wrap(err, "Failed to create DELETE request for test file transfer deletion")
+	}
+	req.Header.Set("Authorization", "Bearer "+tkn)
+
+	client := http.Client{Transport: config.GetTransport()}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return errors.Wrap(err, "Failed to start request for test file transfer deletion")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode > 299 {
+		return errors.Errorf("Error response %v from test file transfer deletion: %v", resp.StatusCode, resp.Status)
+	}
+
+	return nil
+}
+
+// Run a file transfer test suite with upload/download/delete a test file from
+// the server and a xrootd service. It expects `baseUrl` to be the url to the xrootd
+// endpoint, `issuerUrl` be the url to issue scitoken for file transfer, and the
+// test file content/name be based on `testType`
+//
+// Note that for this test to work, you need to have the `issuerUrl` registered in
+// your xrootd as a list of trusted token issuers and the issuer is expected to follow
+// WLCG rules for issuer metadata discovery and public key access
+//
+// Read more: https://github.com/WLCG-AuthZ-WG/common-jwt-profile/blob/master/profile.md#token-verification
+func (t TestFileTransferImpl) RunTests(ctx context.Context, baseUrl, issuerUrl string, testType TestType) (bool, error) {
+	t.audienceUrl = baseUrl
+	t.issuerUrl = issuerUrl
+	t.testType = testType
+	if testType == OriginSelfFileTest {
+		t.testBody = selfTestBody
+	} else if testType == DirectorFileTest {
+		t.testBody = directorTestBody
+	} else {
+		return false, errors.New("Unsupported testType: " + testType.String())
+	}
+
+	downloadUrl, err := t.uploadTestfile(ctx, baseUrl)
+	if err != nil {
+		return false, errors.Wrap(err, "Test file transfer failed during upload")
+	}
+	err = t.downloadTestfile(ctx, downloadUrl)
+	if err != nil {
+		return false, errors.Wrap(err, "Test file transfer failed during download")
+	}
+	err = t.deleteTestfile(ctx, downloadUrl)
+	if err != nil {
+		return false, errors.Wrap(err, "Test file transfer failed during delete")
+	}
+	return true, nil
+}
diff --git a/utils/token_utils.go b/utils/token_utils.go
new file mode 100644
index 000000000..75f8bae78
--- /dev/null
+++ b/utils/token_utils.go
@@ -0,0 +1,256 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package utils
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"net/url"
+	"regexp"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pkg/errors"
+	"github.com/spf13/viper"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/token_scopes"
+)
+
+type (
+	TokenProfile string
+	TokenConfig  struct {
+		TokenProfile TokenProfile
+		Lifetime     time.Duration     // Lifetime is used to set 'exp' claim from now
+		Issuer       string            // Issuer is 'iss' claim
+		Audience     []string          // Audience is 'aud' claim
+		Version      string            // Version is the version for different profiles. 'wlcg.ver' for WLCG profile and 'ver' for scitokens2
+		Subject      string            // Subject is 'sub' claim
+		Claims       map[string]string // Additional claims
+		scope        string            // scope is a string with space-delimited list of scopes. To enforce type check, use AddRawScope or AddScopes to add scopes to your token
+	}
+)
+
+const (
+	WLCG       TokenProfile = "wlcg"
+	Scitokens2 TokenProfile = "scitokens2"
+	None       TokenProfile = "none"
+)
+
+func (p TokenProfile) String() string {
+	return string(p)
+}
+
+// Validate a TokenConfig given its profile and checks if the required claims are present per profile requirement
+// and if provided config values are legal.
+func (config *TokenConfig) Validate() (bool, error) {
+	if config.Lifetime.Seconds() <= 0 {
+		return false, errors.New(fmt.Sprint("Invalid lifetime, lifetime must be positive number: ", config.Lifetime))
+	}
+	if _, err := url.Parse(config.Issuer); err != nil {
+		return false, errors.Wrap(err, "Invalid issuer, issuer is not a valid Url")
+	}
+	switch config.TokenProfile {
+	case Scitokens2:
+		if err := config.verifyCreateSciTokens2(); err != nil {
+			return false, err
+		}
+	case WLCG:
+		if err := config.verifyCreateWLCG(); err != nil {
+			return false, err
+		}
+	case None:
+		return true, nil // we don't have profile specific check for None type
+	default:
+		return false, errors.New(fmt.Sprint("Unsupported token profile: ", config.TokenProfile.String()))
+	}
+	return true, nil
+}
+
+// Verify if the token matches scitoken2 profile requirement
+func (config *TokenConfig) verifyCreateSciTokens2() error {
+	// required fields: aud, ver, scope
+	if len(config.Audience) == 0 {
+		errMsg := "The 'audience' claim is required for the scitokens2 profile, but it could not be found."
+		return errors.New(errMsg)
+	}
+
+	if config.scope == "" {
+		errMsg := "The 'scope' claim is required for the scitokens2 profile, but it could not be found."
+		return errors.New(errMsg)
+	}
+
+	if config.Version == "" {
+		config.Version = "scitokens:2.0"
+	} else {
+		verPattern := `^scitokens:2\.[0-9]+$`
+		re := regexp.MustCompile(verPattern)
+
+		if !re.MatchString(config.Version) {
+			errMsg := "The provided version '" + config.Version +
+				"' is not valid. It must match 'scitokens:<version>', where version is of the form 2.x"
+			return errors.New(errMsg)
+		}
+	}
+	return nil
+}
+
+// Verify if the token matches WLCG profile requirement
+func (config *TokenConfig) verifyCreateWLCG() error {
+	// required fields: sub, wlcg.ver, aud
+	if len(config.Audience) == 0 {
+		errMsg := "The 'audience' claim is required for the scitokens2 profile, but it could not be found."
+		return errors.New(errMsg)
+	}
+
+	if config.Subject == "" {
+		errMsg := "The 'subject' claim is required for the scitokens2 profile, but it could not be found."
+		return errors.New(errMsg)
+	}
+
+	if config.Version == "" {
+		config.Version = "1.0"
+	} else {
+		verPattern := `^1\.[0-9]+$`
+		re := regexp.MustCompile(verPattern)
+		if !re.MatchString(config.Version) {
+			errMsg := "The provided version '" + config.Version + "' is not valid. It must be of the form '1.x'"
+			return errors.New(errMsg)
+		}
+	}
+	return nil
+}
+
+// AddScopes appends a list of token_scopes.TokenScope to the Scope field.
+func (config *TokenConfig) AddScopes(scopes []token_scopes.TokenScope) {
+	if config.scope == "" {
+		config.scope = token_scopes.GetScopeString(scopes)
+	} else {
+		scopeStr := token_scopes.GetScopeString(scopes)
+		if scopeStr != "" {
+			config.scope += " " + scopeStr
+		}
+	}
+}
+
+// AddRawScope appends a space-delimited, case-sensitive scope string to the Scope field.
+//
+// Examples for valid scopes:
+//   - "storage:read"
+//   - "storage:read storage:write"
+func (config *TokenConfig) AddRawScope(scope string) {
+	if config.scope == "" {
+		config.scope = scope
+	} else {
+		if scope != "" {
+			config.scope += " " + scope
+		}
+	}
+}
+
+// GetScope returns a list of space-delimited, case-sensitive strings from TokenConfig.scope
+func (config *TokenConfig) GetScope() string {
+	return config.scope
+}
+
+// CreateToken validates a JWT TokenConfig and if it's valid, create and sign a token based on the TokenConfig.
+func (tokenConfig *TokenConfig) CreateToken() (string, error) {
+	if ok, err := tokenConfig.Validate(); !ok || err != nil {
+		return "", errors.Wrap(err, "Invalid tokenConfig")
+	}
+
+	jti_bytes := make([]byte, 16)
+	if _, err := rand.Read(jti_bytes); err != nil {
+		return "", err
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jti_bytes)
+
+	issuerUrl := ""
+	if tokenConfig.Issuer != "" {
+		url, err := url.Parse(tokenConfig.Issuer)
+		if err != nil {
+			return "", errors.Wrap(err, "Failed to parse the configured IssuerUrl")
+		}
+		issuerUrl = url.String()
+	} else {
+		issuerUrlStr := viper.GetString("IssuerUrl")
+		url, err := url.Parse(issuerUrlStr)
+		if err != nil {
+			return "", errors.Wrap(err, "Failed to parse the configured IssuerUrl")
+		}
+		issuerUrl = url.String()
+	}
+
+	if issuerUrl == "" {
+		return "", errors.New("No issuer was found in the configuration file, and none was provided as a claim")
+	}
+
+	now := time.Now()
+	builder := jwt.NewBuilder()
+	builder.Issuer(issuerUrl).
+		IssuedAt(now).
+		Expiration(now.Add(tokenConfig.Lifetime)).
+		NotBefore(now).
+		Audience(tokenConfig.Audience).
+		Subject(tokenConfig.Subject).
+		Claim("scope", tokenConfig.scope).
+		JwtID(jti)
+
+	if tokenConfig.TokenProfile == Scitokens2 {
+		builder.Claim("ver", tokenConfig.Version)
+	} else if tokenConfig.TokenProfile == WLCG {
+		builder.Claim("wlcg.ver", tokenConfig.Version)
+	}
+
+	if tokenConfig.Claims != nil {
+		for key, val := range tokenConfig.Claims {
+			builder.Claim(key, val)
+		}
+	}
+
+	tok, err := builder.Build()
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to generate token")
+	}
+
+	// Now that we have a token, it needs signing. Note that GetIssuerPrivateJWK
+	// will get the private key passed via the command line because that
+	// file path has already been bound to IssuerKey
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to load signing keys. Either generate one at the default "+
+			"location by serving an origin, or provide one via the --private-key flag")
+	}
+
+	// Get/assign the kid, needed for verification by the client
+	err = jwk.AssignKeyID(key)
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to assign kid to the token")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to sign the deletion token")
+	}
+
+	return string(signed), nil
+}
diff --git a/utils/token_utils_test.go b/utils/token_utils_test.go
new file mode 100644
index 000000000..cd1a308c3
--- /dev/null
+++ b/utils/token_utils_test.go
@@ -0,0 +1,254 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package utils
+
+import (
+	"fmt"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVerifyCreateSciTokens2(t *testing.T) {
+	// Start by feeding it a valid claims map
+	tokenConfig := TokenConfig{TokenProfile: Scitokens2, Audience: []string{"foo"}, Version: "scitokens:2.0", scope: "read:/storage"}
+	err := tokenConfig.verifyCreateSciTokens2()
+	assert.NoError(t, err)
+
+	// Fail to give it audience
+	tokenConfig = TokenConfig{TokenProfile: Scitokens2, Version: "scitokens:2.0", scope: "read:/storage"}
+	err = tokenConfig.verifyCreateSciTokens2()
+	assert.EqualError(t, err, "The 'audience' claim is required for the scitokens2 profile, but it could not be found.")
+
+	// Fail to give it scope
+	tokenConfig = TokenConfig{TokenProfile: Scitokens2, Audience: []string{"foo"}, Version: "scitokens:2.0"}
+	err = tokenConfig.verifyCreateSciTokens2()
+	assert.EqualError(t, err, "The 'scope' claim is required for the scitokens2 profile, but it could not be found.")
+
+	// Give it bad version
+	tokenConfig = TokenConfig{TokenProfile: Scitokens2, Audience: []string{"foo"}, Version: "scitokens:2.xxxx", scope: "read:/storage"}
+	err = tokenConfig.verifyCreateSciTokens2()
+	assert.EqualError(t, err, "The provided version 'scitokens:2.xxxx' is not valid. It must match 'scitokens:<version>', where version is of the form 2.x")
+
+	// Don't give it a version and make sure it gets set correctly
+	tokenConfig = TokenConfig{TokenProfile: Scitokens2, Audience: []string{"foo"}, scope: "read:/storage"}
+	err = tokenConfig.verifyCreateSciTokens2()
+	assert.NoError(t, err)
+	assert.Equal(t, tokenConfig.Version, "scitokens:2.0")
+}
+
+func TestVerifyCreateWLCG(t *testing.T) {
+	// Start by feeding it a valid claims map
+	tokenConfig := TokenConfig{TokenProfile: WLCG, Audience: []string{"director"}, Version: "1.0", Subject: "foo"}
+	err := tokenConfig.verifyCreateWLCG()
+	assert.NoError(t, err)
+
+	// Fail to give it a sub
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Audience: []string{"director"}, Version: "1.0"}
+	err = tokenConfig.verifyCreateWLCG()
+	assert.EqualError(t, err, "The 'subject' claim is required for the scitokens2 profile, but it could not be found.")
+
+	// Fail to give it an aud
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Version: "1.0", Subject: "foo"}
+	err = tokenConfig.verifyCreateWLCG()
+	assert.EqualError(t, err, "The 'audience' claim is required for the scitokens2 profile, but it could not be found.")
+
+	// Give it bad version
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Audience: []string{"director"}, Version: "1.xxxx", Subject: "foo"}
+	err = tokenConfig.verifyCreateWLCG()
+	assert.EqualError(t, err, "The provided version '1.xxxx' is not valid. It must be of the form '1.x'")
+
+	// Don't give it a version and make sure it gets set correctly
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Audience: []string{"director"}, Subject: "foo"}
+	err = tokenConfig.verifyCreateWLCG()
+	assert.NoError(t, err)
+	assert.Equal(t, tokenConfig.Version, "1.0")
+}
+
+// TestAddScopes tests the AddScopes method of TokenConfig
+func TestAddScopes(t *testing.T) {
+	tests := []struct {
+		name             string
+		initialScope     string
+		additionalScopes []token_scopes.TokenScope
+		expectedScope    string
+	}{
+		{
+			name:             "empty-initial-scope-and-empty-additional-scopes",
+			initialScope:     "",
+			additionalScopes: []token_scopes.TokenScope{},
+			expectedScope:    "",
+		},
+		{
+			name:             "empty-initial-scope-and-non-empty-additional-scopes",
+			initialScope:     "",
+			additionalScopes: []token_scopes.TokenScope{"scope1", "scope2"},
+			expectedScope:    "scope1 scope2",
+		},
+		{
+			name:             "non-empty-initial-scope-and-empty-additional-scopes",
+			initialScope:     "existing_scope",
+			additionalScopes: []token_scopes.TokenScope{},
+			expectedScope:    "existing_scope",
+		},
+		{
+			name:             "non-empty-initial-scope-and-non-empty-additional-scopes",
+			initialScope:     "existing_scope",
+			additionalScopes: []token_scopes.TokenScope{"scope1", "scope2"},
+			expectedScope:    "existing_scope scope1 scope2",
+		},
+		{
+			name:             "multiple-initial-scope-and-multiple-additional-scopes",
+			initialScope:     "existing_scope1 existing_scope2",
+			additionalScopes: []token_scopes.TokenScope{"scope1", "scope2"},
+			expectedScope:    "existing_scope1 existing_scope2 scope1 scope2",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := &TokenConfig{scope: tt.initialScope}
+			config.AddScopes(tt.additionalScopes)
+			assert.Equal(t, tt.expectedScope, config.GetScope(), fmt.Sprintf("AddScopes() = %v, want %v", config.scope, tt.expectedScope))
+		})
+	}
+}
+
+// TestAddRawScope tests the AddRawScope method of TokenConfig
+func TestAddRawScope(t *testing.T) {
+	tests := []struct {
+		name          string
+		initialScope  string
+		newScope      string
+		expectedScope string
+	}{
+		{
+			name:          "empty-initial-scope-and-empty-new-scope",
+			initialScope:  "",
+			newScope:      "",
+			expectedScope: "",
+		},
+		{
+			name:          "empty-initial-scope-and-non-empty-new-scope",
+			initialScope:  "",
+			newScope:      "storage:read",
+			expectedScope: "storage:read",
+		},
+		{
+			name:          "non-empty-initial-scope-and-empty-new-scope",
+			initialScope:  "existing_scope",
+			newScope:      "",
+			expectedScope: "existing_scope",
+		},
+		{
+			name:          "non-empty-initial-scope-and-non-empty-new-scope",
+			initialScope:  "existing_scope",
+			newScope:      "storage:read",
+			expectedScope: "existing_scope storage:read",
+		},
+		{
+			name:          "non-empty-initial-scope-and-multiple-new-scopes",
+			initialScope:  "existing_scope",
+			newScope:      "storage:read storage:write",
+			expectedScope: "existing_scope storage:read storage:write",
+		},
+		{
+			name:          "multiple-initial-scope-and-multiple-new-scopes",
+			initialScope:  "existing_scope1 existing_scope2",
+			newScope:      "storage:read storage:write",
+			expectedScope: "existing_scope1 existing_scope2 storage:read storage:write",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := &TokenConfig{scope: tt.initialScope}
+			config.AddRawScope(tt.newScope)
+			assert.Equal(t, tt.expectedScope, config.GetScope(), fmt.Sprintf("AddRawScope() = %v, want %v", config.scope, tt.expectedScope))
+		})
+	}
+}
+
+func TestCreateToken(t *testing.T) {
+	// Some viper pre-requisites
+	viper.Reset()
+	viper.Set("IssuerUrl", "https://my-issuer.com")
+	tDir := t.TempDir()
+	kfile := filepath.Join(tDir, "testKey")
+	viper.Set("IssuerKey", kfile)
+
+	// Generate a private key to use for the test
+	_, err := config.GetIssuerPublicJWKS()
+	assert.NoError(t, err)
+
+	// Test that the wlcg profile works
+	tokenConfig := TokenConfig{TokenProfile: WLCG, Audience: []string{"foo"}, Subject: "bar", Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+
+	assert.NoError(t, err)
+
+	// Test that the wlcg profile fails if neither sub or aud not found
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+	assert.EqualError(t, err, "Invalid tokenConfig: The 'audience' claim is required for the scitokens2 profile, but it could not be found.")
+
+	// Test that the scitokens2 profile works
+	tokenConfig = TokenConfig{TokenProfile: Scitokens2, Audience: []string{"foo"}, scope: "bar", Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+	assert.NoError(t, err)
+
+	// Test that the scitokens2 profile fails if claims not found
+	tokenConfig = TokenConfig{TokenProfile: Scitokens2, Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+	assert.EqualError(t, err, "Invalid tokenConfig: The 'audience' claim is required for the scitokens2 profile, but it could not be found.")
+
+	// Test an unrecognized profile
+	tokenConfig = TokenConfig{TokenProfile: TokenProfile("unknown"), Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+	assert.EqualError(t, err, "Invalid tokenConfig: Unsupported token profile: unknown")
+
+	// Test that additional claims can be passed into the token
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Audience: []string{"foo"}, Subject: "bar", Lifetime: time.Minute * 10, Claims: map[string]string{"foo": "bar"}}
+	token, err := tokenConfig.CreateToken()
+	require.NoError(t, err)
+	jwt, err := jwt.ParseString(token, jwt.WithVerify(false))
+	require.NoError(t, err)
+	val, found := jwt.Get("foo")
+	assert.True(t, found)
+	assert.Equal(t, "bar", val)
+
+	// Test providing issuer via claim
+	viper.Set("IssuerUrl", "")
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Audience: []string{"foo"}, Subject: "bar", Issuer: "https://localhost:9999", Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+	assert.NoError(t, err)
+
+	// Test without configured issuer
+	tokenConfig = TokenConfig{TokenProfile: WLCG, Audience: []string{"foo"}, Subject: "bar", Lifetime: time.Minute * 10}
+	_, err = tokenConfig.CreateToken()
+	assert.EqualError(t, err, "No issuer was found in the configuration file, "+
+		"and none was provided as a claim")
+}
diff --git a/utils/web_utils.go b/utils/web_utils.go
new file mode 100644
index 000000000..843a66b26
--- /dev/null
+++ b/utils/web_utils.go
@@ -0,0 +1,145 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package utils
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/pkg/errors"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+)
+
+type (
+	Server struct {
+		AuthEndpoint string `json:"auth_endpoint"`
+		Endpoint     string `json:"endpoint"`
+		Resource     string `json:"resource"`
+	}
+
+	CredentialGeneration struct {
+		BasePath      string `json:"base_path"`
+		Issuer        string `json:"issuer"`
+		MaxScopeDepth int    `json:"max_scope_depth"`
+		Strategy      string `json:"strategy"`
+		VaultIssuer   string `json:"vault_issuer"`
+		VaultServer   string `json:"vault_server"`
+	}
+
+	Namespace struct {
+		Caches               []Server             `json:"caches"`
+		Origins              []Server             `json:"origins"`
+		CredentialGeneration CredentialGeneration `json:"credential_generation"`
+		DirlistHost          string               `json:"dirlisthost"`
+		Path                 string               `json:"path"`
+		ReadHTTPS            bool                 `json:"readhttps"`
+		UseTokenOnRead       bool                 `json:"usetokenonread"`
+		WritebackHost        string               `json:"writebackhost"`
+	}
+
+	TopologyNamespacesJSON struct {
+		Caches     []Server    `json:"caches"`
+		Namespaces []Namespace `json:"namespaces"`
+	}
+)
+
+// MakeRequest makes an http request with our custom http client. It acts similarly to the http.NewRequest but
+// it only takes json as the request data.
+func MakeRequest(url string, method string, data map[string]interface{}, headers map[string]string) ([]byte, error) {
+	payload, _ := json.Marshal(data)
+	req, err := http.NewRequest(method, url, bytes.NewBuffer(payload))
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	for key, val := range headers {
+		req.Header.Set(key, val)
+	}
+	tr := config.GetTransport()
+	client := &http.Client{Transport: tr}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	// Check HTTP response -- should be 200, else something went wrong
+	body, _ := io.ReadAll(resp.Body)
+	if method == "POST" && resp.StatusCode != 201 && resp.StatusCode != 200 {
+		return body, errors.Errorf("The POST attempt to %s resulted in status code %d", url, resp.StatusCode)
+	} else if method != "POST" && resp.StatusCode != 200 {
+		return body, errors.Errorf("The %s attempt to %s replied with status code %d", method, url, resp.StatusCode)
+	}
+
+	return body, nil
+}
+
+// GetTopologyJSON returns the namespaces and caches from OSDF topology
+func GetTopologyJSON() (*TopologyNamespacesJSON, error) {
+	topoNamespaceUrl := param.Federation_TopologyNamespaceUrl.GetString()
+	if topoNamespaceUrl == "" {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusCritical, "Topology namespaces.json configuration option (`Federation.TopologyNamespaceURL`) not set")
+		return nil, errors.New("Topology namespaces.json configuration option (`Federation.TopologyNamespaceURL`) not set")
+	}
+
+	req, err := http.NewRequest("GET", topoNamespaceUrl, nil)
+	if err != nil {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusCritical, "Failure when getting OSDF namespace data from topology")
+		return nil, errors.Wrap(err, "Failure when getting OSDF namespace data from topology")
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	client := http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusCritical, "Failure when getting response for OSDF namespace data")
+		return nil, errors.Wrap(err, "Failure when getting response for OSDF namespace data")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode > 299 {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusCritical, fmt.Sprintf("Error response %v from OSDF namespace endpoint: %v", resp.StatusCode, resp.Status))
+		return nil, fmt.Errorf("Error response %v from OSDF namespace endpoint: %v", resp.StatusCode, resp.Status)
+	}
+
+	respBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusCritical, "Failure when reading OSDF namespace response")
+		return nil, errors.Wrap(err, "Failure when reading OSDF namespace response")
+	}
+
+	var namespaces TopologyNamespacesJSON
+	if err = json.Unmarshal(respBytes, &namespaces); err != nil {
+		metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusCritical, fmt.Sprintf("Failure when parsing JSON response from topology URL %v", topoNamespaceUrl))
+		return nil, errors.Wrapf(err, "Failure when parsing JSON response from topology URL %v", topoNamespaceUrl)
+	}
+
+	metrics.SetComponentHealthStatus(metrics.DirectorRegistry_Topology, metrics.StatusOK, "")
+
+	return &namespaces, nil
+}
diff --git a/web_ui/README.md b/web_ui/README.md
new file mode 100644
index 000000000..5e2fdb153
--- /dev/null
+++ b/web_ui/README.md
@@ -0,0 +1,6 @@
+A short README explaining our authorization permissions, specifically regarding tokens recieved from the URL or Header vs the login cookie.
+
+
+Tokens that are part of the HTTP Request Header e.g. `{"Authorization": "Bearer +"<token>}` and that are set in the URL Query via `Authz` are considered valid if they are signed by either the Federation jwk or the Origin jwk.
+
+However, tokens that are retrieved from the login cookie `ctx.Cookie("login")` are ONLY valid if the are signed by the Origin jwk. This can be seen in the prometheus code and how it accesses the functions in `Authorization.go`
diff --git a/web_ui/authentication.go b/web_ui/authentication.go
new file mode 100644
index 000000000..a303f1783
--- /dev/null
+++ b/web_ui/authentication.go
@@ -0,0 +1,385 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"bufio"
+	"context"
+	"crypto/ecdsa"
+	"net/http"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/gorilla/csrf"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/tg123/go-htpasswd"
+	"go.uber.org/atomic"
+	"golang.org/x/sync/errgroup"
+)
+
+type (
+	UserRole string
+	Login    struct {
+		User     string `form:"user"`
+		Password string `form:"password"`
+	}
+
+	InitLogin struct {
+		Code string `form:"code"`
+	}
+
+	PasswordReset struct {
+		Password string `form:"password"`
+	}
+
+	WhoAmIRes struct {
+		Authenticated bool     `json:"authenticated"`
+		Role          UserRole `json:"role"`
+		User          string   `json:"user"`
+	}
+)
+
+var (
+	authDB       atomic.Pointer[htpasswd.File]
+	currentCode  atomic.Pointer[string]
+	previousCode atomic.Pointer[string]
+)
+
+const (
+	AdminRole    UserRole = "admin"
+	NonAdminRole UserRole = "user"
+)
+
+// Periodically re-read the htpasswd file used for password-based authentication
+func periodicAuthDBReload(ctx context.Context) error {
+	ticker := time.NewTicker(30 * time.Second)
+	for {
+		select {
+		case <-ticker.C:
+			log.Debug("Reloading the auth database")
+			_ = doReload()
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+func configureAuthDB() error {
+	fileName := param.Server_UIPasswordFile.GetString()
+	if fileName == "" {
+		return errors.New("Location of password file not set")
+	}
+	fp, err := os.Open(fileName)
+	if err != nil {
+		return err
+	}
+	defer fp.Close()
+	scanner := bufio.NewScanner(fp)
+	scanner.Split(bufio.ScanLines)
+	hasAdmin := false
+	for scanner.Scan() {
+		user := strings.Split(scanner.Text(), ":")[0]
+		if user == "admin" {
+			hasAdmin = true
+			break
+		}
+	}
+	if !hasAdmin {
+		return errors.New("AuthDB does not have 'admin' user")
+	}
+
+	auth, err := htpasswd.New(fileName, []htpasswd.PasswdParser{htpasswd.AcceptBcrypt}, nil)
+	if err != nil {
+		return err
+	}
+	authDB.Store(auth)
+
+	return nil
+}
+
+// Get the "subject" claim from the JWT that "login" cookie stores,
+// where subject is set to be the username. Return empty string if no "login" cookie is present
+func GetUser(ctx *gin.Context) (string, error) {
+	token, err := ctx.Cookie("login")
+	if err != nil {
+		return "", nil
+	}
+	if token == "" {
+		return "", errors.New("Login cookie is empty")
+	}
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", err
+	}
+	var raw ecdsa.PrivateKey
+	if err = key.Raw(&raw); err != nil {
+		return "", errors.New("Failed to extract cookie signing key")
+	}
+	parsed, err := jwt.Parse([]byte(token), jwt.WithKey(jwa.ES256, raw.PublicKey))
+	if err != nil {
+		return "", err
+	}
+	if err = jwt.Validate(parsed); err != nil {
+		return "", err
+	}
+	return parsed.Subject(), nil
+}
+
+// Create a JWT and set the "login" cookie to store that JWT
+func setLoginCookie(ctx *gin.Context, user string) {
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		log.Errorln("Failure when loading the cookie signing key:", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Unable to create login cookies"})
+		return
+	}
+
+	scopes := []token_scopes.TokenScope{token_scopes.WebUi_Access, token_scopes.Monitoring_Query, token_scopes.Monitoring_Scrape}
+	now := time.Now()
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.GetScopeString(scopes)).
+		Issuer(param.Server_ExternalWebUrl.GetString()).
+		IssuedAt(now).
+		Expiration(now.Add(30 * time.Minute)).
+		NotBefore(now).
+		Subject(user).
+		Build()
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to build token"})
+		return
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to sign login token"})
+		return
+	}
+
+	// One cookie should be used for all path
+	ctx.SetCookie("login", string(signed), 30*60, "/", ctx.Request.URL.Host, true, true)
+	ctx.SetSameSite(http.SameSiteStrictMode)
+}
+
+// Check if user is authenticated by checking if the "login" cookie is present and set the user identity to ctx
+func AuthHandler(ctx *gin.Context) {
+	user, err := GetUser(ctx)
+	if err != nil || user == "" {
+		log.Errorln("Invalid user cookie or unable to parse user cookie:", err)
+		ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Authentication required to perform this operation"})
+	} else {
+		ctx.Set("User", user)
+		ctx.Next()
+	}
+}
+
+// checkAdmin checks if a user string has admin privilege. It returns boolean and a message
+// indicating the error message.
+//
+// Note that by default it only checks if user == "admin". If you have a custom list of admin identifiers
+// to check, you should set Registry.AdminUsers. See parameters.yaml for details.
+func CheckAdmin(user string) (isAdmin bool, message string) {
+	if user == "admin" {
+		return true, ""
+	}
+	adminList := param.Registry_AdminUsers.GetStringSlice()
+	if adminList == nil {
+		return false, "Registry.AdminUsers is not set, and user is not root user. Admin check returns false"
+	}
+	for _, admin := range adminList {
+		if user == admin {
+			return true, ""
+		}
+	}
+	return false, "You don't have permission to perform this action"
+}
+
+// adminAuthHandler checks the admin status of a logged-in user. This middleware
+// should be cascaded behind the [web_ui.AuthHandler]
+func AdminAuthHandler(ctx *gin.Context) {
+	user := ctx.GetString("User")
+	// This should be done by a regular auth handler from the upstream, but we check here just in case
+	if user == "" {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "Login required to view this page"})
+	}
+	isAdmin, msg := CheckAdmin(user)
+	if isAdmin {
+		ctx.Next()
+		return
+	} else {
+		ctx.JSON(http.StatusForbidden, gin.H{"error": msg})
+	}
+}
+
+// Handle regular username/password based login
+func loginHandler(ctx *gin.Context) {
+	db := authDB.Load()
+	if db == nil {
+		newPath := path.Join(ctx.Request.URL.Path, "..", "initLogin")
+		initUrl := ctx.Request.URL
+		initUrl.Path = newPath
+		ctx.Redirect(307, initUrl.String())
+		return
+	}
+
+	login := Login{}
+	if ctx.ShouldBind(&login) != nil {
+		ctx.JSON(400, gin.H{"error": "Missing user/password in form data"})
+		return
+	}
+	if strings.TrimSpace(login.User) == "" {
+		ctx.JSON(400, gin.H{"error": "User is required"})
+		return
+	}
+	if strings.TrimSpace(login.Password) == "" {
+		ctx.JSON(400, gin.H{"error": "Password is required"})
+		return
+	}
+	if !db.Match(login.User, login.Password) {
+		ctx.JSON(401, gin.H{"error": "Password and user didn't match"})
+		return
+	}
+
+	setLoginCookie(ctx, login.User)
+	ctx.JSON(200, gin.H{"msg": "Success"})
+}
+
+// Handle initial code-based login for admin
+func initLoginHandler(ctx *gin.Context) {
+	db := authDB.Load()
+	if db != nil {
+		ctx.JSON(400, gin.H{"error": "Authentication is already initialized"})
+		return
+	}
+	curCode := currentCode.Load()
+	if curCode == nil {
+		ctx.JSON(400, gin.H{"error": "Code-based login is not available"})
+		return
+	}
+	prevCode := previousCode.Load()
+
+	code := InitLogin{}
+	if ctx.ShouldBind(&code) != nil {
+		ctx.JSON(400, gin.H{"error": "Login code not provided"})
+		return
+	}
+
+	if code.Code != *curCode && (prevCode == nil || code.Code != *prevCode) {
+		ctx.JSON(401, gin.H{"error": "Invalid login code"})
+		return
+	}
+
+	setLoginCookie(ctx, "admin")
+}
+
+// Handle reset password
+func resetLoginHandler(ctx *gin.Context) {
+	passwordReset := PasswordReset{}
+	if ctx.ShouldBind(&passwordReset) != nil {
+		ctx.JSON(400, gin.H{"error": "Invalid password reset request"})
+		return
+	}
+
+	user := ctx.GetString("User")
+
+	if err := WritePasswordEntry(user, passwordReset.Password); err != nil {
+		log.Errorf("Password reset for user %s failed: %s", user, err)
+		ctx.JSON(500, gin.H{"error": "Failed to reset password"})
+	} else {
+		log.Infof("Password reset for user %s was successful", user)
+		ctx.JSON(200, gin.H{"msg": "Success"})
+	}
+	if err := configureAuthDB(); err != nil {
+		log.Errorln("Error in reloading authDB:", err)
+	}
+}
+
+func logoutHandler(ctx *gin.Context) {
+	ctx.SetCookie("login", "", -1, "/", ctx.Request.URL.Host, true, true)
+	ctx.SetSameSite(http.SameSiteStrictMode)
+	ctx.Set("User", "")
+	ctx.JSON(http.StatusOK, gin.H{"message": "Success"})
+}
+
+// Returns the authentication status of the current user, including user id and role
+func whoamiHandler(ctx *gin.Context) {
+	res := WhoAmIRes{}
+	if user, err := GetUser(ctx); err != nil || user == "" {
+		res.Authenticated = false
+		ctx.JSON(http.StatusOK, res)
+	} else {
+		res.Authenticated = true
+		res.User = user
+
+		// Set header to carry CSRF token
+		ctx.Header("X-CSRF-Token", csrf.Token(ctx.Request))
+		isAdmin, _ := CheckAdmin(user)
+		if isAdmin {
+			res.Role = AdminRole
+		} else {
+			res.Role = NonAdminRole
+		}
+		ctx.JSON(http.StatusOK, res)
+	}
+}
+
+// Configure the authentication endpoints for the server web UI
+func configureAuthEndpoints(ctx context.Context, router *gin.Engine, egrp *errgroup.Group) error {
+	if router == nil {
+		return errors.New("Web engine configuration passed a nil pointer")
+	}
+
+	if err := configureAuthDB(); err != nil {
+		log.Infoln("Authorization not configured (non-fatal):", err)
+	}
+
+	csrfHandler, err := config.GetCSRFHandler()
+	if err != nil {
+		return err
+	}
+
+	group := router.Group("/api/v1.0/auth")
+	group.POST("/login", loginHandler)
+	group.POST("/logout", AuthHandler, logoutHandler)
+	group.POST("/initLogin", initLoginHandler)
+	group.POST("/resetLogin", AuthHandler, resetLoginHandler)
+	// Pass csrfhanlder only to the whoami route to generate CSRF token
+	// while leaving other routes free of CSRF check (we might want to do it some time in the future)
+	group.GET("/whoami", csrfHandler, whoamiHandler)
+	group.GET("/loginInitialized", func(ctx *gin.Context) {
+		db := authDB.Load()
+		if db == nil {
+			ctx.JSON(200, gin.H{"initialized": false})
+		} else {
+			ctx.JSON(200, gin.H{"initialized": true})
+		}
+	})
+
+	egrp.Go(func() error { return periodicAuthDBReload(ctx) })
+
+	return nil
+}
diff --git a/web_ui/authentication_test.go b/web_ui/authentication_test.go
new file mode 100644
index 000000000..b33c820e3
--- /dev/null
+++ b/web_ui/authentication_test.go
@@ -0,0 +1,609 @@
+//go:build !windows
+
+package web_ui
+
+import (
+	"context"
+	"crypto/elliptic"
+	"encoding/json"
+	"fmt"
+	"math/rand"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWaitUntilLogin(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirName := t.TempDir()
+	viper.Reset()
+	viper.Set("ConfigDir", dirName)
+	config.InitConfig()
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	go func() {
+		err := waitUntilLogin(ctx)
+		require.NoError(t, err)
+	}()
+	activationCodeFile := param.Server_UIActivationCodeFile.GetString()
+	start := time.Now()
+	for {
+		time.Sleep(10 * time.Millisecond)
+		contents, err := os.ReadFile(activationCodeFile)
+		if os.IsNotExist(err) {
+			if time.Since(start) > 10*time.Second {
+				require.Fail(t, "The UI activation code file did not appear within 10 seconds")
+			}
+			continue
+		} else {
+			require.NoError(t, err)
+		}
+		contentsStr := string(contents[:len(contents)-1])
+		require.Equal(t, *currentCode.Load(), contentsStr)
+		break
+	}
+	cancel()
+	start = time.Now()
+	for {
+		time.Sleep(10 * time.Millisecond)
+		if _, err := os.Stat(activationCodeFile); err == nil {
+			if time.Since(start) > 10*time.Second {
+				require.Fail(t, "The UI activation code file was not cleaned up")
+				return
+			}
+			continue
+		} else if !os.IsNotExist(err) {
+			require.NoError(t, err)
+		}
+		break
+	}
+}
+
+func TestCodeBasedLogin(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirName := t.TempDir()
+	viper.Reset()
+	viper.Set("ConfigDir", dirName)
+	config.InitConfig()
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	err = config.GeneratePrivateKey(param.IssuerKey.GetString(), elliptic.P256())
+	require.NoError(t, err)
+
+	//Invoke the code login API with the correct code, ensure we get a valid code back
+	t.Run("With valid code", func(t *testing.T) {
+		newCode := fmt.Sprintf("%06v", rand.Intn(1000000))
+		currentCode.Store(&newCode)
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/initLogin", strings.NewReader(fmt.Sprintf(`{"code": "%s"}`, newCode)))
+		assert.NoError(t, err)
+
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+
+		//Check the HTTP response code
+		assert.Equal(t, 200, recorder.Code)
+		//Check that we get a cookie back
+		cookies := recorder.Result().Cookies()
+		foundCookie := false
+		for _, cookie := range cookies {
+			if cookie.Name == "login" {
+				foundCookie = true
+			}
+		}
+		assert.True(t, foundCookie)
+	})
+
+	//Invoke the code login with the wrong code, ensure we get a 401
+	t.Run("With invalid code", func(t *testing.T) {
+		require.True(t, param.Server_EnableUI.GetBool())
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/initLogin", strings.NewReader(`{"code": "20"}`))
+		assert.NoError(t, err)
+
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+
+		//Check the HTTP response code
+		assert.Equal(t, 401, recorder.Code)
+		assert.JSONEq(t, `{"error":"Invalid login code"}`, recorder.Body.String())
+	})
+}
+
+func TestPasswordResetAPI(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirName := t.TempDir()
+	viper.Reset()
+	viper.Set("ConfigDir", dirName)
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	err = config.GeneratePrivateKey(param.IssuerKey.GetString(), elliptic.P256())
+	require.NoError(t, err)
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+
+	//////////////////////////////SETUP////////////////////////////////
+	//Add an admin user to file to configure
+	content := "admin:password\n"
+	_, err = tempPasswdFile.WriteString(content)
+	assert.NoError(t, err, "Error writing to temp password file")
+
+	//Configure UI
+	err = configureAuthDB()
+	assert.NoError(t, err)
+
+	//Create a user for testing
+	err = WritePasswordEntry("user", "password")
+	assert.NoError(t, err, "error writing a user")
+	password := "password"
+	user := "user"
+	payload := fmt.Sprintf(`{"user": "%s", "password": "%s"}`, user, password)
+
+	//Create a request
+	req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+	assert.NoError(t, err)
+
+	req.Header.Set("Content-Type", "application/json")
+
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, req)
+
+	//Check ok http reponse
+	assert.Equal(t, http.StatusOK, recorder.Code)
+	//Check that success message returned
+	require.JSONEq(t, `{"msg":"Success"}`, recorder.Body.String())
+	//Get the cookie to pass to password reset
+	loginCookie := recorder.Result().Cookies()
+	cookieValue := loginCookie[0].Value
+
+	///////////////////////////////////////////////////////////////////
+	//Test invoking reset with valid authorization
+	t.Run("With valid authorization", func(t *testing.T) {
+		resetPayload := `{"password": "newpassword"}`
+		reqReset, err := http.NewRequest("POST", "/api/v1.0/auth/resetLogin", strings.NewReader(resetPayload))
+		assert.NoError(t, err)
+
+		reqReset.Header.Set("Content-Type", "application/json")
+
+		reqReset.AddCookie(&http.Cookie{
+			Name:  "login",
+			Value: cookieValue,
+		})
+
+		recorderReset := httptest.NewRecorder()
+		router.ServeHTTP(recorderReset, reqReset)
+
+		//Check ok http reponse
+		assert.Equal(t, 200, recorderReset.Code)
+		//Check that success message returned
+		assert.JSONEq(t, `{"msg":"Success"}`, recorderReset.Body.String())
+
+		//After password reset, test authorization with newly generated password
+		loginWithNewPasswordPayload := `{"user": "user", "password": "newpassword"}`
+
+		reqLoginWithNewPassword, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(loginWithNewPasswordPayload))
+		assert.NoError(t, err)
+
+		reqLoginWithNewPassword.Header.Set("Content-Type", "application/json")
+
+		recorderLoginWithNewPassword := httptest.NewRecorder()
+		router.ServeHTTP(recorderLoginWithNewPassword, reqLoginWithNewPassword)
+
+		//Check HTTP response code 200
+		assert.Equal(t, http.StatusOK, recorderLoginWithNewPassword.Code)
+
+		//Check that the response body contains the success message
+		assert.JSONEq(t, `{"msg":"Success"}`, recorderLoginWithNewPassword.Body.String())
+	})
+
+	//Invoking password reset without a cookie should result in failure
+	t.Run("Without valid cookie", func(t *testing.T) {
+		resetPayload := `{"password": "newpassword"}`
+		reqReset, err := http.NewRequest("POST", "/api/v1.0/auth/resetLogin", strings.NewReader(resetPayload))
+		assert.NoError(t, err)
+
+		reqReset.Header.Set("Content-Type", "application/json")
+
+		recorderReset := httptest.NewRecorder()
+		router.ServeHTTP(recorderReset, reqReset)
+
+		//Check ok http reponse
+		assert.Equal(t, 401, recorderReset.Code)
+		//Check that success message returned
+		assert.JSONEq(t, `{"error":"Authentication required to perform this operation"}`, recorderReset.Body.String())
+	})
+
+}
+
+func TestPasswordBasedLoginAPI(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	config.InitConfig()
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+
+	///////////////////////////SETUP///////////////////////////////////
+	//Add an admin user to file to configure
+	content := "admin:password\n"
+	_, err = tempPasswdFile.WriteString(content)
+	assert.NoError(t, err, "Error writing to temp password file")
+
+	//Configure UI
+	err = configureAuthDB()
+	assert.NoError(t, err)
+
+	//Create a user for testing
+	err = WritePasswordEntry("user", "password")
+	assert.NoError(t, err, "error writing a user")
+	password := "password"
+	user := "user"
+	///////////////////////////////////////////////////////////////////
+
+	//Invoke with valid password, should get a cookie back
+	t.Run("Successful Login", func(t *testing.T) {
+		payload := fmt.Sprintf(`{"user": "%s", "password": "%s"}`, user, password)
+
+		//Create a request
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+		assert.NoError(t, err)
+
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+		//Check ok http reponse
+		assert.Equal(t, http.StatusOK, recorder.Code)
+		//Check that success message returned
+		assert.JSONEq(t, `{"msg":"Success"}`, recorder.Body.String())
+		//Check for a cookie being returned
+		cookies := recorder.Result().Cookies()
+		foundCookie := false
+		for _, cookie := range cookies {
+			if cookie.Name == "login" {
+				foundCookie = true
+			}
+		}
+		assert.True(t, foundCookie)
+	})
+
+	//Invoke without a password should fail
+	t.Run("Without password", func(t *testing.T) {
+		payload := fmt.Sprintf(`{"user": "%s"}`, user)
+		//Create a request
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+		assert.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+		//Check http reponse code 400
+		assert.Equal(t, 400, recorder.Code)
+		assert.JSONEq(t, `{"error":"Password is required"}`, recorder.Body.String())
+	})
+
+	//Invoke with incorrect password should fail
+	t.Run("With incorrect password", func(t *testing.T) {
+		payload := fmt.Sprintf(`{"user": "%s", "password": "%s"}`, user, "incorrectpassword")
+		//Create a request
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+		assert.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+		//Check http reponse code 401
+		assert.Equal(t, 401, recorder.Code)
+		assert.JSONEq(t, `{"error":"Password and user didn't match"}`, recorder.Body.String())
+	})
+
+	//Invoke with incorrect user should fail
+	t.Run("With incorrect user", func(t *testing.T) {
+		payload := fmt.Sprintf(`{"user": "%s", "password": "%s"}`, "incorrectuser", password)
+		//Create a request
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+		assert.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+		//Check http reponse code 401
+		assert.Equal(t, 401, recorder.Code)
+		assert.JSONEq(t, `{"error":"Password and user didn't match"}`, recorder.Body.String())
+	})
+
+	//Invoke with invalid user, should fail
+	t.Run("Without user", func(t *testing.T) {
+		payload := fmt.Sprintf(`{"password": "%s"}`, password)
+		//Create a request
+		req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+		assert.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+		//Check http reponse code 400
+		assert.Equal(t, 400, recorder.Code)
+		assert.JSONEq(t, `{"error":"User is required"}`, recorder.Body.String())
+	})
+}
+
+func TestWhoamiAPI(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirName := t.TempDir()
+	viper.Reset()
+	config.InitConfig()
+	viper.Set("ConfigDir", dirName)
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	err = config.GeneratePrivateKey(param.IssuerKey.GetString(), elliptic.P256())
+	require.NoError(t, err)
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+
+	///////////////////////////SETUP///////////////////////////////////
+	//Add an admin user to file to configure
+	content := "admin:password\n"
+	_, err = tempPasswdFile.WriteString(content)
+	assert.NoError(t, err, "Error writing to temp password file")
+
+	//Configure UI
+	err = configureAuthDB()
+	assert.NoError(t, err)
+
+	//Create a user for testing
+	err = WritePasswordEntry("user", "password")
+	assert.NoError(t, err, "error writing a user")
+	password := "password"
+	user := "user"
+	payload := fmt.Sprintf(`{"user": "%s", "password": "%s"}`, user, password)
+
+	//Create a request
+	req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+	assert.NoError(t, err)
+
+	req.Header.Set("Content-Type", "application/json")
+
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, req)
+	//Check ok http reponse
+	assert.Equal(t, http.StatusOK, recorder.Code)
+	//Check that success message returned
+	assert.JSONEq(t, `{"msg":"Success"}`, recorder.Body.String())
+	//Get the cookie to test 'whoami'
+	loginCookie := recorder.Result().Cookies()
+	cookieValue := loginCookie[0].Value
+
+	///////////////////////////////////////////////////////////////////
+
+	//Invoked with valid cookie, should return the username in the cookie
+	t.Run("With valid cookie", func(t *testing.T) {
+		req, err = http.NewRequest("GET", "/api/v1.0/auth/whoami", nil)
+		assert.NoError(t, err)
+
+		req.AddCookie(&http.Cookie{
+			Name:  "login",
+			Value: cookieValue,
+		})
+
+		recorder = httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+
+		expectedRes := WhoAmIRes{Authenticated: true, Role: "user", User: "user"}
+		resStr, err := json.Marshal(expectedRes)
+		require.NoError(t, err)
+
+		//Check for http reponse code 200
+		assert.Equal(t, 200, recorder.Code)
+		assert.JSONEq(t, string(resStr), recorder.Body.String())
+		assert.NotZero(t, recorder.Header().Get("X-CSRF-Token"))
+	})
+	//Invoked without valid cookie, should return there is no logged-in user
+	t.Run("Without a valid cookie", func(t *testing.T) {
+		req, err = http.NewRequest("GET", "/api/v1.0/auth/whoami", nil)
+		assert.NoError(t, err)
+
+		recorder = httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+
+		expectedRes := WhoAmIRes{}
+		resStr, err := json.Marshal(expectedRes)
+		require.NoError(t, err)
+
+		//Check for http reponse code 200
+		assert.Equal(t, 200, recorder.Code)
+		assert.JSONEq(t, string(resStr), recorder.Body.String())
+	})
+}
+
+func TestAdminAuthHandler(t *testing.T) {
+	// Initialize Gin and set it to test mode
+	gin.SetMode(gin.TestMode)
+
+	// Define test cases
+	testCases := []struct {
+		name          string
+		setupUserFunc func(*gin.Context) // Function to setup user and admin list
+		expectedCode  int                // Expected HTTP status code
+		expectedError string             // Expected error message
+	}{
+		{
+			name: "user-not-logged-in",
+			setupUserFunc: func(ctx *gin.Context) {
+				viper.Set("Registry.AdminUsers", []string{"admin1", "admin2"})
+				ctx.Set("User", "")
+			},
+			expectedCode:  http.StatusUnauthorized,
+			expectedError: "Login required to view this page",
+		},
+		{
+			name: "general-admin-access",
+			setupUserFunc: func(ctx *gin.Context) {
+				viper.Set("Registry.AdminUsers", []string{})
+				ctx.Set("User", "admin")
+			},
+			expectedCode: http.StatusOK,
+		},
+		{
+			name: "specific-admin-user-access",
+			setupUserFunc: func(ctx *gin.Context) {
+				viper.Set("Registry.AdminUsers", []string{"admin1", "admin2"})
+				ctx.Set("User", "admin1")
+			},
+			expectedCode: http.StatusOK,
+		},
+		{
+			name: "non-admin-user-access",
+			setupUserFunc: func(ctx *gin.Context) {
+				viper.Set("Registry.AdminUsers", []string{"admin1", "admin2"})
+				ctx.Set("User", "user")
+			},
+			expectedCode:  http.StatusForbidden,
+			expectedError: "You don't have permission to perform this action",
+		},
+		{
+			name: "admin-list-empty",
+			setupUserFunc: func(ctx *gin.Context) {
+				viper.Set("Registry.AdminUsers", []string{})
+				ctx.Set("User", "user")
+			},
+			expectedCode:  http.StatusForbidden,
+			expectedError: "You don't have permission to perform this action",
+		},
+		{
+			name: "admin-list-multiple-users",
+			setupUserFunc: func(ctx *gin.Context) {
+				viper.Set("Registry.AdminUsers", []string{"admin1", "admin2", "admin3"})
+				ctx.Set("User", "admin2")
+			},
+			expectedCode: http.StatusOK,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			ctx, _ := gin.CreateTestContext(w)
+			tc.setupUserFunc(ctx)
+
+			AdminAuthHandler(ctx)
+
+			assert.Equal(t, tc.expectedCode, w.Code)
+			if tc.expectedError != "" {
+				assert.Contains(t, w.Body.String(), tc.expectedError)
+			}
+			viper.Reset()
+		})
+	}
+}
+
+func TestLogoutAPI(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirName := t.TempDir()
+	viper.Reset()
+	config.InitConfig()
+	viper.Set("ConfigDir", dirName)
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	err = config.GeneratePrivateKey(param.IssuerKey.GetString(), elliptic.P256())
+	require.NoError(t, err)
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+
+	///////////////////////////SETUP///////////////////////////////////
+	//Add an admin user to file to configure
+	content := "admin:password\n"
+	_, err = tempPasswdFile.WriteString(content)
+	assert.NoError(t, err, "Error writing to temp password file")
+
+	//Configure UI
+	err = configureAuthDB()
+	assert.NoError(t, err)
+
+	//Create a user for testing
+	err = WritePasswordEntry("user", "password")
+	assert.NoError(t, err, "error writing a user")
+	password := "password"
+	user := "user"
+	payload := fmt.Sprintf(`{"user": "%s", "password": "%s"}`, user, password)
+
+	//Create a request
+	req, err := http.NewRequest("POST", "/api/v1.0/auth/login", strings.NewReader(payload))
+	assert.NoError(t, err)
+
+	req.Header.Set("Content-Type", "application/json")
+
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, req)
+	//Check ok http reponse
+	assert.Equal(t, http.StatusOK, recorder.Code)
+	//Check that success message returned
+	assert.JSONEq(t, `{"msg":"Success"}`, recorder.Body.String())
+	//Get the cookie to test 'logout'
+	loginCookie := recorder.Result().Cookies()
+	cookieValue := loginCookie[0].Value
+
+	///////////////////////////////////////////////////////////////////
+
+	//Invoked with valid cookie, should return the username in the cookie
+	t.Run("With valid cookie", func(t *testing.T) {
+		req, err = http.NewRequest("POST", "/api/v1.0/auth/logout", nil)
+		assert.NoError(t, err)
+
+		req.AddCookie(&http.Cookie{
+			Name:  "login",
+			Value: cookieValue,
+		})
+
+		recorder = httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+
+		//Check for http reponse code 200
+		assert.Equal(t, 200, recorder.Code)
+		assert.Equal(t, 1, len(recorder.Result().Cookies()))
+		assert.Equal(t, "login", recorder.Result().Cookies()[0].Name)
+		assert.Greater(t, time.Now(), recorder.Result().Cookies()[0].Expires)
+	})
+	//Invoked without valid cookie, should return there is no logged-in user
+	t.Run("Without a valid cookie", func(t *testing.T) {
+		req, err = http.NewRequest("POST", "/api/v1.0/auth/logout", nil)
+		assert.NoError(t, err)
+
+		recorder = httptest.NewRecorder()
+		router.ServeHTTP(recorder, req)
+
+		//Check for http reponse code 200
+		assert.Equal(t, 401, recorder.Code)
+	})
+}
diff --git a/web_ui/authorization.go b/web_ui/authorization.go
new file mode 100644
index 000000000..2402316f9
--- /dev/null
+++ b/web_ui/authorization.go
@@ -0,0 +1,109 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/pelicanplatform/pelican/utils"
+	"github.com/pkg/errors"
+	"github.com/prometheus/common/route"
+)
+
+// Create a token for accessing Prometheus /metrics endpoint on
+// the server itself
+func createPromMetricToken() (string, error) {
+	serverURL := param.Server_ExternalWebUrl.GetString()
+	tokenExpireTime := param.Monitoring_TokenExpiresIn.GetDuration()
+
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.Monitoring_Scrape.String()).
+		Issuer(serverURL).
+		Audience([]string{serverURL}).
+		Subject(serverURL).
+		Expiration(time.Now().Add(tokenExpireTime)).
+		Build()
+	if err != nil {
+		return "", err
+	}
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to load the director's private JWK")
+	}
+
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, key))
+	if err != nil {
+		return "", err
+	}
+	return string(signed), nil
+}
+
+// Handle the authorization of Prometheus /metrics endpoint by checking
+// if a valid token is present with correct scope
+func promMetricAuthHandler(ctx *gin.Context) {
+	if strings.HasPrefix(ctx.Request.URL.Path, "/metrics") {
+		authRequired := param.Monitoring_MetricAuthorization.GetBool()
+		if !authRequired {
+			ctx.Next()
+			return
+		}
+		// Auth is granted if the request is from either
+		// 1.director scraper 2.server (self) scraper 3.authenticated web user (via cookie)
+		authOption := utils.AuthOption{
+			Sources: []utils.TokenSource{utils.Header, utils.Cookie},
+			Issuers: []utils.TokenIssuer{utils.Federation, utils.Issuer},
+			Scopes:  []string{"monitoring.scrape"}}
+
+		valid := utils.CheckAnyAuth(ctx, authOption)
+		if !valid {
+			ctx.AbortWithStatusJSON(403, gin.H{"error": "Authentication required to access this endpoint."})
+		}
+		// Valid director/self request, pass to the next handler
+		ctx.Next()
+	}
+	// We don't care about other routes for this handler
+	ctx.Next()
+}
+
+// Handle the authorization of Prometheus query engine endpoint at `/api/v1.0/prometheus`
+func promQueryEngineAuthHandler(av1 *route.Router) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		authOption := utils.AuthOption{
+			// Cookie for web user access and header for external service like Grafana to access
+			Sources: []utils.TokenSource{utils.Cookie, utils.Header},
+			Issuers: []utils.TokenIssuer{utils.Issuer},
+			Scopes:  []string{"monitoring.query"}}
+
+		exists := utils.CheckAnyAuth(c, authOption)
+		if exists {
+			av1.ServeHTTP(c.Writer, c.Request)
+		} else {
+			c.JSON(http.StatusForbidden, gin.H{"error": "Correct authorization required to access Prometheus query engine APIs"})
+		}
+	}
+}
diff --git a/web_ui/engine_test.go b/web_ui/engine_test.go
new file mode 100644
index 000000000..08e6126e3
--- /dev/null
+++ b/web_ui/engine_test.go
@@ -0,0 +1,201 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/test_utils"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+// Setup a gin engine that will serve up a /ping endpoint on a Unix domain socket.
+func setupPingEngine(t *testing.T, ctx context.Context, egrp *errgroup.Group) (chan bool, context.CancelFunc, string) {
+	dirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Logging.Level", "Debug")
+	viper.Set("ConfigDir", dirname)
+	viper.Set("Server.WebPort", 0)
+	config.InitConfig()
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	ctx, cancel := context.WithCancel(ctx)
+
+	engine, err := GetEngine()
+	require.NoError(t, err)
+
+	engine.GET("/ping", func(ctx *gin.Context) {
+		ctx.Data(http.StatusOK, "text/plain; charset=utf-8", []byte("pong"))
+	})
+
+	// Setup a domain socket instead of listening on TCP
+	socketLocation := filepath.Join(dirname, "engine.sock")
+	ln, err := net.Listen("unix", socketLocation)
+	require.NoError(t, err)
+
+	doneChan := make(chan bool)
+	egrp.Go(func() error {
+		err = runEngineWithListener(ctx, ln, engine, egrp)
+		require.NoError(t, err)
+		doneChan <- true
+		return err
+	})
+
+	transport := *config.GetTransport()
+	transport.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
+		return net.Dial("unix", socketLocation)
+	}
+	httpc := http.Client{
+		Transport: &transport,
+	}
+
+	engineReady := false
+	for idx := 0; idx < 20; idx++ {
+		time.Sleep(10 * time.Millisecond)
+		log.Debug("Checking for engine ready")
+
+		var resp *http.Response
+		resp, err = httpc.Get("https://" + param.Server_Hostname.GetString() + "/ping")
+		if err != nil {
+			continue
+		}
+		assert.Equal(t, "200 OK", resp.Status)
+		var body []byte
+		body, err = io.ReadAll(resp.Body)
+		assert.Equal(t, string(body), "pong")
+	}
+	if !engineReady {
+		require.NoError(t, err)
+	}
+
+	return doneChan, cancel, socketLocation
+}
+
+// Test the engine startup, serving a single request using
+// TLS validation, then a clean shutdown.
+func TestRunEngine(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	doneChan, cancel, _ := setupPingEngine(t, ctx, egrp)
+
+	// Shutdown the engine
+	cancel()
+	timeout := time.Tick(3 * time.Second)
+	select {
+	case ok := <-doneChan:
+		require.True(t, ok)
+	case <-timeout:
+		require.Fail(t, "Timeout when shutting down the engine")
+	}
+}
+
+// Ensure that if the TLS certificate is updated on disk then new
+// connections will use the new version.
+func TestUpdateCert(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	doneChan, pingCancel, socketLocation := setupPingEngine(t, ctx, egrp)
+	defer pingCancel()
+
+	getCurrentFingerprint := func() [sha256.Size]byte {
+
+		conn, err := net.Dial("unix", socketLocation)
+		require.NoError(t, err)
+		defer conn.Close()
+
+		tlsConfig := &tls.Config{
+			InsecureSkipVerify: true,
+			ServerName:         param.Server_WebHost.GetString(),
+		}
+		tlsConn := tls.Client(conn, tlsConfig)
+		err = tlsConn.Handshake()
+		require.NoError(t, err)
+
+		currentCert := tlsConn.ConnectionState().PeerCertificates[0]
+		return sha256.Sum256(currentCert.Raw)
+	}
+
+	// First, compare the current fingerprint against that on disk
+	currentFingerprint := getCurrentFingerprint()
+
+	certFile := param.Server_TLSCertificate.GetString()
+	keyFile := param.Server_TLSKey.GetString()
+	getDiskFingerprint := func() [sha256.Size]byte {
+		diskCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		require.NoError(t, err)
+		return sha256.Sum256(diskCert.Certificate[0])
+	}
+
+	diskFingerprint := getDiskFingerprint()
+	assert.Equal(t, currentFingerprint, diskFingerprint)
+
+	// Next, trigger a reload of the cert
+	require.NoError(t, os.Remove(certFile))
+	require.NoError(t, os.Remove(keyFile))
+	require.NoError(t, config.InitServer(ctx, config.OriginType))
+
+	newDiskFingerprint := getDiskFingerprint()
+	assert.NotEqual(t, diskFingerprint, newDiskFingerprint)
+
+	log.Debugln("Will look for updated TLS certificate")
+	sawUpdate := false
+	for idx := 0; idx < 10; idx++ {
+		time.Sleep(50 * time.Millisecond)
+		log.Debugln("Checking current fingerprint")
+		currentFingerprint := getCurrentFingerprint()
+		if currentFingerprint == newDiskFingerprint {
+			sawUpdate = true
+			break
+		} else {
+			require.Equal(t, currentFingerprint, diskFingerprint)
+		}
+	}
+	assert.True(t, sawUpdate)
+
+	cancel()
+	timeout := time.Tick(3 * time.Second)
+	select {
+	case ok := <-doneChan:
+		require.True(t, ok)
+	case <-timeout:
+		require.Fail(t, "Timeout when shutting down the engine")
+	}
+}
diff --git a/origin_ui/src/.dockerignore b/web_ui/frontend/.dockerignore
similarity index 100%
rename from origin_ui/src/.dockerignore
rename to web_ui/frontend/.dockerignore
diff --git a/origin_ui/src/.eslintrc.json b/web_ui/frontend/.eslintrc.json
similarity index 100%
rename from origin_ui/src/.eslintrc.json
rename to web_ui/frontend/.eslintrc.json
diff --git a/origin_ui/src/.gitignore b/web_ui/frontend/.gitignore
similarity index 100%
rename from origin_ui/src/.gitignore
rename to web_ui/frontend/.gitignore
diff --git a/origin_ui/src/Dockerfile b/web_ui/frontend/Dockerfile
similarity index 93%
rename from origin_ui/src/Dockerfile
rename to web_ui/frontend/Dockerfile
index 1eac7d1e8..9e6b044e5 100644
--- a/origin_ui/src/Dockerfile
+++ b/web_ui/frontend/Dockerfile
@@ -14,9 +14,10 @@
 # limitations under the License.
 #
 
-FROM node:18-alpine
+FROM node:20-alpine
 
-WORKDIR /webapp
 COPY package.json package.json
-
 RUN npm install && npm i -g next
+ENV NODE_PATH=/node_modules
+
+WORKDIR /webapp
diff --git a/web_ui/frontend/README.md b/web_ui/frontend/README.md
new file mode 100644
index 000000000..70920e1c5
--- /dev/null
+++ b/web_ui/frontend/README.md
@@ -0,0 +1,50 @@
+# Origin UI
+
+This ui is generated with Next.js.
+
+## Development
+
+### Local
+
+In production builds the website is compiled and included with the code. This step
+takes a couple minutes and is not well suited for development. Since the website
+sits on top of the api the best way to develop just the website is to run the api
+and the website separately and then use nginx to make them come from the same host
+as they would in production.
+
+#### To run the api:
+
+```shell
+# From repo root
+make web-build
+goreleaser --clean --snapshot
+docker run --rm -it -p 8444:8444 -w /app -v $PWD/dist/pelican_linux_arm64/:/app -v $PWD/local/:/etc/pelican/ pelican-dev /bin/bash
+```
+
+```shell
+# Inside the container
+cp pelican osdf
+./osdf origin serve -f https://osg-htc.org -v /tmp/stash/:/test
+```
+
+#### To run the website and the reverse proxy:
+
+First make sure that the ports are correct in `dev/nginx.conf` so that they point to
+the website and the api as expected. Then run the following command.
+
+```shell
+sh dev/run.sh
+npm run dev
+```
+
+### Docker
+
+```shell
+docker build -t origin-ui .
+```
+
+```shell
+docker run -it -p 3000:3000 -v $(pwd):/webapp origin-ui npm run dev
+```
+
+You can also run if you have node installed locally via `npm install && npm run dev`.
diff --git a/origin_ui/src/app/(dashboard)/layout.tsx b/web_ui/frontend/app/(landing)/layout.tsx
similarity index 81%
rename from origin_ui/src/app/(dashboard)/layout.tsx
rename to web_ui/frontend/app/(landing)/layout.tsx
index 86d0ca656..1e44c3874 100644
--- a/origin_ui/src/app/(dashboard)/layout.tsx
+++ b/web_ui/frontend/app/(landing)/layout.tsx
@@ -19,10 +19,9 @@
 import {Box} from "@mui/material";
 
 import {Header} from "@/components/layout/Header";
-import {Sidebar} from "@/app/(dashboard)/Sidebar";
 
 export const metadata = {
-    title: 'Origin Initialization',
+    title: 'Pelican Platform',
     description: 'Software designed to make data distribution easy',
 }
 
@@ -32,11 +31,11 @@ export default function RootLayout({
     children: React.ReactNode
 }) {
     return (
-        <Box display={"flex"} flexDirection={"row"}>
-            <Sidebar/>
-            <Box component={"main"} p={2} display={"flex"} minHeight={"100vh"} flexGrow={1}>
+        <>
+            <Header text={"Pelican Software"}/>
+            <Box component={"main"} pt={"75px"} display={"flex"} minHeight={"100vh"}>
                 {children}
             </Box>
-        </Box>
+        </>
     )
 }
diff --git a/web_ui/frontend/app/(landing)/page.tsx b/web_ui/frontend/app/(landing)/page.tsx
new file mode 100644
index 000000000..78fab8b6f
--- /dev/null
+++ b/web_ui/frontend/app/(landing)/page.tsx
@@ -0,0 +1,81 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import React, {useState, useEffect} from "react";
+import {Box, Container, Grid, Typography} from "@mui/material";
+import Link from "next/link";
+
+function TextCenteredBox({text} : {text: string}) {
+    return (
+        <Box sx={{
+            aspectRatio: 1,
+            width: "100%",
+            display: "flex",
+            textTransform: "capitalize",
+            bgcolor: "primary.light",
+            borderRadius: "1rem",
+
+        }}>
+            <Box m={"auto"}>
+                <Typography variant={"h4"} align={"center"}>{text}</Typography>
+            </Box>
+        </Box>
+    )
+}
+
+
+export default function Home() {
+
+    const [enabledServers, setEnabledServers] = useState<string[]>([])
+
+    useEffect(() => {
+
+        const getEnabledServers = async () => {
+            try {
+                const res = await fetch("/api/v1.0/servers")
+                const data = await res.json()
+                setEnabledServers(data?.servers)
+            } catch {
+                setEnabledServers(["origin", "director", "registry"])
+            }
+        }
+
+        getEnabledServers()
+    }, []);
+
+    return (
+        <Box width={"100%"} pt={5}>
+            <Container maxWidth={"xl"}>
+                <Typography pb={5} textAlign={"center"} variant={"h3"}>Pelican Services</Typography>
+                <Grid container justifyContent={"center"} spacing={2}>
+                    {enabledServers.map((service) => {
+                        return (
+                            <Grid key={service} item xs={2}>
+                                <Link href={`./${service}/index.html`}>
+                                    <TextCenteredBox text={service}/>
+                                </Link>
+                            </Grid>
+                        )
+                    })}
+                </Grid>
+            </Container>
+        </Box>
+    )
+}
diff --git a/origin_ui/src/app/initialization/code/CodeInput.tsx b/web_ui/frontend/app/(login)/components/CodeInput.tsx
similarity index 94%
rename from origin_ui/src/app/initialization/code/CodeInput.tsx
rename to web_ui/frontend/app/(login)/components/CodeInput.tsx
index 77702b78c..ae405a9a9 100644
--- a/origin_ui/src/app/initialization/code/CodeInput.tsx
+++ b/web_ui/frontend/app/(login)/components/CodeInput.tsx
@@ -18,11 +18,12 @@
 
 import {ChangeEvent, ClipboardEvent, KeyboardEvent, useRef} from "react";
 import {Grid, TextField} from "@mui/material";
-import {AppProps} from "next/app";
+
+export type Code = (number | undefined)[];
 
 interface CodeInputProps {
     length: number;
-    setCode: Function;
+    setCode: (code: Code) => void;
     submitFunction?: () => void;
 }
 
@@ -32,8 +33,8 @@ export default function CodeInput({length, setCode, submitFunction}: CodeInputPr
 
     /**
      * Set the code in the input blocks
-     * @param code: Array of digits to set
-     * @param offset: Offset to start setting the code at, if code is exact length this is set to 0
+     * @param code
+     * @param offset
      */
     function setInputs(code: number[], offset: number) {
 
@@ -54,8 +55,10 @@ export default function CodeInput({length, setCode, submitFunction}: CodeInputPr
     /**
      * Get the value of the input blocks
      */
-    function getValue() {
-        return Number(inputRefs.current.map(input => input!.value).join(""))
+    function getValue() : Code {
+        return inputRefs.current.map(input => {
+            return input!.value == "" ? undefined : Number(input!.value)
+        })
     }
 
     /**
@@ -159,4 +162,4 @@ export default function CodeInput({length, setCode, submitFunction}: CodeInputPr
         </Grid>
     )
 
-}
\ No newline at end of file
+}
diff --git a/origin_ui/src/app/initialization/code/LoadingButton.tsx b/web_ui/frontend/app/(login)/components/LoadingButton.tsx
similarity index 99%
rename from origin_ui/src/app/initialization/code/LoadingButton.tsx
rename to web_ui/frontend/app/(login)/components/LoadingButton.tsx
index 31449ab31..7cfb1880f 100644
--- a/origin_ui/src/app/initialization/code/LoadingButton.tsx
+++ b/web_ui/frontend/app/(login)/components/LoadingButton.tsx
@@ -48,4 +48,4 @@ export default function LoadingButton({loading, ...props}: LoadingButtonProps) {
             {loading ? <CircularProgress size={"1.5rem"}/> : props.children }
         </Button>
     )
-}
\ No newline at end of file
+}
diff --git a/origin_ui/src/app/initialization/password/PasswordInput.tsx b/web_ui/frontend/app/(login)/components/PasswordInput.tsx
similarity index 98%
rename from origin_ui/src/app/initialization/password/PasswordInput.tsx
rename to web_ui/frontend/app/(login)/components/PasswordInput.tsx
index 6c2d8e834..06ea5d3f1 100644
--- a/origin_ui/src/app/initialization/password/PasswordInput.tsx
+++ b/web_ui/frontend/app/(login)/components/PasswordInput.tsx
@@ -50,6 +50,7 @@ export default function PasswordInput({FormControlProps, TextFieldProps}: Passwo
             <TextField
                 label="Password"
                 id="outlined-start-adornment"
+                size={"small"}
                 sx={{ m: 1, width: '50ch' }}
                 type={showPassword ? 'text' : 'password'}
                 {...TextFieldProps}
@@ -70,4 +71,4 @@ export default function PasswordInput({FormControlProps, TextFieldProps}: Passwo
             />
         </FormControl>
     )
-}
\ No newline at end of file
+}
diff --git a/origin_ui/src/app/initialization/code/page.tsx b/web_ui/frontend/app/(login)/initialization/code/page.tsx
similarity index 54%
rename from origin_ui/src/app/initialization/code/page.tsx
rename to web_ui/frontend/app/(login)/initialization/code/page.tsx
index 84df58489..66ab3d8a7 100644
--- a/origin_ui/src/app/initialization/code/page.tsx
+++ b/web_ui/frontend/app/(login)/initialization/code/page.tsx
@@ -18,56 +18,71 @@
 
 "use client"
 
-import {Box, Typography} from "@mui/material";
+import {Box, Typography, Grow} from "@mui/material";
 import { useRouter } from 'next/navigation'
 import { useState } from "react";
 
-import CodeInput from "@/app/initialization/code/CodeInput";
-import LoadingButton from "@/app/initialization/code/LoadingButton";
+import CodeInput, {Code} from "../../components/CodeInput";
+import LoadingButton from "../../components/LoadingButton";
 
 export default function Home() {
 
     const router = useRouter()
-    let [code, _setCode] = useState <number>(0)
+    let [code, _setCode] = useState<Code>([undefined, undefined, undefined, undefined, undefined, undefined])
     let [loading, setLoading] = useState(false);
+    let [error, setError] = useState<string | undefined>(undefined);
 
-    const setCode = (code: number) => {
+    const setCode = (code: Code ) => {
 
         _setCode(code)
+        setError(undefined)
 
-        if(code.toString().length == 6) {
-            submit(code)
+        if(!code.includes(undefined)) {
+            submit(code.map(x => x!.toString()).join(""))
         }
     }
 
-    async function submit(code: number) {
+    async function submit(code: string) {
 
         setLoading(true)
 
-        console.log(`Submitting code ${code}`)
-
-        let response = await fetch("/api/v1.0/origin-ui/initLogin", {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json"
-            },
-            body: JSON.stringify({
-                "code": code.toString()
+        try {
+            let response = await fetch("/api/v1.0/auth/initLogin", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    "code": code
+                })
             })
-        })
 
-        if(response.ok){
-            router.push("../password/index.html")
-        } else {
+            if(response.ok){
+                router.push("../password/index.html")
+            } else {
+                try {
+                    let data = await response.json()
+
+                    setLoading(false)
+                    setError(response.status + ": " + data['error'])
+                } catch {
+                    setLoading(false)
+                    setError(response.status + ": " + response.statusText)
+                }
+            }
+        } catch {
             setLoading(false)
+            setError("Could not connect to server")
         }
+
     }
 
     function onSubmit(e: React.FormEvent<HTMLFormElement>) {
+
         e.preventDefault()
 
-        if(code.toString().length == 6) {
-            submit(code)
+        if(!code.includes(undefined)) {
+            submit(code.map(x => x!.toString()).join(""))
         }
     }
 
@@ -85,7 +100,17 @@ export default function Home() {
                 <Box pt={3} mx={"auto"}>
                     <form onSubmit={onSubmit} action="#">
                         <CodeInput setCode={setCode} length={6}/>
-                        <Box mt={3} display={"flex"}>
+                        <Box mt={2} display={"flex"} flexDirection={"column"}>
+                            <Grow in={error !== undefined}>
+                                <Typography
+                                    textAlign={"center"}
+                                    variant={"subtitle2"}
+                                    color={"error.main"}
+                                    mb={1}
+                                >
+                                    {error}
+                                </Typography>
+                            </Grow>
                             <LoadingButton
                                 variant="outlined"
                                 sx={{margin: "auto"}}
diff --git a/origin_ui/src/app/initialization/password/page.tsx b/web_ui/frontend/app/(login)/initialization/password/page.tsx
similarity index 65%
rename from origin_ui/src/app/initialization/password/page.tsx
rename to web_ui/frontend/app/(login)/initialization/password/page.tsx
index 33a87e777..4b95b464c 100644
--- a/origin_ui/src/app/initialization/password/page.tsx
+++ b/web_ui/frontend/app/(login)/initialization/password/page.tsx
@@ -18,13 +18,13 @@
 
 "use client"
 
-import {Box, Typography} from "@mui/material";
+import {Box, Grow, Typography} from "@mui/material";
 import { useRouter } from 'next/navigation'
 import { useState } from "react";
 
-import LoadingButton from "@/app/initialization/code/LoadingButton";
+import LoadingButton from "../../components/LoadingButton";
 
-import PasswordInput from "@/app/initialization/password/PasswordInput";
+import PasswordInput from "../../components/PasswordInput";
 
 export default function Home() {
 
@@ -32,25 +32,39 @@ export default function Home() {
     let [password, _setPassword] = useState <string>("")
     let [confirmPassword, _setConfirmPassword] = useState <string>("")
     let [loading, setLoading] = useState(false);
+    let [error, setError] = useState<string | undefined>(undefined);
 
     async function submit(password: string) {
 
         setLoading(true)
 
-        let response = await fetch("/api/v1.0/origin-ui/resetLogin", {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json"
-            },
-            body: JSON.stringify({
-                "password": password
+        try {
+            let response = await fetch("/api/v1.0/auth/resetLogin", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    "password": password
+                })
             })
-        })
 
-        if(response.ok){
-            router.push("../../")
-        } else {
+            if(response.ok){
+                router.push("/")
+            } else {
+                try {
+                    let data = await response.json()
+
+                    setLoading(false)
+                    setError(response.status + ": " + data['error'])
+                } catch {
+                    setLoading(false)
+                    setError(response.status + ": " + response.statusText)
+                }
+            }
+        } catch {
             setLoading(false)
+            setError("Could not connect to server")
         }
     }
 
@@ -59,6 +73,8 @@ export default function Home() {
 
         if(password == confirmPassword){
             submit(password)
+        } else {
+            setError("Passwords do not match")
         }
     }
 
@@ -70,7 +86,7 @@ export default function Home() {
                         Set Password
                     </Typography>
                     <Typography textAlign={"center"} variant={"h6"} component={"p"}>
-                        Set root metrics password
+                        This will become the admin password for this Pelican endpoint
                     </Typography>
                 </Box>
                 <Box pt={2} mx={"auto"}>
@@ -80,6 +96,7 @@ export default function Home() {
                                 InputProps: {
                                     onChange: (e) => {
                                         _setPassword(e.target.value)
+                                        setError(undefined)
                                     }
                                 }
                             }}/>
@@ -90,13 +107,24 @@ export default function Home() {
                                 InputProps: {
                                     onChange: (e) => {
                                         _setConfirmPassword(e.target.value)
+                                        setError(undefined)
                                     }
                                 },
                                 error: password != confirmPassword,
                                 helperText: password != confirmPassword ? "Passwords do not match" : ""
                             }}/>
                         </Box>
-                        <Box mt={3} display={"flex"}>
+                        <Box mt={2} display={"flex"} flexDirection={"column"}>
+                            <Grow in={error !== undefined}>
+                                <Typography
+                                    textAlign={"center"}
+                                    variant={"subtitle2"}
+                                    color={"error.main"}
+                                    mb={1}
+                                >
+                                    {error}
+                                </Typography>
+                            </Grow>
                             <LoadingButton
                                 variant="outlined"
                                 sx={{margin: "auto"}}
@@ -113,4 +141,4 @@ export default function Home() {
             </Box>
         </>
     )
-}
\ No newline at end of file
+}
diff --git a/origin_ui/src/app/initialization/layout.tsx b/web_ui/frontend/app/(login)/layout.tsx
similarity index 94%
rename from origin_ui/src/app/initialization/layout.tsx
rename to web_ui/frontend/app/(login)/layout.tsx
index a1e786709..f242b3430 100644
--- a/origin_ui/src/app/initialization/layout.tsx
+++ b/web_ui/frontend/app/(login)/layout.tsx
@@ -21,7 +21,7 @@ import {Box} from "@mui/material";
 import {Header} from "@/components/layout/Header";
 
 export const metadata = {
-    title: 'Origin Initialization',
+    title: 'Pelican Login',
     description: 'Software designed to make data distribution easy',
 }
 
@@ -32,7 +32,7 @@ export default function RootLayout({
 }) {
     return (
         <>
-            <Header/>
+            <Header text={"Pelican Software"}/>
             <Box component={"main"} pt={"75px"} display={"flex"} minHeight={"100vh"}>
                 {children}
             </Box>
diff --git a/web_ui/frontend/app/(login)/login/page.tsx b/web_ui/frontend/app/(login)/login/page.tsx
new file mode 100644
index 000000000..338bd2a15
--- /dev/null
+++ b/web_ui/frontend/app/(login)/login/page.tsx
@@ -0,0 +1,165 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import {Box, Grow, Typography, Button} from "@mui/material";
+import { useRouter } from 'next/navigation'
+import {useEffect, useState} from "react";
+
+import LoadingButton from "../components/LoadingButton";
+
+import PasswordInput from "../components/PasswordInput";
+
+export default function Home() {
+
+    const router = useRouter()
+    let [password, setPassword] = useState <string>("")
+    let [loading, setLoading] = useState(false);
+    let [enabledServers, setEnabledServers] = useState<string[]>([])
+    let [error, setError] = useState<string | undefined>(undefined);
+
+    useEffect(() => {
+        (async () => {
+            const response = await fetch("/api/v1.0/servers")
+            if (response.ok) {
+                const data = await response.json()
+                setEnabledServers(data?.servers)
+            }
+        })()
+    }, []);
+
+    async function submit(password: string) {
+
+        setLoading(true)
+
+        let response
+        try {
+            response = await fetch("/api/v1.0/auth/login", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    "user": "admin",
+                    "password": password
+                })
+            })
+
+            if(response.ok){
+                const url = new URL(window.location.href)
+                const returnURL = url.searchParams.get("returnURL")
+
+                router.push(returnURL ? returnURL : "../")
+            } else {
+                try {
+                    let data = await response.json()
+
+                    setLoading(false)
+                    setError(response.status + ": " + data['error'])
+                } catch {
+                    setLoading(false)
+                    setError(response.status + ": " + response.statusText)
+                }
+            }
+
+        } catch {
+            setLoading(false)
+            setError("Could not connect to server")
+        }
+    }
+
+    function onSubmit(e: React.FormEvent<HTMLFormElement>) {
+        e.preventDefault()
+
+        submit(password)
+    }
+
+    return (
+        <>
+            <Box m={"auto"} mt={12}  display={"flex"} flexDirection={"column"}>
+                <Box>
+                    <Typography textAlign={"center"} variant={"h3"} component={"h3"}>
+                        Login
+                    </Typography>
+                </Box>
+                <Box pt={2} mx={"auto"}>
+                    { enabledServers !== undefined && enabledServers.includes("registry") &&
+                        <>
+                            <Typography textAlign={"center"} variant={"h6"} component={"h2"}>
+                                For Outside Administrators
+                            </Typography>
+                            <Box display={"flex"} justifyContent={"center"} my={2} mb={3}>
+                                <Button
+                                    size={"large"}
+                                    href={"/api/v1.0/auth/cilogon/login?next_url=/view/registry/"}
+                                    variant={"contained"}
+                                >
+                                    Login with CILogon
+                                </Button>
+                            </Box>
+                            <Typography sx={{color: "#646464"}} textAlign={"center"} variant={"subtitle1"} component={"h2"}>
+                                For Registry Administrator
+                            </Typography>
+                        </>
+                    }
+                    <form onSubmit={onSubmit} action="#">
+                        <Box display={"flex"} justifyContent={"center"}>
+                            <PasswordInput
+                                FormControlProps={{
+                                    sx: {width: "50%"},
+                                }}
+                                TextFieldProps={{
+                                    InputProps: {
+                                        sx: {width: "50%"},
+                                        onChange: (e) => {
+                                            setPassword(e.target.value)
+                                            setError(undefined)
+                                        }
+                                    }
+                                }}
+                            />
+                        </Box>
+                        <Box display={"flex"} flexDirection={"column"}>
+                            <Grow in={error !== undefined}>
+                                <Typography
+                                    textAlign={"center"}
+                                    variant={"subtitle2"}
+                                    color={"error.main"}
+                                    mb={1}
+                                >
+                                    {error}
+                                </Typography>
+                            </Grow>
+                            <LoadingButton
+                                variant="outlined"
+                                sx={{margin: "auto"}}
+                                color={"primary"}
+                                type={"submit"}
+                                loading={loading}
+                            >
+                                <span>Confirm</span>
+                            </LoadingButton>
+                        </Box>
+                    </form>
+
+                </Box>
+            </Box>
+        </>
+    )
+}
diff --git a/web_ui/frontend/app/api/docs/SwaggerUI.tsx b/web_ui/frontend/app/api/docs/SwaggerUI.tsx
new file mode 100644
index 000000000..207f57163
--- /dev/null
+++ b/web_ui/frontend/app/api/docs/SwaggerUI.tsx
@@ -0,0 +1,5 @@
+'use client'
+
+import SwaggerUI from "swagger-ui-react";
+
+export default SwaggerUI
diff --git a/web_ui/frontend/app/api/docs/page.tsx b/web_ui/frontend/app/api/docs/page.tsx
new file mode 100644
index 000000000..d5937ccdb
--- /dev/null
+++ b/web_ui/frontend/app/api/docs/page.tsx
@@ -0,0 +1,16 @@
+import React from "react";
+import 'server-only'
+
+import fs from "fs"
+import path from "path"
+import SwaggerUI from "./SwaggerUI";
+import "swagger-ui-react/swagger-ui.css"
+
+const pelicanSwaggerPath = "app/api/docs/pelican-swagger.yaml"
+
+function Page() {
+    const pelicanSwagger = fs.readFileSync(path.resolve(process.cwd(), pelicanSwaggerPath), "utf-8")
+    return <SwaggerUI spec={pelicanSwagger} />
+}
+
+export default Page
diff --git a/web_ui/frontend/app/api/docs/pelican-swagger.yaml b/web_ui/frontend/app/api/docs/pelican-swagger.yaml
new file mode 100644
index 000000000..df7e2c6bd
--- /dev/null
+++ b/web_ui/frontend/app/api/docs/pelican-swagger.yaml
@@ -0,0 +1,1013 @@
+swagger: "2.0"
+info:
+  title: Pelican Server APIs
+  description:
+    "[Pelican](https://pelicanplatform.org/) provides an open-source software platform for federating
+    dataset repositories together and delivering the objects to computing capacity such as the [OSPool](https://osg-htc.org/services/open_science_pool.html)
+
+
+    This is the API documentation for various APIs in Pelican servers (director, registry, origin, etc)
+    to communicate with each other and in-between users accessing the servers.
+
+
+    Note that we use cookie authentication and authorization. We check a cookie named `login` with value being a JWT.
+    The cookie is issued after a successful call to `/api/v1.0/auth/login`. However, OpenAPI 2.0 does not support specifying cookie-based security check.
+    Therefore, as an alternative, we will add `Authentication Required` to the API description where needed.
+
+
+    For how to set up Pelican servers, please refer to the documentation at [docs.pelicanplatform.org](https://docs.pelicanplatform.org/)"
+  license:
+    name: Apache 2.0
+    url: http://www.apache.org/licenses/LICENSE-2.0
+  contact:
+    name: API Support via Pelican GitHub Issue
+    url: https://github.com/PelicanPlatform/pelican/issues
+  version: "1.0"
+basePath: /api/v1.0/
+consumes:
+  - application/json
+produces:
+  - application/json
+schemes:
+  - https
+securityDefinitions:
+  # This is a hacky way to specify Bearer token auth here because it's not actually an "apikey"
+  Bearer:
+    type: apiKey
+    name: Authorization
+    in: header
+    description: >-
+      Enter the JWT with the `Bearer` prefix, e.g. "Bearer abcde12345".
+definitions:
+  HealthStatus:
+    type: object
+    description: The health status of a server component
+    properties:
+      status:
+        type: string
+        description: The status of the component, can be one of "unknown", "warning", "ok", and "critical"
+        example: warning
+      message:
+        type: string
+        description: Optional message to describe the status
+        example: ""
+      last_update:
+        type: integer
+        description: Int64 unix time of the last status update
+        example: 1700594867
+    readOnly: true
+  WhoAmI:
+    type: object
+    description: The return data of /auth/whoami endpoint
+    properties:
+      authenticated:
+        type: boolean
+        description: If the current user is authenticated
+        example: true
+        default: false
+      role:
+        type: string
+        description: The user role. Will be either "admin" or "user"
+        example: "user"
+        default: ""
+      user:
+        type: string
+        description: The user identifier. For root user, it will be "admin".
+          For regular user from CILogon login, it will be the "sub" claim of their CILogon access token
+        example: "http://cilogon.org/serverA/users/12345"
+        default: ""
+  ErrorModel:
+    type: object
+    description: The error reponse of a request
+    properties:
+      error:
+        type: string
+        description: The detail error message
+        example: Bad request
+  SuccessModel:
+    type: object
+    description: The successful reponse of a request
+    properties:
+      msg:
+        type: string
+        description: The detail success message
+        example: Success
+  AdminMetadata:
+    type: object
+    properties:
+      user_id:
+        type: string
+        description: '"sub" claim of user JWT who requested registration'
+      description:
+        type: string
+      site_name:
+        type: string
+        description: "Name of the site"
+      institution:
+        type: string
+        description: >
+          "Unique identifier of the institution to register to.
+          For Pelican running in OSDF mode, this will be the OSG ID of the institution"
+        example: "https://osg-htc.org/iid/01y2jtd41"
+      security_contact_user_id:
+        type: string
+        description: '"sub" claim of user responsible for the security of the service'
+      status:
+        $ref: "#/definitions/RegistrationStatus"
+      approver_id:
+        type: string
+        description: '"sub" claim of user JWT who approved the service registration'
+      approved_at:
+        type: string
+        format: date-time
+        description: "Timestamp of when the registration was approved"
+      created_at:
+        type: string
+        format: date-time
+        description: "Timestamp of when the registration was created"
+      updated_at:
+        type: string
+        format: date-time
+        description: "Timestamp of the last update"
+  AdminMetadataForRegistration:
+    type: object
+    properties:
+      description:
+        type: string
+      site_name:
+        type: string
+        description: "Name of the site"
+      institution:
+        type: string
+        description: >
+          "Unique identifier of the institution to register to.
+          For Pelican running in OSDF mode, this will be the OSG ID of the institution"
+        example: "https://osg-htc.org/iid/01y2jtd41"
+      security_contact_user_id:
+        type: string
+        description: '"sub" claim of user responsible for the security of the service'
+  RegistrationStatus:
+    type: string
+    enum:
+      - Pending
+      - Approved
+      - Denied
+      - Unknown
+  NamespaceWOPubkey:
+    type: object
+    properties:
+      id:
+        type: integer
+        description: The ID of the namespace entry
+        example: 1
+      prefix:
+        type: string
+        description: The namespace prefix to register. Should be an absolute path.
+        example: "/test"
+      identity:
+        type: string
+        description: The user identity we get from CILogon if the namespace is registered via CLI with `--with-identity` flag
+      admin_metadata:
+        $ref: "#/definitions/AdminMetadata"
+  Institution:
+    type: object
+    properties:
+      id:
+        type: string
+        description: The unique ID of the institution. For Pelican running in OSDF alias, this will be OSG ID of the institution
+        example: https://osg-htc.org/iid/01y2jtd41
+      name:
+        type: string
+        description: The name of the institution
+        example: University of Wisconsin - Madison
+  Namespace:
+    type: object
+    properties:
+      id:
+        type: integer
+        description: The ID of the namespace entry
+        example: 1
+      prefix:
+        type: string
+        description: The namespace prefix to register. Should be an absolute path.
+        example: "/test"
+      identity:
+        type: string
+        description: The user identity we get from CILogon if the namespace is registered via CLI with `--identity` flag
+      pubkey:
+        type: string
+        description:
+          The public JWK from the origin that wants to register the namespace.
+          It should be a marshalled (stringfied) JSON that contains either one JWK or a JWKS
+      admin_metadata:
+        $ref: "#/definitions/AdminMetadata"
+  NamespaceForRegistration:
+    type: object
+    properties:
+      prefix:
+        type: string
+        description: The namespace prefix to register. Should be an obsolute paths
+        example: "/test"
+      pubkey:
+        type: string
+        description:
+          The public JWK from the origin that wants to register the namespace.
+          It should be a marshalled (stringfied) JSON that contains either one JWK or a JWKS
+      admin_metadata:
+        $ref: "#/definitions/AdminMetadataForRegistration"
+  RegistrationFieldType:
+    type: string
+    enum:
+      - string
+      - int
+      - enum
+      - datetime
+  RegistrationField:
+    type: object
+    properties:
+      name:
+        type: string
+        description: The name of the field available to register
+        example: "prefix"
+      type:
+        description: The data type of the field
+        $ref: "#/definitions/RegistrationFieldType"
+      required:
+        description: If this field is required for registration
+        type: boolean
+      options:
+        description: The available options if the field is "enum" type
+        type: array
+        items:
+          type: string
+          minItems: 0
+
+tags:
+  - name: auth
+    description: Authentication APIs for all servers
+  - name: common
+    description: Common APIs for all servers
+  - name: metrics
+    description: APIs for various server metrics
+  - name: registry_ui
+    description: APIs for Registry server Web UI
+paths:
+  /health:
+    get:
+      tags:
+        - "common"
+      summary: Health check endpoint for server Web engine
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: "Server Web engine is running and taking requests"
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+                example: "Web Engine Running. Time: 2024-01-10 22:32:59.637471175 +0000 UTC m=+35.515010725"
+  /config:
+    get:
+      tags:
+        - common
+      summary: Return the configuration values of the server and their type
+      description: "`Authentication Required`"
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            description: The JSON object output from viper with all config values and their type in the current server
+            example:
+              ConfigDir:
+                Type: "string"
+                Value: "/etc/pelican"
+              Debug:
+                Type: "bool"
+                Value: true
+              DisableHttpProxy:
+                Type: "bool"
+                Value: false
+              DisableProxyFallback:
+                Type: "bool"
+                Value: false
+              MinimumDownloadSpeed:
+                Type: "int"
+                Value: 0
+              Cache:
+                DataLocation:
+                  Type: "string"
+                  Value: "/run/pelican/xcache"
+                EnableVoms:
+                  Type: "bool"
+                  Value: false
+                ExportLocation:
+                  Type: "string"
+                  Value: "/"
+                Port:
+                  Type: "int"
+                  Value: 8447
+                XRootDPrefix:
+                  Type: "string"
+                  Value: ""
+        "401":
+          description: Unauthorized
+  /servers:
+    get:
+      tags:
+        - common
+      summary: Returns a list of enabled servers
+      description: "`Authentication Required`
+
+        Server names are in lower-case, sorted in alphabetical order.
+        "
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            properties:
+              servers:
+                type: array
+                items:
+                  type: string
+                  minItems: 1
+                example: ["director", "origin", "registry"]
+        "500":
+          description: Server encountered error in reading institution configuration
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /metrics/health:
+    get:
+      tags:
+        - metrics
+      summary: Returns the health status of server components
+      description: "`Authentication Required`"
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            properties:
+              status:
+                type: string
+                description: The overall health status of the server
+              components:
+                type: object
+                description: The health status of each server components
+                properties:
+                  cmsd:
+                    $ref: "#/definitions/HealthStatus"
+                  federation:
+                    $ref: "#/definitions/HealthStatus"
+                  web-ui:
+                    $ref: "#/definitions/HealthStatus"
+                  xrootd:
+                    $ref: "#/definitions/HealthStatus"
+  /auth/login:
+    post:
+      tags:
+        - auth
+      summary: Login with username and password to Pelican web UI
+      consumes:
+        - application/json
+      produces:
+        - application/json
+      parameters:
+        - in: body
+          name: userCredential
+          description: The username and password to authenticate
+          schema:
+            type: object
+            required:
+              - user
+              - password
+            properties:
+              user:
+                type: string
+              password:
+                type: string
+      responses:
+        "200":
+          description: Login succeed
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description: Invalid request, when username or password is missing
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Login failed, when username or password doesn't match the record
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /auth/initLogin:
+    post:
+      tags:
+        - auth
+      summary: Login with one-time activation code to initialize web UI
+      consumes:
+        - application/json
+      produces:
+        - application/json
+      parameters:
+        - in: body
+          name: activationCode
+          description: The 6-digit code used to initialize web UI
+          schema:
+            type: object
+            required:
+              - code
+            properties:
+              code:
+                type: string
+                example: "123456"
+      responses:
+        "200":
+          description: Login succeed
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description:
+            Invalid request, when authentication is already initialized,
+            code-based login is not available, or login code is not provided
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Login failed, when code is not valid
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /auth/resetLogin:
+    post:
+      tags:
+        - auth
+      summary: Reset the password for the user
+      description: "`Authentication Required`"
+      consumes:
+        - application/json
+      produces:
+        - application/json
+      parameters:
+        - in: body
+          name: newPassword
+          description: The new password to reset to
+          schema:
+            type: object
+            required:
+              - password
+            properties:
+              password:
+                type: string
+                description: The new password to reset to
+                example: ""
+      responses:
+        "200":
+          description: Reset succeed
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description: Invalid request request, when password is missing
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Server-side error, when failed to write the new password to auth file
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "403":
+          description: Unauthorized request, when users are not logged in
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /auth/whoami:
+    get:
+      tags:
+        - auth
+      summary: Return the authentication status of the web ui
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            $ref: "#/definitions/WhoAmI"
+          headers:
+            X-CSRF-Token:
+              description: The CSRF token that users are expected to attach as the request header for any modification requests for registry APIs (PUT/PATCH/DELETE).
+              type: string
+  /auth/loginInitialized:
+    get:
+      tags:
+        - auth
+      summary: Return the status of web UI initialization
+      description:
+        The initialization depends on if the user has used the one-time activation
+        code to set up the password for the admin user
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            description: The initialization status
+            properties:
+              initialized:
+                type: boolean
+                example: true
+  /auth/cilogon/login:
+    get:
+      tags:
+        - auth
+      summary: Redirect user to CILogon authentication page for OAuth2 third-party login
+      parameters:
+        - in: query
+          name: next_url
+          type: string
+          description: The path to redirect users to once they successfully authenticated against CILogon
+      responses:
+        "307":
+          description: Redirect user to CILogon authentication page
+        "500":
+          description: Internal server error when generating CSRF cookie for OAuth flow
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /auth/cilogon/callback:
+    get:
+      tags:
+        - "auth"
+      summary: The callback endpoint CILogon will call once the user has been successfully authenticated
+      description: Calling this URL with valid parameters will login the user to Pelican website
+      parameters:
+        - in: query
+          name: state
+          type: string
+          description: The CSRF token for validation and the next_url for redirect, in the form of `"<[16]byte>:<nextURL>"`
+        - in: query
+          name: code
+          type: string
+          description: The access token and refresh token returned from CILogon
+      responses:
+        "307":
+          description: Successfully log the user in, add login cookie, and direct user to `/` if `next_url` is empty; otherwise to `next_url`
+        "400":
+          description: Invalid request, when `state` or `token` query is invalid
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error when processing the token and handshake with CILogon
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/namespaces:
+    get:
+      tags:
+        - "registry_ui"
+      summary: Return a list of all namespaces in the registry
+      description:
+        A public API to get all namespaces in the registry. Note that `pubkey` is not included in the return data.
+
+
+        For unauthenticated users, it only returns a list of approved namespaces.
+
+        For authenticated users, it returns namespaces with any approval status.
+      parameters:
+        - name: server_type
+          in: query
+          required: false
+          description: The type of server to filter the results. The value can be either `origin` or `cache`
+          type: string
+        - name: status
+          in: query
+          required: false
+          description:
+            The approval status of the namespaces, can be `pending`, `approved`, `denied`, or `unknown`.
+
+            If `status == unknown`, internally it will match any registration with `status == ""` or `stauts == "unknown"`
+
+            For unauthenticated users, filter with `status != approved` will result in a 403 error.
+          type: string
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: array
+            items:
+              $ref: "#/definitions/NamespaceWOPubkey"
+            description: An array of namespaces
+        "400":
+          description: Invalid request parameters
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "403":
+          description: Operation forbidden, when an unauthenticated user trying to filter against `status != approval`
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+    options:
+      tags:
+        - "registry_ui"
+      summary: Return a list of field available to register
+      description: "`Authentication Required`"
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: array
+            items:
+              $ref: "#/definitions/RegistrationField"
+    post:
+      tags:
+        - "registry_ui"
+      summary: Create a new namespace registration
+      description: "`Authentication Required`"
+      consumes:
+        - application/json
+      produces:
+        - application/json
+      parameters:
+        - in: body
+          name: namespace
+          description: The namespace data to register
+          required: true
+          schema:
+            $ref: "#/definitions/NamespaceForRegistration"
+        - in: header
+          name: X-CSRF-Token
+          description: The CSRF token for protecting against Cross-Site Request Forgery (CSRF) attacks. Obtained by requesting `/api/v1.0/auth/whoami` and reading response header `X-CSRF-Token`
+          type: string
+          required: true
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description: The request data has invalid or missing field value
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Unauthorized
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/namespaces/user:
+    get:
+      tags:
+        - "registry_ui"
+      summary: Return a list of namespaces for the currently authenticated user
+      description: "`Authentication Required`"
+      parameters:
+        - name: status
+          in: query
+          required: false
+          description:
+            The approval status of the namespaces, can be `pending`, `approved`, `denied`, or `unknown`.
+
+            If `status == unknown`, internally it will match any registration with `status == ""` or `stauts == "unknown"`
+          type: string
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: array
+            items:
+              $ref: "#/definitions/NamespaceWOPubkey"
+            description: An array of namespaces
+        "400":
+          description: Invalid request parameters
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/namespaces/{id}:
+    get:
+      tags:
+        - "registry_ui"
+      summary: Return the namespace by `id`
+      description: "`Authentication Required`
+
+
+        For user with admin previlege, it returns for all valid namespace request.
+
+
+        For general users, it only returns namespace belonging to the user, or it returns 404
+        "
+      operationId: getNamespaceById
+      parameters:
+        - name: id
+          in: path
+          description: ID of the namespace to fetch
+          required: true
+          type: integer
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            $ref: "#/definitions/Namespace"
+        "400":
+          description: Invalid namespace ID
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Authentication required to perform this action
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "404":
+          description: Namespace not found, either does not exists or the user doesn't have previlege to get it
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+    put:
+      tags:
+        - "registry_ui"
+      summary: Update the namespace by `id`
+      description: "`Authentication Required`
+
+
+        For user with admin previlege, they can update any valid namespace.
+
+
+        Non-admin users can update only namespaces they own and only if the approval status is `admin_metadata.status == approved`, otherwise the endpoint returns 404.
+        "
+      operationId: updateNamespaceById
+      parameters:
+        - name: id
+          in: path
+          description: ID of the namespace to update
+          required: true
+          type: integer
+        - in: body
+          name: namespace
+          description: The namespace data to update
+          required: true
+          schema:
+            $ref: "#/definitions/NamespaceForRegistration"
+        - in: header
+          name: X-CSRF-Token
+          description: The CSRF token for protecting against Cross-Site Request Forgery (CSRF) attacks. Obtained by requesting `/api/v1.0/auth/whoami` and reading response header `X-CSRF-Token`
+          type: string
+          required: true
+      consumes:
+        - application/json
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description: Invalid namespace ID
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Authentication required to perform this action
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "403":
+          description: The user does not have previlege to update the namespace
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "404":
+          description: Namespace not found because it does not exist
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/namespaces/{id}/pubkey:
+    get:
+      tags:
+        - "registry_ui"
+      summary: Returns the public key of the namespace by id, in JWK Set format
+      description: It returns the JWK set as a downloadable attachement. Refer to https://datatracker.ietf.org/doc/html/rfc7517#section-5 for the format of JWK set
+      operationId: getNamespacePubkeyById
+      parameters:
+        - name: id
+          in: path
+          description: ID of the namespace to get public key
+          required: true
+          type: integer
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK, an attachement is returned to download
+          schema:
+            type: object
+        "400":
+          description: Invalid namespace ID
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "404":
+          description: Namespace not found, either does not exist or the user doesn't have previlege to get it
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/namespaces/{id}/approve:
+    patch:
+      tags:
+        - "registry_ui"
+      summary: Update namespace status to "approved"
+      description: "`Authentication Required`
+
+
+        Update namespace status to `approved` by namespace `id`.
+
+
+        This action requires admin previlege to perform.
+        "
+      parameters:
+        - name: id
+          in: path
+          description: ID of the namespace to update status
+          required: true
+          type: integer
+        - in: header
+          name: X-CSRF-Token
+          description: The CSRF token for protecting against Cross-Site Request Forgery (CSRF) attacks. Obtained by requesting `/api/v1.0/auth/whoami` and reading response header `X-CSRF-Token`
+          type: string
+          required: true
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description: Invalid namespace ID
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Authentication required to perform this action
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "403":
+          description: The user does not have previlege to update the namespace status
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "404":
+          description: Namespace not found because it does not exist
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/namespaces/{id}/deny:
+    patch:
+      tags:
+        - "registry_ui"
+      summary: Update namespace status to "denied"
+      description: "`Authentication Required`
+
+
+        Update namespace status to `denied` by namespace `id`.
+
+
+        This action requires admin previlege to perform.
+        "
+      parameters:
+        - name: id
+          in: path
+          description: ID of the namespace to update status
+          required: true
+          type: integer
+        - in: header
+          name: X-CSRF-Token
+          description: The CSRF token for protecting against Cross-Site Request Forgery (CSRF) attacks. Obtained by requesting `/api/v1.0/auth/whoami` and reading response header `X-CSRF-Token`
+          type: string
+          required: true
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            type: object
+            $ref: "#/definitions/SuccessModel"
+        "400":
+          description: Invalid namespace ID
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "401":
+          description: Authentication required to perform this action
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "403":
+          description: The user does not have previlege to update the namespace status
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "404":
+          description: Namespace not found because it does not exist
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Internal server error
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+  /registry_ui/institutions:
+    get:
+      tags:
+        - "registry_ui"
+      summary: Returns a list of institution names available for user to select for namespace registration
+      description: "`Authentication Required`"
+      produces:
+        - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            type: array
+            items:
+              type: object
+              $ref: "#/definitions/Institution"
+              minItems: 0
+        "401":
+          description: Authentication required to perform this action
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
+        "500":
+          description: Server didn't configure `Registry.Institutions` or server encountered error in reading institution configuration
+          schema:
+            type: object
+            $ref: "#/definitions/ErrorModel"
diff --git a/web_ui/frontend/app/config/layout.tsx b/web_ui/frontend/app/config/layout.tsx
new file mode 100644
index 000000000..cc0b43658
--- /dev/null
+++ b/web_ui/frontend/app/config/layout.tsx
@@ -0,0 +1,37 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+import {Box} from "@mui/material";
+
+export const metadata = {
+    title: 'Pelican Configuration',
+    description: 'Software designed to make data distribution easy',
+}
+
+export default function RootLayout({
+                                       children,
+                                   }: {
+    children: React.ReactNode
+}) {
+
+    return (
+        <Box display={"flex"} flexDirection={"row"}>
+            {children}
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/app/config/page.tsx b/web_ui/frontend/app/config/page.tsx
new file mode 100644
index 000000000..cf81f3fae
--- /dev/null
+++ b/web_ui/frontend/app/config/page.tsx
@@ -0,0 +1,411 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import RateGraph from "@/components/graphs/RateGraph";
+import StatusBox from "@/components/StatusBox";
+
+import {TimeDuration} from "@/components/graphs/prometheus";
+
+import {
+    Box,
+    FormControl,
+    Grid,
+    InputLabel,
+    MenuItem,
+    Select,
+    Typography,
+    Skeleton,
+    Link,
+    Container,
+    Tooltip
+} from "@mui/material";
+import React, {useEffect, useState} from "react";
+import {OverridableStringUnion} from "@mui/types";
+import {Variant} from "@mui/material/styles/createTypography";
+import {TypographyPropsVariantOverrides} from "@mui/material/Typography";
+import TextField from "@mui/material/TextField";
+import {AppRegistration, ArrowDropDown, ArrowDropUp, AssistantDirection, TripOrigin} from '@mui/icons-material';
+import {default as NextLink} from "next/link";
+import {isLoggedIn} from "@/helpers/login";
+import {Sidebar} from "@/components/layout/Sidebar";
+import Image from "next/image";
+import PelicanLogo from "@/public/static/images/PelicanPlatformLogo_Icon.png";
+import IconButton from "@mui/material/IconButton";
+import {Main} from "@/components/layout/Main";
+
+type duration = number | `${number}${"ns" | "us" | "µs" | "ms" |"s" | "m" | "h"}`;
+
+export type Config = {
+    [key: string]: ConfigValue | Config
+}
+
+interface ConfigValue {
+    Type: "bool" | "time.Duration" | "[]string" | "int" | "string"
+    Value: Config | string | number | boolean | null | string[] | number[] | duration
+}
+
+const isConfig = (value: ConfigValue | Config): boolean => {
+    return (value as Config)?.Type === undefined
+}
+
+
+function sortConfig (a: [string, ConfigValue | Config], b: [string, ConfigValue | Config]) {
+
+    if(isConfig(a[1]) && !isConfig(b[1])){
+        return 1
+    }
+    if(!isConfig(a[1]) && isConfig(b[1])){
+        return -1
+    }
+    return a[0].localeCompare(b[0])
+}
+
+const ConfigDisplayFormElement = ({name, id, configValue}:{name: string, id: string[], configValue: ConfigValue}) : JSX.Element => {
+
+    // If the value needs to be represented as a list in a text field
+    if(configValue.Type && configValue.Type.includes("[]")){
+
+        // Check for null list value
+        if(configValue.Value === null){
+            configValue.Value = []
+        }
+
+        return <TextField
+            fullWidth
+            disabled
+            size="small"
+            id={`${id.join("-")}-text-input`}
+            label={name}
+            variant={"outlined"}
+            value={(configValue.Value as Array<string>).join(", ")}
+        />
+
+    // If the value needs to be represented as a select box
+    } else if(configValue.Type === "bool"){
+
+        return (
+            <FormControl fullWidth>
+                <InputLabel id={`${id.join("-")}-number-input-label`}>{name}</InputLabel>
+                <Select
+                    disabled
+                    size="small"
+                    labelId={`${id.join("-")}-number-input-label`}
+                    id={`${id.join("-")}-number-input`}
+                    label={name}
+                    value={configValue ? 1 : 0}
+                >
+                    <MenuItem value={1}>True</MenuItem>
+                    <MenuItem value={0}>False</MenuItem>
+                </Select>
+            </FormControl>
+        )
+
+    // Catch all for other types and potentially undefined values
+    } else {
+
+        // Convert empty configValues to a space so that the text field is not collapsed
+        switch (configValue.Value){
+            case "":
+                configValue.Value = " "
+                break
+            case null:
+                configValue.Value = "None"
+        }
+
+        return <TextField
+            fullWidth
+            disabled
+            size="small"
+            id={`${id.join("-")}-text-input`}
+            label={name}
+            variant={"outlined"}
+            value={configValue.Value}
+        />
+    }
+}
+
+interface ConfigDisplayProps {
+    id: string[]
+    name: string
+    value: Config | ConfigValue
+    level: number
+}
+
+function ConfigDisplay({id, name, value, level = 1}: ConfigDisplayProps) {
+
+    console.log("ConfigDisplay", id, name, value, level)
+
+    if(name != "") {
+        id = [...id, name]
+    }
+
+    // If this is a ConfigValue then display it
+    if(!isConfig(value)){
+        return (
+            <Box pt={2} id={id.join("-")}>
+                <ConfigDisplayFormElement id={id} name={name} configValue={value as ConfigValue}/>
+            </Box>
+        )
+    }
+
+    // If this is a Config then display all of its values
+    let subValues = Object.entries(value as Config)
+    subValues.sort(sortConfig)
+
+    let configDisplays = subValues.map(([k, v]) => {return <ConfigDisplay id={id} key={k} name={k} value={v} level={level+1}/>})
+
+    let variant:  OverridableStringUnion<"inherit" | Variant, TypographyPropsVariantOverrides>
+    switch (level) {
+        case 1:
+            variant = "h1"
+            break
+        case 2:
+            variant = "h2"
+            break
+        case 3:
+            variant = "h3"
+            break
+        case 4:
+            variant = "h4"
+            break
+        case 5:
+            variant = "h5"
+            break
+        case 6:
+            variant = "h6"
+            break
+        default:
+            variant = "h6"
+    }
+
+    return (
+        <>
+            { name ? <Typography id={id.join("-")} variant={variant} component={variant} mt={2}>{name}</Typography> : undefined}
+            {configDisplays}
+        </>
+    )
+
+}
+
+interface TableOfContentsProps {
+    id: string[]
+    name: string
+    value: Config | ConfigValue
+    level: number
+}
+
+function TableOfContents({id, name, value, level = 1}: TableOfContentsProps) {
+
+    const [open, setOpen] = useState(false)
+
+    if(name != "") {
+        id = [...id, name]
+    }
+
+    let subContents = undefined
+    if(isConfig(value)){
+        let subValues = Object.entries(value)
+        subValues.sort(sortConfig)
+        subContents = subValues.map(([key, value]) => {
+            return <TableOfContents id={id} key={key} name={key} value={value} level={level+1}/>
+        })
+    }
+
+    let headerPointer = (
+        <Box
+            sx={{
+                "&:hover": {
+                    backgroundColor: "primary.light",
+                },
+                borderRadius: 1,
+                paddingX: "5px",
+                paddingLeft: 0+5*level + "px"
+            }}
+        >
+            <Link
+                href={subContents ? undefined : `#${id.join("-")}`}
+                sx={{
+                    cursor: "pointer",
+                    textDecoration: "none",
+                    color: "black",
+                    display: "flex",
+                    flexDirection: "row",
+                    justifyContent: "space-between",
+                }}
+                onClick={() => {
+                    setOpen(!open)
+                }}
+            >
+                <Typography
+                    style={{
+                        fontSize: 20 - 2*level + "px",
+                        fontWeight: subContents ? "600" : "normal",
+                    }}
+                >
+                    {name}
+                </Typography>
+                {
+                    subContents ?
+                        open ? <ArrowDropUp/> : <ArrowDropDown/> :
+                        undefined
+                }
+            </Link>
+        </Box>
+    )
+
+    return (
+        <>
+            { name ? headerPointer : undefined}
+            { subContents && level != 1  ?
+                <Box sx={{
+                    display: open ? "block" : "none",
+                    cursor: "pointer"
+                }}
+                >
+                    {subContents}
+                </Box> :
+                subContents
+            }
+        </>
+    )
+}
+
+export default function Config() {
+
+    const [config, setConfig] = useState<Config|undefined>(undefined)
+    const [enabledServers, setEnabledServers] = useState<string[]>([])
+    const [error, setError] = useState<string|undefined>(undefined)
+
+    let getConfig = async () => {
+
+        //Check if the user is logged in
+        if(!(await isLoggedIn())){
+            window.location.replace("/view/login/")
+        }
+
+        let response = await fetch("/api/v1.0/config")
+        if(response.ok) {
+            setConfig(await response.json())
+        } else {
+            setError("Failed to fetch config, response status: " + response.status)
+        }
+    }
+
+    const getEnabledServers = async () => {
+        try {
+            const res = await fetch("/api/v1.0/servers")
+            const data = await res.json()
+            setEnabledServers(data?.servers)
+        } catch {
+            setEnabledServers(["origin", "director", "registry"])
+        }
+    }
+
+    useEffect(() => {
+        getConfig()
+        getEnabledServers()
+    }, [])
+
+
+    if(error){
+        return (
+            <Box width={"100%"}>
+                <Typography variant={"h4"} component={"h2"} mb={1}>Configuration</Typography>
+                <Typography color={"error"} variant={"body1"} component={"p"} mb={1}>Error: {error}</Typography>
+            </Box>
+        )
+    }
+
+    return (
+        <>
+            <Sidebar>
+                <NextLink href={"/index.html"}>
+                    <Image
+                        src={PelicanLogo}
+                        alt={"Pelican Logo"}
+                        width={36}
+                        height={36}
+                    />
+                </NextLink>
+                { enabledServers.includes("origin") &&
+                    <Box pt={3}>
+                        <NextLink href={"/origin/index.html"}>
+                            <Tooltip title={"Origin"} placement={"right"}>
+                                <IconButton>
+                                    <TripOrigin/>
+                                </IconButton>
+                            </Tooltip>
+                        </NextLink>
+                    </Box>
+                }
+                { enabledServers.includes("director") &&
+                    <Box pt={1}>
+                        <NextLink href={"/director/index.html"}>
+                            <Tooltip title={"Director"} placement={"right"}>
+                                <IconButton>
+                                    <AssistantDirection/>
+                                </IconButton>
+                            </Tooltip>
+                        </NextLink>
+                    </Box>
+                }
+                { enabledServers.includes("registry") &&
+                    <Box pt={1}>
+                        <NextLink href={"/registry/index.html"}>
+                            <Tooltip title={"Registry"} placement={"right"}>
+                                <IconButton>
+                                    <AppRegistration/>
+                                </IconButton>
+                            </Tooltip>
+                        </NextLink>
+                    </Box>
+                }
+            </Sidebar>
+            <Main>
+                <Container maxWidth={"xl"} sx={{"mt": 2 }}>
+                    <Box width={"100%"}>
+                        <Grid container spacing={2}>
+                            <Grid item xs={7} md={8} lg={6}>
+                                <Typography variant={"h4"} component={"h2"} mb={1}>Configuration</Typography>
+                            </Grid>
+                            <Grid  item xs={5} md={4} lg={3}></Grid>
+                            <Grid item xs={7} md={8} lg={6}>
+                                <form>
+                                    {
+                                        config === undefined ?
+                                            <Skeleton  variant="rectangular" animation="wave" height={"1000px"}/> :
+                                            <ConfigDisplay id={[]} name={""} value={config} level={4}/>
+                                    }
+                                </form>
+                            </Grid>
+                            <Grid item xs={5} md={4} lg={3}>
+                                {
+                                    config === undefined ?
+                                        <Skeleton  variant="rectangular" animation="wave" height={"1000px"}/> :
+                                        <Box pt={2}><TableOfContents id={[]} name={""} value={config} level={1}/></Box>
+                                }
+                            </Grid>
+                        </Grid>
+                    </Box>
+                </Container>
+            </Main>
+        </>
+    )
+}
diff --git a/web_ui/frontend/app/director/layout.tsx b/web_ui/frontend/app/director/layout.tsx
new file mode 100644
index 000000000..7883d94d5
--- /dev/null
+++ b/web_ui/frontend/app/director/layout.tsx
@@ -0,0 +1,65 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+import {Box, Tooltip} from "@mui/material";
+
+import {Sidebar} from "@/components/layout/Sidebar";
+import Link from "next/link";
+import Image from "next/image";
+import PelicanLogo from "@/public/static/images/PelicanPlatformLogo_Icon.png";
+import IconButton from "@mui/material/IconButton";
+import BuildIcon from "@mui/icons-material/Build";
+import Main from "@/components/layout/Main";
+
+export const metadata = {
+    title: 'Pelican Director',
+    description: 'Software designed to make data distribution easy',
+}
+
+export default function RootLayout({
+                                       children,
+                                   }: {
+    children: React.ReactNode
+}) {
+    return (
+        <Box display={"flex"} flexDirection={"row"}>
+            <Sidebar>
+                <Link href={"/index.html"}>
+                    <Image
+                        src={PelicanLogo}
+                        alt={"Pelican Logo"}
+                        width={36}
+                        height={36}
+                    />
+                </Link>
+                <Box pt={1}>
+                    <Tooltip title={"Config"} placement={"right"}>
+                        <Link href={"/config/index.html"}>
+                            <IconButton>
+                                <BuildIcon/>
+                            </IconButton>
+                        </Link>
+                    </Tooltip>
+                </Box>
+            </Sidebar>
+            <Main>
+                {children}
+            </Main>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/app/director/page.tsx b/web_ui/frontend/app/director/page.tsx
new file mode 100644
index 000000000..afef66b82
--- /dev/null
+++ b/web_ui/frontend/app/director/page.tsx
@@ -0,0 +1,47 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import RateGraph from "@/components/graphs/RateGraph";
+import StatusBox from "@/components/StatusBox";
+
+import {TimeDuration} from "@/components/graphs/prometheus";
+
+import {Box, Grid, Typography} from "@mui/material";
+import FederationOverview from "@/components/FederationOverview";
+import {ServerTable} from "@/components/ServerTable";
+
+
+export default function Home() {
+
+    return (
+        <Box width={"100%"}>
+            <Grid container spacing={2}>
+                <Grid item xs={12} lg={6}>
+                    <Typography variant={"h4"}>Origins</Typography>
+                    <ServerTable type={"origin"}/>
+                </Grid>
+                <Grid item xs={12} lg={6}>
+                    <Typography variant={"h4"} >Caches</Typography>
+                    <ServerTable type={"cache"}/>
+                </Grid>
+            </Grid>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/app/favicon.ico b/web_ui/frontend/app/favicon.ico
new file mode 100644
index 000000000..a76030948
Binary files /dev/null and b/web_ui/frontend/app/favicon.ico differ
diff --git a/origin_ui/src/app/globals.css b/web_ui/frontend/app/globals.css
similarity index 70%
rename from origin_ui/src/app/globals.css
rename to web_ui/frontend/app/globals.css
index 25285967e..939db50aa 100644
--- a/origin_ui/src/app/globals.css
+++ b/web_ui/frontend/app/globals.css
@@ -58,39 +58,6 @@
   --card-border-rgb: 131, 134, 135;
 }
 
-@media (prefers-color-scheme: dark) {
-  :root {
-    --foreground-rgb: 255, 255, 255;
-    --background-start-rgb: 0, 0, 0;
-    --background-end-rgb: 0, 0, 0;
-
-    --primary-glow: radial-gradient(rgba(1, 65, 255, 0.4), rgba(1, 65, 255, 0));
-    --secondary-glow: linear-gradient(
-      to bottom right,
-      rgba(1, 65, 255, 0),
-      rgba(1, 65, 255, 0),
-      rgba(1, 65, 255, 0.3)
-    );
-
-    --tile-start-rgb: 2, 13, 46;
-    --tile-end-rgb: 2, 5, 19;
-    --tile-border: conic-gradient(
-      #ffffff80,
-      #ffffff40,
-      #ffffff30,
-      #ffffff20,
-      #ffffff10,
-      #ffffff10,
-      #ffffff80
-    );
-
-    --callout-rgb: 20, 20, 20;
-    --callout-border-rgb: 108, 108, 108;
-    --card-rgb: 100, 100, 100;
-    --card-border-rgb: 200, 200, 200;
-  }
-}
-
 * {
   box-sizing: border-box;
   padding: 0;
@@ -101,6 +68,7 @@ html,
 body {
   max-width: 100vw;
   overflow-x: hidden;
+  font-family: 'Poppins',Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;
 }
 
 body {
@@ -111,9 +79,3 @@ a {
   color: inherit;
   text-decoration: none;
 }
-
-@media (prefers-color-scheme: dark) {
-  html {
-    color-scheme: dark;
-  }
-}
diff --git a/origin_ui/src/app/layout.tsx b/web_ui/frontend/app/layout.tsx
similarity index 100%
rename from origin_ui/src/app/layout.tsx
rename to web_ui/frontend/app/layout.tsx
diff --git a/web_ui/frontend/app/origin/layout.tsx b/web_ui/frontend/app/origin/layout.tsx
new file mode 100644
index 000000000..11b4de0b1
--- /dev/null
+++ b/web_ui/frontend/app/origin/layout.tsx
@@ -0,0 +1,65 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+import {Box, Tooltip} from "@mui/material";
+
+import {Sidebar} from "@/components/layout/Sidebar";
+import Link from "next/link";
+import Image from "next/image";
+import PelicanLogo from "@/public/static/images/PelicanPlatformLogo_Icon.png";
+import IconButton from "@mui/material/IconButton";
+import BuildIcon from "@mui/icons-material/Build";
+import Main from "@/components/layout/Main";
+
+export const metadata = {
+    title: 'Pelican Origin',
+    description: 'Software designed to make data distribution easy',
+}
+
+export default function RootLayout({
+                                       children,
+                                   }: {
+    children: React.ReactNode
+}) {
+    return (
+        <Box display={"flex"} flexDirection={"row"}>
+            <Sidebar>
+                <Link href={"/index.html"}>
+                    <Image
+                        src={PelicanLogo}
+                        alt={"Pelican Logo"}
+                        width={36}
+                        height={36}
+                    />
+                </Link>
+                <Box pt={1}>
+                    <Tooltip title={"Config"} placement={"right"}>
+                        <Link href={"/config/index.html"}>
+                            <IconButton>
+                                <BuildIcon/>
+                            </IconButton>
+                        </Link>
+                    </Tooltip>
+                </Box>
+            </Sidebar>
+            <Main>
+                {children}
+            </Main>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/app/origin/page.tsx b/web_ui/frontend/app/origin/page.tsx
new file mode 100644
index 000000000..e566150b9
--- /dev/null
+++ b/web_ui/frontend/app/origin/page.tsx
@@ -0,0 +1,94 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import {Box, Grid, Typography} from "@mui/material";
+
+import RateGraph from "@/components/graphs/RateGraph";
+import StatusBox from "@/components/StatusBox";
+import {DataExportTable} from "@/components/DataExportTable";
+import {TimeDuration} from "@/components/graphs/prometheus";
+import FederationOverview from "@/components/FederationOverview";
+
+export default function Home() {
+
+    return (
+        <Box width={"100%"}>
+            <Grid container spacing={2}>
+                <Grid item xs={12} lg={4}>
+                    <Typography variant="h4">Status</Typography>
+                    <StatusBox/>
+                </Grid>
+                <Grid item xs={12} lg={8}>
+                    <Box sx={{backgroundColor: "#F6F6F6", borderRadius: "1rem"}} p={2}>
+                        <Box minHeight={"200px"}>
+                            <RateGraph
+                                rate={TimeDuration.fromString("3h")}
+                                duration={TimeDuration.fromString("7d")}
+                                resolution={TimeDuration.fromString("3h")}
+                                metrics={['xrootd_server_bytes{direction="rx"}', 'xrootd_server_bytes{direction="tx"}']}
+                                boxProps={{
+                                    maxHeight:"400px",
+                                    flexGrow:1,
+                                    justifyContent:"center",
+                                    display:"flex"
+                                }}
+                                options={{
+                                    scales: {
+                                        x: {
+                                            type: 'time',
+                                            time: {
+                                                round: 'second',
+                                            }
+                                        }
+                                    },
+                                    plugins: {
+                                        zoom: {
+                                            zoom: {
+                                                drag: {
+                                                    enabled: true,
+                                                },
+                                                mode: 'x',
+                                                // TODO - Implement smart update on zoom: onZoom: (chart) => console.log(chart)
+                                            },
+                                        },
+                                    },
+                                }}
+                                datasetOptions={[
+                                    {label: "xrootd_server_bytes{direction=\"rx\"}", borderColor: "#0071ff"},
+                                    {label: "xrootd_server_bytes{direction=\"tx\"}", borderColor: "#54ff80"}
+                                ]}
+                            />
+                        </Box>
+                    </Box>
+                </Grid>
+                <Grid item xs={12} lg={4}>
+                    <Typography variant={"h4"} component={"h2"} mb={2}>Data Exports</Typography>
+                    <Box sx={{backgroundColor: "#F6F6F6", borderRadius: "1rem", overflow: "hidden"}}>
+                        <DataExportTable/>
+                    </Box>
+                </Grid>
+                <Grid item xs={12} lg={4}>
+                    <FederationOverview/>
+                </Grid>
+            </Grid>
+
+        </Box>
+    )
+}
diff --git a/origin_ui/src/app/page.module.css b/web_ui/frontend/app/page.module.css
similarity index 98%
rename from origin_ui/src/app/page.module.css
rename to web_ui/frontend/app/page.module.css
index 4cd2210b3..f15c0ca39 100644
--- a/origin_ui/src/app/page.module.css
+++ b/web_ui/frontend/app/page.module.css
@@ -23,6 +23,7 @@
   align-items: center;
   padding: 6rem;
   min-height: 100vh;
+  z-index: 1;
 }
 
 .description {
@@ -95,11 +96,12 @@
   opacity: 20%;
   transition: opacity .5s ease-out;
   z-index: -1;
-  filter: blur(20px);
   content: "";
+  filter: blur(2px);
   position: absolute;
   top: 0; left: 0;
-  width: 120%; height: 120%;
+  width: 100%;
+  height: 120%;
   margin-left: -5%;
   margin-top: -1%;
 }
@@ -270,4 +272,3 @@
     transform: rotate(0deg);
   }
 }
-
diff --git a/web_ui/frontend/app/registry/layout.tsx b/web_ui/frontend/app/registry/layout.tsx
new file mode 100644
index 000000000..dbaf8af7d
--- /dev/null
+++ b/web_ui/frontend/app/registry/layout.tsx
@@ -0,0 +1,74 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+import {Box, Tooltip} from "@mui/material";
+
+import {Sidebar} from "@/components/layout/Sidebar";
+import Link from "next/link";
+import Image from "next/image";
+import PelicanLogo from "@/public/static/images/PelicanPlatformLogo_Icon.png";
+import IconButton from "@mui/material/IconButton";
+import {Add, Build} from "@mui/icons-material";
+import {Main} from "@/components/layout/Main";
+
+export const metadata = {
+    title: 'Pelican Registry',
+    description: 'Software designed to make data distribution easy',
+}
+
+export default function RootLayout({
+                                       children,
+                                   }: {
+    children: React.ReactNode
+}) {
+    return (
+        <Box display={"flex"} flexDirection={"row"}>
+            <Sidebar>
+                <Link href={"/registry/index.html"}>
+                    <Image
+                        src={PelicanLogo}
+                        alt={"Pelican Logo"}
+                        width={36}
+                        height={36}
+                    />
+                </Link>
+                <Box pt={1}>
+                    <Tooltip title={"Register Namespace"} placement={"right"}>
+                        <Link href={"/registry/namespace/register/index.html"}>
+                            <IconButton>
+                                <Add/>
+                            </IconButton>
+                        </Link>
+                    </Tooltip>
+                </Box>
+                <Box pt={1}>
+                    <Tooltip title={"Config"} placement={"right"}>
+                        <Link href={"/config/index.html"}>
+                            <IconButton>
+                                <Build/>
+                            </IconButton>
+                        </Link>
+                    </Tooltip>
+                </Box>
+            </Sidebar>
+            <Main>
+                {children}
+            </Main>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/app/registry/namespace/components/NamespaceForm.tsx b/web_ui/frontend/app/registry/namespace/components/NamespaceForm.tsx
new file mode 100644
index 000000000..ec1c22a79
--- /dev/null
+++ b/web_ui/frontend/app/registry/namespace/components/NamespaceForm.tsx
@@ -0,0 +1,192 @@
+import {
+    Box,
+    Button,
+    FormControl,
+    FormHelperText,
+    InputLabel,
+    MenuItem,
+    Select,
+    TextareaAutosize,
+    TextField
+} from "@mui/material";
+import React, {useEffect, useState} from "react";
+import {getServerType} from "@/components/Namespace";
+import {Namespace} from "@/components/Main";
+
+interface Institution {
+    id: string;
+    name: string;
+}
+
+interface NamespaceFormProps {
+    namespace?: Namespace;
+    handleSubmit: (e: React.FormEvent<HTMLFormElement>) => Promise<boolean>;
+}
+
+const NamespaceForm = ({
+    namespace,
+    handleSubmit
+}: NamespaceFormProps) => {
+
+    const [institutions, setInstitutions] = useState<Institution[]>([])
+    const [institution, setInstitution] = useState<string>(namespace?.admin_metadata?.institution || '')
+    const [serverType, setServerType] = useState<"origin" | "cache" | ''>(namespace !== undefined ? getServerType(namespace) : "")
+
+    useEffect(() => {
+        (async () => {
+            const url = new URL("/api/v1.0/registry_ui/institutions", window.location.origin)
+            const response = await fetch(url)
+            if (response.ok) {
+                const responseData: Institution[] = await response.json()
+                setInstitutions(responseData)
+            }
+        })()
+    }, []);
+
+    const onSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
+
+        const form = e.currentTarget
+
+        const successfulSubmit = await handleSubmit(e)
+
+        // Clear the form on successful submit
+        if (successfulSubmit) {
+            form.reset()
+            setInstitution("")
+            setServerType("")
+        }
+    }
+
+    return (
+        <form onSubmit={onSubmit}>
+            <Box pb={2}>
+                <TextField
+                    required
+                    fullWidth
+                    size={"small"}
+                    id={"prefix"}
+                    name={"prefix"}
+                    label={"Prefix"}
+                    defaultValue={namespace?.prefix || ""}
+                    variant={"outlined"}
+                    onChange={event => {
+                        if (event.target.value == "") {
+                            setServerType("")
+                        } else if (event.target.value.startsWith("/cache")) {
+                            setServerType("cache")
+                        } else {
+                            setServerType("origin")
+                        }
+                    }}
+                />
+            </Box>
+            <Box pb={2}>
+                <FormControl fullWidth size={"small"}>
+                    <InputLabel id="institution-label">Namespace Type</InputLabel>
+                    <Select
+                        labelId="institution-label"
+                        id="institution"
+                        label="Institution"
+                        value={serverType}
+                        inputProps={{readOnly: true}}
+                    >
+                        <MenuItem value={"cache"}>Cache</MenuItem>
+                        <MenuItem value={"origin"}>Origin</MenuItem>
+                    </Select>
+                    <FormHelperText>Read Only: Caches are declared with a &apos;/cache&apos; prefix</FormHelperText>
+                </FormControl>
+            </Box>
+            <Box pb={2}>
+                <TextField
+                    required
+                    fullWidth
+                    size={"small"}
+                    id={"pubkey"}
+                    name={"pubkey"}
+                    label={"Pubkey"}
+                    variant={"outlined"}
+                    multiline={true}
+                    defaultValue={namespace?.pubkey || ""}
+                    inputProps={{
+                        style: {
+                            fontFamily: "monospace",
+                            fontSize: "0.8rem",
+                            lineHeight: "0.9rem",
+                            minHeight: "1.5rem"
+                        }
+                    }}
+                    helperText="Pubkey is your origin's public JWKS. It must in JSON format, not JSON string"
+                    placeholder={`{
+    "keys": [
+        {
+            "alg": "ES256",
+            "crv": "P-256",
+            "kid": "<Your-kid>",
+            "kty": "EC",
+            "x": "",
+            "y": ""
+        }
+    ]
+}
+                    `}
+                />
+            </Box>
+            <Box pb={2}>
+                <TextField
+                    fullWidth
+                    size={"small"}
+                    id={"description"}
+                    name={"description"}
+                    label={"Description"}
+                    variant={"outlined"}
+                    defaultValue={namespace?.admin_metadata?.description || ""}
+                />
+            </Box>
+            <Box pb={2}>
+                <TextField
+                    fullWidth
+                    size={"small"}
+                    id={"site-name"}
+                    name={"site-name"}
+                    label={"Site Name"}
+                    variant={"outlined"}
+                    defaultValue={namespace?.admin_metadata?.site_name || ""}
+                />
+            </Box>
+            <Box pb={2}>
+                <FormControl required fullWidth size={"small"}>
+                    <InputLabel id="institution-label">Institution</InputLabel>
+                    <Select
+                        labelId="institution-label"
+                        id="institution"
+                        name={"institution"}
+                        label="Institution *"
+                        value={institution}
+                        onChange={event => setInstitution(event.target.value as string)}
+                    >
+                        {institutions.map(institution => <MenuItem key={institution.id}
+                                                                   value={institution.id}>{institution.name}</MenuItem>)}
+                    </Select>
+                </FormControl>
+            </Box>
+            <Box pb={2}>
+                <TextField
+                    fullWidth
+                    size={"small"}
+                    id={"Security Contact ID"}
+                    name={"security-contact-user-id"}
+                    label={"Security Contact ID"}
+                    variant={"outlined"}
+                    helperText="CILogon User Identifier of the user responsible for the security of the service"
+                    defaultValue={namespace?.admin_metadata?.security_contact_user_id || ""}
+                    placeholder="http://cilogon.org/serverA/users/12345"
+                />
+            </Box>
+            <Box pb={2}>
+                <Button type={"submit"} variant={"contained"}>Submit</Button>
+            </Box>
+        </form>
+    )
+}
+
+export default NamespaceForm
diff --git a/web_ui/frontend/app/registry/namespace/edit/page.tsx b/web_ui/frontend/app/registry/namespace/edit/page.tsx
new file mode 100644
index 000000000..498a8b2d0
--- /dev/null
+++ b/web_ui/frontend/app/registry/namespace/edit/page.tsx
@@ -0,0 +1,146 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import {
+    Box,
+    Button,
+    Grid,
+    Typography,
+    Collapse,
+    Alert,
+    Skeleton
+} from "@mui/material";
+import React, {ReactNode, useEffect, useMemo, useState} from "react";
+
+import Link from "next/link";
+
+import AuthenticatedContent from "@/components/layout/AuthenticatedContent";
+import {secureFetch} from "@/helpers/login";
+import {Namespace, Alert as AlertType} from "@/components/Main";
+import NamespaceForm from "@/app/registry/namespace/components/NamespaceForm";
+
+interface Institution {
+    id: string;
+    name: string;
+}
+
+export default function Register() {
+
+    const [id, setId] = useState<string | undefined>(undefined)
+    const [namespace, setNamespace] = useState<Namespace | undefined>(undefined)
+    const [alert, setAlert] = useState<AlertType | undefined>(undefined)
+
+
+    useEffect(() => {
+
+        const urlParams = new URLSearchParams(window.location.search);
+        const id = urlParams.get('id')
+
+        if(id === null){
+            setAlert({severity: "error", message: "No Namespace ID Provided"})
+        } else {
+            setId(id)
+        }
+
+        (async () => {
+
+            const urlParams = new URLSearchParams(window.location.search);
+            const id = urlParams.get('id');
+
+            const url = new URL(`/api/v1.0/registry_ui/namespaces/${id}`, window.location.origin)
+            const response = await fetch(url)
+            if (response.ok) {
+                const namespace: Namespace = await response.json()
+                setNamespace(namespace)
+            } else {
+                setAlert({severity: "error", message: `Failed to fetch namespace: ${id}`})
+            }
+        })()
+    }, [id])
+
+    const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
+
+        e.preventDefault()
+
+        const formData = new FormData(e.currentTarget);
+
+        try {
+            const response = await secureFetch(`/api/v1.0/registry_ui/namespaces/${id}`, {
+                body: JSON.stringify({
+                    prefix: formData.get("prefix"),
+                    pubkey: formData.get("pubkey"),
+                    admin_metadata: {
+                        description: formData.get("description"),
+                        site_name: formData.get("site-name"),
+                        institution: formData.get("institution"),
+                        security_contact_user_id: formData.get("security-contact-user-id")
+                    }
+                }),
+                method: "PUT",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                credentials: "include"
+            })
+
+            if(!response.ok){
+                try {
+                    let data = await response.json()
+                    setAlert({severity: "error", message: response.status + ": " + data['error']})
+                } catch (e) {
+                    setAlert({severity: "error", message: `Failed to edit namespace: ${formData.get("prefix")}`})
+                }
+            } else {
+                setAlert({severity: "success", message: `Successfully edited namespace: ${formData.get("prefix")}`})
+            }
+
+        } catch (e) {
+            console.error(e)
+            setAlert({severity: "error", message: `Fetch error: ${e}`})
+        }
+
+        return false
+    }
+
+    return (
+        <AuthenticatedContent width={"100%"}>
+            <Grid container spacing={2}>
+                <Grid item xs={12}>
+                    <Typography variant={"h4"} pb={3}>Namespace Registry</Typography>
+                </Grid>
+                <Grid item xs={12} lg={8} justifyContent={"space-between"}>
+                    <Typography variant={"h5"} pb={3}>Register Namespace</Typography>
+                    <Collapse in={alert !== undefined}>
+                        <Box mb={2}>
+                            <Alert severity={alert?.severity}>{alert?.message}</Alert>
+                        </Box>
+                    </Collapse>
+                    {
+                        namespace ?
+                        <NamespaceForm handleSubmit={handleSubmit} namespace={namespace}/> :
+                        <Skeleton variant="rounded" width={"100%"} height={400} />
+                    }
+                </Grid>
+                <Grid item lg={2}>
+                </Grid>
+            </Grid>
+        </AuthenticatedContent>
+    )
+}
diff --git a/web_ui/frontend/app/registry/namespace/register/page.tsx b/web_ui/frontend/app/registry/namespace/register/page.tsx
new file mode 100644
index 000000000..c6aa71e4b
--- /dev/null
+++ b/web_ui/frontend/app/registry/namespace/register/page.tsx
@@ -0,0 +1,113 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import {
+    Box,
+    Button,
+    Grid,
+    Typography,
+    TextField,
+    FormControl,
+    InputLabel,
+    Select,
+    MenuItem,
+    TextareaAutosize,
+    FormHelperText,
+    Collapse,
+    Alert
+} from "@mui/material";
+import React, {ReactNode, useEffect, useMemo, useState} from "react";
+
+import Link from "next/link";
+
+import {Alert as AlertType} from "@/components/Main";
+import NamespaceForm from "@/app/registry/namespace/components/NamespaceForm";
+import AuthenticatedContent from "@/components/layout/AuthenticatedContent";
+import {secureFetch} from "@/helpers/login";
+
+export default function Register() {
+
+    const [alert, setAlert] = useState<AlertType | undefined>(undefined)
+
+    const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) : Promise<boolean> => {
+
+        e.preventDefault()
+
+        const formData = new FormData(e.currentTarget);
+
+        try {
+            const response = await secureFetch("/api/v1.0/registry_ui/namespaces", {
+                body: JSON.stringify({
+                    prefix: formData.get("prefix"),
+                    pubkey: formData.get("pubkey"),
+                    admin_metadata: {
+                        description: formData.get("description"),
+                        site_name: formData.get("site-name"),
+                        institution: formData.get("institution"),
+                        security_contact_user_id: formData.get("security-contact-user-id")
+                    }
+                }),
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                credentials: "include"
+            })
+
+            if(!response.ok){
+                try {
+                    let data = await response.json()
+                    setAlert({severity: "error", message: response.status + ": " + data['error']})
+                } catch (e) {
+                    setAlert({severity: "error", message: `Failed to register namespace: ${formData.get("prefix")}`})
+                }
+            } else {
+                setAlert({severity: "success", message: `Successfully registered namespace: ${formData.get("prefix")}`})
+                return true
+            }
+
+        } catch (e) {
+            setAlert({severity: "error", message: `Fetch error: ${e}`})
+        }
+
+        return false
+    }
+
+    return (
+        <AuthenticatedContent width={"100%"}>
+            <Grid container spacing={2}>
+                <Grid item xs={12}>
+                    <Typography variant={"h4"} pb={3}>Namespace Registry</Typography>
+                </Grid>
+                <Grid item xs={12} lg={8} justifyContent={"space-between"}>
+                    <Typography variant={"h5"} pb={3}>Register Namespace</Typography>
+                    <Collapse in={alert !== undefined}>
+                        <Box mb={2}>
+                            <Alert severity={alert?.severity}>{alert?.message}</Alert>
+                        </Box>
+                    </Collapse>
+                    <NamespaceForm handleSubmit={handleSubmit}/>
+                </Grid>
+                <Grid item lg={2}>
+                </Grid>
+            </Grid>
+        </AuthenticatedContent>
+    )
+}
diff --git a/web_ui/frontend/app/registry/page.tsx b/web_ui/frontend/app/registry/page.tsx
new file mode 100644
index 000000000..e06ee65e3
--- /dev/null
+++ b/web_ui/frontend/app/registry/page.tsx
@@ -0,0 +1,148 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import {Box, Button, Grid, Typography, Skeleton, Alert, Collapse} from "@mui/material";
+import React, {useEffect, useMemo, useState} from "react";
+
+import {PendingCard, Card, NamespaceCardSkeleton, CreateNamespaceCard} from "@/components/Namespace";
+import Link from "next/link";
+import {Namespace, Alert as AlertType} from "@/components/Main";
+import UnauthenticatedContent from "@/components/layout/UnauthenticatedContent";
+import {Authenticated, getAuthenticated, isLoggedIn} from "@/helpers/login";
+
+
+export default function Home() {
+
+    const [data, setData] = useState<Namespace[] | undefined>(undefined);
+    const [alert, setAlert] = useState<AlertType | undefined>(undefined)
+    const [authenticated, setAuthenticated] = useState<Authenticated | undefined>(undefined)
+
+    const getData = async () => {
+
+        let data : Namespace[] = []
+
+        const url = new URL("/api/v1.0/registry_ui/namespaces", window.location.origin)
+
+        const response = await fetch(url)
+        if (response.ok) {
+            const responseData: Namespace[] = await response.json()
+            responseData.sort((a, b) => a.id > b.id ? 1 : -1)
+            responseData.forEach((namespace) => {
+                if (namespace.prefix.startsWith("/cache")) {
+                    namespace.type = "cache"
+                } else {
+                    namespace.type = "origin"
+                }
+            })
+            data = responseData
+        }
+
+        return data
+    }
+
+    const _setData = async () => {setData(await getData())}
+
+    useEffect(() => {
+        _setData();
+        (async () => {
+            if(await isLoggedIn()){
+                setAuthenticated(getAuthenticated() as Authenticated)
+            }
+        })();
+    }, [])
+
+    const pendingData = useMemo(
+        () => data?.filter(
+            (namespace) => namespace.admin_metadata.status === "Pending" &&
+                (authenticated?.user == namespace.admin_metadata.user_id || authenticated?.role == "admin")
+                ), [data, authenticated]
+    )
+    const approvedCacheData = useMemo(
+        () => data?.filter(
+            (namespace) => namespace.admin_metadata.status === "Approved" && namespace.type == "cache"
+        ),
+        [data]
+    )
+    const approvedOriginData = useMemo(
+        () => data?.filter(
+            (namespace) => namespace.admin_metadata.status === "Approved" && namespace.type == "origin"
+        ),
+        [data]
+    )
+
+    return (
+        <Box width={"100%"}>
+            <Grid container spacing={2}>
+                <Grid item xs={12} lg={6} xl={4}>
+                    <Typography variant={"h4"}>Namespace Registry</Typography>
+                    <Collapse in={alert !== undefined}>
+                        <Box mt={2}>
+                            <Alert severity={alert?.severity}>{alert?.message}</Alert>
+                        </Box>
+                    </Collapse>
+                </Grid>
+                <Grid item lg={6} xl={8}>
+                </Grid>
+                <Grid item xs={12} lg={6} xl={4} justifyContent={"space-between"}>
+                    <UnauthenticatedContent pb={2}>
+                        <Typography variant={"body1"}>
+                            Login to register new namespaces.
+                            <Button sx={{ml:2}} variant={"contained"} size={"small"} color={"primary"} href={"/view/login/index.html"}>Login</Button>
+                        </Typography>
+                    </UnauthenticatedContent>
+                    {
+                        pendingData && pendingData.length > 0 &&
+                        <Grid item xs={12}>
+                            <Typography variant={"h5"} pb={2}>Pending Registrations</Typography>
+                            <Typography variant={"subtitle1"} pb={2}>
+                                {authenticated !== undefined && authenticated?.role == "admin" && "Awaiting approval from you."}
+                                {authenticated !== undefined && authenticated?.role != "admin" && "Awaiting approval from registry administrators."}
+                            </Typography>
+
+                            {pendingData.map((namespace) => <PendingCard key={namespace.id} namespace={namespace} authenticated={authenticated} onAlert={(a) => setAlert(a)} onUpdate={_setData}/>)}
+                        </Grid>
+                    }
+
+                    <Typography variant={"h5"} py={2}>Public Namespaces</Typography>
+
+                    <Typography variant={"subtitle1"}>
+                        {authenticated !== undefined && authenticated?.role == "admin" &&
+                            "As an administrator, you can edit Public Namespaces by click the pencil button"
+                        }
+                        {authenticated !== undefined && authenticated?.role != "admin" &&
+                            "Public Namespaces are approved by the registry administrators. To edit a Namespace you own please contact the registry administrators."
+                        }
+                    </Typography>
+
+                    <Typography variant={"h6"} py={2}>Origins</Typography>
+                    { approvedOriginData !== undefined ? approvedOriginData.map((namespace) => <Card key={namespace.id} namespace={namespace} authenticated={authenticated}/>) : <NamespaceCardSkeleton/> }
+                    { approvedOriginData !== undefined && approvedOriginData.length === 0 && <CreateNamespaceCard text={"Register Origin"}/>}
+
+                    <Typography variant={"h6"} py={2}>Caches</Typography>
+                    { approvedCacheData !== undefined ? approvedCacheData.map((namespace) => <Card key={namespace.id} namespace={namespace} authenticated={authenticated}/>) : <NamespaceCardSkeleton/> }
+                    { approvedCacheData !== undefined && approvedCacheData.length === 0 && <CreateNamespaceCard text={"Register Cache"}/>}
+
+                </Grid>
+                <Grid item lg={6} xl={8}>
+                </Grid>
+            </Grid>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/components/Cell.tsx b/web_ui/frontend/components/Cell.tsx
new file mode 100644
index 000000000..b46e3caf8
--- /dev/null
+++ b/web_ui/frontend/components/Cell.tsx
@@ -0,0 +1,45 @@
+import React, {FunctionComponent, useEffect, useRef, useState} from "react";
+import {Button, ButtonProps, TableCell} from "@mui/material";
+
+export const TableCellOverflow: FunctionComponent<any> = ({ children, ...props }) => {
+
+    const cellRef = useRef<HTMLTableCellElement>(null);
+    const [overflow, setOverflow] = useState<boolean>(false);
+
+    useEffect(() => {
+        if(cellRef.current) {
+            setOverflow(cellRef.current.scrollWidth > cellRef.current.clientWidth)
+        }
+    }, [])
+
+    return (
+        <TableCell
+            ref={cellRef}
+            sx={{
+                overflowX: "scroll",
+                whiteSpace: "nowrap",
+                boxShadow: overflow ? "inset -13px 0px 20px -21px rgba(0,0,0,0.75)" : "none",
+                border: "solid #ececec 1px",
+                ...props?.sx
+            }}>
+            {String(children)}
+        </TableCell>
+    )
+}
+
+export const TableCellButton: FunctionComponent<any> = ({ children, ...props } : ButtonProps) => {
+
+        return (
+            <TableCell
+                sx={{
+                    textAlign: "center",
+                    border: "solid #ececec 1px",
+                    padding: "0px",
+                    ...props?.sx
+                }}>
+                <Button {...props}>
+                    {children}
+                </Button>
+            </TableCell>
+        )
+}
diff --git a/web_ui/frontend/components/DataExportTable.tsx b/web_ui/frontend/components/DataExportTable.tsx
new file mode 100644
index 000000000..9b9a2f32c
--- /dev/null
+++ b/web_ui/frontend/components/DataExportTable.tsx
@@ -0,0 +1,107 @@
+import {Table, TableCell, TableBody, TableContainer, TableHead, TableRow, Paper, Typography, Box} from '@mui/material';
+import React, {FunctionComponent, ReactElement, useEffect, useMemo, useRef, useState} from "react";
+import {Skeleton} from "@mui/material";
+
+
+
+interface Record {
+    [key: string]: string | number | boolean | null
+}
+
+interface ExportData extends Record {
+    "Type": string
+    "Local Path": string
+    "Namespace Prefix": string
+}
+
+export const TableCellOverflow: FunctionComponent<any> = ({ children, ...props }) => {
+
+    const cellRef = useRef<HTMLTableCellElement>(null);
+    const [overflow, setOverflow] = useState<boolean>(false);
+
+    useEffect(() => {
+        if(cellRef.current) {
+            setOverflow(cellRef.current.scrollWidth > cellRef.current.clientWidth)
+        }
+    }, [])
+
+    return (
+        <TableCell
+            ref={cellRef}
+            sx={{
+                overflowX: "scroll",
+                whiteSpace: "nowrap",
+                boxShadow: overflow ? "inset -13px 0px 20px -21px rgba(0,0,0,0.75)" : "none",
+                ...props?.sx
+        }}>
+            {children}
+        </TableCell>
+    )
+}
+
+export const RecordTable = ({ data }: { data: Record[] }): ReactElement  => {
+    return (
+        <TableContainer>
+            <Table sx={{tableLayout: "fixed"}}>
+                <TableHead>
+                    <TableRow>
+                        {Object.keys(data[0]).map((key, index) => (
+                            <TableCell key={index} sx={{width: index == 0 ? "20%" : "40%"}}>{key}</TableCell>
+                        ))}
+                    </TableRow>
+                </TableHead>
+                <TableBody>
+                    {data.map((record, index) => (
+                        <TableRow key={index}>
+                            {Object.values(record).map((value, index) => (
+                                <TableCellOverflow key={index} sx={{width: index == 0 ? "20%" : "40%"}}>{value == null ? "NULL" : value}</TableCellOverflow>
+                            ))}
+                        </TableRow>
+                    ))}
+                </TableBody>
+            </Table>
+        </TableContainer>
+    )
+}
+
+
+export const DataExportTable = () => {
+
+    const [data, setData] = useState<ExportData[] | undefined>(undefined);
+    const [error, setError] = useState<string | undefined>(undefined);
+
+
+    const getData = async () => {
+        let response = await fetch("/api/v1.0/config")
+        if (response.ok) {
+            const responseData = await response.json()
+
+            setData([{
+                "Type": "POSIX",
+                "Local Path": ["", undefined].includes(responseData?.Xrootd?.Mount?.Value) ? "NULL" : responseData?.Xrootd?.Mount?.Value,
+                "Namespace Prefix": ["", undefined].includes(responseData?.Origin?.NamespacePrefix?.Value) ? "NULL" : responseData?.Origin?.NamespacePrefix?.Value
+            }])
+
+        } else {
+            setError("Failed to fetch config, response status: " + response.status)
+        }
+    }
+
+    useEffect(() => {
+        getData()
+    }, [])
+
+    if(error){
+        return (
+            <Box p={1}>
+                <Typography sx={{color: "red"}} variant={"subtitle2"}>{error}</Typography>
+            </Box>
+        )
+    }
+
+    return (
+        <>
+            {data ? <RecordTable data={data} /> : <Skeleton variant={"rectangular"} height={200} width={"100%"} />}
+        </>
+    )
+}
diff --git a/web_ui/frontend/components/DataTable.tsx b/web_ui/frontend/components/DataTable.tsx
new file mode 100644
index 000000000..be0403721
--- /dev/null
+++ b/web_ui/frontend/components/DataTable.tsx
@@ -0,0 +1,59 @@
+import React, {ReactElement, useMemo} from "react";
+import {Table, TableBody, TableCell, TableContainer, TableHead, TableRow} from "@mui/material";
+
+export interface ColumnMap {
+    [key: string]: Column
+}
+
+export interface Column {
+    name: string
+    cellNode: React.JSX.ElementType
+}
+
+export interface Record {
+    [key: string]: string | number | boolean | null
+}
+
+const DataTable = ({ columnMap, data }: { columnMap: ColumnMap, data: Record[] }): ReactElement  => {
+
+    // If there is data then show, if not then indicate no data
+    const rows = useMemo(() => {
+        if(data.length !==0) {
+            return data.map((record, index) => (
+                <TableRow key={index}>
+                    {Object.entries(columnMap).map(([key, column], index) => {
+                        const CellNode = column.cellNode
+                        return <CellNode key={index}>{record[key]}</CellNode>
+                    })}
+                </TableRow>
+            ))
+        } else {
+            return (
+                <TableRow>
+                    {Object.entries(columnMap).map(([key, column], index) => {
+                        return <TableCell key={index}>No Data</TableCell>
+                    })}
+                </TableRow>
+            )
+        }
+    }, [data])
+
+    return (
+        <TableContainer sx={{maxHeight: "500px"}}>
+            <Table stickyHeader={true} sx={{tableLayout: "fixed"}}>
+                <TableHead>
+                    <TableRow>
+                        {Object.values(columnMap).map((column, index) => (
+                            <TableCell key={index}>{column.name}</TableCell>
+                        ))}
+                    </TableRow>
+                </TableHead>
+                <TableBody>
+                    {rows}
+                </TableBody>
+            </Table>
+        </TableContainer>
+    )
+}
+
+export default DataTable
diff --git a/web_ui/frontend/components/FederationOverview.tsx b/web_ui/frontend/components/FederationOverview.tsx
new file mode 100644
index 000000000..62b93efdf
--- /dev/null
+++ b/web_ui/frontend/components/FederationOverview.tsx
@@ -0,0 +1,87 @@
+'use client'
+
+import LaunchIcon from '@mui/icons-material/Launch';
+import {useEffect, useState} from "react";
+import {Config} from "@/app/config/page";
+import {Box, Typography} from "@mui/material";
+import {isLoggedIn} from "@/helpers/login";
+import Link from "next/link";
+
+
+const LinkBox = ({href, text} : {href: string, text: string}) => {
+    return (
+        <Link href={href}>
+            <Box p={1} px={2} display={"flex"} flexDirection={"row"} bgcolor={"info.light"} borderRadius={2} mb={1}>
+                <Typography sx={{pb: 0}}>
+                    {text}
+                </Typography>
+                <Box ml={"auto"} my={"auto"} display={"flex"}>
+                    <LaunchIcon/>
+                </Box>
+            </Box>
+        </Link>
+    )
+}
+
+const FederationOverview = () => {
+
+    const [config, setConfig] = useState<{ [key: string] : string | undefined} | undefined>(undefined)
+
+    let getConfig = async () => {
+
+        //Check if the user is logged in
+        if(!(await isLoggedIn())){
+            window.location.replace("/view/login/")
+        }
+
+        let response = await fetch("/api/v1.0/config")
+        if(response.ok) {
+            const responseData = await response.json() as Config
+
+            setConfig({
+                JwkUrl: (responseData?.Federation as Config)?.NamespaceUrl?.Value as undefined | string,
+                NamespaceUrl: (responseData?.Federation as Config)?.NamespaceUrl?.Value as undefined | string,
+                DirectorUrl: (responseData?.Federation as Config)?.DirectorUrl?.Value as undefined | string,
+                TopologyNamespaceUrl: (responseData?.Federation as Config)?.TopologyNamespaceUrl?.Value as undefined | string,
+                DiscoveryUrl: (responseData?.Federation as Config)?.DiscoveryUrl?.Value as undefined | string,
+            })
+        } else {
+            console.error("Failed to fetch config for Federation Overview, response status: " + response.status)
+        }
+    }
+
+    useEffect(() => {
+        getConfig()
+    }, [])
+
+    if(config === undefined) {
+        return
+    }
+
+    console.log(config)
+
+    return (
+
+        <Box>
+            {!Object.values(config).every(x => x == undefined) ? <Typography variant={"h4"} component={"h2"}  mb={2}>Federation Overview</Typography> : null}
+            {config?.NamespaceUrl ?
+                <LinkBox href={config?.NamespaceUrl} text={"Namespace Registry"}/> : null
+            }
+            {config?.DirectorUrl ?
+                <LinkBox href={config?.DirectorUrl} text={"Director"}/> : null
+            }
+            {config?.TopologyNamespaceUrl ?
+                <LinkBox href={config?.TopologyNamespaceUrl} text={"Topology Namespace"}/> : null
+            }
+            {config?.DiscoveryUrl ?
+                <LinkBox href={config?.DiscoveryUrl} text={"Discovery"}/> : null
+            }
+            {config?.JwkUrl ?
+                <LinkBox href={config?.JwkUrl} text={"JWK"}/> : null
+            }
+
+        </Box>
+    )
+}
+
+export default FederationOverview;
diff --git a/web_ui/frontend/components/Main.d.ts b/web_ui/frontend/components/Main.d.ts
new file mode 100644
index 000000000..cfe0ce320
--- /dev/null
+++ b/web_ui/frontend/components/Main.d.ts
@@ -0,0 +1,14 @@
+import {NamespaceAdminMetadata} from "@/components/Namespace";
+
+interface Alert {
+    severity: "error" | "warning" | "info" | "success";
+    message: string;
+}
+
+export interface Namespace {
+    id: number;
+    prefix: string;
+    pubkey: string;
+    type: "origin" | "cache";
+    admin_metadata: NamespaceAdminMetadata;
+}
diff --git a/web_ui/frontend/components/Namespace.tsx b/web_ui/frontend/components/Namespace.tsx
new file mode 100644
index 000000000..319b4428e
--- /dev/null
+++ b/web_ui/frontend/components/Namespace.tsx
@@ -0,0 +1,302 @@
+import {Box, Typography, Collapse, Grid, IconButton, Button, Tooltip, Skeleton, BoxProps, Avatar} from "@mui/material";
+import {Edit, Block, Check, Download, Add, Person} from "@mui/icons-material";
+import React, {useEffect, useRef, useState} from "react";
+import Link from "next/link";
+
+import {Namespace, Alert} from "@/components/Main";
+import {getAuthenticated, secureFetch, Authenticated} from "@/helpers/login";
+
+export interface NamespaceAdminMetadata {
+    user_id: string;
+    description: string;
+    site_name: string;
+    institution: string;
+    security_contact_user_id: string;
+    status: "Pending" | "Approved" | "Denied" | "Unknown";
+    approver_id: number;
+    approved_at: string;
+    created_at: string;
+    updated_at: string;
+}
+
+interface InformationDropdownProps {
+    adminMetadata: NamespaceAdminMetadata;
+    transition: boolean;
+    parentRef?: React.RefObject<HTMLDivElement>;
+}
+
+export const getServerType = (namespace: Namespace) => {
+
+    // If the namespace is empty the value is undefined
+    if (namespace?.prefix == null || namespace.prefix == ""){
+        return ""
+    }
+
+    // If the namespace prefix starts with /cache, it is a cache server
+    if (namespace.prefix.startsWith("/cache")) {
+        return "cache"
+    }
+
+    // Otherwise it is an origin server
+    return "origin"
+
+}
+
+const InformationSpan = ({name, value}: {name: string, value: string}) => {
+    return (
+        <Box sx={{
+            "&:nth-of-type(odd)": {
+                bgcolor: "#ececec",
+                p: "0px 5px",
+                m: "0px -5px",
+                borderRadius: "4px"
+            }
+        }}>
+            <Typography variant={"body2"} sx={{fontWeight: 500, display: "inline"}}>{name}: </Typography>
+            <Typography variant={"body2"} sx={{display: "inline"}}>{value}</Typography>
+        </Box>
+    )
+}
+
+const InformationDropdown = ({adminMetadata, transition, parentRef} : InformationDropdownProps) => {
+
+    const information = [
+        {name: "User ID", value: adminMetadata.user_id},
+        {name: "Description", value: adminMetadata.description},
+        {name: "Site Name", value: adminMetadata.site_name},
+        {name: "Institution", value: adminMetadata.institution},
+        {name: "Security Contact User ID", value: adminMetadata.security_contact_user_id},
+        {name: "Status", value: adminMetadata.status},
+        {name: "Approver ID", value: adminMetadata.approver_id.toString()},
+        {name: "Approved At", value: adminMetadata.approved_at},
+        {name: "Created At", value: adminMetadata.created_at},
+        {name: "Updated At", value: adminMetadata.updated_at}
+    ]
+
+    return (
+        <Collapse in={transition}>
+            <Box
+                sx={{
+                    display: "flex",
+                    width: "100%",
+                    justifyContent: "space-between",
+                    border: "solid #ececec 1px",
+                    borderRadius: "0px 0px 10px 10px",
+                    p: 1
+                }}
+            >
+                <Grid container>
+                    <Grid item>
+                        <Box>
+                            {information.map((info) => <InformationSpan key={info.name} {...info}/>)}
+                        </Box>
+                    </Grid>
+                </Grid>
+            </Box>
+        </Collapse>
+    )
+}
+
+export const CreateNamespaceCard = ({text}: {text: string}) => {
+    return (
+        <Box>
+            <Box
+                sx={{
+                    display: "flex",
+                    width: "100%",
+                    justifyContent: "space-between",
+                    border: "solid #ececec 1px",
+                    borderRadius: 2,
+                    p: 1
+                }}
+                 bgcolor={"secondary"}
+            >
+                <Box my={"auto"} ml={1}>
+                    <Typography>{text ? text : "Register Namespace"}</Typography>
+                </Box>
+                <Box>
+                    <Tooltip title={"Register Namespace"}>
+                        <Link href={`/registry/namespace/register`}>
+                            <IconButton sx={{bgcolor: "#2e7d3224"}} onClick={(e: React.MouseEvent) => e.stopPropagation()}>
+                                <Add/>
+                            </IconButton>
+                        </Link>
+                    </Tooltip>
+                </Box>
+            </Box>
+        </Box>
+    )
+}
+
+export const Card = ({
+    namespace,
+    authenticated
+} : {namespace: Namespace, authenticated?: Authenticated}) => {
+    const ref = useRef<HTMLDivElement>(null);
+    const [transition, setTransition] = useState<boolean>(false);
+
+    return (
+        <Box>
+            <Box
+                sx={{
+                    cursor: "pointer",
+                    display: "flex",
+                    width: "100%",
+                    justifyContent: "space-between",
+                    border: "solid #ececec 1px",
+                    borderRadius: transition ? "10px 10px 0px 0px" : 1,
+                    "&:hover": {
+                        bgcolor: "#ececec"
+                    },
+                    p: 1
+                }}
+                bgcolor={"secondary"}
+                onClick={() => setTransition(!transition)}
+            >
+                <Box my={"auto"} ml={1} display={"flex"} flexDirection={"row"}>
+                    <Typography>{namespace.prefix}</Typography>
+                    { authenticated !== undefined && authenticated.user == namespace.admin_metadata.user_id &&
+                        <Tooltip title={"Created By You"}>
+                            <Avatar sx={{height: "25px", width: "25px", my: "auto", ml:1}}>
+                                <Person/>
+                            </Avatar>
+                        </Tooltip>
+                    }
+                </Box>
+                <Box>
+                    <Tooltip title={"Download JWK"}>
+                        <Link href={`https://localhost:8444/api/v1.0/registry_ui/namespaces/${namespace.id}/pubkey`}>
+                            <IconButton onClick={(e: React.MouseEvent) => e.stopPropagation()} sx={{mx: 1}}>
+                                <Download/>
+                            </IconButton>
+                        </Link>
+                    </Tooltip>
+                    {
+                        authenticated?.role == "admin" &&
+                        <Tooltip title={"Edit Registration"}>
+                            <Link href={`/registry/namespace/edit?id=${namespace.id}`}>
+                                <IconButton onClick={(e: React.MouseEvent) => e.stopPropagation()}>
+                                    <Edit/>
+                                </IconButton>
+                            </Link>
+                        </Tooltip>
+                    }
+                </Box>
+            </Box>
+            <Box ref={ref}>
+                <InformationDropdown adminMetadata={namespace.admin_metadata} transition={transition} parentRef={ref}/>
+            </Box>
+        </Box>
+    )
+}
+
+export const NamespaceCardSkeleton = () => {
+    return <Skeleton variant="rounded" width={"100%"} height={60} />
+}
+
+interface PendingCardProps {
+    namespace: Namespace;
+    onUpdate: () => void;
+    onAlert: (alert: Alert) => void;
+    authenticated?: Authenticated
+}
+
+export const PendingCard = ({
+    namespace,
+    onUpdate,
+    onAlert,
+    authenticated
+}: PendingCardProps) => {
+
+    const ref = useRef<HTMLDivElement>(null);
+    const [transition, setTransition] = useState<boolean>(false);
+
+    const approveNamespace = async (e: React.MouseEvent) => {
+        try {
+            const response = await secureFetch(`/api/v1.0/registry_ui/namespaces/${namespace.id}/approve`, {
+                method: "PATCH"
+            })
+
+            if (!response.ok){
+                onAlert({severity: "error", message: `Failed to approve namespace: ${namespace.prefix}`})
+            } else {
+                onUpdate()
+                onAlert({severity: "success", message: `Successfully approved namespace: ${namespace.prefix}`})
+            }
+
+        } catch (error) {
+            console.error(error)
+        } finally {
+            e.stopPropagation()
+        }
+    }
+
+    const denyNamespace = async (e: React.MouseEvent) => {
+        try {
+            const response = await secureFetch(`/api/v1.0/registry_ui/namespaces/${namespace.id}/deny`, {
+                method: "PATCH"
+            })
+
+            if (!response.ok){
+                onAlert({severity: "error", message: `Failed to deny namespace: ${namespace.prefix}`})
+            } else {
+                onUpdate()
+                onAlert({severity: "success", message: `Successfully denied namespace: ${namespace.prefix}`})
+            }
+
+        } catch (error) {
+            console.error(error)
+        } finally {
+            e.stopPropagation()
+        }
+    }
+
+    return (
+        <Box>
+            <Box sx={{
+                    cursor: "pointer",
+                    display: "flex",
+                    width: "100%",
+                    justifyContent: "space-between",
+                    border: "solid #ececec 1px",
+                    borderRadius: transition ? "10px 10px 0px 0px" : 2,
+                    "&:hover": {
+                        bgcolor: "#ececec"
+                    },
+                    p: 1
+                }}
+                bgcolor={"secondary"}
+                onClick={() => setTransition(!transition)}
+            >
+                <Box my={"auto"} ml={1}>
+                    <Typography>{namespace.prefix}</Typography>
+                </Box>
+                <Box>
+                    { authenticated?.role == "admin" &&
+                        <>
+                            <Tooltip title={"Deny Registration"}>
+                                <IconButton sx={{bgcolor: "#ff00001a", mx: 1}} color={"error"} onClick={(e) => denyNamespace(e)}><Block/></IconButton>
+                            </Tooltip>
+                            <Tooltip title={"Approve Registration"}>
+                                <IconButton sx={{bgcolor: "#2e7d3224", mx: 1}} color={"success"} onClick={(e) => approveNamespace(e)}><Check/></IconButton>
+                            </Tooltip>
+                        </>
+                    }
+                    {
+                        (authenticated?.role == "admin" || authenticated?.user == namespace.admin_metadata.user_id) &&
+                        <Tooltip title={"Edit Registration"}>
+                            <Link href={`/registry/namespace/edit?id=${namespace.id}`}>
+                                <IconButton onClick={(e: React.MouseEvent) => e.stopPropagation()}>
+                                    <Edit/>
+                                </IconButton>
+                            </Link>
+                        </Tooltip>
+                    }
+                </Box>
+            </Box>
+            <Box ref={ref}>
+                <InformationDropdown adminMetadata={namespace.admin_metadata} transition={transition} parentRef={ref}/>
+            </Box>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/components/NamespaceTable.tsx b/web_ui/frontend/components/NamespaceTable.tsx
new file mode 100644
index 000000000..f886df032
--- /dev/null
+++ b/web_ui/frontend/components/NamespaceTable.tsx
@@ -0,0 +1,58 @@
+import {Typography, Box, Button, ButtonProps} from '@mui/material';
+import React, {
+    useCallback,
+    useEffect,
+    useState
+} from "react";
+import {Skeleton} from "@mui/material";
+
+import {Card} from "@/components/Namespace";
+import {Namespace} from "@/components/Main";
+
+
+interface ServerTableProps {
+    type?: "cache" | "origin"
+}
+
+const NamespaceTable = ({type} : ServerTableProps) => {
+
+    const [data, setData] = useState<Namespace[] | undefined>(undefined);
+    const [error, setError] = useState<string | undefined>(undefined);
+
+    const getData = useCallback(async () => {
+        const url = new URL("/api/v1.0/registry_ui/namespaces", window.location.origin)
+        if (type){
+            url.searchParams.append("server_type", type)
+        }
+
+        let response = await fetch(url)
+        if (response.ok) {
+            const responseData: Namespace[] = await response.json()
+            responseData.sort((a, b) => a.id > b.id ? 1 : -1)
+            setData(responseData)
+
+        } else {
+            setError("Failed to fetch config, response status: " + response.status)
+        }
+    }, [type])
+
+    useEffect(() => {
+        getData()
+    }, [])
+
+    if(error){
+        return (
+            <Box p={1}>
+                <Typography sx={{color: "red"}} variant={"subtitle2"}>{error}</Typography>
+            </Box>
+        )
+    }
+
+    return (
+        <Box display={"flex"}>
+            {data ? data.map((namespace) => <Card key={namespace.id} namespace={namespace}/>) : <Skeleton variant={"rectangular"} width={"100%"} height={"100%"}/>}
+        </Box>
+    )
+}
+
+export default NamespaceTable
diff --git a/web_ui/frontend/components/ServerTable.tsx b/web_ui/frontend/components/ServerTable.tsx
new file mode 100644
index 000000000..d90457299
--- /dev/null
+++ b/web_ui/frontend/components/ServerTable.tsx
@@ -0,0 +1,115 @@
+import {Table, TableCell, TableBody, TableContainer, TableHead, TableRow, Paper, Typography, Box} from '@mui/material';
+import React, {
+    FunctionComponent,
+    ReactElement,
+    ReactNode,
+    useCallback,
+    useEffect,
+    useMemo,
+    useRef,
+    useState
+} from "react";
+import {Skeleton} from "@mui/material";
+import Link from "next/link";
+
+import DataTable, {Record} from "@/components/DataTable";
+import {TableCellOverflow} from "@/components/Cell";
+
+
+interface ExportData extends Record {
+    "Type": string
+    "Local Path": string
+    "Namespace Prefix": string
+}
+
+const TableCellOverflowLink: React.JSX.ElementType = ({ children, ...props }) => {
+
+    if (children === null){
+        children = ""
+    }
+
+    return (
+        <TableCellOverflow sx={{color: "blue", cursor: "pointer"}} {...props}>
+            <Link href={children as string}>
+                {children as string}
+            </Link>
+        </TableCellOverflow>
+    )
+}
+
+
+
+interface Server extends Record {
+    name: string
+    authUrl: string
+    url: string
+    webUrl: string
+    type: string
+    latitude: number
+    longitude: number
+}
+
+
+interface ServerTableProps {
+    type?: "cache" | "origin"
+}
+
+export const ServerTable = ({type} : ServerTableProps) => {
+
+    const [data, setData] = useState<Server[] | undefined>(undefined);
+    const [error, setError] = useState<string | undefined>(undefined);
+
+    const keyToName = {
+        "name": {
+            name: "Name",
+            cellNode: TableCellOverflow
+        },
+        "authUrl": {
+            name: "Auth URL",
+            cellNode: TableCellOverflowLink
+        },
+        "url": {
+            name: "URL",
+            cellNode: TableCellOverflowLink
+        },
+        "webUrl": {
+            name: "Web URL",
+            cellNode: TableCellOverflowLink
+        }
+    }
+
+    const getData = useCallback(async () => {
+        const url = new URL("/api/v1.0/director_ui/servers", window.location.origin)
+        if (type){
+            url.searchParams.append("server_type", type)
+        }
+
+        let response = await fetch(url)
+        if (response.ok) {
+            const responseData: Server[] = await response.json()
+            responseData.sort((a, b) => a.name.localeCompare(b.name))
+            setData(responseData)
+
+        } else {
+            setError("Failed to fetch config, response status: " + response.status)
+        }
+    }, [type])
+
+    useEffect(() => {
+        getData()
+    }, [])
+
+    if(error){
+        return (
+            <Box p={1}>
+                <Typography sx={{color: "red"}} variant={"subtitle2"}>{error}</Typography>
+            </Box>
+        )
+    }
+
+    return (
+        <>
+            {data ? <DataTable columnMap={keyToName} data={data} /> : <Skeleton variant={"rectangular"} height={200} width={"100%"} />}
+        </>
+    )
+}
diff --git a/web_ui/frontend/components/StatusBox.tsx b/web_ui/frontend/components/StatusBox.tsx
new file mode 100644
index 000000000..e615af071
--- /dev/null
+++ b/web_ui/frontend/components/StatusBox.tsx
@@ -0,0 +1,154 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+import {Box, Grid, Skeleton, Typography} from "@mui/material";
+import {useEffect, useState} from "react";
+import {DateTime} from "luxon";
+import { alpha, useTheme } from "@mui/material";
+
+interface StatusDisplayProps {
+    component: string;
+    status: string;
+    message?: string;
+}
+
+function StatusDisplay({component, status, message}: StatusDisplayProps) {
+
+    const theme = useTheme()
+
+    let backgroundColor: string
+    switch (status) {
+        case "ok":
+            backgroundColor = theme.palette.success.light
+            break
+        case "warning":
+            backgroundColor = theme.palette.warning.light
+            break
+        case "critical":
+            backgroundColor = theme.palette.error.light
+            break
+        default:
+            backgroundColor = theme.palette.warning.light
+    }
+
+    let backgroundColorFinal = alpha(backgroundColor, 0.5)
+
+    switch (component) {
+        case "xrootd":
+            component = "XRootD"
+            break
+        case "web-ui":
+            component = "Web UI"
+            break
+        case "cmsd":
+            component = "CMSD"
+            break
+        case "federation":
+            component = "Federation"
+            break
+        case "director":
+            component = "Director"
+            break
+        default:
+    }
+
+    return (
+        <Box p={1} px={2} display={"flex"} flexDirection={"column"} bgcolor={backgroundColorFinal} borderRadius={2} mb={1}>
+            <Box>
+                <Typography>
+                    {component}
+                </Typography>
+            </Box>
+            { message ?
+                <Box>
+                    <Typography variant={"body2"}>
+                        {message}
+                    </Typography>
+                </Box> :
+                undefined
+            }
+        </Box>
+    )
+}
+
+
+export default function StatusBox() {
+
+    const [status, setStatus] = useState<any>(undefined)
+    const [updated, setUpdated] = useState<DateTime>(DateTime.now())
+    const [error, setError] = useState<string | undefined>(undefined)
+
+    let getStatus = async () => {
+        let response = await fetch("/api/v1.0/metrics/health")
+
+        if(response.ok) {
+            let data = await response.json()
+            setUpdated(DateTime.now())
+            setStatus(data)
+        } else {
+            setError("Error fetching status json: " + response.status)
+        }
+
+    }
+
+    useEffect(() => {
+        getStatus()
+
+        const interval = setInterval(() => getStatus(), 60000);
+        return () => clearInterval(interval)
+    }, [])
+
+    if(status === undefined || error !== undefined) {
+        return (
+            <Box>
+                <Box minHeight={"300px"}>
+                    {
+                        error ?
+                            <Typography sx={{color: "red"}} variant={"subtitle2"}>{error}</Typography> :
+                            <Skeleton variant="rectangular" height={250} />
+                    }
+                </Box>
+            </Box>
+        )
+    }
+
+    let statusComponents: any[] = []
+    try {
+        statusComponents = Object.entries(status['components']).map(([component, status]: [string, any]) => {
+            return (
+                <StatusDisplay key={component} component={component} status={status['status']} message={status['message']}/>
+            )
+        })
+    } catch (e) {
+        setError("Error parsing status json: " + e)
+    }
+
+
+
+
+    return (
+        <Box>
+            <Box>
+                {statusComponents}
+            </Box>
+            <Box>
+                <Typography sx={{color: "grey"}} variant={"subtitle2"}>Last Updated: {updated.toLocaleString(DateTime.DATETIME_MED)}</Typography>
+            </Box>
+        </Box>
+    )
+}
diff --git a/web_ui/frontend/components/graphs/Graph.tsx b/web_ui/frontend/components/graphs/Graph.tsx
new file mode 100644
index 000000000..5fe48d8c7
--- /dev/null
+++ b/web_ui/frontend/components/graphs/Graph.tsx
@@ -0,0 +1,139 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+"use client"
+
+import {useEffect, useState} from "react";
+import {
+    Chart as ChartJS,
+    CategoryScale,
+    LinearScale,
+    TimeScale,
+    PointElement,
+    LineElement,
+    Title,
+    Tooltip,
+    Legend,
+    ChartOptions,
+    Colors
+} from 'chart.js';
+
+
+import zoomPlugin from 'chartjs-plugin-zoom';
+import 'chartjs-adapter-luxon';
+
+import {BoxProps} from "@mui/material";
+
+import {Line} from "react-chartjs-2";
+import {Box, Skeleton, Typography} from "@mui/material";
+
+import {getDataFunction} from "@/components/graphs/prometheus";
+import {ChartData} from "chart.js";
+
+const defaultOptions: Partial<ChartOptions<"line">> = {
+    scales: {
+        x: {
+            type: 'time',
+            time: {
+                round: 'second',
+            }
+        }
+    }
+}
+
+interface GraphProps {
+    getData: getDataFunction;
+    drawer?: any;
+    options?: ChartOptions<"line">
+    boxProps?: BoxProps;
+}
+
+export default function Graph({getData, options, boxProps, drawer}: GraphProps) {
+
+    let [data, _setData] = useState<ChartData<"line", any, any>>()
+    let [loading, setLoading] = useState<boolean>(true)
+    let [error, setError] = useState<string>("")
+
+
+    async function setData() {
+        try {
+            let response = await getData()
+            _setData(response)
+            setLoading(false)
+            if(response.datasets[0].data.length == 0){
+                let date = new Date(Date.now()).toLocaleTimeString()
+                setError(`No data returned by database as of ${date}; Plot will auto-refresh. Adjust Graph Settings to set a lower Rate Time Range and Resolution.`)
+            } else {
+                setError("")
+            }
+        } catch (e: any) {
+            let date = new Date(Date.now()).toLocaleString()
+            setError(date + " : " + e.message + "; Plot will auto-refresh")
+        }
+    }
+
+    useEffect(() => {
+
+        ChartJS.register(
+            CategoryScale,
+            LinearScale,
+            PointElement,
+            LineElement,
+            Title,
+            Tooltip,
+            Legend,
+            TimeScale,
+            zoomPlugin,
+            Colors
+        );
+
+
+        // Do the initial data fetch
+        setData()
+
+        // Refetch the data every minute
+        const interval = setInterval(() => setData(), 60000);
+        return () => clearInterval(interval);
+
+    }, [getData])
+
+    return (
+        <Box>
+            { loading || !data ?
+                <Box borderRadius={2} overflow={"hidden"}><Skeleton variant={"rectangular"} width={"100%"} height={"300px"} /></Box> :
+                <>
+                    <Box m={"auto"} {...boxProps}>
+                        <Line
+                            data={data}
+                            options={{
+                                ...defaultOptions,
+                                ...options
+                            }}
+                        />
+                    </Box>
+                    <Box display={"flex"}>
+                        { drawer ? drawer : undefined }
+                    </Box>
+                </>
+            }
+            <Box display={"flex"} flexDirection={"column"} pt={1}>
+                <Typography m={"auto"} color={"red"} variant={"body2"} textAlign={"center"}>{error}</Typography>
+            </Box>
+        </Box>
+    )
+
+}
diff --git a/web_ui/frontend/components/graphs/LineGraph.tsx b/web_ui/frontend/components/graphs/LineGraph.tsx
new file mode 100644
index 000000000..e5a703a6b
--- /dev/null
+++ b/web_ui/frontend/components/graphs/LineGraph.tsx
@@ -0,0 +1,62 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+import {useState} from "react";
+import {
+    ChartOptions,
+    ChartDataset,
+} from 'chart.js';
+
+import {BoxProps} from "@mui/material";
+
+
+import {query_basic, TimeDuration} from "@/components/graphs/prometheus";
+import {ChartData} from "chart.js";
+import Graph from "@/components/graphs/Graph";
+
+
+interface LineGraphProps {
+    boxProps?: BoxProps;
+    metric: string;
+    duration?: TimeDuration;
+    resolution?: TimeDuration;
+    options?: ChartOptions<"line">
+    datasetOptions?: Partial<ChartDataset<"line">>
+}
+
+export default function LineGraph({ boxProps, metric, duration=new TimeDuration(31, "d"), resolution=new TimeDuration(1, "h"), options, datasetOptions}: LineGraphProps) {
+
+    let [_duration, setDuration] = useState(duration)
+    let [_resolution, setResolution] = useState(resolution)
+
+    async function getData(){
+        let chartData: ChartData<"line", any, any> = {
+            datasets: [{
+                data: await query_basic({metric: metric, duration:_duration, resolution:_resolution}),
+                ...datasetOptions
+            }]
+        }
+
+        return chartData
+    }
+
+    return (
+        <Graph getData={getData} options={options} boxProps={boxProps}/>
+    )
+
+}
diff --git a/web_ui/frontend/components/graphs/RateGraph.tsx b/web_ui/frontend/components/graphs/RateGraph.tsx
new file mode 100644
index 000000000..fc6994a4e
--- /dev/null
+++ b/web_ui/frontend/components/graphs/RateGraph.tsx
@@ -0,0 +1,328 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import dynamic from "next/dynamic";
+
+import {useEffect, useState} from "react";
+import {
+    ChartOptions,
+    ChartDataset,
+    ChartData
+} from 'chart.js';
+
+import {DateTime} from "luxon";
+
+import 'chartjs-adapter-luxon';
+
+import {BoxProps, Button, FormControl, Grid, IconButton, InputLabel, MenuItem, Paper, Select} from "@mui/material";
+
+import {Box} from "@mui/material";
+
+import {query_rate, TimeDuration, DurationType} from "@/components/graphs/prometheus";
+import {AutoGraphOutlined, CalendarMonth, QuestionMark, ReplayOutlined} from "@mui/icons-material";
+import {DatePicker, LocalizationProvider} from "@mui/x-date-pickers";
+import {AdapterLuxon} from "@mui/x-date-pickers/AdapterLuxon";
+import TextField from "@mui/material/TextField";
+
+const Graph = dynamic(
+    () => import('@/components/graphs/Graph'),
+    { ssr: false }
+)
+
+function DrawerBox({children, hidden=false}: {children: any, hidden: boolean}) {
+
+    return (
+        <Box
+            sx={{
+                display: "flex",
+                overflow: "hidden",
+                maxHeight: hidden ? 0 : "200px",
+                m: hidden ? 0 : 2,
+                pt: hidden ? 0 : 2,
+                flexDirection: "column",
+                transition: "all 0.2s ease",
+            }}>
+            {children}
+        </Box>
+    )
+}
+
+
+interface RateGraphDrawerProps {
+    reset: Function;
+    rate: TimeDuration;
+    resolution: TimeDuration;
+    duration: TimeDuration;
+    time: DateTime;
+    setRate: Function
+    setResolution: Function
+    setDuration: Function
+    setTime: Function
+}
+
+function RateGraphDrawer({reset, rate, resolution, duration, time, setRate, setResolution, setDuration, setTime}: RateGraphDrawerProps) {
+
+    const [reportPeriodHidden, setReportPeriodHidden] = useState<boolean>(true)
+    const [graphSettingsHidden, setGraphSettingsHidden] = useState<boolean>(true)
+
+    const [drawerOpen, setDrawerOpen] = useState<boolean>(false)
+
+    useEffect(() => {
+        setDrawerOpen(!reportPeriodHidden || !graphSettingsHidden)
+    }, [reportPeriodHidden, graphSettingsHidden])
+
+    return (
+        <Paper elevation={drawerOpen ? 1 : 0} sx={{display: "flex", flexGrow: 1, flexDirection: "column", transition: "all 0.5s ease", backgroundColor: drawerOpen ? "#fff" : "#fff0" }}>
+            <Box display={"flex"} flexGrow={1} m={1} mb={0}>
+                <IconButton size={"small"} onClick={() => reset()}><ReplayOutlined /></IconButton>
+                <Button
+                    size={"small"}
+                    variant="outlined"
+                    startIcon={<CalendarMonth />}
+                    onClick={() => {
+                        setReportPeriodHidden(!reportPeriodHidden);
+                        setGraphSettingsHidden(true)
+                    }}
+                >
+                    Report Period
+                </Button>
+                <Button
+                    size={"small"}
+                    variant="outlined"
+                    startIcon={<AutoGraphOutlined />}
+                    onClick={() => {
+                        setGraphSettingsHidden(!graphSettingsHidden);
+                        setReportPeriodHidden(true)
+                    }}
+                    sx={{marginLeft: 1}}
+                >
+                    Graph Settings
+                </Button>
+            </Box>
+            <Box>
+                <DrawerBox hidden={reportPeriodHidden}>
+                    <Grid container spacing={2}>
+                        <Grid item xs={12} md={6}>
+                            <FormControl fullWidth>
+                                <InputLabel id="select-report-length-label">Report Length</InputLabel>
+                                <Select
+                                    labelId="select-report-length-label"
+                                    id="select-report-length"
+                                    label="Report Length"
+                                    value={duration.value}
+                                    onChange={(e) => setDuration(new TimeDuration(e.target.value as number, duration.type))}
+                                >
+                                    <MenuItem value={1}>Day</MenuItem>
+                                    <MenuItem value={7}>Week</MenuItem>
+                                    <MenuItem value={31}>Month</MenuItem>
+                                </Select>
+                            </FormControl>
+                        </Grid>
+                        <Grid item xs={12} md={6}>
+                            <LocalizationProvider dateAdapter={AdapterLuxon}>
+                                <DatePicker sx={{width: "100%"}} label={"Report End"} value={time} onChange={d => {console.log(d); setTime(d)}} />
+                            </LocalizationProvider>
+                        </Grid>
+                    </Grid>
+                </DrawerBox>
+                <DrawerBox hidden={graphSettingsHidden}>
+                    <Grid container spacing={2}>
+                        <Grid item xs={12}>
+                            <Grid container spacing={1}>
+                                <Grid item xs={6}>
+                                    <FormControl fullWidth>
+                                        <TextField
+                                            label={"Rate Time Range"}
+                                            type={"number"}
+                                            inputProps={{min:0}}
+                                            value={rate.value}
+                                            onChange={(e) => setRate(new TimeDuration(parseInt(e.target.value), rate.type))}
+                                        ></TextField>
+                                    </FormControl>
+                                </Grid>
+                                <Grid item xs={5}>
+                                    <FormControl fullWidth>
+                                        <InputLabel id="select-report-length-label">Unit</InputLabel>
+                                        <Select
+                                            labelId="select-report-length-label"
+                                            id="select-report-length"
+                                            label="Report Length"
+                                            value={rate.type}
+                                            onChange={(e) => setRate(new TimeDuration(rate.value, e.target.value as DurationType))}
+                                        >
+                                            <MenuItem value={"m"}>Minute</MenuItem>
+                                            <MenuItem value={"h"}>Hour</MenuItem>
+                                            <MenuItem value={"d"}>Day</MenuItem>
+                                        </Select>
+                                    </FormControl>
+                                </Grid>
+                                <Grid item xs={1} m={"auto"}>
+                                    <IconButton href={"https://prometheus.io/docs/prometheus/latest/querying/functions/#rate"} size={"small"} target="_blank" rel="noopener noreferrer"><QuestionMark/></IconButton>
+                                </Grid>
+                            </Grid>
+                        </Grid>
+                        <Grid item xs={12}>
+                            <Grid container spacing={1}>
+                                <Grid item xs={6}>
+                                    <FormControl fullWidth>
+                                        <TextField
+                                            label={"Resolution"}
+                                            type={"number"}
+                                            inputProps={{min:0}}
+                                            value={resolution.value}
+                                            onChange={(e) => setResolution(new TimeDuration(parseInt(e.target.value), resolution.type))}
+                                        ></TextField>
+                                    </FormControl>
+                                </Grid>
+                                <Grid item xs={5}>
+                                    <FormControl fullWidth>
+                                        <InputLabel id="select-report-length-label">Unit</InputLabel>
+                                        <Select
+                                            labelId="select-report-length-label"
+                                            id="select-report-length"
+                                            label="Report Length"
+                                            value={resolution.type}
+                                            onChange={(e) => setResolution(new TimeDuration(resolution.value, e.target.value as DurationType))}
+                                        >
+                                            <MenuItem value={"m"}>Minute</MenuItem>
+                                            <MenuItem value={"h"}>Hour</MenuItem>
+                                            <MenuItem value={"d"}>Day</MenuItem>
+                                        </Select>
+                                    </FormControl>
+                                </Grid>
+                                <Grid item xs={1} m={"auto"}>
+                                    <IconButton href={"https://prometheus.io/docs/prometheus/latest/querying/examples/#subquery"} size={"small"} target="_blank" rel="noopener noreferrer"><QuestionMark/></IconButton>
+                                </Grid>
+                            </Grid>
+                        </Grid>
+                    </Grid>
+                </DrawerBox>
+            </Box>
+        </Paper>
+    )
+}
+
+interface RateGraphProps {
+    boxProps?: BoxProps;
+    metrics: string[];
+    rate?: TimeDuration;
+    duration?: TimeDuration;
+    resolution?: TimeDuration;
+    options?: ChartOptions<"line">
+    datasetOptions?: Partial<ChartDataset<"line">> | Partial<ChartDataset<"line">>[];
+}
+
+export default function RateGraph({boxProps, metrics, rate=new TimeDuration(30, "m"), duration=new TimeDuration(1, "d"), resolution=new TimeDuration(1, "m"), options={}, datasetOptions={}}: RateGraphProps) {
+    let default_rate = rate
+    let default_duration = duration
+    let default_resolution = resolution
+
+    let reset = () => {
+        setRate(default_rate.copy())
+        setDuration(default_duration.copy())
+        setResolution(default_resolution.copy())
+        setTime(DateTime.now())
+    }
+
+    let [_rate, setRate] = useState(rate)
+    let [_duration, _setDuration] = useState(duration)
+    let [_resolution, setResolution] = useState(resolution)
+    let [_time, _setTime] = useState<DateTime>(DateTime.now())
+
+    // Create some reasonable defaults for the graph
+    let setDuration = (duration: TimeDuration) => {
+        if(duration.value == 1){
+            setRate(new TimeDuration(30, "m"))
+            setResolution(new TimeDuration(10, "m"))
+        } else if(duration.value == 7){
+            setRate(new TimeDuration(3, "h"))
+            setResolution(new TimeDuration(30, "m"))
+        } else if(duration.value == 31){
+            setRate(new TimeDuration(12, "h"))
+            setResolution(new TimeDuration(12, "h"))
+        }
+
+        _setDuration(duration)
+    }
+
+    let setTime = (time: DateTime) => {
+        // If it's not today, then set time to the end of that day
+        // If it's today, then set to date.now
+        //
+        // This helps us to get the latest data while not going over the wanted time range
+        // If we set the time to the future, PromQL will give you random data in the future to
+        // interpolate the missing ones
+        if (time.hasSame(DateTime.now(), "day")) {
+            time = DateTime.now()
+        } else {
+            time.set({hour: 23, minute: 59, second: 59, millisecond: 999})
+        }
+        _setTime(time)
+    }
+
+
+    async function getData(){
+        let chartData: ChartData<"line", any, any> = {
+            datasets: await Promise.all(metrics.map(async (metric, index) => {
+
+                let datasetOption: Partial<ChartDataset<"line">> = {}
+                if(datasetOptions instanceof Array){
+                    try {
+                        datasetOption = datasetOptions[index]
+                    } catch (e) {
+                        console.error("datasetOptions is an array, but the number of elements < the number of metrics")
+                    }
+                } else {
+                    datasetOption = datasetOptions
+                }
+
+                let updatedTime = _time
+                if (updatedTime.hasSame(DateTime.now(), "day")) {
+                    updatedTime = DateTime.now()
+                }
+
+                return {
+                    data: (await query_rate({metric, rate:_rate, duration:_duration, resolution:_resolution, time:updatedTime})),
+                    ...datasetOption
+                }
+            }))
+        }
+
+        return chartData
+    }
+
+    return (
+        <Graph
+            getData={getData}
+            drawer={<RateGraphDrawer
+                        reset={reset}
+                        duration={_duration}
+                        setDuration={setDuration}
+                        rate={_rate}
+                        setRate={setRate}
+                        resolution={_resolution}
+                        setResolution={setResolution}
+                        time={_time}
+                        setTime={setTime}
+                    />}
+            options={options} boxProps={boxProps}
+        />
+    )
+}
diff --git a/web_ui/frontend/components/graphs/prometheus.tsx b/web_ui/frontend/components/graphs/prometheus.tsx
new file mode 100644
index 000000000..132e9c780
--- /dev/null
+++ b/web_ui/frontend/components/graphs/prometheus.tsx
@@ -0,0 +1,144 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+
+import {ChartData} from "chart.js";
+
+import {isLoggedIn} from "@/helpers/login";
+import {DateTime} from "luxon";
+
+let getTimeDuration = (value: string, defaultValue: number = 1) => {
+    let _value = value.match(/\d+/)
+    if(_value){
+        return parseInt(_value[0])
+    }
+
+    console.error("Invalid time duration, using default value: " + defaultValue.toString())
+    return defaultValue
+}
+
+let getDurationType = (value: string, defaultType: string = "h") => {
+    let _type = value.match(/\D+/)
+    if(_type){
+        return _type[0]
+    }
+
+    console.error(`Invalid time duration type (${value}), using default value: ` + defaultType.toString())
+    return defaultType
+}
+
+export type DurationType = "ms" | "s" | "m" | "h" | "d" | "w" | "y";
+
+export class TimeDuration {
+    value: number;
+    type: DurationType;
+
+    constructor(value: number, type: DurationType) {
+        this.value = value;
+        this.type = type;
+    }
+
+    toString(){
+        return `${this.value}${this.type}`
+    }
+
+    static fromString(value: string){
+        let _value= getTimeDuration(value)
+        let _type = getDurationType(value) as DurationType
+
+        return new TimeDuration(_value, _type)
+    }
+
+    copy(){
+        return new TimeDuration(this.value, this.type)
+    }
+}
+
+export interface getDataFunction {
+    (): Promise<ChartData<"line", any, any>>
+}
+
+export interface DataPoint {
+    x: any;
+    y: any;
+}
+
+export async function query_raw(query: string, time?: Number): Promise<DataPoint[]> {
+
+    //Check if the user is logged in
+    if(!(await isLoggedIn())){
+        window.location.replace("/view/login/")
+    }
+
+    const url = new URL(window.location.origin + "/api/v1.0/prometheus/query")
+    url.searchParams.append("query", query)
+    if(time) {
+        url.searchParams.append("time", time.toString())
+    }
+
+
+    let response = await fetch(url.href)
+
+    if (response.status !== 200) {
+        throw new Error(`Prometheus query returned status ${response.status}`)
+    }
+
+    let json = await response.json()
+
+    if (json.status !== "success") {
+        throw new Error(`Prometheus query returned status ${json.status}`)
+    }
+
+
+    if(json.data.result.length == 0){
+        return []
+    }
+
+    // This will return the list of time and value tuples [1693918800,"0"],[1693919100,"0"]...
+    let prometheusTuples = json.data.result[0].values
+
+    // Chart.js expects milliseconds since epoch
+    let data: DataPoint[] = prometheusTuples.map((tuple: any) => { return {x: tuple[0] * 1000, y: tuple[1]}})
+
+    return data
+}
+
+interface QueryBasicOptions {
+    metric: string;
+    duration: TimeDuration;
+    resolution: TimeDuration;
+    time?: DateTime;
+}
+
+export async function query_basic({metric, duration, resolution, time}: QueryBasicOptions): Promise<DataPoint[]> {
+    let query = `${metric}[${duration.toString()}:${resolution.toString()}]`
+    return query_raw(query, time?.toSeconds())
+}
+
+interface QueryRateOptions {
+    metric: string;
+    rate: TimeDuration;
+    duration: TimeDuration;
+    resolution: TimeDuration;
+    time?: DateTime;
+}
+
+export async function query_rate({metric, rate, duration, resolution, time}: QueryRateOptions): Promise<DataPoint[]>  {
+    let query = `rate(${metric}[${rate.toString()}])[${duration.toString()}:${resolution.toString()}]`
+    return query_raw(query, time?.toSeconds())
+}
diff --git a/web_ui/frontend/components/layout/AuthenticatedContent.tsx b/web_ui/frontend/components/layout/AuthenticatedContent.tsx
new file mode 100644
index 000000000..baea4eceb
--- /dev/null
+++ b/web_ui/frontend/components/layout/AuthenticatedContent.tsx
@@ -0,0 +1,31 @@
+import {Box, BoxProps, Skeleton} from "@mui/material";
+import {useEffect, useState} from "react";
+import {isLoggedIn} from "@/helpers/login";
+
+const AuthenticatedContent = ({...props} : BoxProps) => {
+
+    const [authenticated, setAuthenticated] = useState<boolean | undefined>(undefined)
+
+    useEffect(() => {
+        (async () => {
+            const loggedIn = await isLoggedIn()
+            setAuthenticated(loggedIn)
+            if(!loggedIn){
+                window.location.replace("/view/login/index.html")
+            }
+        })()
+    }, []);
+
+    if(authenticated === false){
+        return null
+    }
+
+    return (
+        <Box {...props}>
+            {authenticated === undefined && <Skeleton variant="rounded" height={"95vh"} width={"100%"} />}
+            {authenticated && props.children}
+        </Box>
+    )
+}
+
+export default AuthenticatedContent
diff --git a/web_ui/frontend/components/layout/Drawer.tsx b/web_ui/frontend/components/layout/Drawer.tsx
new file mode 100644
index 000000000..139b68af8
--- /dev/null
+++ b/web_ui/frontend/components/layout/Drawer.tsx
@@ -0,0 +1,9 @@
+
+
+export function Drawer() {
+    return (
+        <div>
+
+        </div>
+    )
+}
diff --git a/origin_ui/src/components/layout/Header.tsx b/web_ui/frontend/components/layout/Header.tsx
similarity index 96%
rename from origin_ui/src/components/layout/Header.tsx
rename to web_ui/frontend/components/layout/Header.tsx
index da0a561fb..18438e0b3 100644
--- a/origin_ui/src/components/layout/Header.tsx
+++ b/web_ui/frontend/components/layout/Header.tsx
@@ -27,7 +27,7 @@ import PelicanLogo from "../../public/static/images/PelicanPlatformLogo_Icon.png
 import GithubIcon from "../../public/static/images/github-mark.png"
 import {Typography} from "@mui/material";
 
-export const Header = () => {
+export const Header = ({text}: {text: string}) => {
 
     let [scrolledTop, setScrolledTop] = useState(true);
 
@@ -47,7 +47,7 @@ export const Header = () => {
                     width={32}
                     height={32}
                 />
-                <Typography variant={"h5"} my={"auto"} ml={".5rem"}>Pelican Origin</Typography>
+                <Typography variant={"h5"} my={"auto"} ml={".5rem"}>{text}</Typography>
             </div>
             <div>
                 <a href={"https://github.com/PelicanPlatform"}>
@@ -61,4 +61,4 @@ export const Header = () => {
             </div>
         </div>
     )
-}
\ No newline at end of file
+}
diff --git a/web_ui/frontend/components/layout/Main.tsx b/web_ui/frontend/components/layout/Main.tsx
new file mode 100644
index 000000000..7c78586de
--- /dev/null
+++ b/web_ui/frontend/components/layout/Main.tsx
@@ -0,0 +1,10 @@
+import {Box} from "@mui/material";
+import {ReactNode} from "react";
+
+export const Main = ({children}: {children: ReactNode}) => {
+    return <Box component={"main"} p={2} pl={0} ml={"90px"} display={"flex"} minHeight={"100vh"} flexGrow={1} zIndex={1}>
+        {children}
+    </Box>
+}
+
+export default Main;
diff --git a/web_ui/frontend/components/layout/Sidebar.tsx b/web_ui/frontend/components/layout/Sidebar.tsx
new file mode 100644
index 000000000..f5d786c75
--- /dev/null
+++ b/web_ui/frontend/components/layout/Sidebar.tsx
@@ -0,0 +1,230 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+"use client"
+
+import Image from 'next/image'
+import { useRouter } from 'next/navigation'
+import {Typography, Box, Button, Snackbar, Alert, Tooltip, IconButton, Grow, Paper, BoxProps} from "@mui/material";
+import { ClickAwayListener } from '@mui/base';
+import {Help, HelpOutline, Description, BugReport} from "@mui/icons-material";
+import LogoutIcon from '@mui/icons-material/Logout';
+
+import styles from "../../app/page.module.css"
+import GitHubIcon from '@mui/icons-material/GitHub';
+import React, {ReactNode, useState} from "react";
+import Link from 'next/link';
+
+interface SpeedButtonProps {
+    open: boolean,
+    order: number,
+    icon: ReactNode,
+    title: string,
+    onClick?: () => void
+    href?: string
+    boxProps?: BoxProps
+}
+
+export const getVersionNumber = () => {
+    const { version } = require('../../package.json');
+    return version;
+}
+
+const SpeedDialButton = ({open, order, icon, title, onClick, href, boxProps} : SpeedButtonProps) => {
+
+    // Logical XOR
+    if((href != undefined) == (onClick != undefined)){
+        throw new Error("SpeedDialButton must have either an onClick xor href prop")
+    }
+
+    return (
+        <Grow
+            in={open}
+            style={{ transformOrigin: '0 0 0' }}
+            {...(open ? { timeout: 200 * order } : {})}
+        >
+            <Box pl={1} {...boxProps}>
+                <Tooltip title={title} arrow>
+                    <Paper elevation={2} sx={{ borderRadius: "50%", bgcolor: "#ffffff00"}}>
+                        { href != undefined ?
+                            <Link href={href}>
+                                <IconButton sx={{bgcolor: "primary.light", "&:hover": {bgcolor: "white"}}}>
+                                    {icon}
+                                </IconButton>
+                            </Link>
+                            :
+                            <IconButton sx={{bgcolor: "primary.light", "&:hover": {bgcolor: "white"}}} onClick={onClick}>
+                                {icon}
+                            </IconButton>
+                        }
+                    </Paper>
+                </Tooltip>
+            </Box>
+        </Grow>
+    )
+
+}
+
+const PelicanSpeedDial = () => {
+    const [open, setOpen] = useState(false);
+
+    const actions = [
+        {
+            boxProps: {pl: 3},
+            icon: <Description/>,
+            title: 'Documentation',
+            href: "https://docs.pelicanplatform.org"
+        },
+        {
+            icon: <GitHubIcon/>,
+            title: 'Github',
+            href: "github.com/PelicanPlatform/pelican"
+        },
+        {
+            icon: <BugReport/>,
+            title: 'Report Bug',
+            href: "https://github.com/PelicanPlatform/pelican/issues/new"
+        }
+    ];
+
+    return (
+        <ClickAwayListener onClickAway={() => setOpen(false)}>
+            <Box sx={{
+                display: "flex",
+                flexDirection: "row",
+            }}>
+                <Paper elevation={open ? 2 : 0} sx={{ borderRadius: "50%", bgcolor: "#ffffff00"}}>
+                    <IconButton onClick={() => setOpen(!open)}>
+                        <HelpOutline/>
+                    </IconButton>
+                </Paper>
+                <Box position={"relative"}>
+                    <Box
+                        sx={{
+                            position: 'absolute',
+                            top: 0,
+                            left: 0,
+                            display: 'flex',
+                            flexDirection: 'row'
+                        }}
+                    >
+                        {actions.map((action, index) => (
+                            <SpeedDialButton
+                                key={action.title}
+                                open={open}
+                                order={index}
+                                {...action}
+                            />
+                        ))}
+                        <Grow
+                            in={open}
+                            style={{ transformOrigin: '0 0 0' }}
+                            {...(open ? { timeout: 200 * actions.length } : {})}
+                        >
+                            <Box pl={1}>
+                                <Tooltip title={"Active Version"} arrow>
+                                    <Paper elevation={2} sx={{ bgcolor: "primary.light", borderRadius: "20px", "&:hover": {bgcolor: "white"}}}>
+                                        <Button sx={{fontSize: "16px", color: "black"}} href={"https://github.com/PelicanPlatform/pelican/releases"}>
+                                            {getVersionNumber()}
+                                        </Button>
+                                    </Paper>
+                                </Tooltip>
+                            </Box>
+                        </Grow>
+                    </Box>
+                </Box>
+            </Box>
+        </ClickAwayListener>
+    )
+}
+
+
+
+
+export const Sidebar = ({children}: {children: ReactNode}) => {
+    const router = useRouter()
+
+    const [error, setError] = useState("")
+
+    const handleLogout = async (e: React.MouseEvent<HTMLElement>) => {
+        try {
+            let response = await fetch("/api/v1.0/auth/logout", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                }
+            })
+
+            if(response.ok){
+                router.push("/")
+            } else {
+                try {
+                    let data = await response.json()
+                    if (data?.error) {
+                        setError(response.status + ": " + data['error'])
+                    } else {
+                        setError("Server error with status code " + response.status)
+                    }
+                } catch {
+                    setError("Server error with status code " + response.status)
+                }
+            }
+        } catch {
+            setError("Could not connect to server")
+        }
+    }
+
+    return (
+        <Box>
+            <Snackbar
+                open={error!=""}
+                autoHideDuration={6000}
+                onClose={() => {setError("")}}
+                anchorOrigin={{vertical: "top", horizontal: "center"}}
+            >
+                <Alert onClose={() => {setError("")}} severity="error" sx={{ width: '100%' }}>
+                    {error}
+                </Alert>
+            </Snackbar>
+            <Box sx={{
+                display: "flex",
+                flexDirection: "row",
+                top:0,
+                position:"fixed",
+                zIndex:2
+            }}>
+                <Box height={"100vh"} display={"flex"}>
+                    <Box className={styles.header} style={{display: "flex", flexDirection: "column", justifyContent:"space-between", padding:"1rem", flexGrow: 1}}>
+                        <Box style={{display:"flex", flexDirection: "column"}}>
+                            {children}
+                        </Box>
+                        <Box display={"flex"} flexDirection={"column"} justifyContent={"center"} textAlign={"center"}>
+                            <Tooltip title="Logout" placement="right" arrow>
+                                <IconButton aria-label='logout' onClick={handleLogout} style={{marginBottom: 10}}>
+                                    <LogoutIcon/>
+                                </IconButton>
+                            </Tooltip>
+                            <PelicanSpeedDial/>
+                        </Box>
+                    </Box>
+                </Box>
+            </Box>
+        </Box>
+
+    )
+}
diff --git a/web_ui/frontend/components/layout/UnauthenticatedContent.tsx b/web_ui/frontend/components/layout/UnauthenticatedContent.tsx
new file mode 100644
index 000000000..95cd667bf
--- /dev/null
+++ b/web_ui/frontend/components/layout/UnauthenticatedContent.tsx
@@ -0,0 +1,30 @@
+import {Box, BoxProps, Skeleton, Alert} from "@mui/material";
+import {useEffect, useState} from "react";
+import {isLoggedIn} from "@/helpers/login";
+
+const UnauthenticatedContent = ({...props} : BoxProps) => {
+
+    const [authenticated, setAuthenticated] = useState<boolean | undefined>(undefined)
+
+    useEffect(() => {
+        (async () => {
+            const loggedIn = await isLoggedIn()
+            setAuthenticated(loggedIn)
+        })()
+    }, []);
+
+    if(authenticated === true){
+        return null
+    }
+
+    return (
+        <Box {...props}>
+            {authenticated === undefined && <Skeleton variant="rounded" height={"50px"} width={"100%"} />}
+            {authenticated === false &&
+                <Alert severity="info">{props.children}</Alert>
+            }
+        </Box>
+    )
+}
+
+export default UnauthenticatedContent
diff --git a/origin_ui/src/components/progress-pager.tsx b/web_ui/frontend/components/progress-pager.tsx
similarity index 99%
rename from origin_ui/src/components/progress-pager.tsx
rename to web_ui/frontend/components/progress-pager.tsx
index a80fff889..ac2731766 100644
--- a/origin_ui/src/components/progress-pager.tsx
+++ b/web_ui/frontend/components/progress-pager.tsx
@@ -53,4 +53,4 @@ export default function ProgressPager({steps, activeStep}: ProgressPagerProps) {
             }
         </Grid>
     )
-}
\ No newline at end of file
+}
diff --git a/web_ui/frontend/dev/data/pubkey.json b/web_ui/frontend/dev/data/pubkey.json
new file mode 100644
index 000000000..99167622e
--- /dev/null
+++ b/web_ui/frontend/dev/data/pubkey.json
@@ -0,0 +1,12 @@
+{
+  "keys": [
+    {
+      "alg": "ES256",
+      "crv": "P-256",
+      "kid": "",
+      "kty": "EC",
+      "x": "",
+      "y": ""
+    }
+  ]
+}
diff --git a/web_ui/frontend/dev/nginx.conf b/web_ui/frontend/dev/nginx.conf
new file mode 100644
index 000000000..5745bc8f2
--- /dev/null
+++ b/web_ui/frontend/dev/nginx.conf
@@ -0,0 +1,38 @@
+user  nginx;
+worker_processes  auto;  ## Default: 1
+worker_rlimit_nofile 8192;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+events {
+  worker_connections  4096;  ## Default: 1024
+}
+
+http {
+    include    /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    index    index.html index.htm index.php;
+
+    server {
+        listen              8443;
+
+        location /api {
+            proxy_read_timeout 300s;
+            proxy_connect_timeout 10s;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_pass https://host.docker.internal:8444;
+        }
+
+        location /view {
+            proxy_read_timeout 300s;
+            proxy_connect_timeout 10s;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_pass http://host.docker.internal:3000;
+        }
+
+        gzip on;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+    }
+}
diff --git a/web_ui/frontend/dev/run.sh b/web_ui/frontend/dev/run.sh
new file mode 100644
index 000000000..3568acfcf
--- /dev/null
+++ b/web_ui/frontend/dev/run.sh
@@ -0,0 +1,2 @@
+docker restart pelican-dev-proxy
+docker run --name pelican-dev-proxy -it -p 8443:8443 -v /Users/clock/GolandProjects/pelican/web_ui/frontend/dev/nginx.conf:/etc/nginx/nginx.conf:ro -d nginx
diff --git a/web_ui/frontend/helpers/login.tsx b/web_ui/frontend/helpers/login.tsx
new file mode 100644
index 000000000..63c48ed5a
--- /dev/null
+++ b/web_ui/frontend/helpers/login.tsx
@@ -0,0 +1,81 @@
+
+export interface Authenticated {
+    authenticated: boolean
+    csrf_token: string
+    role: string
+    time: number
+    user: string
+}
+
+export async function secureFetch(url: string | URL, options: RequestInit = {}) {
+    if(await isLoggedIn()) {
+
+        // If they are logged in, this key must exist
+        const authenticated = getJsonFromSessionStorage<Authenticated>("authenticated") as Authenticated
+
+        return await fetch(url, {
+            ...options,
+            headers: {
+                ...options.headers,
+                "X-CSRF-Token": authenticated.csrf_token
+            }
+        })
+    }
+
+    throw new Error("You must be logged in to make this request")
+}
+
+export function getJsonFromSessionStorage<O>(key: string) : O | null {
+    if(sessionStorage.getItem(key) !== null) {
+        return JSON.parse(sessionStorage.getItem(key) as string)
+    }
+    return null
+}
+
+export function getAuthenticated() : Authenticated | null {
+    return getJsonFromSessionStorage<Authenticated>("authenticated")
+}
+
+// Allow them to see a page if logged in
+export async function isLoggedIn() : Promise<boolean> {
+
+    // If the session is valid then read it
+    const authenticated = getJsonFromSessionStorage<Authenticated>("authenticated")
+    if(authenticated != null){
+        if(authenticated.time + 10000 > Date.now()){
+            return authenticated.authenticated
+        }
+    }
+
+    // Check if the user is authenticated
+    try {
+
+        let response = await fetch("/api/v1.0/auth/whoami")
+        if(!response.ok){
+            return false
+        }
+
+        const json = await response.json()
+        const authenticated = json['authenticated']
+
+        // If authenticated, store status and csrf token
+        if(authenticated){
+            sessionStorage.setItem(
+                "authenticated",
+                JSON.stringify({
+                    time: Date.now(),
+                    authenticated: true,
+                    user: json['user'],
+                    role: json['role'],
+                    csrf_token: response.headers.get('X-CSRF-Token')
+                })
+            )
+            return true
+        }
+
+        return false
+
+    } catch (error) {
+        return false
+    }
+}
diff --git a/origin_ui/src/next.config.js b/web_ui/frontend/next.config.js
similarity index 90%
rename from origin_ui/src/next.config.js
rename to web_ui/frontend/next.config.js
index c4f11b6d3..66c8c3163 100644
--- a/origin_ui/src/next.config.js
+++ b/web_ui/frontend/next.config.js
@@ -1,10 +1,9 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
     output: process.env.NODE_ENV == "dev" ? "standalone" : 'export',
-    basePath: '/view',
+    basePath: "/view",
     trailingSlash: true,
     images: { unoptimized: true }
 }
 
-
 module.exports = nextConfig
diff --git a/origin_ui/src/package-lock.json b/web_ui/frontend/package-lock.json
similarity index 52%
rename from origin_ui/src/package-lock.json
rename to web_ui/frontend/package-lock.json
index c0294142c..40b4843b8 100644
--- a/origin_ui/src/package-lock.json
+++ b/web_ui/frontend/package-lock.json
@@ -1,28 +1,41 @@
 {
   "name": "src",
-  "version": "0.1.0",
+  "version": "7.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "src",
-      "version": "0.1.0",
+      "version": "7.2.0",
       "dependencies": {
         "@emotion/react": "^11.11.1",
         "@emotion/styled": "^11.11.0",
         "@mui/icons-material": "^5.14.3",
         "@mui/material": "^5.14.5",
+        "@mui/x-date-pickers": "^6.16.0",
         "@types/node": "20.4.5",
         "@types/react": "18.2.16",
         "@types/react-dom": "18.2.7",
         "chart.js": "^4.4.0",
+        "chartjs-adapter-luxon": "^1.3.1",
+        "chartjs-plugin-zoom": "^2.0.1",
         "eslint": "8.45.0",
         "eslint-config-next": "13.4.12",
-        "next": "^13.4.13",
+        "luxon": "^3.4.3",
+        "next": "14.0.3",
         "react": "18.2.0",
         "react-chartjs-2": "^5.2.0",
         "react-dom": "18.2.0",
-        "typescript": "5.1.6"
+        "swagger-ui-react": "^5.10.3",
+        "typescript": "5.1.6",
+        "yaml": "^2.3.4"
+      },
+      "devDependencies": {
+        "@types/luxon": "^3.3.2",
+        "@types/swagger-ui-react": "^4.18.3"
+      },
+      "engines": {
+        "node": "20"
       }
     },
     "node_modules/@aashutoshrathi/word-wrap": {
@@ -34,22 +47,23 @@
       }
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.5.tgz",
-      "integrity": "sha512-Xmwn266vad+6DAqEB2A6V/CcZVp62BbwVmcOJc2RPuwih1kw02TjQvWVWlcKGbBPd+8/0V5DEkOcizRGYsspYQ==",
+      "version": "7.22.13",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.13.tgz",
+      "integrity": "sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==",
       "dependencies": {
-        "@babel/highlight": "^7.22.5"
+        "@babel/highlight": "^7.22.13",
+        "chalk": "^2.4.2"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.22.5.tgz",
-      "integrity": "sha512-8Dl6+HD/cKifutF5qGd/8ZJi84QeAKh+CEe1sBzz8UayBBGg1dAIJrdHOcOM5b2MpzWL2yuotJTtGjETq0qjXg==",
+      "version": "7.22.15",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.22.15.tgz",
+      "integrity": "sha512-0pYVBnDKZO2fnSPCrgM/6WMc7eS20Fbok+0r88fp+YtWVLZrp4CkafFGIp+W0VKw4a22sgebPT99y+FDNMdP4w==",
       "dependencies": {
-        "@babel/types": "^7.22.5"
+        "@babel/types": "^7.22.15"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -64,114 +78,67 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.5.tgz",
-      "integrity": "sha512-aJXu+6lErq8ltp+JhkJUfk1MTGyuA4v7f3pA+BJ5HLfNC6nAQ0Cpi9uOquUj8Hehg0aUiHzWQbOVJGao6ztBAQ==",
+      "version": "7.22.20",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz",
+      "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/highlight": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.5.tgz",
-      "integrity": "sha512-BSKlD1hgnedS5XRnGOljZawtag7H1yPfQp0tdNJCHoH6AZ+Pcm9VvkrK59/Yy593Ypg0zMxH2BxD1VPYUQ7UIw==",
+      "version": "7.22.20",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.20.tgz",
+      "integrity": "sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.22.5",
-        "chalk": "^2.0.0",
+        "@babel/helper-validator-identifier": "^7.22.20",
+        "chalk": "^2.4.2",
         "js-tokens": "^4.0.0"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/highlight/node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/chalk": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/color-convert": {
-      "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/color-name": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw=="
-    },
-    "node_modules/@babel/highlight/node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/has-flag": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+    "node_modules/@babel/runtime": {
+      "version": "7.23.2",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.23.2.tgz",
+      "integrity": "sha512-mM8eg4yl5D6i3lu2QKPuPH4FArvJ8KhTofbE7jwMUv9KX5mBvwPAqnV3MlyBNqdp9RyRKP6Yck8TrfYrPvX3bg==",
       "dependencies": {
-        "has-flag": "^3.0.0"
+        "regenerator-runtime": "^0.14.0"
       },
       "engines": {
-        "node": ">=4"
+        "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/runtime": {
-      "version": "7.22.6",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.22.6.tgz",
-      "integrity": "sha512-wDb5pWm4WDdF6LFUde3Jl8WzPA+3ZbxYqkC6xAXuD3irdEHN1k0NfTRrJD8ZD378SJ61miMLCqIOXYhd8x+AJQ==",
+    "node_modules/@babel/runtime-corejs3": {
+      "version": "7.23.5",
+      "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.23.5.tgz",
+      "integrity": "sha512-7+ziVclejQTLYhXl+Oi1f6gTGD1XDCeLa4R472TNGQxb08zbEJ0OdNoh5Piz+57Ltmui6xR88BXR4gS3/Toslw==",
       "dependencies": {
-        "regenerator-runtime": "^0.13.11"
+        "core-js-pure": "^3.30.2",
+        "regenerator-runtime": "^0.14.0"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.22.5.tgz",
-      "integrity": "sha512-zo3MIHGOkPOfoRXitsgHLjEXmlDaD/5KU1Uzuc9GNiZPhSqVxVRtxuPaSBZDsYZ9qV88AjtMtWW7ww98loJ9KA==",
+      "version": "7.23.0",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.0.tgz",
+      "integrity": "sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg==",
       "dependencies": {
         "@babel/helper-string-parser": "^7.22.5",
-        "@babel/helper-validator-identifier": "^7.22.5",
+        "@babel/helper-validator-identifier": "^7.22.20",
         "to-fast-properties": "^2.0.0"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@braintree/sanitize-url": {
+      "version": "6.0.4",
+      "resolved": "https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-6.0.4.tgz",
+      "integrity": "sha512-s3jaWicZd0pkP0jf5ysyHUI/RE7MHos6qlToFcGWXVp+ykHOy77OUMrfbgJ9it2C5bow7OIQwYYaHjk9XlBQ2A=="
+    },
     "node_modules/@emotion/babel-plugin": {
       "version": "11.11.0",
       "resolved": "https://registry.npmjs.org/@emotion/babel-plugin/-/babel-plugin-11.11.0.tgz",
@@ -320,17 +287,17 @@
       }
     },
     "node_modules/@eslint-community/regexpp": {
-      "version": "4.6.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.6.1.tgz",
-      "integrity": "sha512-O7x6dMstWLn2ktjcoiNLDkAGG2EjveHL+Vvc+n0fXumkJYAcSqcVYKtwDU+hDZ0uDUsnUagSYaZrOLAYE8un1A==",
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.9.1.tgz",
+      "integrity": "sha512-Y27x+MBLjXa+0JWDhykM3+JE+il3kHKAEqabfEWq3SDhZjLYb6/BHL/JKFnH3fe207JaXkyDo685Oc2Glt6ifA==",
       "engines": {
         "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
       }
     },
     "node_modules/@eslint/eslintrc": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-2.1.0.tgz",
-      "integrity": "sha512-Lj7DECXqIVCqnqjjHMPna4vn6GJcMgul/wuS0je9OZ9gsL0zzDpKPVtcG1HaDVc+9y+qgXneTeUMbCqXJNpH1A==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-2.1.2.tgz",
+      "integrity": "sha512-+wvgpDsrB1YqAMdEUCcnTlpfVBH7Vqn6A/NT3D8WVXFIaKMlErPIZT3oCIAVCOtarRpMtelZLqJeU3t7WY6X6g==",
       "dependencies": {
         "ajv": "^6.12.4",
         "debug": "^4.3.2",
@@ -357,12 +324,54 @@
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       }
     },
+    "node_modules/@fastify/busboy": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.0.tgz",
+      "integrity": "sha512-+KpH+QxZU7O4675t3mnkQKcZZg56u+K/Ct2K+N2AZYNVK8kyeo/bI18tI8aPm3tvNNRyTWfj6s5tnGNlcbQRsA==",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@floating-ui/core": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.5.0.tgz",
+      "integrity": "sha512-kK1h4m36DQ0UHGj5Ah4db7R0rHemTqqO0QLvUqi1/mUUp3LuAWbWxdxSIf/XsnH9VS6rRVPLJCncjRzUvyCLXg==",
+      "dependencies": {
+        "@floating-ui/utils": "^0.1.3"
+      }
+    },
+    "node_modules/@floating-ui/dom": {
+      "version": "1.5.3",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.5.3.tgz",
+      "integrity": "sha512-ClAbQnEqJAKCJOEbbLo5IUlZHkNszqhuxS4fHAVxRPXPya6Ysf2G8KypnYcOTpx6I8xcgF9bbHb6g/2KpbV8qA==",
+      "dependencies": {
+        "@floating-ui/core": "^1.4.2",
+        "@floating-ui/utils": "^0.1.3"
+      }
+    },
+    "node_modules/@floating-ui/react-dom": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.0.2.tgz",
+      "integrity": "sha512-5qhlDvjaLmAst/rKb3VdlCinwTF4EYMiVxuuc/HVUjs46W0zgtbMmAZ1UTsDrRTxRmUEzl92mOtWbeeXL26lSQ==",
+      "dependencies": {
+        "@floating-ui/dom": "^1.5.1"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@floating-ui/utils": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.1.6.tgz",
+      "integrity": "sha512-OfX7E2oUDYxtBvsuS4e/jSn4Q9Qb6DzgeYtsAdkPZ47znpoNsMgZw0+tVijiv3uGNR6dgNlty6r9rzIzHjtd/A=="
+    },
     "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.10",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.10.tgz",
-      "integrity": "sha512-KVVjQmNUepDVGXNuoRRdmmEjruj0KfiGSbS8LVc12LMsWDQzRXJ0qdhN8L8uUigKpfEHRhlaQFY0ib1tnUbNeQ==",
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.13.tgz",
+      "integrity": "sha512-JSBDMiDKSzQVngfRjOdFXgFfklaXI4K9nLF49Auh21lmBWRLIK3+xTErTWD4KU54pb6coM6ESE7Awz/FNU3zgQ==",
       "dependencies": {
-        "@humanwhocodes/object-schema": "^1.2.1",
+        "@humanwhocodes/object-schema": "^2.0.1",
         "debug": "^4.1.1",
         "minimatch": "^3.0.5"
       },
@@ -383,9 +392,9 @@
       }
     },
     "node_modules/@humanwhocodes/object-schema": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
-      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA=="
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.1.tgz",
+      "integrity": "sha512-dvuCeX5fC9dXgJn9t+X5atfmgQAzUOWqS1254Gh0m6i8wKd10ebXkfNKiRK+1GWi/yTvvLDHpoxLr0xxxeslWw=="
     },
     "node_modules/@kurkle/color": {
       "version": "0.3.2",
@@ -393,18 +402,17 @@
       "integrity": "sha512-fuscdXJ9G1qb7W8VdHi+IwRqij3lBkosAm4ydQtEmbY58OzHXqQhvlxqEkoz0yssNVn38bcpRWgA9PP+OGoisw=="
     },
     "node_modules/@mui/base": {
-      "version": "5.0.0-beta.11",
-      "resolved": "https://registry.npmjs.org/@mui/base/-/base-5.0.0-beta.11.tgz",
-      "integrity": "sha512-FdKZGPd8qmC3ZNke7CNhzcEgToc02M6WYZc9hcBsNQ17bgAd3s9F//1bDDYgMVBYxDM71V0sv/hBHlOY4I1ZVA==",
-      "dependencies": {
-        "@babel/runtime": "^7.22.6",
-        "@emotion/is-prop-valid": "^1.2.1",
-        "@mui/types": "^7.2.4",
-        "@mui/utils": "^5.14.5",
+      "version": "5.0.0-beta.21",
+      "resolved": "https://registry.npmjs.org/@mui/base/-/base-5.0.0-beta.21.tgz",
+      "integrity": "sha512-eTKWx3WV/nwmRUK4z4K1MzlMyWCsi3WJ3RtV4DiXZeRh4qd4JCyp1Zzzi8Wv9xM4dEBmqQntFoei716PzwmFfA==",
+      "dependencies": {
+        "@babel/runtime": "^7.23.2",
+        "@floating-ui/react-dom": "^2.0.2",
+        "@mui/types": "^7.2.7",
+        "@mui/utils": "^5.14.15",
         "@popperjs/core": "^2.11.8",
         "clsx": "^2.0.0",
-        "prop-types": "^15.8.1",
-        "react-is": "^18.2.0"
+        "prop-types": "^15.8.1"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -424,26 +432,21 @@
         }
       }
     },
-    "node_modules/@mui/base/node_modules/react-is": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.2.0.tgz",
-      "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w=="
-    },
     "node_modules/@mui/core-downloads-tracker": {
-      "version": "5.14.5",
-      "resolved": "https://registry.npmjs.org/@mui/core-downloads-tracker/-/core-downloads-tracker-5.14.5.tgz",
-      "integrity": "sha512-+wpGH1USwPcKMFPMvXqYPC6fEvhxM3FzxC8lyDiNK/imLyyJ6y2DPb1Oue7OGIKJWBmYBqrWWtfovrxd1aJHTA==",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/core-downloads-tracker/-/core-downloads-tracker-5.14.15.tgz",
+      "integrity": "sha512-ZCDzBWtCKjAYAlKKM3PA/jG/3uVIDT9ZitOtVixIVmTCQyc5jSV1qhJX8+qIGz4RQZ9KLzPWO2tXd0O5hvzouQ==",
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/mui"
       }
     },
     "node_modules/@mui/icons-material": {
-      "version": "5.14.3",
-      "resolved": "https://registry.npmjs.org/@mui/icons-material/-/icons-material-5.14.3.tgz",
-      "integrity": "sha512-XkxWPhageu1OPUm2LWjo5XqeQ0t2xfGe8EiLkRW9oz2LHMMZmijvCxulhgquUVTF1DnoSh+3KoDLSsoAFtVNVw==",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/icons-material/-/icons-material-5.14.15.tgz",
+      "integrity": "sha512-Dqu21vN/mVNzebJ+ofnKG+CeJYIhHuDs5+0fMEpdpzRt6UojelzdrEkNv+XkO0e1JMclzeXIRx404FirK/CFRw==",
       "dependencies": {
-        "@babel/runtime": "^7.22.6"
+        "@babel/runtime": "^7.23.2"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -464,17 +467,17 @@
       }
     },
     "node_modules/@mui/material": {
-      "version": "5.14.5",
-      "resolved": "https://registry.npmjs.org/@mui/material/-/material-5.14.5.tgz",
-      "integrity": "sha512-4qa4GMfuZH0Ai3mttk5ccXP8a3sf7aPlAJwyMrUSz6h9hPri6BPou94zeu3rENhhmKLby9S/W1y+pmficy8JKA==",
-      "dependencies": {
-        "@babel/runtime": "^7.22.6",
-        "@mui/base": "5.0.0-beta.11",
-        "@mui/core-downloads-tracker": "^5.14.5",
-        "@mui/system": "^5.14.5",
-        "@mui/types": "^7.2.4",
-        "@mui/utils": "^5.14.5",
-        "@types/react-transition-group": "^4.4.6",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/material/-/material-5.14.15.tgz",
+      "integrity": "sha512-Gq65rHjvLzkxmhG8bvag851Oqsmru7qkUb/cCI2xu7dQzmY345f9xJRJi72sRGjhaqHXWeRKw/yIwp/7oQoeXg==",
+      "dependencies": {
+        "@babel/runtime": "^7.23.2",
+        "@mui/base": "5.0.0-beta.21",
+        "@mui/core-downloads-tracker": "^5.14.15",
+        "@mui/system": "^5.14.15",
+        "@mui/types": "^7.2.7",
+        "@mui/utils": "^5.14.15",
+        "@types/react-transition-group": "^4.4.7",
         "clsx": "^2.0.0",
         "csstype": "^3.1.2",
         "prop-types": "^15.8.1",
@@ -513,12 +516,12 @@
       "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w=="
     },
     "node_modules/@mui/private-theming": {
-      "version": "5.14.5",
-      "resolved": "https://registry.npmjs.org/@mui/private-theming/-/private-theming-5.14.5.tgz",
-      "integrity": "sha512-cC4C5RrpXpDaaZyH9QwmPhRLgz+f2SYbOty3cPkk4qPSOSfif2ZEcDD9HTENKDDd9deB+xkPKzzZhi8cxIx8Ig==",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/private-theming/-/private-theming-5.14.15.tgz",
+      "integrity": "sha512-V2Xh+Tu6A07NoSpup0P9m29GwvNMYl5DegsGWqlOTJyAV7cuuVjmVPqxgvL8xBng4R85xqIQJRMjtYYktoPNuQ==",
       "dependencies": {
-        "@babel/runtime": "^7.22.6",
-        "@mui/utils": "^5.14.5",
+        "@babel/runtime": "^7.23.2",
+        "@mui/utils": "^5.14.15",
         "prop-types": "^15.8.1"
       },
       "engines": {
@@ -539,11 +542,11 @@
       }
     },
     "node_modules/@mui/styled-engine": {
-      "version": "5.13.2",
-      "resolved": "https://registry.npmjs.org/@mui/styled-engine/-/styled-engine-5.13.2.tgz",
-      "integrity": "sha512-VCYCU6xVtXOrIN8lcbuPmoG+u7FYuOERG++fpY74hPpEWkyFQG97F+/XfTQVYzlR2m7nPjnwVUgATcTCMEaMvw==",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/styled-engine/-/styled-engine-5.14.15.tgz",
+      "integrity": "sha512-mbOjRf867BysNpexe5Z/P8s3bWzDPNowmKhi7gtNDP/LPEeqAfiDSuC4WPTXmtvse1dCl30Nl755OLUYuoi7Mw==",
       "dependencies": {
-        "@babel/runtime": "^7.21.0",
+        "@babel/runtime": "^7.23.2",
         "@emotion/cache": "^11.11.0",
         "csstype": "^3.1.2",
         "prop-types": "^15.8.1"
@@ -570,15 +573,15 @@
       }
     },
     "node_modules/@mui/system": {
-      "version": "5.14.5",
-      "resolved": "https://registry.npmjs.org/@mui/system/-/system-5.14.5.tgz",
-      "integrity": "sha512-mextXZHDeGcR7E1kx43TRARrVXy+gI4wzpUgNv7MqZs1dvTVXQGVeAT6ydj9d6FUqHBPMNLGV/21vJOrpqsL+w==",
-      "dependencies": {
-        "@babel/runtime": "^7.22.6",
-        "@mui/private-theming": "^5.14.5",
-        "@mui/styled-engine": "^5.13.2",
-        "@mui/types": "^7.2.4",
-        "@mui/utils": "^5.14.5",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/system/-/system-5.14.15.tgz",
+      "integrity": "sha512-zr0Gdk1RgKiEk+tCMB900LaOpEC8NaGvxtkmMdL/CXgkqQZSVZOt2PQsxJWaw7kE4YVkIe4VukFVc43qcq9u3w==",
+      "dependencies": {
+        "@babel/runtime": "^7.23.2",
+        "@mui/private-theming": "^5.14.15",
+        "@mui/styled-engine": "^5.14.15",
+        "@mui/types": "^7.2.7",
+        "@mui/utils": "^5.14.15",
         "clsx": "^2.0.0",
         "csstype": "^3.1.2",
         "prop-types": "^15.8.1"
@@ -609,11 +612,11 @@
       }
     },
     "node_modules/@mui/types": {
-      "version": "7.2.4",
-      "resolved": "https://registry.npmjs.org/@mui/types/-/types-7.2.4.tgz",
-      "integrity": "sha512-LBcwa8rN84bKF+f5sDyku42w1NTxaPgPyYKODsh01U1fVstTClbUoSA96oyRBnSNyEiAVjKm6Gwx9vjR+xyqHA==",
+      "version": "7.2.7",
+      "resolved": "https://registry.npmjs.org/@mui/types/-/types-7.2.7.tgz",
+      "integrity": "sha512-sofpWmcBqOlTzRbr1cLQuUDKaUYVZTw8ENQrtL39TECRNENEzwgnNPh6WMfqMZlMvf1Aj9DLg74XPjnLr0izUQ==",
       "peerDependencies": {
-        "@types/react": "*"
+        "@types/react": "^17.0.0 || ^18.0.0"
       },
       "peerDependenciesMeta": {
         "@types/react": {
@@ -622,13 +625,12 @@
       }
     },
     "node_modules/@mui/utils": {
-      "version": "5.14.5",
-      "resolved": "https://registry.npmjs.org/@mui/utils/-/utils-5.14.5.tgz",
-      "integrity": "sha512-6Hzw63VR9C5xYv+CbjndoRLU6Gntal8rJ5W+GUzkyHrGWIyYPWZPa6AevnyGioySNETATe1H9oXS8f/7qgIHJA==",
+      "version": "5.14.15",
+      "resolved": "https://registry.npmjs.org/@mui/utils/-/utils-5.14.15.tgz",
+      "integrity": "sha512-QBfHovAvTa0J1jXuYDaXGk+Yyp7+Fm8GSqx6nK2JbezGqzCFfirNdop/+bL9Flh/OQ/64PeXcW4HGDdOge+n3A==",
       "dependencies": {
-        "@babel/runtime": "^7.22.6",
-        "@types/prop-types": "^15.7.5",
-        "@types/react-is": "^18.2.1",
+        "@babel/runtime": "^7.23.2",
+        "@types/prop-types": "^15.7.8",
         "prop-types": "^15.8.1",
         "react-is": "^18.2.0"
       },
@@ -640,7 +642,13 @@
         "url": "https://opencollective.com/mui"
       },
       "peerDependencies": {
+        "@types/react": "^17.0.0 || ^18.0.0",
         "react": "^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
     "node_modules/@mui/utils/node_modules/react-is": {
@@ -648,10 +656,75 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.2.0.tgz",
       "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w=="
     },
+    "node_modules/@mui/x-date-pickers": {
+      "version": "6.16.3",
+      "resolved": "https://registry.npmjs.org/@mui/x-date-pickers/-/x-date-pickers-6.16.3.tgz",
+      "integrity": "sha512-CBwXrOJ5blqkAdF0d1dWF1RMeCS6ZYDq+53Yf/r+Izqj33+SCw+wAbdrxuIxE2GL3JY5NszEx8JFnCKZIzFZuA==",
+      "dependencies": {
+        "@babel/runtime": "^7.23.2",
+        "@mui/base": "^5.0.0-beta.20",
+        "@mui/utils": "^5.14.14",
+        "@types/react-transition-group": "^4.4.7",
+        "clsx": "^2.0.0",
+        "prop-types": "^15.8.1",
+        "react-transition-group": "^4.4.5"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/mui"
+      },
+      "peerDependencies": {
+        "@emotion/react": "^11.9.0",
+        "@emotion/styled": "^11.8.1",
+        "@mui/material": "^5.8.6",
+        "@mui/system": "^5.8.0",
+        "date-fns": "^2.25.0",
+        "date-fns-jalali": "^2.13.0-0",
+        "dayjs": "^1.10.7",
+        "luxon": "^3.0.2",
+        "moment": "^2.29.4",
+        "moment-hijri": "^2.1.2",
+        "moment-jalaali": "^0.7.4 || ^0.8.0 || ^0.9.0 || ^0.10.0",
+        "react": "^17.0.0 || ^18.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@emotion/react": {
+          "optional": true
+        },
+        "@emotion/styled": {
+          "optional": true
+        },
+        "date-fns": {
+          "optional": true
+        },
+        "date-fns-jalali": {
+          "optional": true
+        },
+        "dayjs": {
+          "optional": true
+        },
+        "luxon": {
+          "optional": true
+        },
+        "moment": {
+          "optional": true
+        },
+        "moment-hijri": {
+          "optional": true
+        },
+        "moment-jalaali": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@next/env": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-13.4.13.tgz",
-      "integrity": "sha512-fwz2QgVg08v7ZL7KmbQBLF2PubR/6zQdKBgmHEl3BCyWTEDsAQEijjw2gbFhI1tcKfLdOOJUXntz5vZ4S0Polg=="
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.0.3.tgz",
+      "integrity": "sha512-7xRqh9nMvP5xrW4/+L0jgRRX+HoNRGnfJpD+5Wq6/13j3dsdzxO3BCXn7D3hMqsDb+vjZnJq+vI7+EtgrYZTeA=="
     },
     "node_modules/@next/eslint-plugin-next": {
       "version": "13.4.12",
@@ -661,10 +734,29 @@
         "glob": "7.1.7"
       }
     },
+    "node_modules/@next/eslint-plugin-next/node_modules/glob": {
+      "version": "7.1.7",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.7.tgz",
+      "integrity": "sha512-OvD9ENzPLbegENnYP5UUfJIirTg4+XwMWGaQfQTY0JenxNvvIKP3U3/tAQSPIu/lHxXYSZmpXlUHeqAIdKzBLQ==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-13.4.13.tgz",
-      "integrity": "sha512-ZptVhHjzUuivnXMNCJ6lER33HN7lC+rZ01z+PM10Ows21NHFYMvGhi5iXkGtBDk6VmtzsbqnAjnx4Oz5um0FjA==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.0.3.tgz",
+      "integrity": "sha512-64JbSvi3nbbcEtyitNn2LEDS/hcleAFpHdykpcnrstITFlzFgB/bW0ER5/SJJwUPj+ZPY+z3e+1jAfcczRLVGw==",
       "cpu": [
         "arm64"
       ],
@@ -677,9 +769,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-13.4.13.tgz",
-      "integrity": "sha512-t9nTiWCLApw8W4G1kqJyYP7y6/7lyal3PftmRturIxAIBlZss9wrtVN8nci50StDHmIlIDxfguYIEGVr9DbFTg==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.0.3.tgz",
+      "integrity": "sha512-RkTf+KbAD0SgYdVn1XzqE/+sIxYGB7NLMZRn9I4Z24afrhUpVJx6L8hsRnIwxz3ERE2NFURNliPjJ2QNfnWicQ==",
       "cpu": [
         "x64"
       ],
@@ -692,9 +784,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-13.4.13.tgz",
-      "integrity": "sha512-xEHUqC8eqR5DHe8SOmMnDU1K3ggrJ28uIKltrQAwqFSSSmzjnN/XMocZkcVhuncuxYrpbri0iMQstRyRVdQVWg==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.0.3.tgz",
+      "integrity": "sha512-3tBWGgz7M9RKLO6sPWC6c4pAw4geujSwQ7q7Si4d6bo0l6cLs4tmO+lnSwFp1Tm3lxwfMk0SgkJT7EdwYSJvcg==",
       "cpu": [
         "arm64"
       ],
@@ -707,9 +799,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-13.4.13.tgz",
-      "integrity": "sha512-sNf3MnLAm8rquSSAoeD9nVcdaDeRYOeey4stOWOyWIgbBDtP+C93amSgH/LPTDoUV7gNiU6f+ghepTjTjRgIUQ==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.0.3.tgz",
+      "integrity": "sha512-v0v8Kb8j8T23jvVUWZeA2D8+izWspeyeDGNaT2/mTHWp7+37fiNfL8bmBWiOmeumXkacM/AB0XOUQvEbncSnHA==",
       "cpu": [
         "arm64"
       ],
@@ -722,9 +814,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-13.4.13.tgz",
-      "integrity": "sha512-WhcRaJJSHyx9OWmKjjz+OWHumiPZWRqmM/09Bt7Up4UqUJFFhGExeztR4trtv3rflvULatu9IH/nTV8fUUgaMA==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.0.3.tgz",
+      "integrity": "sha512-VM1aE1tJKLBwMGtyBR21yy+STfl0MapMQnNrXkxeyLs0GFv/kZqXS5Jw/TQ3TSUnbv0QPDf/X8sDXuMtSgG6eg==",
       "cpu": [
         "x64"
       ],
@@ -737,9 +829,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-13.4.13.tgz",
-      "integrity": "sha512-+Y4LLhOWWZQIDKVwr2R17lq2KSN0F1c30QVgGIWfnjjHpH8nrIWHEndhqYU+iFuW8It78CiJjQKTw4f51HD7jA==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.0.3.tgz",
+      "integrity": "sha512-64EnmKy18MYFL5CzLaSuUn561hbO1Gk16jM/KHznYP3iCIfF9e3yULtHaMy0D8zbHfxset9LTOv6cuYKJgcOxg==",
       "cpu": [
         "x64"
       ],
@@ -752,9 +844,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-13.4.13.tgz",
-      "integrity": "sha512-rWurdOR20uxjfqd1X9vDAgv0Jb26KjyL8akF9CBeFqX8rVaBAnW/Wf6A2gYEwyYY4Bai3T7p1kro6DFrsvBAAw==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.0.3.tgz",
+      "integrity": "sha512-WRDp8QrmsL1bbGtsh5GqQ/KWulmrnMBgbnb+59qNTW1kVi1nG/2ndZLkcbs2GX7NpFLlToLRMWSQXmPzQm4tog==",
       "cpu": [
         "arm64"
       ],
@@ -767,9 +859,9 @@
       }
     },
     "node_modules/@next/swc-win32-ia32-msvc": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-13.4.13.tgz",
-      "integrity": "sha512-E8bSPwRuY5ibJ3CzLQmJEt8qaWrPYuUTwnrwygPUEWoLzD5YRx9SD37oXRdU81TgGwDzCxpl7z5Nqlfk50xAog==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.0.3.tgz",
+      "integrity": "sha512-EKffQeqCrj+t6qFFhIFTRoqb2QwX1mU7iTOvMyLbYw3QtqTw9sMwjykyiMlZlrfm2a4fA84+/aeW+PMg1MjuTg==",
       "cpu": [
         "ia32"
       ],
@@ -782,9 +874,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-13.4.13.tgz",
-      "integrity": "sha512-4KlyC6jWRubPnppgfYsNTPeWfGCxtWLh5vaOAW/kdzAk9widqho8Qb5S4K2vHmal1tsURi7Onk2MMCV1phvyqA==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.0.3.tgz",
+      "integrity": "sha512-ERhKPSJ1vQrPiwrs15Pjz/rvDHZmkmvbf/BjPN/UCOI++ODftT0GtasDPi0j+y6PPJi5HsXw+dpRaXUaw4vjuQ==",
       "cpu": [
         "x64"
       ],
@@ -828,25 +920,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/@pkgr/utils": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/@pkgr/utils/-/utils-2.4.2.tgz",
-      "integrity": "sha512-POgTXhjrTfbTV63DiFXav4lBHiICLKKwDeaKn9Nphwj7WH6m0hMMCaJkMyRWjgtPFyRKRVoMXXjczsTQRDEhYw==",
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "fast-glob": "^3.3.0",
-        "is-glob": "^4.0.3",
-        "open": "^9.1.0",
-        "picocolors": "^1.0.0",
-        "tslib": "^2.6.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/unts"
-      }
-    },
     "node_modules/@popperjs/core": {
       "version": "2.11.8",
       "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz",
@@ -857,104 +930,571 @@
       }
     },
     "node_modules/@rushstack/eslint-patch": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.3.2.tgz",
-      "integrity": "sha512-V+MvGwaHH03hYhY+k6Ef/xKd6RYlc4q8WBx+2ANmipHJcKuktNcI/NgEsJgdSUF6Lw32njT6OnrRsKYCdgHjYw=="
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.5.1.tgz",
+      "integrity": "sha512-6i/8UoL0P5y4leBIGzvkZdS85RDMG9y1ihZzmTZQ5LdHUYmZ7pKFoj8X0236s3lusPs1Fa5HTQUpwI+UfTcmeA=="
+    },
+    "node_modules/@swagger-api/apidom-ast": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ast/-/apidom-ast-0.86.0.tgz",
+      "integrity": "sha512-Q1c5bciMCIGvOx1uZWh567qql2Ef0pCoZOKfhpQ+vKIevfTO85fRBmixyjxv2zETq2UZ1XwsW8q8k0feu1yBjw==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2",
+        "unraw": "^3.0.0"
+      }
+    },
+    "node_modules/@swagger-api/apidom-core": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-core/-/apidom-core-0.86.0.tgz",
+      "integrity": "sha512-HsM6Y5hEDlm8gwO5dSH9QOdtU3H18oVuEZJ/hmC7YCsqrG3EfCD3Y0V1uskuQraaUnyxVGKtgDqUrrWfoWH/sw==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-ast": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "minim": "~0.23.8",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "short-unique-id": "^5.0.2",
+        "stampit": "^4.3.2"
+      }
+    },
+    "node_modules/@swagger-api/apidom-error": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-error/-/apidom-error-0.86.0.tgz",
+      "integrity": "sha512-nUV91SDdiZ0nzk8o/D7ILToAYRpLNHsXKXnse8yMXmgaDYnQ5cBKQnuOcDOH9PG3HfDfE+MDy/aM8WKvKUzxMg==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7"
+      }
+    },
+    "node_modules/@swagger-api/apidom-json-pointer": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-json-pointer/-/apidom-json-pointer-0.86.0.tgz",
+      "integrity": "sha512-iEY16JZeNWFBxy9YimDwGoJ+LL4dvZndd7KLrtT3SN1q/oSbLPc4mc5PsqVQwV3pplYVorGwlL5sZ5BMRRuxEQ==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
+      }
+    },
+    "node_modules/@swagger-api/apidom-ns-api-design-systems": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-api-design-systems/-/apidom-ns-api-design-systems-0.86.0.tgz",
+      "integrity": "sha512-/oSrDO5YqI4b8a5DbPGV0a5mss3Rdi72vIMlEzElhuX9NkeOI0foEyzhIL/lpjrI0iUmzLk30H0puQU3aspNZA==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-1": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
     },
-    "node_modules/@swc/helpers": {
-      "version": "0.5.1",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.1.tgz",
-      "integrity": "sha512-sJ902EfIzn1Fa+qYmjdQqh8tPsoxyBz+8yBKC2HKUxyezKJFwPGOn7pv4WY6QuQW//ySQi5lJjA/ZT9sNWWNTg==",
+    "node_modules/@swagger-api/apidom-ns-asyncapi-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-asyncapi-2/-/apidom-ns-asyncapi-2-0.86.0.tgz",
+      "integrity": "sha512-q7ZGjAv1oD8Cs/cJA/jkVgVysrU5T72ItO4LcUiyd6VqfK5f13CjXw5nADPW3ETPwz1uOQ0GO6SEDNlGCsEE3A==",
+      "optional": true,
       "dependencies": {
-        "tslib": "^2.4.0"
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-json-schema-draft-7": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
+    },
+    "node_modules/@swagger-api/apidom-ns-json-schema-draft-4": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-json-schema-draft-4/-/apidom-ns-json-schema-draft-4-0.86.0.tgz",
+      "integrity": "sha512-NELX5IeCYErvTc/rJTkud8YySsaEYY4g7FwnCze8u6VnypVQLD9GPbpSR7rpm/lugx0phoAfcGvHM+mOqt14yQ==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-ast": "^0.86.0",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
+    },
+    "node_modules/@swagger-api/apidom-ns-json-schema-draft-6": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-json-schema-draft-6/-/apidom-ns-json-schema-draft-6-0.86.0.tgz",
+      "integrity": "sha512-ZYfgawZHDtsztiKIFxpTX78ajZWkyNp9+psXv7l91r0TFiuRVJRERmfvtpHE9m0sGHkJEfRcxL3RlZceQ9fohw==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@swagger-api/apidom-ns-json-schema-draft-4": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
       }
     },
-    "node_modules/@types/json5": {
-      "version": "0.0.29",
-      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
-      "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ=="
+    "node_modules/@swagger-api/apidom-ns-json-schema-draft-7": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-json-schema-draft-7/-/apidom-ns-json-schema-draft-7-0.86.0.tgz",
+      "integrity": "sha512-EcPCeS/mcgZnZJvHNrqQrdQ1V4miBx55xEcmUpfDebacexlLV9A/OpeL8ttIVJRmuhv4ATiq2/eOKaN7wETB4w==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@swagger-api/apidom-ns-json-schema-draft-6": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
     },
-    "node_modules/@types/node": {
-      "version": "20.4.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.4.5.tgz",
-      "integrity": "sha512-rt40Nk13II9JwQBdeYqmbn2Q6IVTA5uPhvSO+JVqdXw/6/4glI6oR9ezty/A9Hg5u7JH4OmYmuQ+XvjKm0Datg=="
+    "node_modules/@swagger-api/apidom-ns-openapi-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-openapi-2/-/apidom-ns-openapi-2-0.86.0.tgz",
+      "integrity": "sha512-IkORhlU8E5VoIYYJ2O+Oe/9JLcI/MLGl6yAsaReK1TZxyK/7tLghbIu6sBfJCAr7Jt1WY6lwWtvJg0ptTZ2zTw==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@swagger-api/apidom-ns-json-schema-draft-4": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
+    },
+    "node_modules/@swagger-api/apidom-ns-openapi-3-0": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-openapi-3-0/-/apidom-ns-openapi-3-0-0.86.0.tgz",
+      "integrity": "sha512-u489LR/E+5q1Hh3fzex4j6wpCBQwmcNy52dF3YSQbz5PTUOIfU4QGR6fh4/3sgublS7eQ84Z6G77Mg/vzZjeCQ==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@swagger-api/apidom-ns-json-schema-draft-4": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
+    },
+    "node_modules/@swagger-api/apidom-ns-openapi-3-1": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ns-openapi-3-1/-/apidom-ns-openapi-3-1-0.86.0.tgz",
+      "integrity": "sha512-oYXd0qHxisPh5/SNHWtlAl/g1GtDl+OPrZUp4y6tTHHLc1M4HQ/q0iTcHHdvg+t+m3l7z9wwN8KtvKtwD6EnTw==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-ast": "^0.86.0",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-0": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      }
+    },
+    "node_modules/@swagger-api/apidom-parser-adapter-api-design-systems-json": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-api-design-systems-json/-/apidom-parser-adapter-api-design-systems-json-0.86.0.tgz",
+      "integrity": "sha512-6+dhrsqAm56Vr6rhmheOPQZxQd1Zw9HXD9+JC83sMJUOstH0q73ApdKbwU8ksGYPxIeANUdjQ3oIz0Nj2tBMvw==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-api-design-systems": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-json": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
+      }
     },
-    "node_modules/@types/parse-json": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.0.tgz",
-      "integrity": "sha512-//oorEZjL6sbPcKUaCdIGlIUeH26mgzimjBB77G6XRgnDl/L5wOnpyBGRe/Mmf5CVW3PwEBE1NjiMZ/ssFh4wA=="
+    "node_modules/@swagger-api/apidom-parser-adapter-api-design-systems-yaml": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-api-design-systems-yaml/-/apidom-parser-adapter-api-design-systems-yaml-0.86.0.tgz",
+      "integrity": "sha512-mQTKwIorT1VSa75nsclSUCp5EaovWkuaewZfrOGDUWFhY+++vcnScBdcJv7TBtO2ttTge4UOSu9qgpoSrztXZg==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-api-design-systems": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-yaml-1-2": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
+      }
     },
-    "node_modules/@types/prop-types": {
-      "version": "15.7.5",
-      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.5.tgz",
-      "integrity": "sha512-JCB8C6SnDoQf0cNycqd/35A7MjcnK+ZTqE7judS6o7utxUCg6imJg3QK2qzHKszlTjcj2cn+NwMB2i96ubpj7w=="
+    "node_modules/@swagger-api/apidom-parser-adapter-asyncapi-json-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-asyncapi-json-2/-/apidom-parser-adapter-asyncapi-json-2-0.86.0.tgz",
+      "integrity": "sha512-jNtvUJoiI++P3FAQf7X03se+Qx0sUhA5bBSINGMuhjPcSyOAWj9oiPjpB9SYltaqvEb9ek7iPObrt/dx9zj6Ag==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-asyncapi-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-json": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
+      }
     },
-    "node_modules/@types/react": {
-      "version": "18.2.16",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.16.tgz",
-      "integrity": "sha512-LLFWr12ZhBJ4YVw7neWLe6Pk7Ey5R9OCydfuMsz1L8bZxzaawJj2p06Q8/EFEHDeTBQNFLF62X+CG7B2zIyu0Q==",
+    "node_modules/@swagger-api/apidom-parser-adapter-asyncapi-yaml-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-asyncapi-yaml-2/-/apidom-parser-adapter-asyncapi-yaml-2-0.86.0.tgz",
+      "integrity": "sha512-A0GTtD6gYPEA3tQQ1A6yw+SceKdDEea3slISVx5bpeDREk8wAl/886EGJICcgFrPO57dUD3HoLqmPn/uUl26mA==",
+      "optional": true,
       "dependencies": {
-        "@types/prop-types": "*",
-        "@types/scheduler": "*",
-        "csstype": "^3.0.2"
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-asyncapi-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-yaml-1-2": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
       }
     },
-    "node_modules/@types/react-dom": {
-      "version": "18.2.7",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.2.7.tgz",
-      "integrity": "sha512-GRaAEriuT4zp9N4p1i8BDBYmEyfo+xQ3yHjJU4eiK5NDa1RmUZG+unZABUTK4/Ox/M+GaHwb6Ow8rUITrtjszA==",
+    "node_modules/@swagger-api/apidom-parser-adapter-json": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-json/-/apidom-parser-adapter-json-0.86.0.tgz",
+      "integrity": "sha512-bh5fndjX7JwgkZ0z3tEDknCEFysAs2oSoYiHN8iSLl/MKXBE001tJeJrOdnP9BnrPQSyXAbdT1c1dG3oTnxUgw==",
+      "optional": true,
       "dependencies": {
-        "@types/react": "*"
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-ast": "^0.86.0",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2",
+        "tree-sitter": "=0.20.4",
+        "tree-sitter-json": "=0.20.1",
+        "web-tree-sitter": "=0.20.3"
+      }
+    },
+    "node_modules/@swagger-api/apidom-parser-adapter-openapi-json-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-openapi-json-2/-/apidom-parser-adapter-openapi-json-2-0.86.0.tgz",
+      "integrity": "sha512-BULmOvcLnf4QpZ2QFOCrpZnNKLf8sZfzpDPXJm6QwyoZQqAMmeHmEzAY9dE9RrCwNx9lVjumAEoyNf7Hy4qrWw==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-json": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
       }
     },
-    "node_modules/@types/react-is": {
-      "version": "18.2.1",
-      "resolved": "https://registry.npmjs.org/@types/react-is/-/react-is-18.2.1.tgz",
-      "integrity": "sha512-wyUkmaaSZEzFZivD8F2ftSyAfk6L+DfFliVj/mYdOXbVjRcS87fQJLTnhk6dRZPuJjI+9g6RZJO4PNCngUrmyw==",
+    "node_modules/@swagger-api/apidom-parser-adapter-openapi-json-3-0": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-openapi-json-3-0/-/apidom-parser-adapter-openapi-json-3-0-0.86.0.tgz",
+      "integrity": "sha512-zo/fNkWe9A2AL+cqzt+Z3OiTE5oLEWpLY+Y0tuLWh8YME0ZY7BmR2HYNdWquIhOy5b279QeD19Kv15aY24obxA==",
+      "optional": true,
       "dependencies": {
-        "@types/react": "*"
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-0": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-json": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
       }
     },
-    "node_modules/@types/react-transition-group": {
-      "version": "4.4.6",
-      "resolved": "https://registry.npmjs.org/@types/react-transition-group/-/react-transition-group-4.4.6.tgz",
-      "integrity": "sha512-VnCdSxfcm08KjsJVQcfBmhEQAPnLB8G08hAxn39azX1qYBQ/5RVQuoHuKIcfKOdncuaUvEpFKFzEvbtIMsfVew==",
+    "node_modules/@swagger-api/apidom-parser-adapter-openapi-json-3-1": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-openapi-json-3-1/-/apidom-parser-adapter-openapi-json-3-1-0.86.0.tgz",
+      "integrity": "sha512-NkFrAyr27Ubwkacv2YolxSN/NciKqJyIEXtAg4SfP/ejTy1Gl+PcT5pZSjQ3doRx1BPp3CF+a2Hsi5HJI6wEzA==",
+      "optional": true,
       "dependencies": {
-        "@types/react": "*"
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-1": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-json": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
       }
     },
-    "node_modules/@types/scheduler": {
-      "version": "0.16.3",
-      "resolved": "https://registry.npmjs.org/@types/scheduler/-/scheduler-0.16.3.tgz",
-      "integrity": "sha512-5cJ8CB4yAx7BH1oMvdU0Jh9lrEXyPkar6F9G/ERswkCuvP4KQZfZkSjcMbAICCpQTN4OuZn8tz0HiKv9TGZgrQ=="
+    "node_modules/@swagger-api/apidom-parser-adapter-openapi-yaml-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-openapi-yaml-2/-/apidom-parser-adapter-openapi-yaml-2-0.86.0.tgz",
+      "integrity": "sha512-flAGqElCSrVN9XXdA00NWmctOPuqzc+8r15omRvVFZ+Qfzca+FWpyFvzUFr92TKX87XUBALvnu7VA5+g1PftGg==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-yaml-1-2": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
+      }
     },
-    "node_modules/@typescript-eslint/parser": {
-      "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.62.0.tgz",
-      "integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==",
+    "node_modules/@swagger-api/apidom-parser-adapter-openapi-yaml-3-0": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-openapi-yaml-3-0/-/apidom-parser-adapter-openapi-yaml-3-0-0.86.0.tgz",
+      "integrity": "sha512-TT93vbdj6GWhNHU4cTih/93kWJ5l6ZeEyaEQWyd+MhDxgoy6/rCOeblwyMQCgaXL6AmG5qSKTu48Y+GTCqURng==",
+      "optional": true,
       "dependencies": {
-        "@typescript-eslint/scope-manager": "5.62.0",
-        "@typescript-eslint/types": "5.62.0",
-        "@typescript-eslint/typescript-estree": "5.62.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-0": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-yaml-1-2": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
       }
     },
-    "node_modules/@typescript-eslint/scope-manager": {
+    "node_modules/@swagger-api/apidom-parser-adapter-openapi-yaml-3-1": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-openapi-yaml-3-1/-/apidom-parser-adapter-openapi-yaml-3-1-0.86.0.tgz",
+      "integrity": "sha512-BPNzUdbQbd29YrotIhg/pPZkVXZ8PZOEy9Wy/Aornv9gFZwhzzWE9uOo/HGBDXJqqq5Va1RJkxuYXjIX7BVKBw==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-1": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-yaml-1-2": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.0.0"
+      }
+    },
+    "node_modules/@swagger-api/apidom-parser-adapter-yaml-1-2": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-parser-adapter-yaml-1-2/-/apidom-parser-adapter-yaml-1-2-0.86.0.tgz",
+      "integrity": "sha512-wtvEJFk4uxQbDQH23mjVIeOJJ6IEpiorBNfW/6foPfJbUU7zDE/a0VTEo/wKPxumLe9eLNHuTZSSOvy2y0BmTw==",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-ast": "^0.86.0",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2",
+        "tree-sitter": "=0.20.4",
+        "tree-sitter-yaml": "=0.5.0",
+        "web-tree-sitter": "=0.20.3"
+      }
+    },
+    "node_modules/@swagger-api/apidom-reference": {
+      "version": "0.86.0",
+      "resolved": "https://registry.npmjs.org/@swagger-api/apidom-reference/-/apidom-reference-0.86.0.tgz",
+      "integrity": "sha512-YjlocO/JkuK1SwGs8ke7AAHecR5w2GyKjWRAGZ06+2ZO8cqV3/0uuuL+laRbYchrFWERqJCUEQre0qJ3BPY7xA==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.20.7",
+        "@swagger-api/apidom-core": "^0.86.0",
+        "@types/ramda": "~0.29.6",
+        "axios": "^1.4.0",
+        "minimatch": "^7.4.3",
+        "process": "^0.11.10",
+        "ramda": "~0.29.1",
+        "ramda-adjunct": "^4.1.1",
+        "stampit": "^4.3.2"
+      },
+      "optionalDependencies": {
+        "@swagger-api/apidom-error": "^0.86.0",
+        "@swagger-api/apidom-json-pointer": "^0.86.0",
+        "@swagger-api/apidom-ns-asyncapi-2": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-2": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-0": "^0.86.0",
+        "@swagger-api/apidom-ns-openapi-3-1": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-api-design-systems-json": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-api-design-systems-yaml": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-asyncapi-json-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-asyncapi-yaml-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-json": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-openapi-json-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-openapi-json-3-0": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-openapi-json-3-1": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-openapi-yaml-2": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-openapi-yaml-3-0": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-openapi-yaml-3-1": "^0.86.0",
+        "@swagger-api/apidom-parser-adapter-yaml-1-2": "^0.86.0"
+      }
+    },
+    "node_modules/@swagger-api/apidom-reference/node_modules/brace-expansion": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/@swagger-api/apidom-reference/node_modules/minimatch": {
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-7.4.6.tgz",
+      "integrity": "sha512-sBz8G/YjVniEz6lKPNpKxXwazJe4c19fEfV2GDMX6AjFz+MX9uDWIZW8XreVhkFW3fkIdTv/gxWr/Kks5FFAVw==",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@swc/helpers": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.2.tgz",
+      "integrity": "sha512-E4KcWTpoLHqwPHLxidpOqQbcrZVgi0rsmmZXUle1jXmJfuIf/UWpczUJ7MZZ5tlxytgJXyp0w4PGkkeLiuIdZw==",
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@swc/helpers/node_modules/tslib": {
+      "version": "2.6.2",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz",
+      "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
+    },
+    "node_modules/@types/hast": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-2.3.8.tgz",
+      "integrity": "sha512-aMIqAlFd2wTIDZuvLbhUT+TGvMxrNC8ECUIVtH6xxy0sQLs3iu6NO8Kp/VT5je7i5ufnebXzdV1dNDMnvaH6IQ==",
+      "dependencies": {
+        "@types/unist": "^2"
+      }
+    },
+    "node_modules/@types/hoist-non-react-statics": {
+      "version": "3.3.5",
+      "resolved": "https://registry.npmjs.org/@types/hoist-non-react-statics/-/hoist-non-react-statics-3.3.5.tgz",
+      "integrity": "sha512-SbcrWzkKBw2cdwRTwQAswfpB9g9LJWfjtUeW/jvNwbhC8cpmmNYVePa+ncbUe0rGTQ7G3Ff6mYUN2VMfLVr+Sg==",
+      "dependencies": {
+        "@types/react": "*",
+        "hoist-non-react-statics": "^3.3.0"
+      }
+    },
+    "node_modules/@types/json5": {
+      "version": "0.0.29",
+      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
+      "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ=="
+    },
+    "node_modules/@types/luxon": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-3.3.3.tgz",
+      "integrity": "sha512-/BJF3NT0pRMuxrenr42emRUF67sXwcZCd+S1ksG/Fcf9O7C3kKCY4uJSbKBE4KDUIYr3WMsvfmWD8hRjXExBJQ==",
+      "dev": true
+    },
+    "node_modules/@types/node": {
+      "version": "20.4.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.4.5.tgz",
+      "integrity": "sha512-rt40Nk13II9JwQBdeYqmbn2Q6IVTA5uPhvSO+JVqdXw/6/4glI6oR9ezty/A9Hg5u7JH4OmYmuQ+XvjKm0Datg=="
+    },
+    "node_modules/@types/parse-json": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.1.tgz",
+      "integrity": "sha512-3YmXzzPAdOTVljVMkTMBdBEvlOLg2cDQaDhnnhT3nT9uDbnJzjWhKlzb+desT12Y7tGqaN6d+AbozcKzyL36Ng=="
+    },
+    "node_modules/@types/prop-types": {
+      "version": "15.7.9",
+      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.9.tgz",
+      "integrity": "sha512-n1yyPsugYNSmHgxDFjicaI2+gCNjsBck8UX9kuofAKlc0h1bL+20oSF72KeNaW2DUlesbEVCFgyV2dPGTiY42g=="
+    },
+    "node_modules/@types/ramda": {
+      "version": "0.29.9",
+      "resolved": "https://registry.npmjs.org/@types/ramda/-/ramda-0.29.9.tgz",
+      "integrity": "sha512-X3yEG6tQCWBcUAql+RPC/O1Hm9BSU+MXu2wJnCETuAgUlrEDwTA1kIOdEEE4YXDtf0zfQLHa9CCE7WYp9kqPIQ==",
+      "dependencies": {
+        "types-ramda": "^0.29.6"
+      }
+    },
+    "node_modules/@types/react": {
+      "version": "18.2.16",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.16.tgz",
+      "integrity": "sha512-LLFWr12ZhBJ4YVw7neWLe6Pk7Ey5R9OCydfuMsz1L8bZxzaawJj2p06Q8/EFEHDeTBQNFLF62X+CG7B2zIyu0Q==",
+      "dependencies": {
+        "@types/prop-types": "*",
+        "@types/scheduler": "*",
+        "csstype": "^3.0.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "18.2.7",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.2.7.tgz",
+      "integrity": "sha512-GRaAEriuT4zp9N4p1i8BDBYmEyfo+xQ3yHjJU4eiK5NDa1RmUZG+unZABUTK4/Ox/M+GaHwb6Ow8rUITrtjszA==",
+      "dependencies": {
+        "@types/react": "*"
+      }
+    },
+    "node_modules/@types/react-transition-group": {
+      "version": "4.4.8",
+      "resolved": "https://registry.npmjs.org/@types/react-transition-group/-/react-transition-group-4.4.8.tgz",
+      "integrity": "sha512-QmQ22q+Pb+HQSn04NL3HtrqHwYMf4h3QKArOy5F8U5nEVMaihBs3SR10WiOM1iwPz5jIo8x/u11al+iEGZZrvg==",
+      "dependencies": {
+        "@types/react": "*"
+      }
+    },
+    "node_modules/@types/scheduler": {
+      "version": "0.16.5",
+      "resolved": "https://registry.npmjs.org/@types/scheduler/-/scheduler-0.16.5.tgz",
+      "integrity": "sha512-s/FPdYRmZR8SjLWGMCuax7r3qCWQw9QKHzXVukAuuIJkXkDRwp+Pu5LMIVFi0Fxbav35WURicYr8u1QsoybnQw=="
+    },
+    "node_modules/@types/swagger-ui-react": {
+      "version": "4.18.3",
+      "resolved": "https://registry.npmjs.org/@types/swagger-ui-react/-/swagger-ui-react-4.18.3.tgz",
+      "integrity": "sha512-Mo/R7IjDVwtiFPs84pWvh5pI9iyNGBjmfielxqbOh2Jv+8WVSDVe8Nu25kb5BOuV2xmGS3o33jr6nwDJMBcX+Q==",
+      "dev": true,
+      "dependencies": {
+        "@types/react": "*"
+      }
+    },
+    "node_modules/@types/unist": {
+      "version": "2.0.10",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-2.0.10.tgz",
+      "integrity": "sha512-IfYcSBWE3hLpBg8+X2SEa8LVkJdJEkT2Ese2aaLs3ptGdVtABxndrMaxuFlQ1qdFf9Q5rDvDpxI3WwgvKFAsQA=="
+    },
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.3.tgz",
+      "integrity": "sha512-EwmlvuaxPNej9+T4v5AuBPJa2x2UOJVdjCtDHgcDqitUeOtjnJKJ+apYjVcAoBEMjKW1VVFGZLUb5+qqa09XFA=="
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "5.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.62.0.tgz",
+      "integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==",
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "5.62.0",
+        "@typescript-eslint/types": "5.62.0",
+        "@typescript-eslint/typescript-estree": "5.62.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
       "version": "5.62.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.62.0.tgz",
       "integrity": "sha512-VXuvVvZeQCQb5Zgf4HAxc04q5j+WrNAtNh9OwCsCgpKqESMTu3tF/jhZ3xG6T4NZwWl65Bg8KuS2uEvhSfLl0w==",
@@ -1024,6 +1564,11 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@yarnpkg/lockfile": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz",
+      "integrity": "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ=="
+    },
     "node_modules/acorn": {
       "version": "8.10.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.10.0.tgz",
@@ -1067,17 +1612,14 @@
       }
     },
     "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
       "dependencies": {
-        "color-convert": "^2.0.1"
+        "color-convert": "^1.9.0"
       },
       "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+        "node": ">=4"
       }
     },
     "node_modules/argparse": {
@@ -1106,14 +1648,14 @@
       }
     },
     "node_modules/array-includes": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.6.tgz",
-      "integrity": "sha512-sgTbLvL6cNnw24FnbaDyjmvddQ2ML8arZsgaJhoABMoplz/4QRhtrYS+alr1BUM1Bwp6dhx8vVCBSLG+StwOFw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.7.tgz",
+      "integrity": "sha512-dlcsNBIiWhPkHdOEEKnehA+RNUWDc4UqFtnIXU4uuYDPtA4LDkr7qip2p0VvFAEXNDr0yWZ9PJyIRiGjRLQzwQ==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
+        "get-intrinsic": "^1.2.1",
         "is-string": "^1.0.7"
       },
       "engines": {
@@ -1131,14 +1673,32 @@
         "node": ">=8"
       }
     },
+    "node_modules/array.prototype.findlastindex": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/array.prototype.findlastindex/-/array.prototype.findlastindex-1.2.3.tgz",
+      "integrity": "sha512-LzLoiOMAxvy+Gd3BAq3B7VeIgPdo+Q8hthvKtXybMvRV0jrXfJM/t8mw7nNlpEcVlVUnCnM2KSX4XU5HmpodOA==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
+        "es-shim-unscopables": "^1.0.0",
+        "get-intrinsic": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/array.prototype.flat": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.1.tgz",
-      "integrity": "sha512-roTU0KWIOmJ4DRLmwKd19Otg0/mT3qPNt0Qb3GWW8iObuZXxrjB/pzn0R3hqpRSWg4HCwqx+0vwOnWnvlOyeIA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.2.tgz",
+      "integrity": "sha512-djYB+Zx2vLewY8RWlNCUdHjDXs2XOgm602S9E7P/UpHgfeHL00cRiIF+IN/G/aUJ7kGPb6yO/ErDI5V2s8iycA==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
         "es-shim-unscopables": "^1.0.0"
       },
       "engines": {
@@ -1149,13 +1709,13 @@
       }
     },
     "node_modules/array.prototype.flatmap": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.1.tgz",
-      "integrity": "sha512-8UGn9O1FDVvMNB0UlLv4voxRMze7+FpHyF5mSMRjWHUMlpoDViniy05870VlxhfgTnLbpuwTzvD76MTtWxB/mQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.2.tgz",
+      "integrity": "sha512-Ewyx0c9PmpcsByhSW4r+9zDU7sGjFc86qf/kKtuSCRdhfbk0SNLLkaT5qvcHnRGgc5NP/ly/y+qkXkqONX54CQ==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
         "es-shim-unscopables": "^1.0.0"
       },
       "engines": {
@@ -1166,25 +1726,26 @@
       }
     },
     "node_modules/array.prototype.tosorted": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.1.tgz",
-      "integrity": "sha512-pZYPXPRl2PqWcsUs6LOMn+1f1532nEoPTYowBtqLwAW+W8vSVhkIGnmOX1t/UQjD6YGI0vcD2B1U7ZFGQH9jnQ==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.2.tgz",
+      "integrity": "sha512-HuQCHOlk1Weat5jzStICBCd83NxiIMwqDg/dHEsoefabn/hJRj5pVdWcPUSpRrwhwxZOsQassMpgN/xRYFBMIg==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
         "es-shim-unscopables": "^1.0.0",
-        "get-intrinsic": "^1.1.3"
+        "get-intrinsic": "^1.2.1"
       }
     },
     "node_modules/arraybuffer.prototype.slice": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.1.tgz",
-      "integrity": "sha512-09x0ZWFEjj4WD8PDbykUwo3t9arLn8NIzmmYEJFpYekOAQjpkGSyrQhNoRTcwwcFRu+ycWF78QZ63oWTqSjBcw==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.2.tgz",
+      "integrity": "sha512-yMBKppFur/fbHu9/6USUe03bZ4knMYiwFBcyiaXB8Go0qNehwX6inYPzK9U0NeQvGxKthcmHcaR8P5MStSRBAw==",
       "dependencies": {
         "array-buffer-byte-length": "^1.0.0",
         "call-bind": "^1.0.2",
         "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
         "get-intrinsic": "^1.2.1",
         "is-array-buffer": "^3.0.2",
         "is-shared-array-buffer": "^1.0.2"
@@ -1201,6 +1762,40 @@
       "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.7.tgz",
       "integrity": "sha512-eBvWn1lvIApYMhzQMsu9ciLfkBY499mFZlNqG+/9WR7PVlroQw0vG30cOQQbaKz3sCEc44TAOu2ykzqXSNnwag=="
     },
+    "node_modules/asynciterator.prototype": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/asynciterator.prototype/-/asynciterator.prototype-1.0.0.tgz",
+      "integrity": "sha512-wwHYEIS0Q80f5mosx3L/dfG5t5rjEa9Ft51GTaNt862EnpyGHpgz2RkZvLPp1oF5TnAiTohkEKVEu8pQPJI7Vg==",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      }
+    },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
+    },
+    "node_modules/at-least-node": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
+      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
+      "engines": {
+        "node": ">= 4.0.0"
+      }
+    },
+    "node_modules/autolinker": {
+      "version": "3.16.2",
+      "resolved": "https://registry.npmjs.org/autolinker/-/autolinker-3.16.2.tgz",
+      "integrity": "sha512-JiYl7j2Z19F9NdTmirENSUUIIL/9MytEWtmzhfmsKPCp9E+G35Y0UNCMoM9tFigxT59qSc8Ml2dlZXOCVTYwuA==",
+      "dependencies": {
+        "tslib": "^2.3.0"
+      }
+    },
+    "node_modules/autolinker/node_modules/tslib": {
+      "version": "2.6.2",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz",
+      "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
+    },
     "node_modules/available-typed-arrays": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz",
@@ -1213,13 +1808,23 @@
       }
     },
     "node_modules/axe-core": {
-      "version": "4.7.2",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.7.2.tgz",
-      "integrity": "sha512-zIURGIS1E1Q4pcrMjp+nnEh+16G56eG/MUllJH8yEvw7asDo7Ac9uhC9KIH5jzpITueEZolfYglnCGIuSBz39g==",
+      "version": "4.8.2",
+      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.8.2.tgz",
+      "integrity": "sha512-/dlp0fxyM3R8YW7MFzaHWXrf4zzbr0vaYb23VBFCl83R7nWNPg/yaQw2Dc8jzCMmDVLhSdzH8MjrsuIUuvX+6g==",
       "engines": {
         "node": ">=4"
       }
     },
+    "node_modules/axios": {
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.2.tgz",
+      "integrity": "sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==",
+      "dependencies": {
+        "follow-redirects": "^1.15.0",
+        "form-data": "^4.0.0",
+        "proxy-from-env": "^1.1.0"
+      }
+    },
     "node_modules/axobject-query": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-3.2.1.tgz",
@@ -1247,23 +1852,34 @@
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
-    "node_modules/big-integer": {
-      "version": "1.6.51",
-      "resolved": "https://registry.npmjs.org/big-integer/-/big-integer-1.6.51.tgz",
-      "integrity": "sha512-GPEid2Y9QU1Exl1rpO9B2IPJGHPSupF5GnVIP0blYvNOMer2bTvSWs1jGOUg04hTmu67nmLsQ9TBo1puaotBHg==",
-      "engines": {
-        "node": ">=0.6"
-      }
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
     },
-    "node_modules/bplist-parser": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/bplist-parser/-/bplist-parser-0.2.0.tgz",
-      "integrity": "sha512-z0M+byMThzQmD9NILRniCUXYsYpjwnlO8N5uCFaCqIOpqRsJCrQL9NK3JsD67CN5a08nF5oIL2bD6loTdHOuKw==",
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "optional": true,
       "dependencies": {
-        "big-integer": "^1.6.44"
-      },
-      "engines": {
-        "node": ">= 5.10.0"
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
       }
     },
     "node_modules/brace-expansion": {
@@ -1286,18 +1902,28 @@
         "node": ">=8"
       }
     },
-    "node_modules/bundle-name": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-3.0.0.tgz",
-      "integrity": "sha512-PKA4BeSvBpQKQ8iPOGCSiell+N8P+Tf1DlwqmYhpe2gAhKPHn8EYOxVT+ShuGmhg8lN8XiSlS80yiExKXrURlw==",
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "optional": true,
       "dependencies": {
-        "run-applescript": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
       }
     },
     "node_modules/busboy": {
@@ -1312,12 +1938,13 @@
       }
     },
     "node_modules/call-bind": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
-      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.5.tgz",
+      "integrity": "sha512-C3nQxfFZxFRVoJoGKKI8y3MOEo129NQ+FgQ08iye+Mk4zNZZGdjfs06bVTr+DBSlA66Q2VEcMki/cUCP4SercQ==",
       "dependencies": {
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.0.2"
+        "function-bind": "^1.1.2",
+        "get-intrinsic": "^1.2.1",
+        "set-function-length": "^1.1.1"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -1332,9 +1959,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001517",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001517.tgz",
-      "integrity": "sha512-Vdhm5S11DaFVLlyiKu4hiUTkpZu+y1KA/rZZqVQfOD5YdDT/eQKlkt7NaE0WGOFgX32diqt9MiP9CAiFeRklaA==",
+      "version": "1.0.30001553",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001553.tgz",
+      "integrity": "sha512-N0ttd6TrFfuqKNi+pMgWJTb9qrdJu4JSpgPFLe/lrD19ugC6fZgF0pUewRowDwzdDnb9V41mFcdlYgl/PyKf4A==",
       "funding": [
         {
           "type": "opencollective",
@@ -1351,35 +1978,113 @@
       ]
     },
     "node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
       "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
       },
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
+        "node": ">=4"
       }
     },
-    "node_modules/chart.js": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.4.0.tgz",
-      "integrity": "sha512-vQEj6d+z0dcsKLlQvbKIMYFHd3t8W/7L2vfJIbYcfyPcRx92CsHqECpueN8qVGNlKyDcr5wBrYAYKnfu/9Q1hQ==",
-      "dependencies": {
-        "@kurkle/color": "^0.3.0"
-      },
+    "node_modules/chalk/node_modules/escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
       "engines": {
-        "pnpm": ">=7"
+        "node": ">=0.8.0"
       }
     },
-    "node_modules/client-only": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
-      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA=="
+    "node_modules/character-entities": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-1.2.4.tgz",
+      "integrity": "sha512-iBMyeEHxfVnIakwOuDXpVkc54HijNgCyQB2w0VfGQThle6NXn50zU6V/u+LDhxHcDUPojn6Kpga3PTAD8W1bQw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-legacy": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-1.1.4.tgz",
+      "integrity": "sha512-3Xnr+7ZFS1uxeiUDvV02wQ+QDbc55o97tIV5zHScSPJpcLm/r0DFPcoY3tYRp+VZukxuMeKgXYmsXQHO05zQeA==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-reference-invalid": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-1.1.4.tgz",
+      "integrity": "sha512-mKKUkUbhPpQlCOfIuZkvSEgktjPFIsZKRRbC6KWVEMvlzblj3i3asQv5ODsrwt0N3pHAEvjP8KTQPHkp0+6jOg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/chart.js": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.4.0.tgz",
+      "integrity": "sha512-vQEj6d+z0dcsKLlQvbKIMYFHd3t8W/7L2vfJIbYcfyPcRx92CsHqECpueN8qVGNlKyDcr5wBrYAYKnfu/9Q1hQ==",
+      "dependencies": {
+        "@kurkle/color": "^0.3.0"
+      },
+      "engines": {
+        "pnpm": ">=7"
+      }
+    },
+    "node_modules/chartjs-adapter-luxon": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/chartjs-adapter-luxon/-/chartjs-adapter-luxon-1.3.1.tgz",
+      "integrity": "sha512-yxHov3X8y+reIibl1o+j18xzrcdddCLqsXhriV2+aQ4hCR66IYFchlRXUvrJVoxglJ380pgytU7YWtoqdIgqhg==",
+      "peerDependencies": {
+        "chart.js": ">=3.0.0",
+        "luxon": ">=1.0.0"
+      }
+    },
+    "node_modules/chartjs-plugin-zoom": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/chartjs-plugin-zoom/-/chartjs-plugin-zoom-2.0.1.tgz",
+      "integrity": "sha512-ogOmLu6e+Q7E1XWOCOz9YwybMslz9qNfGV2a+qjfmqJYpsw5ZMoRHZBUyW+NGhkpQ5PwwPA/+rikHpBZb7PZuA==",
+      "dependencies": {
+        "hammerjs": "^2.0.8"
+      },
+      "peerDependencies": {
+        "chart.js": ">=3.2.0"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "optional": true
+    },
+    "node_modules/ci-info": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
+      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/classnames": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.3.2.tgz",
+      "integrity": "sha512-CSbhY4cFEJRe6/GQzIk5qXZ4Jeg5pcsP7b5peFSDpffpe1cqjASH/n9UTjBwOp6XpMSTwQ8Za2K5V02ueA7Tmw=="
+    },
+    "node_modules/client-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
+      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA=="
     },
     "node_modules/clsx": {
       "version": "2.0.0",
@@ -1390,20 +2095,37 @@
       }
     },
     "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
       "dependencies": {
-        "color-name": "~1.1.4"
+        "color-name": "1.1.3"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw=="
+    },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
       },
       "engines": {
-        "node": ">=7.0.0"
+        "node": ">= 0.8"
       }
     },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+    "node_modules/comma-separated-tokens": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-1.0.8.tgz",
+      "integrity": "sha512-GHuDRO12Sypu2cV70d1dkA2EUmXHgntrzbpvOB+Qy+49ypNfGgFQIC2fhhXbnyrJRynDCAARsT7Ou0M6hirpfw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
     },
     "node_modules/concat-map": {
       "version": "0.0.1",
@@ -1415,6 +2137,32 @@
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
       "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A=="
     },
+    "node_modules/cookie": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
+      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/copy-to-clipboard": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/copy-to-clipboard/-/copy-to-clipboard-3.3.3.tgz",
+      "integrity": "sha512-2KV8NhB5JqC3ky0r9PMCAZKbUHSwtEo4CwCs0KXgruG43gX5PMqDEBbVU4OUzw2MuAWUfsuFmWvEKG5QRfSnJA==",
+      "dependencies": {
+        "toggle-selection": "^1.0.6"
+      }
+    },
+    "node_modules/core-js-pure": {
+      "version": "3.34.0",
+      "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.34.0.tgz",
+      "integrity": "sha512-pmhivkYXkymswFfbXsANmBAewXx86UBfmagP+w0wkK06kLsLlTK5oQmsURPivzMkIBQiYq2cjamcZExIwlFQIg==",
+      "hasInstallScript": true,
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/core-js"
+      }
+    },
     "node_modules/cosmiconfig": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz",
@@ -1430,6 +2178,14 @@
         "node": ">=10"
       }
     },
+    "node_modules/cosmiconfig/node_modules/yaml": {
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
+      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/cross-spawn": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
@@ -1443,6 +2199,11 @@
         "node": ">= 8"
       }
     },
+    "node_modules/css.escape": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/css.escape/-/css.escape-1.5.1.tgz",
+      "integrity": "sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg=="
+    },
     "node_modules/csstype": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.2.tgz",
@@ -1469,59 +2230,61 @@
         }
       }
     },
-    "node_modules/deep-is": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="
-    },
-    "node_modules/default-browser": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-4.0.0.tgz",
-      "integrity": "sha512-wX5pXO1+BrhMkSbROFsyxUm0i/cJEScyNhA4PPxc41ICuv05ZZB/MX28s8aZx6xjmatvebIapF6hLEKEcpneUA==",
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "optional": true,
       "dependencies": {
-        "bundle-name": "^3.0.0",
-        "default-browser-id": "^3.0.0",
-        "execa": "^7.1.1",
-        "titleize": "^3.0.0"
+        "mimic-response": "^3.1.0"
       },
       "engines": {
-        "node": ">=14.16"
+        "node": ">=10"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/default-browser-id": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/default-browser-id/-/default-browser-id-3.0.0.tgz",
-      "integrity": "sha512-OZ1y3y0SqSICtE8DE4S8YOE9UZOJ8wO16fKWVP5J1Qz42kV9jcnMVFrEE/noXb/ss3Q4pZIH79kxofzyNNtUNA==",
-      "dependencies": {
-        "bplist-parser": "^0.2.0",
-        "untildify": "^4.0.0"
-      },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=4.0.0"
       }
     },
-    "node_modules/define-lazy-prop": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
-      "integrity": "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==",
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="
+    },
+    "node_modules/deepmerge": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
       "engines": {
-        "node": ">=12"
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/define-data-property": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.1.tgz",
+      "integrity": "sha512-E7uGkTzkk1d0ByLeSc6ZsFS79Axg+m1P/VsgYsxHgiuc3tFSj+MjMIwe90FC4lOAZzNBdY7kkO2P2wKdsQ1vgQ==",
+      "dependencies": {
+        "get-intrinsic": "^1.2.1",
+        "gopd": "^1.0.1",
+        "has-property-descriptors": "^1.0.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "engines": {
+        "node": ">= 0.4"
       }
     },
     "node_modules/define-properties": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.0.tgz",
-      "integrity": "sha512-xvqAVKGfT1+UAvPwKTVw/njhdQ8ZhXK4lI0bCIuCMrp2up9nPnaDftrLtmpTazqd1o+UY4zgzU+avtMbDP+ldA==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
+      "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
       "dependencies": {
+        "define-data-property": "^1.0.1",
         "has-property-descriptors": "^1.0.0",
         "object-keys": "^1.1.1"
       },
@@ -1532,6 +2295,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/dequal": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
@@ -1540,6 +2311,15 @@
         "node": ">=6"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.2.tgz",
+      "integrity": "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw==",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/dir-glob": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
@@ -1571,11 +2351,33 @@
         "csstype": "^3.0.2"
       }
     },
+    "node_modules/dompurify": {
+      "version": "3.0.6",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.0.6.tgz",
+      "integrity": "sha512-ilkD8YEnnGh1zJ240uJsW7AzE+2qpbOUYjacomn3AvJ6J4JhKGSZ2nh4wUIXPZrEPppaCLx5jFe8T89Rk8tQ7w=="
+    },
+    "node_modules/drange": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/drange/-/drange-1.1.1.tgz",
+      "integrity": "sha512-pYxfDYpued//QpnLIm4Avk7rsNtAtQkUES2cwAYSvD/wd2pKD71gN2Ebj3e7klzXwjocvE8c5vx/1fxwpqmSxA==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
       "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
     },
+    "node_modules/end-of-stream": {
+      "version": "1.4.4",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+      "optional": true,
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
     "node_modules/enhanced-resolve": {
       "version": "5.15.0",
       "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.15.0.tgz",
@@ -1597,25 +2399,25 @@
       }
     },
     "node_modules/es-abstract": {
-      "version": "1.22.1",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.22.1.tgz",
-      "integrity": "sha512-ioRRcXMO6OFyRpyzV3kE1IIBd4WG5/kltnzdxSCqoP8CMGs/Li+M1uF5o7lOkZVFjDs+NLesthnF66Pg/0q0Lw==",
+      "version": "1.22.3",
+      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.22.3.tgz",
+      "integrity": "sha512-eiiY8HQeYfYH2Con2berK+To6GrK2RxbPawDkGq4UiCQQfZHb6wX9qQqkbpPqaxQFcl8d9QzZqo0tGE0VcrdwA==",
       "dependencies": {
         "array-buffer-byte-length": "^1.0.0",
-        "arraybuffer.prototype.slice": "^1.0.1",
+        "arraybuffer.prototype.slice": "^1.0.2",
         "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
+        "call-bind": "^1.0.5",
         "es-set-tostringtag": "^2.0.1",
         "es-to-primitive": "^1.2.1",
-        "function.prototype.name": "^1.1.5",
-        "get-intrinsic": "^1.2.1",
+        "function.prototype.name": "^1.1.6",
+        "get-intrinsic": "^1.2.2",
         "get-symbol-description": "^1.0.0",
         "globalthis": "^1.0.3",
         "gopd": "^1.0.1",
-        "has": "^1.0.3",
         "has-property-descriptors": "^1.0.0",
         "has-proto": "^1.0.1",
         "has-symbols": "^1.0.3",
+        "hasown": "^2.0.0",
         "internal-slot": "^1.0.5",
         "is-array-buffer": "^3.0.2",
         "is-callable": "^1.2.7",
@@ -1623,23 +2425,23 @@
         "is-regex": "^1.1.4",
         "is-shared-array-buffer": "^1.0.2",
         "is-string": "^1.0.7",
-        "is-typed-array": "^1.1.10",
+        "is-typed-array": "^1.1.12",
         "is-weakref": "^1.0.2",
-        "object-inspect": "^1.12.3",
+        "object-inspect": "^1.13.1",
         "object-keys": "^1.1.1",
         "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.5.0",
-        "safe-array-concat": "^1.0.0",
+        "regexp.prototype.flags": "^1.5.1",
+        "safe-array-concat": "^1.0.1",
         "safe-regex-test": "^1.0.0",
-        "string.prototype.trim": "^1.2.7",
-        "string.prototype.trimend": "^1.0.6",
-        "string.prototype.trimstart": "^1.0.6",
+        "string.prototype.trim": "^1.2.8",
+        "string.prototype.trimend": "^1.0.7",
+        "string.prototype.trimstart": "^1.0.7",
         "typed-array-buffer": "^1.0.0",
         "typed-array-byte-length": "^1.0.0",
         "typed-array-byte-offset": "^1.0.0",
         "typed-array-length": "^1.0.4",
         "unbox-primitive": "^1.0.2",
-        "which-typed-array": "^1.1.10"
+        "which-typed-array": "^1.1.13"
       },
       "engines": {
         "node": ">= 0.4"
@@ -1648,25 +2450,46 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/es-iterator-helpers": {
+      "version": "1.0.15",
+      "resolved": "https://registry.npmjs.org/es-iterator-helpers/-/es-iterator-helpers-1.0.15.tgz",
+      "integrity": "sha512-GhoY8uYqd6iwUl2kgjTm4CZAf6oo5mHK7BPqx3rKgx893YSsy0LGHV6gfqqQvZt/8xM8xeOnfXBCfqclMKkJ5g==",
+      "dependencies": {
+        "asynciterator.prototype": "^1.0.0",
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.22.1",
+        "es-set-tostringtag": "^2.0.1",
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.2.1",
+        "globalthis": "^1.0.3",
+        "has-property-descriptors": "^1.0.0",
+        "has-proto": "^1.0.1",
+        "has-symbols": "^1.0.3",
+        "internal-slot": "^1.0.5",
+        "iterator.prototype": "^1.1.2",
+        "safe-array-concat": "^1.0.1"
+      }
+    },
     "node_modules/es-set-tostringtag": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.0.1.tgz",
-      "integrity": "sha512-g3OMbtlwY3QewlqAiMLI47KywjWZoEytKr8pf6iTC8uJq5bIAH52Z9pnQ8pVL6whrCto53JZDuUIsifGeLorTg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.0.2.tgz",
+      "integrity": "sha512-BuDyupZt65P9D2D2vA/zqcI3G5xRsklm5N3xCwuiy+/vKy8i0ifdsQP1sLgO4tZDSCaQUSnmC48khknGMV3D2Q==",
       "dependencies": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "has-tostringtag": "^1.0.0"
+        "get-intrinsic": "^1.2.2",
+        "has-tostringtag": "^1.0.0",
+        "hasown": "^2.0.0"
       },
       "engines": {
         "node": ">= 0.4"
       }
     },
     "node_modules/es-shim-unscopables": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.0.0.tgz",
-      "integrity": "sha512-Jm6GPcCdC30eMLbZ2x8z2WuRwAws3zTBBKuusffYVUrNj/GVSUAZ+xKMaUpfNDR5IbyNA5LJbaecoUVbmUcB1w==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.0.2.tgz",
+      "integrity": "sha512-J3yBRXCzDu4ULnQwxyToo/OjdMx6akgVC7K6few0a7F/0wLtmKKN7I73AH5T2836UuXRqN7Qg+IIUw/+YJksRw==",
       "dependencies": {
-        "has": "^1.0.3"
+        "hasown": "^2.0.0"
       }
     },
     "node_modules/es-to-primitive": {
@@ -1775,13 +2598,13 @@
       }
     },
     "node_modules/eslint-import-resolver-node": {
-      "version": "0.3.7",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.7.tgz",
-      "integrity": "sha512-gozW2blMLJCeFpBwugLTGyvVjNoeo1knonXAcatC6bjPBZitotxdWf7Gimr25N4c0AAOo4eOUfaG82IJPDpqCA==",
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.9.tgz",
+      "integrity": "sha512-WFj2isz22JahUv+B788TlO3N6zL3nNJGU8CcZbPZvVEkBPaJdCV4vy5wyghty5ROFbCRnm132v8BScu5/1BQ8g==",
       "dependencies": {
         "debug": "^3.2.7",
-        "is-core-module": "^2.11.0",
-        "resolve": "^1.22.1"
+        "is-core-module": "^2.13.0",
+        "resolve": "^1.22.4"
       }
     },
     "node_modules/eslint-import-resolver-node/node_modules/debug": {
@@ -1793,18 +2616,17 @@
       }
     },
     "node_modules/eslint-import-resolver-typescript": {
-      "version": "3.5.5",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.5.5.tgz",
-      "integrity": "sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==",
+      "version": "3.6.1",
+      "resolved": "https://registry.npmjs.org/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.6.1.tgz",
+      "integrity": "sha512-xgdptdoi5W3niYeuQxKmzVDTATvLYqhpwmykwsh7f6HIOStGWEIL9iqZgQDF9u9OEzrRwR8no5q2VT+bjAujTg==",
       "dependencies": {
         "debug": "^4.3.4",
         "enhanced-resolve": "^5.12.0",
         "eslint-module-utils": "^2.7.4",
+        "fast-glob": "^3.3.1",
         "get-tsconfig": "^4.5.0",
-        "globby": "^13.1.3",
         "is-core-module": "^2.11.0",
-        "is-glob": "^4.0.3",
-        "synckit": "^0.8.5"
+        "is-glob": "^4.0.3"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -1817,35 +2639,6 @@
         "eslint-plugin-import": "*"
       }
     },
-    "node_modules/eslint-import-resolver-typescript/node_modules/globby": {
-      "version": "13.2.2",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-13.2.2.tgz",
-      "integrity": "sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==",
-      "dependencies": {
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.3.0",
-        "ignore": "^5.2.4",
-        "merge2": "^1.4.1",
-        "slash": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint-import-resolver-typescript/node_modules/slash": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/eslint-module-utils": {
       "version": "2.8.0",
       "resolved": "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.8.0.tgz",
@@ -1871,25 +2664,27 @@
       }
     },
     "node_modules/eslint-plugin-import": {
-      "version": "2.27.5",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.27.5.tgz",
-      "integrity": "sha512-LmEt3GVofgiGuiE+ORpnvP+kAm3h6MLZJ4Q5HCyHADofsb4VzXFsRiWj3c0OFiV+3DWFh0qg3v9gcPlfc3zRow==",
-      "dependencies": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flat": "^1.3.1",
-        "array.prototype.flatmap": "^1.3.1",
+      "version": "2.29.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.29.0.tgz",
+      "integrity": "sha512-QPOO5NO6Odv5lpoTkddtutccQjysJuFxoPS7fAHO+9m9udNHvTCPSAMW9zGAYj8lAIdr40I8yPCdUYrncXtrwg==",
+      "dependencies": {
+        "array-includes": "^3.1.7",
+        "array.prototype.findlastindex": "^1.2.3",
+        "array.prototype.flat": "^1.3.2",
+        "array.prototype.flatmap": "^1.3.2",
         "debug": "^3.2.7",
         "doctrine": "^2.1.0",
-        "eslint-import-resolver-node": "^0.3.7",
-        "eslint-module-utils": "^2.7.4",
-        "has": "^1.0.3",
-        "is-core-module": "^2.11.0",
+        "eslint-import-resolver-node": "^0.3.9",
+        "eslint-module-utils": "^2.8.0",
+        "hasown": "^2.0.0",
+        "is-core-module": "^2.13.1",
         "is-glob": "^4.0.3",
         "minimatch": "^3.1.2",
-        "object.values": "^1.1.6",
-        "resolve": "^1.22.1",
-        "semver": "^6.3.0",
-        "tsconfig-paths": "^3.14.1"
+        "object.fromentries": "^2.0.7",
+        "object.groupby": "^1.0.1",
+        "object.values": "^1.1.7",
+        "semver": "^6.3.1",
+        "tsconfig-paths": "^3.14.2"
       },
       "engines": {
         "node": ">=4"
@@ -1963,14 +2758,15 @@
       }
     },
     "node_modules/eslint-plugin-react": {
-      "version": "7.33.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.33.0.tgz",
-      "integrity": "sha512-qewL/8P34WkY8jAqdQxsiL82pDUeT7nhs8IsuXgfgnsEloKCT4miAV9N9kGtx7/KM9NH/NCGUE7Edt9iGxLXFw==",
+      "version": "7.33.2",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.33.2.tgz",
+      "integrity": "sha512-73QQMKALArI8/7xGLNI/3LylrEYrlKZSb5C9+q3OtOewTnMQi5cT+aE9E41sLCmli3I9PGGmD1yiZydyo4FEPw==",
       "dependencies": {
         "array-includes": "^3.1.6",
         "array.prototype.flatmap": "^1.3.1",
         "array.prototype.tosorted": "^1.1.1",
         "doctrine": "^2.1.0",
+        "es-iterator-helpers": "^1.0.12",
         "estraverse": "^5.3.0",
         "jsx-ast-utils": "^2.4.1 || ^3.0.0",
         "minimatch": "^3.1.2",
@@ -2013,11 +2809,11 @@
       }
     },
     "node_modules/eslint-plugin-react/node_modules/resolve": {
-      "version": "2.0.0-next.4",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.4.tgz",
-      "integrity": "sha512-iMDbmAWtfU+MHpxt/I5iWI7cY6YVEZUQ3MBgPQ++XD1PELuJHIl82xBmObyP2KyQmkNB2dsqF7seoQQiAn5yDQ==",
+      "version": "2.0.0-next.5",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.5.tgz",
+      "integrity": "sha512-U7WjGVG9sH8tvjW5SmGbQuui75FiyjAX72HX15DwBBwF9dNiQZRQAg9nnPhYy+TUnE0+VcrttuvNI8oSxZcocA==",
       "dependencies": {
-        "is-core-module": "^2.9.0",
+        "is-core-module": "^2.13.0",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
       },
@@ -2037,9 +2833,9 @@
       }
     },
     "node_modules/eslint-scope": {
-      "version": "7.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.1.tgz",
-      "integrity": "sha512-CvefSOsDdaYYvxChovdrPo/ZGt8d5lrJWleAc1diXRKhHGiTYEI26cvo8Kle/wGnsizoCJjK73FMg1/IkIwiNA==",
+      "version": "7.2.2",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.2.tgz",
+      "integrity": "sha512-dOt21O7lTMhDM+X9mB4GX+DZrZtCUJPL/wlcTqxyrx5IvO0IYtILdtrQGQp+8n5S0gwSVmOf9NQrjMOgfQZlIg==",
       "dependencies": {
         "esrecurse": "^4.3.0",
         "estraverse": "^5.2.0"
@@ -2052,9 +2848,9 @@
       }
     },
     "node_modules/eslint-visitor-keys": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.1.tgz",
-      "integrity": "sha512-pZnmmLwYzf+kWaM/Qgrvpen51upAktaaiI01nsJD/Yr3lMOdNtq0cxkrrg16w64VtisN6okbs7Q8AfGqj4c9fA==",
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
       "engines": {
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       },
@@ -2062,51 +2858,115 @@
         "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/espree": {
-      "version": "9.6.1",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
-      "integrity": "sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==",
+    "node_modules/eslint/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
       "dependencies": {
-        "acorn": "^8.9.0",
-        "acorn-jsx": "^5.3.2",
-        "eslint-visitor-keys": "^3.4.1"
+        "color-convert": "^2.0.1"
       },
       "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+        "node": ">=8"
       },
       "funding": {
-        "url": "https://opencollective.com/eslint"
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/esquery": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.5.0.tgz",
-      "integrity": "sha512-YQLXUplAwJgCydQ78IMJywZCceoqk1oH01OERdSAJc/7U2AylwjhSCLDEtqwg811idIS/9fIU5GjG73IgjKMVg==",
+    "node_modules/eslint/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dependencies": {
-        "estraverse": "^5.1.0"
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
       },
       "engines": {
-        "node": ">=0.10"
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/esrecurse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+    "node_modules/eslint/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
       "dependencies": {
-        "estraverse": "^5.2.0"
+        "color-name": "~1.1.4"
       },
       "engines": {
-        "node": ">=4.0"
+        "node": ">=7.0.0"
       }
     },
-    "node_modules/estraverse": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
-      "engines": {
-        "node": ">=4.0"
-      }
+    "node_modules/eslint/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+    },
+    "node_modules/eslint/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/espree": {
+      "version": "9.6.1",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
+      "integrity": "sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==",
+      "dependencies": {
+        "acorn": "^8.9.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^3.4.1"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.5.0.tgz",
+      "integrity": "sha512-YQLXUplAwJgCydQ78IMJywZCceoqk1oH01OERdSAJc/7U2AylwjhSCLDEtqwg811idIS/9fIU5GjG73IgjKMVg==",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "engines": {
+        "node": ">=4.0"
+      }
     },
     "node_modules/esutils": {
       "version": "2.0.3",
@@ -2116,26 +2976,13 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/execa": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-7.1.1.tgz",
-      "integrity": "sha512-wH0eMf/UXckdUYnO21+HDztteVv05rq2GXksxT4fCGeHkBhw1DROXh40wcjMcRqDOWE7iPJ4n3M7e2+YFP+76Q==",
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "get-stream": "^6.0.1",
-        "human-signals": "^4.3.0",
-        "is-stream": "^3.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^5.1.0",
-        "onetime": "^6.0.0",
-        "signal-exit": "^3.0.7",
-        "strip-final-newline": "^3.0.0"
-      },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "optional": true,
       "engines": {
-        "node": "^14.18.0 || ^16.14.0 || >=18.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+        "node": ">=6"
       }
     },
     "node_modules/fast-deep-equal": {
@@ -2169,6 +3016,11 @@
         "node": ">= 6"
       }
     },
+    "node_modules/fast-json-patch": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz",
+      "integrity": "sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ=="
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -2187,6 +3039,18 @@
         "reusify": "^1.0.4"
       }
     },
+    "node_modules/fault": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/fault/-/fault-1.0.4.tgz",
+      "integrity": "sha512-CJ0HCB5tL5fYTEA7ToAq5+kTwd++Borf1/bifxd9iT70QcXr4MRrO3Llf8Ifs70q+SJcGHFtnIE/Nw6giCtECA==",
+      "dependencies": {
+        "format": "^0.2.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/file-entry-cache": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
@@ -2229,22 +3093,50 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/find-yarn-workspace-root": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/find-yarn-workspace-root/-/find-yarn-workspace-root-2.0.0.tgz",
+      "integrity": "sha512-1IMnbjt4KzsQfnhnzNd8wUEgXZ44IzZaZmnLYx7D5FZlaHt2gW20Cri8Q+E/t5tIj4+epTBub+2Zxu/vNILzqQ==",
+      "dependencies": {
+        "micromatch": "^4.0.2"
+      }
+    },
     "node_modules/flat-cache": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.0.4.tgz",
-      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.1.1.tgz",
+      "integrity": "sha512-/qM2b3LUIaIgviBQovTLvijfyOQXPtSRnRK26ksj2J7rzPIecePUIpJsZ4T02Qg+xiAEKIs5K8dsHEd+VaKa/Q==",
       "dependencies": {
-        "flatted": "^3.1.0",
+        "flatted": "^3.2.9",
+        "keyv": "^4.5.3",
         "rimraf": "^3.0.2"
       },
       "engines": {
-        "node": "^10.12.0 || >=12.0.0"
+        "node": ">=12.0.0"
       }
     },
     "node_modules/flatted": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.7.tgz",
-      "integrity": "sha512-5nqDSxl8nn5BSNxyR3n4I6eDmbolI6WT+QqR547RwxQapgjQBmtktdP+HTBb/a/zLsbzERTONyUB5pefh5TtjQ=="
+      "version": "3.2.9",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.9.tgz",
+      "integrity": "sha512-36yxDn5H7OFZQla0/jFJmbIKTdZAQHngCedGxiMmpNfEZM0sdEeT+WczLQrjK6D7o2aiyLYDnkw0R3JK0Qv1RQ=="
+    },
+    "node_modules/follow-redirects": {
+      "version": "1.15.3",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.3.tgz",
+      "integrity": "sha512-1VzOtuEM8pC9SFU1E+8KfTjZyMztRsgEfwQl44z8A25uy13jSzTj6dyK2Df52iV0vgHCfBwLhDWevLn95w5v6Q==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/RubenVerborgh"
+        }
+      ],
+      "engines": {
+        "node": ">=4.0"
+      },
+      "peerDependenciesMeta": {
+        "debug": {
+          "optional": true
+        }
+      }
     },
     "node_modules/for-each": {
       "version": "0.3.3",
@@ -2254,25 +3146,69 @@
         "is-callable": "^1.1.3"
       }
     },
+    "node_modules/form-data": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
+      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/format": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/format/-/format-0.2.2.tgz",
+      "integrity": "sha512-wzsgA6WOq+09wrU1tsJ09udeR/YZRaeArL9e1wPbFg3GG2yDnC2ldKpxs4xunpFF9DgqCqOIra3bc1HWrJ37Ww==",
+      "engines": {
+        "node": ">=0.4.x"
+      }
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "optional": true
+    },
+    "node_modules/fs-extra": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "dependencies": {
+        "at-least-node": "^1.0.0",
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
       "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
     },
     "node_modules/function-bind": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
     },
     "node_modules/function.prototype.name": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.5.tgz",
-      "integrity": "sha512-uN7m/BzVKQnCUF/iW8jYea67v++2u7m5UgENbHRtdDVclOUP+FMPlCNdmk0h/ysGyo2tavMJEDqJAkJdRa1vMA==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.6.tgz",
+      "integrity": "sha512-Z5kx79swU5P27WEayXM1tBi5Ze/lbIyiNgU3qyXUOf9b2rgXYyF9Dy9Cx+IQv/Lc8WCG6L82zwUPpSS9hGehIg==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3",
-        "es-abstract": "^1.19.0",
-        "functions-have-names": "^1.2.2"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
+        "functions-have-names": "^1.2.3"
       },
       "engines": {
         "node": ">= 0.4"
@@ -2290,30 +3226,19 @@
       }
     },
     "node_modules/get-intrinsic": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.1.tgz",
-      "integrity": "sha512-2DcsyfABl+gVHEfCOaTrWgyt+tb6MSEGmKq+kI5HwLbIYgjgmMcV8KQ41uaKz1xxUcn9tJtgFbQUEVcEbd0FYw==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.2.tgz",
+      "integrity": "sha512-0gSo4ml/0j98Y3lngkFEot/zhiCeWsbYIlZ+uZOVgzLyLaUw7wxUL+nCTP0XJvJg1AXulJRI3UJi8GsbDuxdGA==",
       "dependencies": {
-        "function-bind": "^1.1.1",
-        "has": "^1.0.3",
+        "function-bind": "^1.1.2",
         "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3"
+        "has-symbols": "^1.0.3",
+        "hasown": "^2.0.0"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/get-stream": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/get-symbol-description": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz",
@@ -2330,9 +3255,9 @@
       }
     },
     "node_modules/get-tsconfig": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.6.2.tgz",
-      "integrity": "sha512-E5XrT4CbbXcXWy+1jChlZmrmCwd5KGx502kDCXJJ7y898TtWW9FwoG5HfOLVRKmlmDGkWN2HM9Ho+/Y8F0sJDg==",
+      "version": "4.7.2",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.7.2.tgz",
+      "integrity": "sha512-wuMsz4leaj5hbGgg4IvDU0bqJagpftG5l5cXIAvo8uZrqn0NJqwtfupTN00VnkQJPcIRrxYrm1Ue24btpCha2A==",
       "dependencies": {
         "resolve-pkg-maps": "^1.0.0"
       },
@@ -2340,15 +3265,21 @@
         "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "optional": true
+    },
     "node_modules/glob": {
-      "version": "7.1.7",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.7.tgz",
-      "integrity": "sha512-OvD9ENzPLbegENnYP5UUfJIirTg4+XwMWGaQfQTY0JenxNvvIKP3U3/tAQSPIu/lHxXYSZmpXlUHeqAIdKzBLQ==",
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
       "dependencies": {
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
         "inherits": "2",
-        "minimatch": "^3.0.4",
+        "minimatch": "^3.1.1",
         "once": "^1.3.0",
         "path-is-absolute": "^1.0.0"
       },
@@ -2376,9 +3307,9 @@
       "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw=="
     },
     "node_modules/globals": {
-      "version": "13.20.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-13.20.0.tgz",
-      "integrity": "sha512-Qg5QtVkCy/kv3FUSlu4ukeZDVf9ee0iXLAUYX13gbR17bnejFTzr4iS9bY7kwCf1NztRNm1t91fjOiyx4CSwPQ==",
+      "version": "13.23.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.23.0.tgz",
+      "integrity": "sha512-XAmF0RjlrjY23MA51q3HltdlGxUpXPvg0GioKiD9X6HD28iMjo2dKC8Vqwm7lne4GNr78+RHTfliktR6ZH09wA==",
       "dependencies": {
         "type-fest": "^0.20.2"
       },
@@ -2443,13 +3374,18 @@
       "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
       "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag=="
     },
+    "node_modules/hammerjs": {
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/hammerjs/-/hammerjs-2.0.8.tgz",
+      "integrity": "sha512-tSQXBXS/MWQOn/RKckawJ61vvsDpCom87JgxiYdGwHdOa0ht0vzUWDlfioofFCRU0L+6NGDt6XzbgoJvZkMeRQ==",
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
     "node_modules/has": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "dependencies": {
-        "function-bind": "^1.1.1"
-      },
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/has/-/has-1.0.4.tgz",
+      "integrity": "sha512-qdSAmqLF6209RFj4VVItywPMbm3vWylknmB3nvNiUIs72xAimcM8nVYxYr7ncvZq5qzk9MKIZR8ijqD/1QuYjQ==",
       "engines": {
         "node": ">= 0.4.0"
       }
@@ -2463,19 +3399,19 @@
       }
     },
     "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
       "engines": {
-        "node": ">=8"
+        "node": ">=4"
       }
     },
     "node_modules/has-property-descriptors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.0.tgz",
-      "integrity": "sha512-62DVLZGoiEBDHQyqG4w9xCuZ7eJEwNmJRWw2VY84Oedb7WFcA27fiEVe8oUQx9hAUJ4ekurquucTGwsyO1XGdQ==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.1.tgz",
+      "integrity": "sha512-VsX8eaIewvas0xnvinAe9bw4WfIeODpGYikiWYLH+dma0Jw6KHYqWiWfhQlgOVK8D6PvjubK5Uc4P0iIhIcNVg==",
       "dependencies": {
-        "get-intrinsic": "^1.1.1"
+        "get-intrinsic": "^1.2.2"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -2517,6 +3453,50 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/hasown": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz",
+      "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/hast-util-parse-selector": {
+      "version": "2.2.5",
+      "resolved": "https://registry.npmjs.org/hast-util-parse-selector/-/hast-util-parse-selector-2.2.5.tgz",
+      "integrity": "sha512-7j6mrk/qqkSehsM92wQjdIgWM2/BW61u/53G6xmC8i1OmEdKLHbk419QKQUjz6LglWsfqoiHmyMRkP1BGjecNQ==",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hastscript": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/hastscript/-/hastscript-6.0.0.tgz",
+      "integrity": "sha512-nDM6bvd7lIqDUiYEiu5Sl/+6ReP0BMk/2f4U/Rooccxkj0P5nm+acM5PrGJ/t5I8qPGiqZSE6hVAwZEdZIvP4w==",
+      "dependencies": {
+        "@types/hast": "^2.0.0",
+        "comma-separated-tokens": "^1.0.0",
+        "hast-util-parse-selector": "^2.0.0",
+        "property-information": "^5.0.0",
+        "space-separated-tokens": "^1.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/highlight.js": {
+      "version": "10.7.3",
+      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-10.7.3.tgz",
+      "integrity": "sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/hoist-non-react-statics": {
       "version": "3.3.2",
       "resolved": "https://registry.npmjs.org/hoist-non-react-statics/-/hoist-non-react-statics-3.3.2.tgz",
@@ -2525,13 +3505,24 @@
         "react-is": "^16.7.0"
       }
     },
-    "node_modules/human-signals": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-4.3.1.tgz",
-      "integrity": "sha512-nZXjEF2nbo7lIw3mgYjItAfgQXog3OjJogSbKa2CQIIvSGWcKgeJnQlNXip6NglNzYH45nSRiEVimMvYL8DDqQ==",
-      "engines": {
-        "node": ">=14.18.0"
-      }
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
     },
     "node_modules/ignore": {
       "version": "5.2.4",
@@ -2541,6 +3532,14 @@
         "node": ">= 4"
       }
     },
+    "node_modules/immutable": {
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-3.8.2.tgz",
+      "integrity": "sha512-15gZoQ38eYjEjxkorfbcgBKBL6R7T459OuK+CpcWt7O3KF4uPCx2tD0uFETlUDIyo+1789crbMhTvQBSR5yBMg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/import-fresh": {
       "version": "3.3.0",
       "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
@@ -2578,19 +3577,55 @@
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
     },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "optional": true
+    },
     "node_modules/internal-slot": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.5.tgz",
-      "integrity": "sha512-Y+R5hJrzs52QCG2laLn4udYVnxsfny9CpOhNhUvk/SSSVyF6T27FzRbF0sroPidSu3X8oEAkOn2K804mjpt6UQ==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.6.tgz",
+      "integrity": "sha512-Xj6dv+PsbtwyPpEflsejS+oIZxmMlV44zAhG479uYu89MsjcYOhCFnNyKrkJrihbsiasQyY0afoCl/9BLR65bg==",
       "dependencies": {
-        "get-intrinsic": "^1.2.0",
-        "has": "^1.0.3",
+        "get-intrinsic": "^1.2.2",
+        "hasown": "^2.0.0",
         "side-channel": "^1.0.4"
       },
       "engines": {
         "node": ">= 0.4"
       }
     },
+    "node_modules/invariant": {
+      "version": "2.2.4",
+      "resolved": "https://registry.npmjs.org/invariant/-/invariant-2.2.4.tgz",
+      "integrity": "sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA==",
+      "dependencies": {
+        "loose-envify": "^1.0.0"
+      }
+    },
+    "node_modules/is-alphabetical": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-1.0.4.tgz",
+      "integrity": "sha512-DwzsA04LQ10FHTZuL0/grVDk4rFoVH1pjAToYwBrHSxcrBIGQuXrQMtD5U1b0U2XVgKZCTLLP8u2Qxqhy3l2Vg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-alphanumerical": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-1.0.4.tgz",
+      "integrity": "sha512-UzoZUr+XfVz3t3v4KyGEniVL9BDRoQtY7tOyrRybkVNjDFWyo1yhXNGrrBTQxp3ib9BLAWs7k2YKBQsFRkZG9A==",
+      "dependencies": {
+        "is-alphabetical": "^1.0.0",
+        "is-decimal": "^1.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/is-array-buffer": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.2.tgz",
@@ -2609,6 +3644,20 @@
       "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
       "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg=="
     },
+    "node_modules/is-async-function": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/is-async-function/-/is-async-function-2.0.0.tgz",
+      "integrity": "sha512-Y1JXKrfykRJGdlDwdKlLpLyMIiWqWvuSd17TvZk68PLAOGOoF4Xyav1z0Xhoi+gCYjZVeC5SI+hYFOfvXmGRCA==",
+      "dependencies": {
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/is-bigint": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz",
@@ -2647,11 +3696,11 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.12.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.12.1.tgz",
-      "integrity": "sha512-Q4ZuBAe2FUsKtyQJoQHlvP8OvBERxO3jEmy1I7hcRXcJBGGHFh/aJBswbXuS9sgrDH2QUO8ilkwNPHvHMd8clg==",
+      "version": "2.13.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.13.1.tgz",
+      "integrity": "sha512-hHrIjvZsftOsvKSn2TRYl63zvxsgE0K+0mYMoH6gD4omR5IWB2KynivBQczo3+wF1cCkjzvptnI9Q0sPU66ilw==",
       "dependencies": {
-        "has": "^1.0.3"
+        "hasown": "^2.0.0"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -2671,15 +3720,24 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-decimal": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-1.0.4.tgz",
+      "integrity": "sha512-RGdriMmQQvZ2aqaQq3awNA6dCGtKpiDFcOzrTWrDAT2MiWrKQVPmxLGHl7Y2nNu6led0kEyoX0enY0qXYsv9zw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/is-docker": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
-      "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
+      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
       "bin": {
         "is-docker": "cli.js"
       },
       "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+        "node": ">=8"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -2693,6 +3751,31 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-finalizationregistry": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-finalizationregistry/-/is-finalizationregistry-1.0.2.tgz",
+      "integrity": "sha512-0by5vtUJs8iFQb5TYUHHPudOR+qXYIMKtiUzvLIZITZUjknFmziyBJuLhVRc+Ds0dREFlskDNJKYIdIzu/9pfw==",
+      "dependencies": {
+        "call-bind": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-generator-function": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.0.10.tgz",
+      "integrity": "sha512-jsEjy9l3yiXEQ+PsXdmBwEPcOxaXWLspKdplFUVI9vq1iZgIekeC0L167qeu86czQaxed3q/Uzuw0swL0irL8A==",
+      "dependencies": {
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/is-glob": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
@@ -2704,21 +3787,21 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/is-inside-container": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
-      "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==",
-      "dependencies": {
-        "is-docker": "^3.0.0"
-      },
-      "bin": {
-        "is-inside-container": "cli.js"
-      },
-      "engines": {
-        "node": ">=14.16"
-      },
+    "node_modules/is-hexadecimal": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-1.0.4.tgz",
+      "integrity": "sha512-gyPJuv83bHMpocVYoqof5VDiZveEoGoFL8m3BXNb2VW8Xs+rz9kqO8LOQ5DH6EsuvilT1ApazU0pyl+ytbPtlw==",
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-map": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.2.tgz",
+      "integrity": "sha512-cOZFQQozTha1f4MxLFzlgKYPTyj26picdZTx82hbc/Xf4K/tZOOXSCkMvU4pKioRXGDLJRn0GM7Upe7kR721yg==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/is-negative-zero": {
@@ -2762,6 +3845,14 @@
         "node": ">=8"
       }
     },
+    "node_modules/is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/is-regex": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
@@ -2777,6 +3868,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-set": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.2.tgz",
+      "integrity": "sha512-+2cnTEZeY5z/iXGbLhPrOAaK/Mau5k5eXq9j14CpRTftq0pAJu2MwVRSZhyZWBzx3o6X795Lz6Bpb6R0GKf37g==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/is-shared-array-buffer": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.2.tgz",
@@ -2788,17 +3887,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/is-stream": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz",
-      "integrity": "sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==",
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/is-string": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz",
@@ -2841,6 +3929,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-weakmap": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.1.tgz",
+      "integrity": "sha512-NSBR4kH5oVj1Uwvv970ruUkCV7O1mzgVFO4/rev2cLRda9Tm9HrL70ZPut4rOHgY0FNrUu9BCbXA2sdQ+x0chA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/is-weakref": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
@@ -2852,6 +3948,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-weakset": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.2.tgz",
+      "integrity": "sha512-t2yVvttHkQktwnNNmBQ98AhENLdPUTDTE21uPqAQ0ARwQfGeQKRVS0NNurH7bTf7RrvcVn1OOge45CnBeHCSmg==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "get-intrinsic": "^1.1.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/is-wsl": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
@@ -2863,20 +3971,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/is-wsl/node_modules/is-docker": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/isarray": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
@@ -2887,6 +3981,23 @@
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="
     },
+    "node_modules/iterator.prototype": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/iterator.prototype/-/iterator.prototype-1.1.2.tgz",
+      "integrity": "sha512-DR33HMMr8EzwuRL8Y9D3u2BMj8+RqSE850jfGu59kS7tbmPLzGkZmVSfyCFSDxuZiEY6Rzt3T2NA/qU+NwVj1w==",
+      "dependencies": {
+        "define-properties": "^1.2.1",
+        "get-intrinsic": "^1.2.1",
+        "has-symbols": "^1.0.3",
+        "reflect.getprototypeof": "^1.0.4",
+        "set-function-name": "^2.0.1"
+      }
+    },
+    "node_modules/js-file-download": {
+      "version": "0.4.12",
+      "resolved": "https://registry.npmjs.org/js-file-download/-/js-file-download-0.4.12.tgz",
+      "integrity": "sha512-rML+NkoD08p5Dllpjo0ffy4jRHeY6Zsapvr/W86N7E0yuzAO6qa5X9+xog6zQNlH102J7IXljNY2FtS6Lj3ucg=="
+    },
     "node_modules/js-tokens": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
@@ -2903,6 +4014,11 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/json-buffer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
+      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="
+    },
     "node_modules/json-parse-even-better-errors": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
@@ -2913,6 +4029,23 @@
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
       "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="
     },
+    "node_modules/json-stable-stringify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify/-/json-stable-stringify-1.1.0.tgz",
+      "integrity": "sha512-zfA+5SuwYN2VWqN1/5HZaDzQKLJHaBVMZIIM+wuYjdptkaQsqzDdqjqf+lZZJUuJq1aanHiY8LhH8LmH+qBYJA==",
+      "dependencies": {
+        "call-bind": "^1.0.5",
+        "isarray": "^2.0.5",
+        "jsonify": "^0.0.1",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
@@ -2929,10 +4062,29 @@
         "json5": "lib/cli.js"
       }
     },
+    "node_modules/jsonfile": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "node_modules/jsonify": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/jsonify/-/jsonify-0.0.1.tgz",
+      "integrity": "sha512-2/Ki0GcmuqSrgFyelQq9M05y7PS0mEwuIzrf3f1fPqkVDVRvZrPZtVSMHxdgo8Aq0sxAOb/cr2aqqA3LeWHVPg==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/jsx-ast-utils": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.4.tgz",
-      "integrity": "sha512-fX2TVdCViod6HwKEtSWGHs57oFhVfCMwieb9PuRDgjDPh5XeqJiHFFFJCHxU5cnTc3Bu/GRL+kPiFmw8XWOfKw==",
+      "version": "3.3.5",
+      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz",
+      "integrity": "sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==",
       "dependencies": {
         "array-includes": "^3.1.6",
         "array.prototype.flat": "^1.3.1",
@@ -2943,6 +4095,22 @@
         "node": ">=4.0"
       }
     },
+    "node_modules/keyv": {
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
+      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "dependencies": {
+        "json-buffer": "3.0.1"
+      }
+    },
+    "node_modules/klaw-sync": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/klaw-sync/-/klaw-sync-6.0.0.tgz",
+      "integrity": "sha512-nIeuVSzdCCs6TDPTqI8w1Yre34sSq7AkZ4B3sfOBbI2CgVSB4Du4aLQijFU2+lhAFCwt9+42Hel6lQNIv6AntQ==",
+      "dependencies": {
+        "graceful-fs": "^4.1.11"
+      }
+    },
     "node_modules/language-subtag-registry": {
       "version": "0.3.22",
       "resolved": "https://registry.npmjs.org/language-subtag-registry/-/language-subtag-registry-0.3.22.tgz",
@@ -2987,6 +4155,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
+    },
+    "node_modules/lodash.debounce": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+      "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow=="
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -3003,6 +4181,19 @@
         "loose-envify": "cli.js"
       }
     },
+    "node_modules/lowlight": {
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/lowlight/-/lowlight-1.20.0.tgz",
+      "integrity": "sha512-8Ktj+prEb1RoCPkEOrPMYUN/nCggB7qAWe3a7OpMjWQkh3l2RD5wKRQ+o8Q8YuI9RG/xs95waaI/E6ym/7NsTw==",
+      "dependencies": {
+        "fault": "^1.0.0",
+        "highlight.js": "~10.7.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/lru-cache": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
@@ -3014,10 +4205,13 @@
         "node": ">=10"
       }
     },
-    "node_modules/merge-stream": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="
+    "node_modules/luxon": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.4.3.tgz",
+      "integrity": "sha512-tFWBiv3h7z+T/tDaoxA8rqTxy1CHV6gHS//QdaH4pulbq/JuBSGgQspQQqcgnwdAx6pNI7cmvz5Sv/addzHmUg==",
+      "engines": {
+        "node": ">=12"
+      }
     },
     "node_modules/merge2": {
       "version": "1.4.1",
@@ -3039,17 +4233,48 @@
         "node": ">=8.6"
       }
     },
-    "node_modules/mimic-fn": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz",
-      "integrity": "sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==",
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
       "engines": {
-        "node": ">=12"
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "optional": true,
+      "engines": {
+        "node": ">=10"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/minim": {
+      "version": "0.23.8",
+      "resolved": "https://registry.npmjs.org/minim/-/minim-0.23.8.tgz",
+      "integrity": "sha512-bjdr2xW1dBCMsMGGsUeqM4eFI60m94+szhxWys+B1ztIt6gWSfeGBdSVCIawezeHYLYn0j6zrsXdQS/JllBzww==",
+      "dependencies": {
+        "lodash": "^4.15.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/minimatch": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
@@ -3069,15 +4294,27 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "optional": true
+    },
     "node_modules/ms": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
       "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
     },
+    "node_modules/nan": {
+      "version": "2.18.0",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz",
+      "integrity": "sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w==",
+      "optional": true
+    },
     "node_modules/nanoid": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz",
-      "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==",
+      "version": "3.3.7",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.7.tgz",
+      "integrity": "sha512-eSRppjcPIatRIMC1U6UngP8XFcz8MQWGQdt1MTBQ7NaAmvXDfvNxbvWV3x2y6CdEUciCSsDHDQZbhYaB8QEo2g==",
       "funding": [
         {
           "type": "github",
@@ -3091,41 +4328,46 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
+    "node_modules/napi-build-utils": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.2.tgz",
+      "integrity": "sha512-ONmRUqK7zj7DWX0D9ADe03wbwOBZxNAfF20PlGfCWQcD3+/MakShIHrMqx9YwPTfxDdF1zLeL+RGZiR9kGMLdg==",
+      "optional": true
+    },
     "node_modules/natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
       "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="
     },
     "node_modules/next": {
-      "version": "13.4.13",
-      "resolved": "https://registry.npmjs.org/next/-/next-13.4.13.tgz",
-      "integrity": "sha512-A3YVbVDNeXLhWsZ8Nf6IkxmNlmTNz0yVg186NJ97tGZqPDdPzTrHotJ+A1cuJm2XfuWPrKOUZILl5iBQkIf8Jw==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/next/-/next-14.0.3.tgz",
+      "integrity": "sha512-AbYdRNfImBr3XGtvnwOxq8ekVCwbFTv/UJoLwmaX89nk9i051AEY4/HAWzU0YpaTDw8IofUpmuIlvzWF13jxIw==",
       "dependencies": {
-        "@next/env": "13.4.13",
-        "@swc/helpers": "0.5.1",
+        "@next/env": "14.0.3",
+        "@swc/helpers": "0.5.2",
         "busboy": "1.6.0",
         "caniuse-lite": "^1.0.30001406",
-        "postcss": "8.4.14",
+        "postcss": "8.4.31",
         "styled-jsx": "5.1.1",
-        "watchpack": "2.4.0",
-        "zod": "3.21.4"
+        "watchpack": "2.4.0"
       },
       "bin": {
         "next": "dist/bin/next"
       },
       "engines": {
-        "node": ">=16.8.0"
+        "node": ">=18.17.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "13.4.13",
-        "@next/swc-darwin-x64": "13.4.13",
-        "@next/swc-linux-arm64-gnu": "13.4.13",
-        "@next/swc-linux-arm64-musl": "13.4.13",
-        "@next/swc-linux-x64-gnu": "13.4.13",
-        "@next/swc-linux-x64-musl": "13.4.13",
-        "@next/swc-win32-arm64-msvc": "13.4.13",
-        "@next/swc-win32-ia32-msvc": "13.4.13",
-        "@next/swc-win32-x64-msvc": "13.4.13"
+        "@next/swc-darwin-arm64": "14.0.3",
+        "@next/swc-darwin-x64": "14.0.3",
+        "@next/swc-linux-arm64-gnu": "14.0.3",
+        "@next/swc-linux-arm64-musl": "14.0.3",
+        "@next/swc-linux-x64-gnu": "14.0.3",
+        "@next/swc-linux-x64-musl": "14.0.3",
+        "@next/swc-win32-arm64-msvc": "14.0.3",
+        "@next/swc-win32-ia32-msvc": "14.0.3",
+        "@next/swc-win32-x64-msvc": "14.0.3"
       },
       "peerDependencies": {
         "@opentelemetry/api": "^1.1.0",
@@ -3142,29 +4384,55 @@
         }
       }
     },
-    "node_modules/npm-run-path": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-5.1.0.tgz",
-      "integrity": "sha512-sJOdmRGrY2sjNTRMbSvluQqg+8X7ZK61yvzBEIDhz4f8z1TZFYABsqjjCBd/0PUNE9M6QDgHJXQkGUEm7Q+l9Q==",
+    "node_modules/node-abi": {
+      "version": "3.52.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.52.0.tgz",
+      "integrity": "sha512-JJ98b02z16ILv7859irtXn4oUaFWADtvkzy2c0IAatNVX2Mc9Yoh8z6hZInn3QwvMEYhHuQloYi+TTQy67SIdQ==",
+      "optional": true,
       "dependencies": {
-        "path-key": "^4.0.0"
+        "semver": "^7.3.5"
       },
       "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=10"
       }
     },
-    "node_modules/npm-run-path/node_modules/path-key": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-4.0.0.tgz",
-      "integrity": "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==",
+    "node_modules/node-abort-controller": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/node-abort-controller/-/node-abort-controller-3.1.1.tgz",
+      "integrity": "sha512-AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ=="
+    },
+    "node_modules/node-domexception": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
+      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "github",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
       "engines": {
-        "node": ">=12"
+        "node": ">=10.5.0"
+      }
+    },
+    "node_modules/node-fetch-commonjs": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/node-fetch-commonjs/-/node-fetch-commonjs-3.3.2.tgz",
+      "integrity": "sha512-VBlAiynj3VMLrotgwOS3OyECFxas5y7ltLcK4t41lMUZeaK15Ym4QRkqN0EQKAFL42q9i21EPKjzLUPfltR72A==",
+      "dependencies": {
+        "node-domexception": "^1.0.0",
+        "web-streams-polyfill": "^3.0.3"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "type": "opencollective",
+        "url": "https://opencollective.com/node-fetch"
       }
     },
     "node_modules/object-assign": {
@@ -3176,9 +4444,9 @@
       }
     },
     "node_modules/object-inspect": {
-      "version": "1.12.3",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.3.tgz",
-      "integrity": "sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g==",
+      "version": "1.13.1",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz",
+      "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
@@ -3209,26 +4477,26 @@
       }
     },
     "node_modules/object.entries": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.6.tgz",
-      "integrity": "sha512-leTPzo4Zvg3pmbQ3rDK69Rl8GQvIqMWubrkxONG9/ojtFE2rD9fjMKfSI5BxW3osRH1m6VdzmqK8oAY9aT4x5w==",
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.7.tgz",
+      "integrity": "sha512-jCBs/0plmPsOnrKAfFQXRG2NFjlhZgjjcBLSmTnEhU8U6vVTsVe8ANeQJCHTl3gSsI4J+0emOoCgoKlmQPMgmA==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "engines": {
         "node": ">= 0.4"
       }
     },
     "node_modules/object.fromentries": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.6.tgz",
-      "integrity": "sha512-VciD13dswC4j1Xt5394WR4MzmAQmlgN72phd/riNp9vtD7tp4QQWJ0R4wvclXcafgcYK8veHRed2W6XeGBvcfg==",
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.7.tgz",
+      "integrity": "sha512-UPbPHML6sL8PI/mOqPwsH4G6iyXcCGzLin8KvEPenOZN5lpCNBZZQ+V62vdjB1mQHrmqGQt5/OJzemUA+KJmEA==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "engines": {
         "node": ">= 0.4"
@@ -3237,26 +4505,37 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/object.groupby": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/object.groupby/-/object.groupby-1.0.1.tgz",
+      "integrity": "sha512-HqaQtqLnp/8Bn4GL16cj+CUYbnpe1bh0TtEaWvybszDG4tgxCJuRpV8VGuvNaI1fAnI4lUJzDG55MXcOH4JZcQ==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
+        "get-intrinsic": "^1.2.1"
+      }
+    },
     "node_modules/object.hasown": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/object.hasown/-/object.hasown-1.1.2.tgz",
-      "integrity": "sha512-B5UIT3J1W+WuWIU55h0mjlwaqxiE5vYENJXIXZ4VFe05pNYrkKuK0U/6aFcb0pKywYJh7IhfoqUfKVmrJJHZHw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/object.hasown/-/object.hasown-1.1.3.tgz",
+      "integrity": "sha512-fFI4VcYpRHvSLXxP7yiZOMAd331cPfd2p7PFDVbgUsYOfCT3tICVqXWngbjr4m49OvsBwUBQ6O2uQoJvy3RexA==",
       "dependencies": {
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/object.values": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.1.6.tgz",
-      "integrity": "sha512-FVVTkD1vENCsAcwNs9k6jea2uHC/X0+JcjG8YA60FN5CMaJmG95wT9jek/xX9nornqGRrBkKtzuAu2wuHpKqvw==",
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.1.7.tgz",
+      "integrity": "sha512-aU6xnDFYT3x17e/f0IiiwlGPTy2jzMySGfUB4fq6z7CV8l85CWHDk5ErhyhpfDHhrOMwGFhSQkhMGHaIotA6Ng==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "engines": {
         "node": ">= 0.4"
@@ -3273,32 +4552,16 @@
         "wrappy": "1"
       }
     },
-    "node_modules/onetime": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz",
-      "integrity": "sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==",
-      "dependencies": {
-        "mimic-fn": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/open": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/open/-/open-9.1.0.tgz",
-      "integrity": "sha512-OS+QTnw1/4vrf+9hh1jc1jnYjzSG4ttTBB8UxOwAnInG3Uo4ssetzC1ihqaIHjLJnA5GGlRl6QlZXOTQhRBUvg==",
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/open/-/open-7.4.2.tgz",
+      "integrity": "sha512-MVHddDVweXZF3awtlAS+6pgKLlm/JgxZ90+/NBurBoQctVOOB/zDdVjcyPzQ+0laDGbsWgrRkflI65sQeOgT9Q==",
       "dependencies": {
-        "default-browser": "^4.0.0",
-        "define-lazy-prop": "^3.0.0",
-        "is-inside-container": "^1.0.0",
-        "is-wsl": "^2.2.0"
+        "is-docker": "^2.0.0",
+        "is-wsl": "^2.1.1"
       },
       "engines": {
-        "node": ">=14.16"
+        "node": ">=8"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -3320,6 +4583,14 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/os-tmpdir": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz",
+      "integrity": "sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/p-limit": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
@@ -3359,6 +4630,23 @@
         "node": ">=6"
       }
     },
+    "node_modules/parse-entities": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-2.0.0.tgz",
+      "integrity": "sha512-kkywGpCcRYhqQIchaWqZ875wzpS/bMKhz5HnN3p7wveJTkTtyAB/AlnS0f8DFSqYW1T82t6yEAkEcB+A1I3MbQ==",
+      "dependencies": {
+        "character-entities": "^1.0.0",
+        "character-entities-legacy": "^1.0.0",
+        "character-reference-invalid": "^1.0.0",
+        "is-alphanumerical": "^1.0.0",
+        "is-decimal": "^1.0.0",
+        "is-hexadecimal": "^1.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/parse-json": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
@@ -3376,26 +4664,138 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+    "node_modules/patch-package": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/patch-package/-/patch-package-8.0.0.tgz",
+      "integrity": "sha512-da8BVIhzjtgScwDJ2TtKsfT5JFWz1hYoBl9rUQ1f38MC2HwnEIkK8VN3dKMKcP7P7bvvgzNDbfNHtx3MsQb5vA==",
+      "dependencies": {
+        "@yarnpkg/lockfile": "^1.1.0",
+        "chalk": "^4.1.2",
+        "ci-info": "^3.7.0",
+        "cross-spawn": "^7.0.3",
+        "find-yarn-workspace-root": "^2.0.0",
+        "fs-extra": "^9.0.0",
+        "json-stable-stringify": "^1.0.2",
+        "klaw-sync": "^6.0.0",
+        "minimist": "^1.2.6",
+        "open": "^7.4.2",
+        "rimraf": "^2.6.3",
+        "semver": "^7.5.3",
+        "slash": "^2.0.0",
+        "tmp": "^0.0.33",
+        "yaml": "^2.2.2"
+      },
+      "bin": {
+        "patch-package": "index.js"
+      },
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">=14",
+        "npm": ">5"
       }
     },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+    "node_modules/patch-package/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/patch-package/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/patch-package/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/patch-package/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+    },
+    "node_modules/patch-package/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/patch-package/node_modules/rimraf": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz",
+      "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==",
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      }
+    },
+    "node_modules/patch-package/node_modules/slash": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-2.0.0.tgz",
+      "integrity": "sha512-ZYKh3Wh2z1PpEXWr0MpSBZ0V6mZHAQfYevttO11c51CaWjGTaadiKZ+wVt1PbMlDV5qhMFslpZCemhwOK7C89A==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/patch-package/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "engines": {
         "node": ">=8"
       }
@@ -3430,9 +4830,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.4.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz",
-      "integrity": "sha512-E398TUmfAYFPBSdzgeieK2Y1+1cpdxJx8yXbK/m57nRhKSmk1GB2tO4lbLBtlkfPQTDKfe4Xqv1ASWPpayPEig==",
+      "version": "8.4.31",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
+      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -3441,10 +4841,14 @@
         {
           "type": "tidelift",
           "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
         }
       ],
       "dependencies": {
-        "nanoid": "^3.3.4",
+        "nanoid": "^3.3.6",
         "picocolors": "^1.0.0",
         "source-map-js": "^1.0.2"
       },
@@ -3452,6 +4856,32 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/prebuild-install": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.1.tgz",
+      "integrity": "sha512-jAXscXWMcCK8GgCoHOfIr0ODh5ai8mj63L2nWrjuAgXE6tDyYGnx4/8o/rCgU+B4JSyZBKbeZqzhtwtC3ovxjw==",
+      "optional": true,
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^1.0.1",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -3460,6 +4890,22 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/prismjs": {
+      "version": "1.29.0",
+      "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.29.0.tgz",
+      "integrity": "sha512-Kx/1w86q/epKcmte75LNrEoT+lX8pBpavuAbvJWRXar7Hz8jrtF+e3vY751p0R8H9HdArwaCTNDDzHg/ScJK1Q==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/process": {
+      "version": "0.11.10",
+      "resolved": "https://registry.npmjs.org/process/-/process-0.11.10.tgz",
+      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
     "node_modules/prop-types": {
       "version": "15.8.1",
       "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
@@ -3470,6 +4916,33 @@
         "react-is": "^16.13.1"
       }
     },
+    "node_modules/property-information": {
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-5.6.0.tgz",
+      "integrity": "sha512-YUHSPk+A30YPv+0Qf8i9Mbfe/C0hdPXk1s1jPVToV8pk8BQtpw10ct89Eo7OWkutrwqvT0eicAxlOg3dOAu8JA==",
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg=="
+    },
+    "node_modules/pump": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz",
+      "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
+      "optional": true,
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
     "node_modules/punycode": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.0.tgz",
@@ -3478,6 +4951,25 @@
         "node": ">=6"
       }
     },
+    "node_modules/qs": {
+      "version": "6.11.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.2.tgz",
+      "integrity": "sha512-tDNIz22aBzCDxLtVH++VnTfzxlfeK5CbqohpSqpJgj1Wg/cQbStNAz3NuqCs5vV+pjBsK4x4pN9HlVh7rcYRiA==",
+      "dependencies": {
+        "side-channel": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/querystringify": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
+      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ=="
+    },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@@ -3497,6 +4989,74 @@
         }
       ]
     },
+    "node_modules/ramda": {
+      "version": "0.29.1",
+      "resolved": "https://registry.npmjs.org/ramda/-/ramda-0.29.1.tgz",
+      "integrity": "sha512-OfxIeWzd4xdUNxlWhgFazxsA/nl3mS4/jGZI5n00uWOoSSFRhC1b6gl6xvmzUamgmqELraWp0J/qqVlXYPDPyA==",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/ramda"
+      }
+    },
+    "node_modules/ramda-adjunct": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/ramda-adjunct/-/ramda-adjunct-4.1.1.tgz",
+      "integrity": "sha512-BnCGsZybQZMDGram9y7RiryoRHS5uwx8YeGuUeDKuZuvK38XO6JJfmK85BwRWAKFA6pZ5nZBO/HBFtExVaf31w==",
+      "engines": {
+        "node": ">=0.10.3"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/ramda-adjunct"
+      },
+      "peerDependencies": {
+        "ramda": ">= 0.29.0"
+      }
+    },
+    "node_modules/randexp": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/randexp/-/randexp-0.5.3.tgz",
+      "integrity": "sha512-U+5l2KrcMNOUPYvazA3h5ekF80FHTUG+87SEAmHZmolh1M+i/WyTCxVzmi+tidIa1tM4BSe8g2Y/D3loWDjj+w==",
+      "dependencies": {
+        "drange": "^1.0.2",
+        "ret": "^0.2.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/randombytes": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
+      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "dependencies": {
+        "safe-buffer": "^5.1.0"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "optional": true,
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/rc/node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/react": {
       "version": "18.2.0",
       "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz",
@@ -3517,6 +5077,30 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
       }
     },
+    "node_modules/react-copy-to-clipboard": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/react-copy-to-clipboard/-/react-copy-to-clipboard-5.1.0.tgz",
+      "integrity": "sha512-k61RsNgAayIJNoy9yDsYzDe/yAZAzEbEgcz3DZMhF686LEyukcE1hzurxe85JandPUG+yTfGVFzuEw3xt8WP/A==",
+      "dependencies": {
+        "copy-to-clipboard": "^3.3.1",
+        "prop-types": "^15.8.1"
+      },
+      "peerDependencies": {
+        "react": "^15.3.0 || 16 || 17 || 18"
+      }
+    },
+    "node_modules/react-debounce-input": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/react-debounce-input/-/react-debounce-input-3.3.0.tgz",
+      "integrity": "sha512-VEqkvs8JvY/IIZvh71Z0TC+mdbxERvYF33RcebnodlsUZ8RSgyKe2VWaHXv4+/8aoOgXLxWrdsYs2hDhcwbUgA==",
+      "dependencies": {
+        "lodash.debounce": "^4",
+        "prop-types": "^15.8.1"
+      },
+      "peerDependencies": {
+        "react": "^15.3.0 || 16 || 17 || 18"
+      }
+    },
     "node_modules/react-dom": {
       "version": "18.2.0",
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz",
@@ -3529,11 +5113,98 @@
         "react": "^18.2.0"
       }
     },
+    "node_modules/react-immutable-proptypes": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/react-immutable-proptypes/-/react-immutable-proptypes-2.2.0.tgz",
+      "integrity": "sha512-Vf4gBsePlwdGvSZoLSBfd4HAP93HDauMY4fDjXhreg/vg6F3Fj/MXDNyTbltPC/xZKmZc+cjLu3598DdYK6sgQ==",
+      "dependencies": {
+        "invariant": "^2.2.2"
+      },
+      "peerDependencies": {
+        "immutable": ">=3.6.2"
+      }
+    },
+    "node_modules/react-immutable-pure-component": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/react-immutable-pure-component/-/react-immutable-pure-component-2.2.2.tgz",
+      "integrity": "sha512-vkgoMJUDqHZfXXnjVlG3keCxSO/U6WeDQ5/Sl0GK2cH8TOxEzQ5jXqDXHEL/jqk6fsNxV05oH5kD7VNMUE2k+A==",
+      "peerDependencies": {
+        "immutable": ">= 2 || >= 4.0.0-rc",
+        "react": ">= 16.6",
+        "react-dom": ">= 16.6"
+      }
+    },
+    "node_modules/react-inspector": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/react-inspector/-/react-inspector-6.0.2.tgz",
+      "integrity": "sha512-x+b7LxhmHXjHoU/VrFAzw5iutsILRoYyDq97EDYdFpPLcvqtEzk4ZSZSQjnFPbr5T57tLXnHcqFYoN1pI6u8uQ==",
+      "peerDependencies": {
+        "react": "^16.8.4 || ^17.0.0 || ^18.0.0"
+      }
+    },
     "node_modules/react-is": {
       "version": "16.13.1",
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
       "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
     },
+    "node_modules/react-redux": {
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-8.1.3.tgz",
+      "integrity": "sha512-n0ZrutD7DaX/j9VscF+uTALI3oUPa/pO4Z3soOBIjuRn/FzVu6aehhysxZCLi6y7duMf52WNZGMl7CtuK5EnRw==",
+      "dependencies": {
+        "@babel/runtime": "^7.12.1",
+        "@types/hoist-non-react-statics": "^3.3.1",
+        "@types/use-sync-external-store": "^0.0.3",
+        "hoist-non-react-statics": "^3.3.2",
+        "react-is": "^18.0.0",
+        "use-sync-external-store": "^1.0.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.8 || ^17.0 || ^18.0",
+        "@types/react-dom": "^16.8 || ^17.0 || ^18.0",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0",
+        "react-native": ">=0.59",
+        "redux": "^4 || ^5.0.0-beta.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        },
+        "react-native": {
+          "optional": true
+        },
+        "redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-redux/node_modules/react-is": {
+      "version": "18.2.0",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.2.0.tgz",
+      "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w=="
+    },
+    "node_modules/react-syntax-highlighter": {
+      "version": "15.5.0",
+      "resolved": "https://registry.npmjs.org/react-syntax-highlighter/-/react-syntax-highlighter-15.5.0.tgz",
+      "integrity": "sha512-+zq2myprEnQmH5yw6Gqc8lD55QHnpKaU8TOcFeC/Lg/MQSs8UknEA0JC4nTZGFAXC2J2Hyj/ijJ7NlabyPi2gg==",
+      "dependencies": {
+        "@babel/runtime": "^7.3.1",
+        "highlight.js": "^10.4.1",
+        "lowlight": "^1.17.0",
+        "prismjs": "^1.27.0",
+        "refractor": "^3.6.0"
+      },
+      "peerDependencies": {
+        "react": ">= 0.14.0"
+      }
+    },
     "node_modules/react-transition-group": {
       "version": "4.4.5",
       "resolved": "https://registry.npmjs.org/react-transition-group/-/react-transition-group-4.4.5.tgz",
@@ -3549,19 +5220,90 @@
         "react-dom": ">=16.6.0"
       }
     },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "optional": true,
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/redux": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-4.2.1.tgz",
+      "integrity": "sha512-LAUYz4lc+Do8/g7aeRa8JkyDErK6ekstQaqWQrNRW//MY1TvCEpMtpTWvlQ+FPbWCx+Xixu/6SHt5N0HR+SB4w==",
+      "dependencies": {
+        "@babel/runtime": "^7.9.2"
+      }
+    },
+    "node_modules/redux-immutable": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/redux-immutable/-/redux-immutable-4.0.0.tgz",
+      "integrity": "sha512-SchSn/DWfGb3oAejd+1hhHx01xUoxY+V7TeK0BKqpkLKiQPVFf7DYzEaKmrEVxsWxielKfSK9/Xq66YyxgR1cg==",
+      "peerDependencies": {
+        "immutable": "^3.8.1 || ^4.0.0-rc.1"
+      }
+    },
+    "node_modules/reflect.getprototypeof": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.4.tgz",
+      "integrity": "sha512-ECkTw8TmJwW60lOTR+ZkODISW6RQ8+2CL3COqtiJKLd6MmB45hN51HprHFziKLGkAuTGQhBb91V8cy+KHlaCjw==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
+        "get-intrinsic": "^1.2.1",
+        "globalthis": "^1.0.3",
+        "which-builtin-type": "^1.1.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/refractor": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/refractor/-/refractor-3.6.0.tgz",
+      "integrity": "sha512-MY9W41IOWxxk31o+YvFCNyNzdkc9M20NoZK5vq6jkv4I/uh2zkWcfudj0Q1fovjUQJrNewS9NMzeTtqPf+n5EA==",
+      "dependencies": {
+        "hastscript": "^6.0.0",
+        "parse-entities": "^2.0.0",
+        "prismjs": "~1.27.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/refractor/node_modules/prismjs": {
+      "version": "1.27.0",
+      "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.27.0.tgz",
+      "integrity": "sha512-t13BGPUlFDR7wRB5kQDG4jjl7XeuH6jbJGt11JHPL96qwsEHNX2+68tFXqc1/k+/jALsbSWJKUOT/hcYAZ5LkA==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/regenerator-runtime": {
-      "version": "0.13.11",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg=="
+      "version": "0.14.0",
+      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.0.tgz",
+      "integrity": "sha512-srw17NI0TUWHuGa5CFGGmhfNIeja30WMBfbslPNhf6JrqQlLN5gcrvig1oqPxiVaXb0oW0XRKtH6Nngs5lKCIA=="
     },
     "node_modules/regexp.prototype.flags": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.0.tgz",
-      "integrity": "sha512-0SutC3pNudRKgquxGoRGIz946MZVHqbNfPjBdxeOhBrdgDKlRoXmYLQN9xRbrR09ZXWeGAdPuif7egofn6v5LA==",
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.1.tgz",
+      "integrity": "sha512-sy6TXMN+hnP/wMy+ISxg3krXx7BAtWVO4UouuCN/ziM9UEne0euamVNafDfvC83bRNr95y0V5iijeDQFUNpvrg==",
       "dependencies": {
         "call-bind": "^1.0.2",
         "define-properties": "^1.2.0",
-        "functions-have-names": "^1.2.3"
+        "set-function-name": "^2.0.0"
       },
       "engines": {
         "node": ">= 0.4"
@@ -3570,12 +5312,53 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/remarkable": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/remarkable/-/remarkable-2.0.1.tgz",
+      "integrity": "sha512-YJyMcOH5lrR+kZdmB0aJJ4+93bEojRZ1HGDn9Eagu6ibg7aVZhc3OWbbShRid+Q5eAfsEqWxpe+g5W5nYNfNiA==",
+      "dependencies": {
+        "argparse": "^1.0.10",
+        "autolinker": "^3.11.0"
+      },
+      "bin": {
+        "remarkable": "bin/remarkable.js"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/remarkable/node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/repeat-string": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
+      "integrity": "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==",
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/requires-port": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ=="
+    },
+    "node_modules/reselect": {
+      "version": "4.1.8",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-4.1.8.tgz",
+      "integrity": "sha512-ab9EmR80F/zQTMNeneUr4cv+jSwPJgIlvEmVwLerwrWVbpLlBuls9XHzIeTFy4cegU2NHBp3va0LKOzU5qFEYQ=="
+    },
     "node_modules/resolve": {
-      "version": "1.22.2",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.2.tgz",
-      "integrity": "sha512-Sb+mjNHOULsBv818T40qSPeRiuWLyaGMa5ewydRLFimneixmVy2zdivRl+AF6jaYPC8ERxGDmFSiqui6SfPd+g==",
+      "version": "1.22.8",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz",
+      "integrity": "sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==",
       "dependencies": {
-        "is-core-module": "^2.11.0",
+        "is-core-module": "^2.13.0",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
       },
@@ -3602,6 +5385,14 @@
         "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
       }
     },
+    "node_modules/ret": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/ret/-/ret-0.2.2.tgz",
+      "integrity": "sha512-M0b3YWQs7R3Z917WRQy1HHA7Ba7D8hvZg6UE5mLykJxQVE2ju0IXbGlaHPPlkY+WN7wFP+wUMXmBFA0aV6vYGQ==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/reusify": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
@@ -3625,102 +5416,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/run-applescript": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-5.0.0.tgz",
-      "integrity": "sha512-XcT5rBksx1QdIhlFOCtgZkB99ZEouFZ1E2Kc2LHqNW13U3/74YGdkQRmThTwxy4QIyookibDKYZOPqX//6BlAg==",
-      "dependencies": {
-        "execa": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/run-applescript/node_modules/execa": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "get-stream": "^6.0.0",
-        "human-signals": "^2.1.0",
-        "is-stream": "^2.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^4.0.1",
-        "onetime": "^5.1.2",
-        "signal-exit": "^3.0.3",
-        "strip-final-newline": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/execa?sponsor=1"
-      }
-    },
-    "node_modules/run-applescript/node_modules/human-signals": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
-      "engines": {
-        "node": ">=10.17.0"
-      }
-    },
-    "node_modules/run-applescript/node_modules/is-stream": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/run-applescript/node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/run-applescript/node_modules/npm-run-path": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
-      "dependencies": {
-        "path-key": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/run-applescript/node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/run-applescript/node_modules/strip-final-newline": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/run-parallel": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
@@ -3744,12 +5439,12 @@
       }
     },
     "node_modules/safe-array-concat": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.0.0.tgz",
-      "integrity": "sha512-9dVEFruWIsnie89yym+xWTAYASdpw3CJV7Li/6zBewGf9z2i1j31rP6jnY0pHEO4QZh6N0K11bFjWmdR8UGdPQ==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.0.1.tgz",
+      "integrity": "sha512-6XbUAseYE2KtOuGueyeobCySj9L4+66Tn6KQMOPQJrAJEowYKW/YR/MGJZl7FdydUdaFu4LYyDZjxf4/Nmo23Q==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.0",
+        "get-intrinsic": "^1.2.1",
         "has-symbols": "^1.0.3",
         "isarray": "^2.0.5"
       },
@@ -3760,6 +5455,25 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
     "node_modules/safe-regex-test": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.0.0.tgz",
@@ -3795,6 +5509,59 @@
         "node": ">=10"
       }
     },
+    "node_modules/serialize-error": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-8.1.0.tgz",
+      "integrity": "sha512-3NnuWfM6vBYoy5gZFvHiYsVbafvI9vZv/+jlIigFn4oP4zjNPK3LhcY0xSCgeb1a5L8jO71Mit9LlNoi2UfDDQ==",
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/set-function-length": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.1.1.tgz",
+      "integrity": "sha512-VoaqjbBJKiWtg4yRcKBQ7g7wnGnLV3M8oLvVWwOk2PdYY6PEFegR1vezXR0tw6fZGF9csVakIRjrJiy2veSBFQ==",
+      "dependencies": {
+        "define-data-property": "^1.1.1",
+        "get-intrinsic": "^1.2.1",
+        "gopd": "^1.0.1",
+        "has-property-descriptors": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/set-function-name": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/set-function-name/-/set-function-name-2.0.1.tgz",
+      "integrity": "sha512-tMNCiqYVkXIZgc2Hnoy2IvC/f8ezc5koaRFkCjrpWzGpCd3qbZXPzVy9MAZzK1ch/X0jvSkojys3oqJN0qCmdA==",
+      "dependencies": {
+        "define-data-property": "^1.0.1",
+        "functions-have-names": "^1.2.3",
+        "has-property-descriptors": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/sha.js": {
+      "version": "2.4.11",
+      "resolved": "https://registry.npmjs.org/sha.js/-/sha.js-2.4.11.tgz",
+      "integrity": "sha512-QMEp5B7cftE7APOjk5Y6xgrbWu+WkLVQwk8JNjZ8nKRciZaByEW6MubieAiToS7+dwvrjGhH8jRXz3MVd0AYqQ==",
+      "dependencies": {
+        "inherits": "^2.0.1",
+        "safe-buffer": "^5.0.1"
+      },
+      "bin": {
+        "sha.js": "bin.js"
+      }
+    },
     "node_modules/shebang-command": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -3814,6 +5581,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/short-unique-id": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/short-unique-id/-/short-unique-id-5.0.3.tgz",
+      "integrity": "sha512-yhniEILouC0s4lpH0h7rJsfylZdca10W9mDJRAFh3EpcSUanCHGb0R7kcFOIUCZYSAPo0PUD5ZxWQdW0T4xaug==",
+      "bin": {
+        "short-unique-id": "bin/short-unique-id",
+        "suid": "bin/short-unique-id"
+      }
+    },
     "node_modules/side-channel": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
@@ -3827,10 +5603,50 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "optional": true
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "optional": true,
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
     },
     "node_modules/slash": {
       "version": "3.0.0",
@@ -3856,6 +5672,25 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/space-separated-tokens": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-1.1.5.tgz",
+      "integrity": "sha512-q/JSVd1Lptzhf5bkYm4ob4iWPjx0KiRe3sRFBNrVqbJkFaBm5vbbowy1mymoPNLRa52+oadOhJ+K49wsSeSjTA==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g=="
+    },
+    "node_modules/stampit": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/stampit/-/stampit-4.3.2.tgz",
+      "integrity": "sha512-pE2org1+ZWQBnIxRPrBM2gVupkuDD0TTNIo1H6GdT/vO82NXli2z8lRE8cu/nBIHrcOCXFBAHpb9ZldrB2/qOA=="
+    },
     "node_modules/streamsearch": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
@@ -3864,18 +5699,28 @@
         "node": ">=10.0.0"
       }
     },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "optional": true,
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
     "node_modules/string.prototype.matchall": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.8.tgz",
-      "integrity": "sha512-6zOCOcJ+RJAQshcTvXPHoxoQGONa3e/Lqx90wUA+wEzX78sg5Bo+1tQo4N0pohS0erG9qtCqJDjNCQBjeWVxyg==",
+      "version": "4.0.10",
+      "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.10.tgz",
+      "integrity": "sha512-rGXbGmOEosIQi6Qva94HUjgPs9vKW+dkG7Y8Q5O2OYkWL6wFaTRZO8zM4mhP94uX55wgyrXzfS2aGtGzUL7EJQ==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1",
+        "get-intrinsic": "^1.2.1",
         "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.3",
-        "regexp.prototype.flags": "^1.4.3",
+        "internal-slot": "^1.0.5",
+        "regexp.prototype.flags": "^1.5.0",
+        "set-function-name": "^2.0.0",
         "side-channel": "^1.0.4"
       },
       "funding": {
@@ -3883,13 +5728,13 @@
       }
     },
     "node_modules/string.prototype.trim": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.7.tgz",
-      "integrity": "sha512-p6TmeT1T3411M8Cgg9wBTMRtY2q9+PNy9EV1i2lIXUN/btt763oIfxwN3RR8VU6wHX8j/1CFy0L+YuThm6bgOg==",
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.8.tgz",
+      "integrity": "sha512-lfjY4HcixfQXOfaqCvcBuOIapyaroTXhbkfJN3gcB1OtyupngWK4sEET9Knd0cXd28kTUqu/kHoV4HKSJdnjiQ==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "engines": {
         "node": ">= 0.4"
@@ -3899,26 +5744,26 @@
       }
     },
     "node_modules/string.prototype.trimend": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.6.tgz",
-      "integrity": "sha512-JySq+4mrPf9EsDBEDYMOb/lM7XQLulwg5R/m1r0PXEFqrV0qHvl58sdTilSXtKOflCsK2E8jxf+GKC0T07RWwQ==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.7.tgz",
+      "integrity": "sha512-Ni79DqeB72ZFq1uH/L6zJ+DKZTkOtPIHovb3YZHQViE+HDouuU4mBrLOLDn5Dde3RF8qw5qVETEjhu9locMLvA==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/string.prototype.trimstart": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.6.tgz",
-      "integrity": "sha512-omqjMDaY92pbn5HOX7f9IccLA+U1tA9GvtU4JrodiXFfYB7jPzzHpRzpglLAjtUV6bB557zwClJezTqnAiYnQA==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.7.tgz",
+      "integrity": "sha512-NGhtDFu3jCEm7B4Fy0DpLewdJQOZcQ0rGbwQ/+stjnrp2i+rlKeCvos9hOIeCmqwratM47OBxY7uFZzjxHXmrg==",
       "dependencies": {
         "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
+        "define-properties": "^1.2.0",
+        "es-abstract": "^1.22.1"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -3943,17 +5788,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/strip-final-newline": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz",
-      "integrity": "sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
@@ -3993,14 +5827,14 @@
       "integrity": "sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw=="
     },
     "node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
       "dependencies": {
-        "has-flag": "^4.0.0"
+        "has-flag": "^3.0.0"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=4"
       }
     },
     "node_modules/supports-preserve-symlinks-flag": {
@@ -4014,19 +5848,72 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/synckit": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.8.5.tgz",
-      "integrity": "sha512-L1dapNV6vu2s/4Sputv8xGsCdAVlb5nRDMFU/E27D44l5U6cw1g0dGd45uLc+OXjNMmF4ntiMdCimzcjFKQI8Q==",
-      "dependencies": {
-        "@pkgr/utils": "^2.3.1",
-        "tslib": "^2.5.0"
-      },
-      "engines": {
-        "node": "^14.18.0 || >=16.0.0"
+    "node_modules/swagger-client": {
+      "version": "3.24.5",
+      "resolved": "https://registry.npmjs.org/swagger-client/-/swagger-client-3.24.5.tgz",
+      "integrity": "sha512-qb4Rr9LpWs7o2AO4KdiIK+dz0GbrRLyD+UyN24h6AcNcDUnwfkb6LgFE4e6bXwVXWJzMp27w1QvSQ4hQNMPnoQ==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.22.15",
+        "@swagger-api/apidom-core": ">=0.83.0 <1.0.0",
+        "@swagger-api/apidom-error": ">=0.83.0 <1.0.0",
+        "@swagger-api/apidom-json-pointer": ">=0.83.0 <1.0.0",
+        "@swagger-api/apidom-ns-openapi-3-1": ">=0.83.0 <1.0.0",
+        "@swagger-api/apidom-reference": ">=0.83.0 <1.0.0",
+        "cookie": "~0.5.0",
+        "deepmerge": "~4.3.0",
+        "fast-json-patch": "^3.0.0-1",
+        "is-plain-object": "^5.0.0",
+        "js-yaml": "^4.1.0",
+        "node-abort-controller": "^3.1.1",
+        "node-fetch-commonjs": "^3.3.1",
+        "qs": "^6.10.2",
+        "traverse": "~0.6.6",
+        "undici": "^5.24.0"
+      }
+    },
+    "node_modules/swagger-ui-react": {
+      "version": "5.10.3",
+      "resolved": "https://registry.npmjs.org/swagger-ui-react/-/swagger-ui-react-5.10.3.tgz",
+      "integrity": "sha512-AB/ko3xD76wyCFbfb5zihy8Gacg7Lz62umzcmBLC/+VN8twib4ayWNZ48lTRh6Kb9vitvEQCDM/4VS2uTwwy0w==",
+      "dependencies": {
+        "@babel/runtime-corejs3": "^7.23.2",
+        "@braintree/sanitize-url": "=6.0.4",
+        "base64-js": "^1.5.1",
+        "classnames": "^2.3.1",
+        "css.escape": "1.5.1",
+        "deep-extend": "0.6.0",
+        "dompurify": "=3.0.6",
+        "ieee754": "^1.2.1",
+        "immutable": "^3.x.x",
+        "js-file-download": "^0.4.12",
+        "js-yaml": "=4.1.0",
+        "lodash": "^4.17.21",
+        "patch-package": "^8.0.0",
+        "prop-types": "^15.8.1",
+        "randexp": "^0.5.3",
+        "randombytes": "^2.1.0",
+        "react-copy-to-clipboard": "5.1.0",
+        "react-debounce-input": "=3.3.0",
+        "react-immutable-proptypes": "2.2.0",
+        "react-immutable-pure-component": "^2.2.0",
+        "react-inspector": "^6.0.1",
+        "react-redux": "^8.1.3",
+        "react-syntax-highlighter": "^15.5.0",
+        "redux": "^4.1.2",
+        "redux-immutable": "^4.0.0",
+        "remarkable": "^2.0.1",
+        "reselect": "^4.1.8",
+        "serialize-error": "^8.1.0",
+        "sha.js": "^2.4.11",
+        "swagger-client": "^3.24.5",
+        "url-parse": "^1.5.10",
+        "xml": "=1.0.1",
+        "xml-but-prettier": "^1.0.1",
+        "zenscroll": "^4.0.2"
       },
-      "funding": {
-        "url": "https://opencollective.com/unts"
+      "peerDependencies": {
+        "react": ">=17.0.0",
+        "react-dom": ">=17.0.0"
       }
     },
     "node_modules/tapable": {
@@ -4037,20 +5924,48 @@
         "node": ">=6"
       }
     },
+    "node_modules/tar-fs": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz",
+      "integrity": "sha512-V0r2Y9scmbDRLCNex/+hYzvp/zyYjvFbHPNgVTKfQvVrb6guiE/fxP+XblDNR011utopbkex2nM4dHNV6GDsng==",
+      "optional": true,
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "optional": true,
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/text-table": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
       "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw=="
     },
-    "node_modules/titleize": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/titleize/-/titleize-3.0.0.tgz",
-      "integrity": "sha512-KxVu8EYHDPBdUYdKZdKtU2aj2XfEx9AfjXxE/Aj0vT06w2icA09Vus1rh6eSu1y01akYg6BjIK/hxyLJINoMLQ==",
-      "engines": {
-        "node": ">=12"
+    "node_modules/tmp": {
+      "version": "0.0.33",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz",
+      "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==",
+      "dependencies": {
+        "os-tmpdir": "~1.0.2"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "engines": {
+        "node": ">=0.6.0"
       }
     },
     "node_modules/to-fast-properties": {
@@ -4072,6 +5987,55 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/toggle-selection": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/toggle-selection/-/toggle-selection-1.0.6.tgz",
+      "integrity": "sha512-BiZS+C1OS8g/q2RRbJmy59xpyghNBqrr6k5L/uKBGRsTfxmu3ffiRnd8mlGPUVayg8pvfi5urfnu8TU7DVOkLQ=="
+    },
+    "node_modules/traverse": {
+      "version": "0.6.7",
+      "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.6.7.tgz",
+      "integrity": "sha512-/y956gpUo9ZNCb99YjxG7OaslxZWHfCHAUUfshwqOXmxUIvqLjVO581BT+gM59+QV9tFe6/CGG53tsA1Y7RSdg==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/tree-sitter": {
+      "version": "0.20.4",
+      "resolved": "https://registry.npmjs.org/tree-sitter/-/tree-sitter-0.20.4.tgz",
+      "integrity": "sha512-rjfR5dc4knG3jnJNN/giJ9WOoN1zL/kZyrS0ILh+eqq8RNcIbiXA63JsMEgluug0aNvfQvK4BfCErN1vIzvKog==",
+      "hasInstallScript": true,
+      "optional": true,
+      "dependencies": {
+        "nan": "^2.17.0",
+        "prebuild-install": "^7.1.1"
+      }
+    },
+    "node_modules/tree-sitter-json": {
+      "version": "0.20.1",
+      "resolved": "https://registry.npmjs.org/tree-sitter-json/-/tree-sitter-json-0.20.1.tgz",
+      "integrity": "sha512-482hf7J+aBwhksSw8yWaqI8nyP1DrSwnS4IMBShsnkFWD3SE8oalHnsEik59fEVi3orcTCUtMzSjZx+0Tpa6Vw==",
+      "hasInstallScript": true,
+      "optional": true,
+      "dependencies": {
+        "nan": "^2.18.0"
+      }
+    },
+    "node_modules/tree-sitter-yaml": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/tree-sitter-yaml/-/tree-sitter-yaml-0.5.0.tgz",
+      "integrity": "sha512-POJ4ZNXXSWIG/W4Rjuyg36MkUD4d769YRUGKRqN+sVaj/VCo6Dh6Pkssn1Rtewd5kybx+jT1BWMyWN0CijXnMA==",
+      "hasInstallScript": true,
+      "optional": true,
+      "dependencies": {
+        "nan": "^2.14.0"
+      }
+    },
+    "node_modules/ts-toolbelt": {
+      "version": "9.6.0",
+      "resolved": "https://registry.npmjs.org/ts-toolbelt/-/ts-toolbelt-9.6.0.tgz",
+      "integrity": "sha512-nsZd8ZeNUzukXPlJmTBwUAuABDe/9qtVDelJeT/qW0ow3ZS3BsQJtNkan1802aM9Uf68/Y8ljw86Hu0h5IUW3w=="
+    },
     "node_modules/tsconfig-paths": {
       "version": "3.14.2",
       "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.14.2.tgz",
@@ -4084,9 +6048,9 @@
       }
     },
     "node_modules/tslib": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.1.tgz",
-      "integrity": "sha512-t0hLfiEKfMUoqhG+U1oid7Pva4bbDPHYfJNiB7BiIjRkj1pyC++4N3huJfqY6aRH6VTB0rvtzQwjM4K6qpfOig=="
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg=="
     },
     "node_modules/tsutils": {
       "version": "3.21.0",
@@ -4102,10 +6066,17 @@
         "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta"
       }
     },
-    "node_modules/tsutils/node_modules/tslib": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg=="
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "optional": true,
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
     },
     "node_modules/type-check": {
       "version": "0.4.0",
@@ -4190,6 +6161,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/types-ramda": {
+      "version": "0.29.6",
+      "resolved": "https://registry.npmjs.org/types-ramda/-/types-ramda-0.29.6.tgz",
+      "integrity": "sha512-VJoOk1uYNh9ZguGd3eZvqkdhD4hTGtnjRBUx5Zc0U9ftmnCgiWcSj/lsahzKunbiwRje1MxxNkEy1UdcXRCpYw==",
+      "dependencies": {
+        "ts-toolbelt": "^9.6.0"
+      }
+    },
     "node_modules/typescript": {
       "version": "5.1.6",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.1.6.tgz",
@@ -4216,14 +6195,30 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/untildify": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/untildify/-/untildify-4.0.0.tgz",
-      "integrity": "sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==",
+    "node_modules/undici": {
+      "version": "5.28.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.2.tgz",
+      "integrity": "sha512-wh1pHJHnUeQV5Xa8/kyQhO7WFa8M34l026L5P/+2TYiakvGy5Rdc8jWZVyG7ieht/0WgJLEd3kcU5gKx+6GC8w==",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
       "engines": {
-        "node": ">=8"
+        "node": ">=14.0"
+      }
+    },
+    "node_modules/universalify": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
+      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "engines": {
+        "node": ">= 10.0.0"
       }
     },
+    "node_modules/unraw": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/unraw/-/unraw-3.0.0.tgz",
+      "integrity": "sha512-08/DA66UF65OlpUDIQtbJyrqTR0jTAlJ+jsnkQ4jxR7+K5g5YG1APZKQSMCE1vqqmD+2pv6+IdEjmopFatacvg=="
+    },
     "node_modules/uri-js": {
       "version": "4.4.1",
       "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
@@ -4232,6 +6227,29 @@
         "punycode": "^2.1.0"
       }
     },
+    "node_modules/url-parse": {
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
+      "dependencies": {
+        "querystringify": "^2.1.1",
+        "requires-port": "^1.0.0"
+      }
+    },
+    "node_modules/use-sync-external-store": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.2.0.tgz",
+      "integrity": "sha512-eEgnFxGQ1Ife9bzYs6VLi8/4X6CObHMw9Qr9tPY43iKwsPw8xE8+EFsf/2cFZ5S3esXgpWgtSCtLNS41F+sKPA==",
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "optional": true
+    },
     "node_modules/watchpack": {
       "version": "2.4.0",
       "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
@@ -4244,6 +6262,20 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/web-streams-polyfill": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.2.1.tgz",
+      "integrity": "sha512-e0MO3wdXWKrLbL0DgGnUV7WHVuw9OUvL4hjgnPkIeEvESk74gAITi5G606JtZPp39cd8HA9VQzCIvA49LpPN5Q==",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/web-tree-sitter": {
+      "version": "0.20.3",
+      "resolved": "https://registry.npmjs.org/web-tree-sitter/-/web-tree-sitter-0.20.3.tgz",
+      "integrity": "sha512-zKGJW9r23y3BcJusbgvnOH2OYAW40MXAOi9bi3Gcc7T4Gms9WWgXF8m6adsJWpGJEhgOzCrfiz1IzKowJWrtYw==",
+      "optional": true
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -4273,13 +6305,52 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/which-builtin-type": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/which-builtin-type/-/which-builtin-type-1.1.3.tgz",
+      "integrity": "sha512-YmjsSMDBYsM1CaFiayOVT06+KJeXf0o5M/CAd4o1lTadFAtacTUM49zoYxr/oroopFDfhvN6iEcBxUyc3gvKmw==",
+      "dependencies": {
+        "function.prototype.name": "^1.1.5",
+        "has-tostringtag": "^1.0.0",
+        "is-async-function": "^2.0.0",
+        "is-date-object": "^1.0.5",
+        "is-finalizationregistry": "^1.0.2",
+        "is-generator-function": "^1.0.10",
+        "is-regex": "^1.1.4",
+        "is-weakref": "^1.0.2",
+        "isarray": "^2.0.5",
+        "which-boxed-primitive": "^1.0.2",
+        "which-collection": "^1.0.1",
+        "which-typed-array": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/which-collection": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.1.tgz",
+      "integrity": "sha512-W8xeTUwaln8i3K/cY1nGXzdnVZlidBcagyNFtBdD5kxnb4TvGKR7FfSIS3mYpwWS1QUCutfKz8IY8RjftB0+1A==",
+      "dependencies": {
+        "is-map": "^2.0.1",
+        "is-set": "^2.0.1",
+        "is-weakmap": "^2.0.1",
+        "is-weakset": "^2.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/which-typed-array": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.11.tgz",
-      "integrity": "sha512-qe9UWWpkeG5yzZ0tNYxDmd7vo58HDBc39mZ0xWWpolAGADdFOzkfamWLDxkOWcvHQKVmdTyQdLD4NOfjLWTKew==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.13.tgz",
+      "integrity": "sha512-P5Nra0qjSncduVPEAr7xhoF5guty49ArDTwzJ/yNuPIbZppyRxFQsRCWrocxIY+CnMVG+qfbU2FmDKyvSGClow==",
       "dependencies": {
         "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
+        "call-bind": "^1.0.4",
         "for-each": "^0.3.3",
         "gopd": "^1.0.1",
         "has-tostringtag": "^1.0.0"
@@ -4296,17 +6367,38 @@
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
       "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
     },
+    "node_modules/xml": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/xml/-/xml-1.0.1.tgz",
+      "integrity": "sha512-huCv9IH9Tcf95zuYCsQraZtWnJvBtLVE0QHMOs8bWyZAFZNDcYjsPq1nEx8jKA9y+Beo9v+7OBPRisQTjinQMw=="
+    },
+    "node_modules/xml-but-prettier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/xml-but-prettier/-/xml-but-prettier-1.0.1.tgz",
+      "integrity": "sha512-C2CJaadHrZTqESlH03WOyw0oZTtoy2uEg6dSDF6YRg+9GnYNub53RRemLpnvtbHDFelxMx4LajiFsYeR6XJHgQ==",
+      "dependencies": {
+        "repeat-string": "^1.5.2"
+      }
+    },
+    "node_modules/xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "engines": {
+        "node": ">=0.4"
+      }
+    },
     "node_modules/yallist": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
       "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
     },
     "node_modules/yaml": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "version": "2.3.4",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.3.4.tgz",
+      "integrity": "sha512-8aAvwVUSHpfEqTQ4w/KMlf3HcRdt50E5ODIQJBw1fQ5RL34xabzxtUlzTXVqc4rkZsPbvrXKWnABCD7kWSmocA==",
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
     "node_modules/yocto-queue": {
@@ -4320,13 +6412,10 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/zod": {
-      "version": "3.21.4",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.21.4.tgz",
-      "integrity": "sha512-m46AKbrzKVzOzs/DZgVnG5H55N1sv1M8qZU3A8RIKbs3mrACDNeIOeilDymVb2HdmP8uwshOCF4uJ8uM9rCqJw==",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
+    "node_modules/zenscroll": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/zenscroll/-/zenscroll-4.0.2.tgz",
+      "integrity": "sha512-jEA1znR7b4C/NnaycInCU6h/d15ZzCd1jmsruqOKnZP6WXQSMH3W2GL+OXbkruslU4h+Tzuos0HdswzRUk/Vgg=="
     }
   }
 }
diff --git a/origin_ui/src/package.json b/web_ui/frontend/package.json
similarity index 58%
rename from origin_ui/src/package.json
rename to web_ui/frontend/package.json
index 5c1b9d13b..76ef1740f 100644
--- a/origin_ui/src/package.json
+++ b/web_ui/frontend/package.json
@@ -1,9 +1,9 @@
 {
   "name": "src",
-  "version": "0.1.0",
+  "version": "7.2.0",
   "private": true,
   "scripts": {
-    "dev": "next dev",
+    "dev": "export NODE_ENV=development && next dev",
     "build": "next build",
     "start": "next start",
     "export": "next export",
@@ -15,16 +15,29 @@
     "@emotion/styled": "^11.11.0",
     "@mui/icons-material": "^5.14.3",
     "@mui/material": "^5.14.5",
+    "@mui/x-date-pickers": "^6.16.0",
     "@types/node": "20.4.5",
     "@types/react": "18.2.16",
     "@types/react-dom": "18.2.7",
     "chart.js": "^4.4.0",
+    "chartjs-adapter-luxon": "^1.3.1",
+    "chartjs-plugin-zoom": "^2.0.1",
     "eslint": "8.45.0",
     "eslint-config-next": "13.4.12",
-    "next": "^13.4.13",
+    "luxon": "^3.4.3",
+    "next": "14.0.3",
     "react": "18.2.0",
     "react-chartjs-2": "^5.2.0",
     "react-dom": "18.2.0",
-    "typescript": "5.1.6"
+    "swagger-ui-react": "^5.10.3",
+    "typescript": "5.1.6",
+    "yaml": "^2.3.4"
+  },
+  "devDependencies": {
+    "@types/luxon": "^3.3.2",
+    "@types/swagger-ui-react": "^4.18.3"
+  },
+  "engines": {
+    "node": "20"
   }
 }
diff --git a/origin_ui/src/public/github-mark.png b/web_ui/frontend/public/github-mark.png
similarity index 100%
rename from origin_ui/src/public/github-mark.png
rename to web_ui/frontend/public/github-mark.png
diff --git a/origin_ui/src/public/next.svg b/web_ui/frontend/public/next.svg
similarity index 97%
rename from origin_ui/src/public/next.svg
rename to web_ui/frontend/public/next.svg
index 5174b28c5..5bb00d403 100644
--- a/origin_ui/src/public/next.svg
+++ b/web_ui/frontend/public/next.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>
diff --git a/origin_ui/src/public/static/images/PelicanPlatformLogo_Icon.png b/web_ui/frontend/public/static/images/PelicanPlatformLogo_Icon.png
similarity index 100%
rename from origin_ui/src/public/static/images/PelicanPlatformLogo_Icon.png
rename to web_ui/frontend/public/static/images/PelicanPlatformLogo_Icon.png
diff --git a/origin_ui/src/public/static/images/github-mark.png b/web_ui/frontend/public/static/images/github-mark.png
similarity index 100%
rename from origin_ui/src/public/static/images/github-mark.png
rename to web_ui/frontend/public/static/images/github-mark.png
diff --git a/origin_ui/src/public/theme.tsx b/web_ui/frontend/public/theme.tsx
similarity index 98%
rename from origin_ui/src/public/theme.tsx
rename to web_ui/frontend/public/theme.tsx
index f9c00e24f..639715f49 100644
--- a/origin_ui/src/public/theme.tsx
+++ b/web_ui/frontend/public/theme.tsx
@@ -60,6 +60,7 @@ let theme = createTheme({
             fontSize: "1.2rem",
         },
         fontFamily: [
+            "Poppins",
             "Helvetica Neue",
             "Helvetica",
             "Arial",
@@ -82,4 +83,4 @@ interface ThemeProviderClientProps {
 
 export const ThemeProviderClient: FC<ThemeProviderClientProps> = ({children}) => {
     return <ThemeProvider theme={theme}>{children}</ThemeProvider>
-}
\ No newline at end of file
+}
diff --git a/origin_ui/src/public/vercel.svg b/web_ui/frontend/public/vercel.svg
similarity index 91%
rename from origin_ui/src/public/vercel.svg
rename to web_ui/frontend/public/vercel.svg
index d2f842227..1aeda7d6d 100644
--- a/origin_ui/src/public/vercel.svg
+++ b/web_ui/frontend/public/vercel.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 283 64"><path fill="black" d="M141 16c-11 0-19 7-19 18s9 18 20 18c7 0 13-3 16-7l-7-5c-2 3-6 4-9 4-5 0-9-3-10-7h28v-3c0-11-8-18-19-18zm-9 15c1-4 4-7 9-7s8 3 9 7h-18zm117-15c-11 0-19 7-19 18s9 18 20 18c6 0 12-3 16-7l-8-5c-2 3-5 4-8 4-5 0-9-3-11-7h28l1-3c0-11-8-18-19-18zm-10 15c2-4 5-7 10-7s8 3 9 7h-19zm-39 3c0 6 4 10 10 10 4 0 7-2 9-5l8 5c-3 5-9 8-17 8-11 0-19-7-19-18s8-18 19-18c8 0 14 3 17 8l-8 5c-2-3-5-5-9-5-6 0-10 4-10 10zm83-29v46h-9V5h9zM37 0l37 64H0L37 0zm92 5-27 48L74 5h10l18 30 17-30h10zm59 12v10l-3-1c-6 0-10 4-10 10v15h-9V17h9v9c0-5 6-9 13-9z"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 283 64"><path fill="black" d="M141 16c-11 0-19 7-19 18s9 18 20 18c7 0 13-3 16-7l-7-5c-2 3-6 4-9 4-5 0-9-3-10-7h28v-3c0-11-8-18-19-18zm-9 15c1-4 4-7 9-7s8 3 9 7h-18zm117-15c-11 0-19 7-19 18s9 18 20 18c6 0 12-3 16-7l-8-5c-2 3-5 4-8 4-5 0-9-3-11-7h28l1-3c0-11-8-18-19-18zm-10 15c2-4 5-7 10-7s8 3 9 7h-19zm-39 3c0 6 4 10 10 10 4 0 7-2 9-5l8 5c-3 5-9 8-17 8-11 0-19-7-19-18s8-18 19-18c8 0 14 3 17 8l-8 5c-2-3-5-5-9-5-6 0-10 4-10 10zm83-29v46h-9V5h9zM37 0l37 64H0L37 0zm92 5-27 48L74 5h10l18 30 17-30h10zm59 12v10l-3-1c-6 0-10 4-10 10v15h-9V17h9v9c0-5 6-9 13-9z"/></svg>
diff --git a/origin_ui/src/tsconfig.json b/web_ui/frontend/tsconfig.json
similarity index 96%
rename from origin_ui/src/tsconfig.json
rename to web_ui/frontend/tsconfig.json
index 23ba4fd54..c443fefcc 100644
--- a/origin_ui/src/tsconfig.json
+++ b/web_ui/frontend/tsconfig.json
@@ -1,6 +1,6 @@
 {
   "compilerOptions": {
-    "target": "es5",
+    "target": "es6",
     "lib": ["dom", "dom.iterable", "esnext"],
     "allowJs": true,
     "skipLibCheck": true,
diff --git a/web_ui/oauth2_client.go b/web_ui/oauth2_client.go
new file mode 100644
index 000000000..8e3ee11a5
--- /dev/null
+++ b/web_ui/oauth2_client.go
@@ -0,0 +1,249 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync/atomic"
+
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	pelican_oauth2 "github.com/pelicanplatform/pelican/oauth2"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	"golang.org/x/oauth2"
+)
+
+type (
+	oauthLoginRequest struct {
+		NextUrl string `form:"next_url,omitempty"`
+	}
+
+	oauthCallbackRequest struct {
+		State string `form:"state"`
+		Code  string `form:"code"`
+	}
+
+	cilogonUserInfo struct {
+		Email string `json:"email,omitempty"`
+		Sub   string `json:"sub"`
+		SubID string `json:"subject_id,omitempty"`
+	}
+)
+
+const (
+	oauthCallbackPath = "/api/v1.0/auth/cilogon/callback"
+)
+
+var (
+	ciLogonOAuthConfig atomic.Pointer[oauth2.Config]
+	cilogonUserInfoUrl = "" // Value will be set at ConfigOAuthClientAPIs
+)
+
+// Generate a 16B random string and set ctx session key oauthstate as the random string
+// return the random string with URL encoded nextUrl for CSRF token validation
+func generateCSRFCookie(ctx *gin.Context, nextUrl string) (string, error) {
+	session := sessions.Default(ctx)
+
+	b := make([]byte, 16)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+
+	state := base64.URLEncoding.EncodeToString(b)
+	session.Set("oauthstate", state)
+	err = session.Save()
+	if err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("%s:%s", state, url.QueryEscape(nextUrl)), nil
+}
+
+// Handler to redirect user to the login page of OAuth2 provider (CILogon)
+// You can pass an optional next_url as query param if you want the user
+// to be redirected back to where they were before hitting the login when
+// the user is successfully authenticated against CILogon
+func handleOAuthLogin(ctx *gin.Context) {
+	req := oauthLoginRequest{}
+	if ctx.ShouldBindQuery(&req) != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Failed to bind next url"})
+	}
+
+	// CSRF token is required, embed next URL to the state
+	csrfState, err := generateCSRFCookie(ctx, req.NextUrl)
+
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate CSRF token"})
+		return
+	}
+
+	redirectUrl := ciLogonOAuthConfig.Load().AuthCodeURL(csrfState)
+
+	ctx.Redirect(http.StatusTemporaryRedirect, redirectUrl)
+}
+
+// Handle the callback request from CILogon when user is successfully authenticated
+// Get user info from CILogon and issue our token for user to access web UI
+func handleOAuthCallback(ctx *gin.Context) {
+	session := sessions.Default(ctx)
+	c := context.Background()
+	csrfFromSession := session.Get("oauthstate")
+	if csrfFromSession == nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid OAuth callback: CSRF token from cookie is missing"})
+		return
+	}
+
+	req := oauthCallbackRequest{}
+	if ctx.ShouldBindQuery(&req) != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint("Invalid OAuth callback: fail to bind CSRF token from state query: ", ctx.Request.URL)})
+		return
+	}
+
+	// Format of state: <[16]byte>:<nextURL>
+	parts := strings.SplitN(req.State, ":", 2)
+	if len(parts) != 2 {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint("Invalid OAuth callback: fail to split state param: ", ctx.Request.URL)})
+		return
+	}
+	nextURL, err := url.QueryUnescape(parts[1])
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint("Invalid OAuth callback: fail to parse next_url: ", ctx.Request.URL)})
+	}
+
+	if parts[0] != csrfFromSession {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprint("Invalid OAuth callback: CSRF token doesn't match: ", ctx.Request.URL)})
+		return
+	}
+
+	// We only need this token to grab user id from cilogon
+	// and we won't store it anywhere. We will later issue our own token
+	// for user access
+	token, err := ciLogonOAuthConfig.Load().Exchange(c, req.Code)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprint("Error in exchanging code for token: ", ctx.Request.URL)})
+		return
+	}
+
+	client := ciLogonOAuthConfig.Load().Client(c, token)
+	client.Transport = config.GetTransport()
+	data := url.Values{}
+	data.Add("access_token", token.AccessToken)
+
+	// Use access_token to get user info from CILogon
+	resp, err := client.PostForm(cilogonUserInfoUrl, data)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprint("Error requesting user info from CILogon: ", err)})
+		return
+	}
+	body, _ := io.ReadAll(resp.Body)
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprint("Error parsing user info from CILogon: ", err)})
+		return
+	}
+
+	userInfo := cilogonUserInfo{}
+
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprint("Error parsing user info from CILogon: ", err)})
+		return
+	}
+
+	userIdentifier := userInfo.Sub
+	if userIdentifier == "" {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Error setting login cookie: can't find valid user id from CILogon"})
+		return
+	}
+
+	redirectLocation := "/"
+	if nextURL != "" {
+		redirectLocation = nextURL
+	}
+
+	// Issue our own JWT for web UI access
+	setLoginCookie(ctx, userIdentifier)
+
+	// Redirect user to where they were or root path
+	ctx.Redirect(http.StatusTemporaryRedirect, redirectLocation)
+}
+
+// Configure OAuth2 client and register related authentication endpoints for Web UI
+func ConfigOAuthClientAPIs(engine *gin.Engine) error {
+	sessionSecretByte, err := config.LoadSessionSecret()
+	if err != nil {
+		return errors.Wrap(err, "Failed to configure OAuth client")
+	}
+	oauthCommonConfig, err := pelican_oauth2.ServerOIDCClient()
+	if err != nil {
+		return errors.Wrap(err, "Failed to load server OIDC client config")
+	}
+
+	cilogonUserInfoUrl = oauthCommonConfig.Endpoint.UserInfoURL
+
+	redirectUrlStr := param.Server_ExternalWebUrl.GetString()
+	redirectUrl, err := url.Parse(redirectUrlStr)
+	if err != nil {
+		return err
+	}
+	redirectUrl.Path = oauthCallbackPath
+	redirectHostname := param.OIDC_ClientRedirectHostname.GetString()
+	if redirectHostname != "" {
+		_, _, err := net.SplitHostPort(redirectHostname)
+		if err != nil {
+			// Port not present
+			redirectUrl.Host = fmt.Sprint(redirectHostname, ":", param.Server_WebPort.GetInt())
+		} else {
+			// Port present
+			redirectUrl.Host = redirectHostname
+		}
+	}
+	config := &oauth2.Config{
+		RedirectURL:  redirectUrl.String(),
+		ClientID:     oauthCommonConfig.ClientID,
+		ClientSecret: oauthCommonConfig.ClientSecret,
+		Scopes:       oauthCommonConfig.Scopes,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  oauthCommonConfig.Endpoint.AuthURL,
+			TokenURL: oauthCommonConfig.Endpoint.TokenURL,
+		},
+	}
+	ciLogonOAuthConfig.Store(config)
+
+	store := cookie.NewStore(sessionSecretByte)
+	sessionHandler := sessions.Sessions("pelican-session", store)
+
+	ciLogonGroup := engine.Group("/api/v1.0/auth/cilogon", sessionHandler)
+	{
+		ciLogonGroup.GET("/login", handleOAuthLogin)
+		ciLogonGroup.GET("/callback", handleOAuthCallback)
+	}
+	return nil
+}
diff --git a/web_ui/prometheus.go b/web_ui/prometheus.go
index 4aaa4fd4c..af36b2959 100644
--- a/web_ui/prometheus.go
+++ b/web_ui/prometheus.go
@@ -11,44 +11,45 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// This package started as a fork of the `prometheus` CLI executable and was
+// This file started as a fork of the `prometheus` CLI executable and was
 // heavily adapted to make it embedded into the pelican web UI.
+
 package web_ui
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"math"
 	"net/http"
 	"net/url"
-	"os"
-	"os/signal"
+	"path/filepath"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/alecthomas/units"
 	"github.com/gin-gonic/gin"
-	kit_log "github.com/go-kit/kit/log/logrus"
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/grafana/regexp"
 	"github.com/mwitkow/go-conntrack"
 	"github.com/oklog/run"
 	pelican_config "github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/utils"
+	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/common/version"
 	"github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
 	"go.uber.org/atomic"
 
 	common_config "github.com/prometheus/common/config"
 	"github.com/prometheus/common/route"
 	"github.com/prometheus/prometheus/config"
 	"github.com/prometheus/prometheus/discovery"
+	prom_http "github.com/prometheus/prometheus/discovery/http"
 	"github.com/prometheus/prometheus/discovery/targetgroup"
 	"github.com/prometheus/prometheus/model/exemplar"
 	"github.com/prometheus/prometheus/model/histogram"
@@ -58,6 +59,7 @@ import (
 	"github.com/prometheus/prometheus/promql"
 	"github.com/prometheus/prometheus/scrape"
 	"github.com/prometheus/prometheus/storage"
+
 	//"github.com/prometheus/prometheus/storage/remote"
 	"github.com/prometheus/prometheus/tsdb"
 	"github.com/prometheus/prometheus/tsdb/agent"
@@ -108,6 +110,11 @@ type ReadyHandler struct {
 	ready atomic.Uint32
 }
 
+type LogrusAdapter struct {
+	*logrus.Logger
+	defaultFields logrus.Fields
+}
+
 func (h *ReadyHandler) SetReady(v bool) {
 	if v {
 		h.ready.Store(1)
@@ -136,12 +143,160 @@ func runtimeInfo() (api_v1.RuntimeInfo, error) {
 	return api_v1.RuntimeInfo{}, nil
 }
 
-func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
+// Configure director's Prometheus scraper to use HTTP service discovery for origins/caches
+func configDirectorPromScraper(ctx context.Context) (*config.ScrapeConfig, error) {
+	serverDiscoveryUrl, err := url.Parse(param.Server_ExternalWebUrl.GetString())
+	if err != nil {
+		return nil, fmt.Errorf("parse external URL %v: %w", param.Server_ExternalWebUrl.GetString(), err)
+	}
+	sdToken, err := director.CreateDirectorSDToken()
+	if err != nil {
+		return nil, fmt.Errorf("Failed to generate token for Prometheus service discovery at start: %v", err)
+	}
+	scraperToken, err := director.CreateDirectorScrapeToken()
+	if err != nil {
+		return nil, fmt.Errorf("Failed to generate token for director scraper at start: %v", err)
+	}
+	serverDiscoveryUrl.Path = "/api/v1.0/director/discoverServers"
+	scrapeConfig := config.DefaultScrapeConfig
+	scrapeConfig.JobName = "origin_cache_servers"
+	scrapeConfig.Scheme = "https"
+
+	// This will cause the director to maintain a CA bundle, including the custom CA, at
+	// the given location.  Makes up for the fact we can't provide Prometheus with a transport
+	caBundle := filepath.Join(param.Monitoring_DataLocation.GetString(), "ca-bundle.crt")
+	caCount, err := utils.LaunchPeriodicWriteCABundle(ctx, caBundle, 2*time.Minute)
+	if err != nil {
+		return nil, errors.Wrap(err, "Unable to generate CA bundle for prometheus")
+	}
+
+	scraperHttpClientConfig := common_config.HTTPClientConfig{
+		TLSConfig: common_config.TLSConfig{
+			// For the scraper to origin/caches' metrics, we get TLSSkipVerify from config
+			// As this request is to external address
+			InsecureSkipVerify: param.TLSSkipVerify.GetBool(),
+		},
+		// We add token auth for scraping all origin/cache servers
+		Authorization: &common_config.Authorization{
+			Type:        "Bearer",
+			Credentials: common_config.Secret(scraperToken),
+		},
+	}
+	if caCount > 0 {
+		scraperHttpClientConfig.TLSConfig.CAFile = caBundle
+	}
 
+	scrapeConfig.HTTPClientConfig = scraperHttpClientConfig
+	scrapeConfig.ServiceDiscoveryConfigs = make([]discovery.Config, 1)
+	sdHttpClientConfig := common_config.HTTPClientConfig{
+		TLSConfig: common_config.TLSConfig{
+			// Service discovery is internal only to the director, so there's
+			// no need to enforce TLS check
+			InsecureSkipVerify: true,
+		},
+		Authorization: &common_config.Authorization{
+			Type:        "Bearer",
+			Credentials: common_config.Secret(sdToken),
+		},
+	}
+	scrapeConfig.ServiceDiscoveryConfigs[0] = &prom_http.SDConfig{
+		URL:              serverDiscoveryUrl.String(),
+		RefreshInterval:  model.Duration(15 * time.Second),
+		HTTPClientConfig: sdHttpClientConfig,
+	}
+	return &scrapeConfig, nil
+}
+
+// Log method which satisfies the kitlog.Logger interface.
+// It also propragates field level and field message to top level log
+func (a LogrusAdapter) Log(keyvals ...interface{}) error {
+	// Extract the log level and message from the keyvals.
+	logLevel := logrus.InfoLevel
+	msg := ""
+	fields := make(logrus.Fields)
+	for k, v := range a.defaultFields {
+		fields[k] = v
+	}
+
+	for i := 0; i < len(keyvals); i += 2 {
+		if key, ok := keyvals[i].(string); ok {
+			if val := keyvals[i+1]; key == "level" {
+				// Parse the log level.
+				var err error
+				logval, ok := val.(level.Value)
+				if !ok {
+					a.Logger.Error("log: can't log level value")
+					return err
+				}
+				logLevel, err = logrus.ParseLevel(logval.String())
+				if err != nil {
+					a.Logger.Error("log: invalid log level message")
+					return err
+				}
+			} else if key == "msg" {
+				msg, ok = val.(string)
+				if !ok {
+					a.Logger.Error("log: invalid log message")
+					return errors.New("log: invalid log message")
+				}
+			} else if key == "err" {
+				logErr, ok := val.(error)
+				if !ok {
+					if logStr, ok := val.(string); ok {
+						msg = logStr
+					} else {
+						a.Logger.Errorf("prometheus log adapter: invalid incoming error log message (err-tagged key doesn't have an error object attached).  Error is %v; type %T", val, val)
+						return errors.New("log: invalid error log message")
+					}
+				} else {
+					msg = logErr.Error()
+				}
+			} else {
+				fields[key] = val
+			}
+		}
+	}
+
+	// Set the log level and log the message with the fields.
+	entry := a.WithFields(fields)
+	switch logLevel {
+	case logrus.WarnLevel:
+		entry.Warn(msg)
+	case logrus.ErrorLevel:
+		entry.Error(msg)
+	case logrus.InfoLevel:
+		entry.Info(msg)
+	case logrus.DebugLevel:
+		entry.Debug(msg)
+	default:
+		entry.Info(msg) // Default to info level if not specified.
+	}
+
+	return nil
+}
+
+func ConfigureEmbeddedPrometheus(ctx context.Context, engine *gin.Engine) error {
+	// This is fine if each process has only one server enabled
+	// Since the "federation-in-the-box" feature won't include any web components
+	// we can assume that this is the only server to enable
+	isDirector := pelican_config.IsServerEnabled(pelican_config.DirectorType)
 	cfg := flagConfig{}
-	ListenAddress := fmt.Sprintf("0.0.0.0:%v", viper.GetInt("WebPort"))
+	ListenAddress := fmt.Sprintf("0.0.0.0:%v", param.Server_WebPort.GetInt())
 	cfg.webTimeout = model.Duration(5 * time.Minute)
-	cfg.serverStoragePath = viper.GetString("MonitoringData")
+	cfg.serverStoragePath = param.Monitoring_DataLocation.GetString()
+
+	// The code below is for testing director Prometheus scraping locally
+	// Uncomment only if you know what you are doing
+
+	// if isDirector {
+	// 	err := os.MkdirAll("/var/lib/pelican/director-monitoring/data", 0750)
+	// 	if err != nil {
+	// 		return errors.New("Failure when creating a directory for the monitoring data")
+	// 	}
+	// 	cfg.serverStoragePath = "/var/lib/pelican/director-monitoring/data"
+	// } else {
+	// 	cfg.serverStoragePath = param.Monitoring_DataLocation.GetString()
+	// }
 	cfg.tsdb.MinBlockDuration = model.Duration(2 * time.Hour)
 	cfg.tsdb.NoLockfile = false
 	cfg.tsdb.WALCompression = true
@@ -164,13 +319,16 @@ func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
 	scrape.AlignScrapeTimestamps = true
 	scrape.ScrapeTimestampTolerance = 2 * time.Millisecond
 
-	logger := kit_log.NewLogger(logrus.WithFields(logrus.Fields{"component": "prometheus"}))
+	logrusLogger := logrus.WithFields(logrus.Fields{"component": "prometheus"})
+
+	// Create a Go kit logger that wraps the logrus logger.
+	logger := LogrusAdapter{Logger: logrusLogger.Logger, defaultFields: logrusLogger.Data}
 
 	localStoragePath := cfg.serverStoragePath
 
-	external_url, err := url.Parse("https://" + pelican_config.ComputeExternalAddress())
+	external_url, err := url.Parse(param.Server_ExternalWebUrl.GetString())
 	if err != nil {
-		return fmt.Errorf("parse external URL https://%v: %w", pelican_config.ComputeExternalAddress(), err)
+		return fmt.Errorf("parse external URL %v: %w", param.Server_ExternalWebUrl.GetString(), err)
 	}
 
 	CORSOrigin, err := compileCORSRegexString(".*")
@@ -183,20 +341,48 @@ func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
 		GlobalConfig:  config.DefaultGlobalConfig,
 		ScrapeConfigs: make([]*config.ScrapeConfig, 1),
 	}
+
+	selfScraperToken, err := createPromMetricToken()
+	if err != nil {
+		return fmt.Errorf("Failed to generate token for self-scraper at start: %v", err)
+	}
+
 	scrapeConfig := config.DefaultScrapeConfig
 	scrapeConfig.JobName = "prometheus"
 	scrapeConfig.Scheme = "https"
+	scraperHttpClientConfig := common_config.HTTPClientConfig{
+		TLSConfig: common_config.TLSConfig{
+			// This is the self-scrape, so no need to enforce the TLS check
+			InsecureSkipVerify: true,
+		},
+		// We add token auth for scraping all origin/cache servers
+		Authorization: &common_config.Authorization{
+			Type:        "Bearer",
+			Credentials: common_config.Secret(selfScraperToken),
+		},
+	}
+	scrapeConfig.HTTPClientConfig = scraperHttpClientConfig
 	scrapeConfig.ServiceDiscoveryConfigs = make([]discovery.Config, 1)
+	// model.AddressLabel needs a hostname (w/ port), so we cut the protocol here
+	externalAddressWoProtocol, _ := strings.CutPrefix(param.Server_ExternalWebUrl.GetString(), "https://")
 	scrapeConfig.ServiceDiscoveryConfigs[0] = discovery.StaticConfig{
 		&targetgroup.Group{
 			Targets: []model.LabelSet{{
-				model.AddressLabel: model.LabelValue(pelican_config.ComputeExternalAddress()),
+				model.AddressLabel: model.LabelValue(externalAddressWoProtocol),
 			}},
 		},
 	}
-	scrapeConfig.HTTPClientConfig = common_config.DefaultHTTPClientConfig
-	scrapeConfig.HTTPClientConfig.TLSConfig.InsecureSkipVerify = true
 	promCfg.ScrapeConfigs[0] = &scrapeConfig
+
+	// Add origins/caches monitoring to director's prometheus instance
+	if isDirector {
+		dirPromScraperConfig, err := configDirectorPromScraper(ctx)
+		if err != nil {
+			return err
+		}
+		promCfg.ScrapeConfigs = append(promCfg.ScrapeConfigs, dirPromScraperConfig)
+	}
+
 	promCfg.GlobalConfig.ScrapeInterval = model.Duration(15 * time.Second)
 
 	if promCfg.StorageConfig.TSDBConfig != nil {
@@ -339,7 +525,15 @@ func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
 	//WithInstrumentation(setPathWithPrefix("/api/v1"))
 	apiV1.Register(av1)
 
-	engine.GET("/api/v1.0/prometheus/*any", gin.WrapH(av1))
+	// TODO: Add authorization to director's PromQL endpoint once there's a
+	// way that user can be authenticated or we have a web UI for director
+	if !isDirector {
+		engine.GET("/api/v1.0/prometheus/*any", promQueryEngineAuthHandler(av1))
+	} else {
+		engine.GET("/api/v1.0/prometheus/*any", func(ctx *gin.Context) {
+			av1.ServeHTTP(ctx.Writer, ctx.Request)
+		})
+	}
 
 	reloaders := []reloader{
 		{
@@ -395,19 +589,15 @@ func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
 	var g run.Group
 	{
 		// Termination handler.
-		term := make(chan os.Signal, 1)
-		signal.Notify(term, os.Interrupt, syscall.SIGTERM)
 		cancel := make(chan struct{})
 		g.Add(
 			func() error {
 				// Don't forget to release the reloadReady channel so that waiting blocks can exit normally.
 				select {
-				case <-term:
-					err := level.Warn(logger).Log("msg", "Received SIGTERM, exiting gracefully...")
+				case <-ctx.Done():
+					err := level.Info(logger).Log("msg", "Received shutdown, exiting gracefully...")
 					_ = err
 					reloadReady.Close()
-				//case <-webHandler.Quit():
-				//	level.Warn(logger).Log("msg", "Received termination request via web service, exiting gracefully...")
 				case <-cancel:
 					reloadReady.Close()
 				}
@@ -415,7 +605,6 @@ func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
 			},
 			func(err error) {
 				close(cancel)
-				//webHandler.SetReady(false)
 				readyHandler.SetReady(false)
 			},
 		)
@@ -436,6 +625,128 @@ func ConfigureEmbeddedPrometheus(engine *gin.Engine) error {
 			},
 		)
 	}
+	{
+		// Periodic scraper config reload to refresh service discovery token
+		cancel := make(chan struct{})
+		g.Add(
+			func() error {
+				refreshInterval := param.Monitoring_TokenRefreshInterval.GetDuration()
+				if refreshInterval <= 0 {
+					err := level.Warn(logger).Log("msg", "Refresh interval is non-positive value. Stop reloading.")
+					_ = err
+					return errors.New("Refresh interval is non-positive value. Stop reloading.")
+				}
+				ticker := time.NewTicker(refreshInterval)
+				for {
+					select {
+					case <-cancel:
+						ticker.Stop()
+						err1 := level.Info(logger).Log("msg", "Stopping scraper config periodic reload...")
+						_ = err1
+						return nil
+					case <-ticker.C:
+						// Create an anonymous function to always use defer for locks
+						err := func() error {
+							globalConfigMtx.Lock()
+							defer globalConfigMtx.Unlock()
+							// Create a new self-scrape token
+							selfScraperToken, err := createPromMetricToken()
+							if err != nil {
+								return fmt.Errorf("Failed to generate token for self-scraper at start: %v", err)
+							}
+
+							// We need a fresh ScrapeConfigs copy so that deepEqual can give us green light
+							// before reload the scrape config
+							tempConfig := config.Config{
+								GlobalConfig:  promCfg.GlobalConfig,
+								ScrapeConfigs: make([]*config.ScrapeConfig, 1),
+							}
+
+							if len(promCfg.ScrapeConfigs) < 1 {
+								return errors.New("Length of ScrapeConfigs is less than 1, abort reloading")
+							}
+
+							oldScrapeCfg := promCfg.ScrapeConfigs[0]
+
+							newScrapeConfig := config.DefaultScrapeConfig
+							newScrapeConfig.JobName = oldScrapeCfg.JobName
+							newScrapeConfig.Scheme = oldScrapeCfg.Scheme
+							scraperHttpClientConfig := common_config.HTTPClientConfig{
+								TLSConfig: common_config.TLSConfig{
+									// This is the self-scrape, so no need to enforce TLS check
+									InsecureSkipVerify: true,
+								},
+								Authorization: &common_config.Authorization{
+									Type:        "Bearer",
+									Credentials: common_config.Secret(selfScraperToken),
+								},
+							}
+							newScrapeConfig.HTTPClientConfig = scraperHttpClientConfig
+							newScrapeConfig.ServiceDiscoveryConfigs = make([]discovery.Config, 1)
+							newScrapeConfig.ServiceDiscoveryConfigs[0] = oldScrapeCfg.ServiceDiscoveryConfigs[0]
+							tempConfig.ScrapeConfigs[0] = &newScrapeConfig
+
+							if len(promCfg.ScrapeConfigs) > 1 {
+								for idx, cfg := range promCfg.ScrapeConfigs {
+									if idx != 0 {
+										tempConfig.ScrapeConfigs = append(tempConfig.ScrapeConfigs, cfg)
+									}
+								}
+							}
+
+							// Refresh the scraper token by reloading the scraper config
+							err = scrapeManager.ApplyConfig(&tempConfig)
+
+							if err != nil {
+								return fmt.Errorf("Failed to reapply scrape configs: %v", err)
+							}
+
+							if isDirector {
+								// Refresh service discovery token by re-configure scraper
+								if len(promCfg.ScrapeConfigs) < 2 {
+									return errors.New("Prometheus scraper config didn't include origin/cache HTTP SD config. Length of configs less than 2.")
+								}
+								// Index 0 is the default config for servers
+								// Create new director-scrap token & service discovery token
+								promCfg.ScrapeConfigs[1], err = configDirectorPromScraper(ctx)
+								if err != nil {
+									return fmt.Errorf("Failed to generate token for director scraper when refresh it: %v", err)
+								}
+							}
+
+							c := make(map[string]discovery.Configs)
+							scfgs, err := promCfg.GetScrapeConfigs()
+							if err != nil {
+								return err
+							}
+							for _, v := range scfgs {
+								c[v.JobName] = v.ServiceDiscoveryConfigs
+							}
+							// We refresh the service discovery config for all the scrapers
+							if err := discoveryManagerScrape.ApplyConfig(c); err != nil {
+								err2 := level.Error(logger).Log("msg", fmt.Sprint("Scraper service discovery config periodic reload failed: ", err))
+								_ = err2
+								return err
+							}
+
+							err = level.Info(logger).Log("msg", "Successfully reloaded scraper and service discovery config")
+							_ = err
+							return nil
+						}()
+						if err != nil {
+							return err
+						}
+					}
+				}
+			},
+			func(err error) {
+				err2 := level.Info(logger).Log("msg", "Stopping scraper config periodic reload...")
+				_ = err2
+				// terminate reload
+				close(cancel)
+			},
+		)
+	}
 	{
 		// Scrape manager.
 		g.Add(
diff --git a/web_ui/prometheus_test.go b/web_ui/prometheus_test.go
new file mode 100644
index 000000000..182d3e30a
--- /dev/null
+++ b/web_ui/prometheus_test.go
@@ -0,0 +1,344 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/token_scopes"
+	"github.com/prometheus/common/route"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPrometheusProtectionFederationURL(t *testing.T) {
+
+	/*
+	* Tests that prometheus metrics are behind federation's token. Specifically it signs a token
+	* with the a generated key o prometheus GET endpoint with both URL. It mimics matching the Federation URL
+	* to ensure that check is done, but intercepts with returning a generated jwk for testing purposes
+	 */
+
+	// Setup httptest recorder and context for the the unit test
+	viper.Reset()
+
+	av1 := route.New().WithPrefix("/api/v1.0/prometheus")
+
+	// Create temp dir for the origin key file
+	tDir := t.TempDir()
+	kfile := filepath.Join(tDir, "testKey")
+	//Setup a private key
+	viper.Set("IssuerKey", kfile)
+
+	w := httptest.NewRecorder()
+	c, r := gin.CreateTestContext(w)
+
+	// Set ExternalWebUrl so that IssuerCheck can pass
+	viper.Set("Server.ExternalWebUrl", "https://test-origin.org:8444")
+
+	c.Request = &http.Request{
+		URL: &url.URL{},
+	}
+
+	jti_bytes := make([]byte, 16)
+	_, err := rand.Read(jti_bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jti_bytes)
+
+	issuerUrl := param.Server_ExternalWebUrl.GetString()
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.Monitoring_Query.String()).
+		Claim("wlcg.ver", "1.0").
+		JwtID(jti).
+		Issuer(issuerUrl).
+		Audience([]string{issuerUrl}).
+		Subject("sub").
+		Expiration(time.Now().Add(time.Minute)).
+		IssuedAt(time.Now()).
+		Build()
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pkey, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Sign the token with the origin private key
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, pkey))
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Set the request to run through the promQueryEngineAuthHandler function
+	r.GET("/api/v1.0/prometheus/*any", promQueryEngineAuthHandler(av1))
+	c.Request, _ = http.NewRequest(http.MethodGet, "/api/v1.0/prometheus/test", bytes.NewBuffer([]byte(`{}`)))
+
+	// Puts the token in cookie
+	c.Request.AddCookie(&http.Cookie{Name: "login", Value: string(signed)})
+
+	r.ServeHTTP(w, c.Request)
+
+	assert.Equal(t, 404, w.Result().StatusCode, "Expected status code of 404 representing failure due to minimal server setup, not token check")
+}
+
+func TestPrometheusProtectionOriginHeaderScope(t *testing.T) {
+	/*
+	* Tests that the prometheus protections are behind the origin's token and tests that the token is accessable from
+	* the header function. It signs a token with the origin's jwks key and adds it to the header before attempting
+	* to access the prometheus metrics. It then attempts to access the metrics with a token with an invalid scope.
+	* It attempts to do so again with a token signed by a bad key. Both these are expected to fail.
+	 */
+
+	viper.Reset()
+	viper.Set("Server.ExternalWebUrl", "https://test-origin.org:8444")
+
+	av1 := route.New().WithPrefix("/api/v1.0/prometheus")
+
+	// Create temp dir for the origin key file
+	tDir := t.TempDir()
+	kfile := filepath.Join(tDir, "testKey")
+
+	//Setup a private key and a token
+	viper.Set("IssuerKey", kfile)
+
+	w := httptest.NewRecorder()
+	c, r := gin.CreateTestContext(w)
+
+	c.Request = &http.Request{
+		URL: &url.URL{},
+	}
+
+	// Load the private key
+	privKey, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a token
+	jti_bytes := make([]byte, 16)
+	_, err = rand.Read(jti_bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jti := base64.RawURLEncoding.EncodeToString(jti_bytes)
+
+	issuerUrl := param.Server_ExternalWebUrl.GetString()
+	tok, err := jwt.NewBuilder().
+		Claim("scope", token_scopes.Monitoring_Query.String()).
+		Claim("wlcg.ver", "1.0").
+		JwtID(jti).
+		Issuer(issuerUrl).
+		Audience([]string{issuerUrl}).
+		Subject("sub").
+		Expiration(time.Now().Add(time.Minute)).
+		IssuedAt(time.Now()).
+		Build()
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Sign the token with the origin private key
+	signed, err := jwt.Sign(tok, jwt.WithKey(jwa.ES256, privKey))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Set the request to go through the promQueryEngineAuthHandler function
+	r.GET("/api/v1.0/prometheus/*any", promQueryEngineAuthHandler(av1))
+	c.Request, _ = http.NewRequest(http.MethodGet, "/api/v1.0/prometheus/test", bytes.NewBuffer([]byte(`{}`)))
+
+	// Put the signed token within the header
+	c.Request.Header.Set("Authorization", "Bearer "+string(signed))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	r.ServeHTTP(w, c.Request)
+
+	assert.Equal(t, 404, w.Result().StatusCode, "Expected status code of 404 representing failure due to minimal server setup, not token check")
+
+	// Create a new Recorder and Context for the next HTTPtest call
+	w = httptest.NewRecorder()
+	c, r = gin.CreateTestContext(w)
+
+	c.Request = &http.Request{
+		URL: &url.URL{},
+	}
+
+	// Create a private key to use for the test
+	privateKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	assert.NoError(t, err, "Error generating private key")
+
+	// Convert from raw ecdsa to jwk.Key
+	pKey, err := jwk.FromRaw(privateKey)
+	assert.NoError(t, err, "Unable to convert ecdsa.PrivateKey to jwk.Key")
+
+	//Assign Key id to the private key
+	err = jwk.AssignKeyID(pKey)
+	assert.NoError(t, err, "Error assigning kid to private key")
+
+	//Set an algorithm for the key
+	err = pKey.Set(jwk.AlgorithmKey, jwa.ES256)
+	assert.NoError(t, err, "Unable to set algorithm for pKey")
+
+	jti_bytes = make([]byte, 16)
+	_, err = rand.Read(jti_bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jti = base64.RawURLEncoding.EncodeToString(jti_bytes)
+
+	// Create a new token to be used
+	tok, err = jwt.NewBuilder().
+		Claim("scope", token_scopes.Monitoring_Query.String()).
+		Claim("wlcg.ver", "1.0").
+		JwtID(jti).
+		Issuer(issuerUrl).
+		Audience([]string{issuerUrl}).
+		Subject("sub").
+		Expiration(time.Now().Add(time.Minute)).
+		IssuedAt(time.Now()).
+		Build()
+
+	assert.NoError(t, err, "Error creating token")
+
+	// Sign token with private key (not the origin)
+	signed, err = jwt.Sign(tok, jwt.WithKey(jwa.ES256, pKey))
+	assert.NoError(t, err, "Error signing token")
+
+	r.GET("/api/v1.0/prometheus/*any", promQueryEngineAuthHandler(av1))
+	c.Request, _ = http.NewRequest(http.MethodGet, "/api/v1.0/prometheus/test", bytes.NewBuffer([]byte(`{}`)))
+
+	c.Request.Header.Set("Authorization", "Bearer "+string(signed))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	r.ServeHTTP(w, c.Request)
+	// Assert that it gets the correct Permission Denied 403 code
+	assert.Equal(t, 403, w.Result().StatusCode, "Expected failing status code of 403: Permission Denied")
+
+	// Create a new Recorder and Context for the next HTTPtest call
+	w = httptest.NewRecorder()
+	c, r = gin.CreateTestContext(w)
+
+	c.Request = &http.Request{
+		URL: &url.URL{},
+	}
+
+	// Create a new token to be used
+	tok, err = jwt.NewBuilder().
+		Claim("scope", "not.prometheus").
+		Claim("wlcg.ver", "1.0").
+		JwtID(jti).
+		Issuer(issuerUrl).
+		Audience([]string{issuerUrl}).
+		Subject("sub").
+		Expiration(time.Now().Add(time.Minute)).
+		IssuedAt(time.Now()).
+		Build()
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Sign the token with the origin private key
+	signed, err = jwt.Sign(tok, jwt.WithKey(jwa.ES256, privKey))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Set the request to go through the promQueryEngineAuthHandler function
+	r.GET("/api/v1.0/prometheus/*any", promQueryEngineAuthHandler(av1))
+	c.Request, _ = http.NewRequest(http.MethodGet, "/api/v1.0/prometheus/test", bytes.NewBuffer([]byte(`{}`)))
+
+	// Put the signed token within the header
+	c.Request.Header.Set("Authorization", "Bearer "+string(signed))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	r.ServeHTTP(w, c.Request)
+
+	assert.Equal(t, 403, w.Result().StatusCode, "Expected status code of 403 due to bad token scope")
+
+	key, err := config.GetIssuerPrivateJWK()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a new Recorder and Context for the next HTTPtest call
+	w = httptest.NewRecorder()
+	c, r = gin.CreateTestContext(w)
+
+	now := time.Now()
+	tok, err = jwt.NewBuilder().
+		Issuer(issuerUrl).
+		Claim("scope", token_scopes.Monitoring_Query.String()).
+		Claim("wlcg.ver", "1.0").
+		IssuedAt(now).
+		Expiration(now.Add(30 * time.Minute)).
+		NotBefore(now).
+		Subject("user").
+		Build()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var raw ecdsa.PrivateKey
+	if err = key.Raw(&raw); err != nil {
+		t.Fatal(err)
+	}
+	signed, err = jwt.Sign(tok, jwt.WithKey(jwa.ES256, raw))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Set the request to go through the promQueryEngineAuthHandler function
+	r.GET("/api/v1.0/prometheus/*any", promQueryEngineAuthHandler(av1))
+
+	http.SetCookie(w, &http.Cookie{Name: "login", Value: string(signed)})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	c.Request, _ = http.NewRequest(http.MethodGet, "/api/v1.0/prometheus/test", bytes.NewBuffer([]byte(`{}`)))
+	c.Request.Header.Set("Cookie", w.Header().Get("Set-Cookie"))
+
+	r.ServeHTTP(w, c.Request)
+
+	assert.Equal(t, 404, w.Result().StatusCode, "Expected status code of 404 representing failure due to minimal server setup, not token check")
+}
diff --git a/web_ui/ui.go b/web_ui/ui.go
index c7b063a6d..195003649 100644
--- a/web_ui/ui.go
+++ b/web_ui/ui.go
@@ -19,33 +19,303 @@
 package web_ui
 
 import (
+	"context"
+	"crypto/tls"
+	"embed"
 	"fmt"
+	"math/rand"
+	"mime"
+	"net"
 	"net/http"
+	"os"
+	"os/signal"
+	"path"
+	"path/filepath"
+	"strings"
+	"syscall"
 	"time"
 
+	"github.com/pelicanplatform/pelican/config"
+
 	"github.com/gin-gonic/gin"
 	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
-	"github.com/zsais/go-gin-prometheus"
+	ginprometheus "github.com/zsais/go-gin-prometheus"
+	"go.uber.org/atomic"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/term"
+)
+
+var (
+
+	//go:embed frontend/out/*
+	webAssets embed.FS
 )
 
-func ConfigureMetrics(engine *gin.Engine) error {
-	err := ConfigureEmbeddedPrometheus(engine)
+func getConfigValues(ctx *gin.Context) {
+	user := ctx.GetString("User")
+	if user == "" {
+		ctx.JSON(401, gin.H{"error": "Authentication required to visit this API"})
+		return
+	}
+	rawConfig, err := param.UnmarshalConfig()
 	if err != nil {
-		return err
+		ctx.JSON(500, gin.H{"error": "Failed to get the unmarshaled rawConfig"})
+		return
 	}
+	configWithType := param.ConvertToConfigWithType(rawConfig)
+
+	ctx.JSON(200, configWithType)
+}
+
+func getEnabledServers(ctx *gin.Context) {
+	enabledServers := config.GetEnabledServerString(true)
+	if len(enabledServers) == 0 {
+		ctx.JSON(500, gin.H{"error": "No enabled servers found"})
+		return
+	}
+
+	ctx.JSON(200, gin.H{"servers": enabledServers})
+}
+
+func configureWebResource(engine *gin.Engine) error {
+	engine.GET("/view/*requestPath", func(ctx *gin.Context) {
+		requestPath := ctx.Param("requestPath")
+
+		// If the requestPath is a directory indicate that we are looking for the index.html file
+		if strings.HasSuffix(requestPath, "/") {
+			requestPath += "index.html"
+		}
+
+		// Clean the request path
+		requestPath = path.Clean(requestPath)
+
+		// If requestPath doesn't have extension, is not a directory, and has a index file, redirect to index file
+		if !strings.Contains(requestPath, ".") && !strings.HasSuffix(requestPath, "/") {
+			if _, err := webAssets.ReadFile("frontend/out" + requestPath + "/index.html"); err == nil {
+				ctx.Redirect(http.StatusMovedPermanently, "/view/"+requestPath+"/")
+				return
+			}
+		}
+
+		db := authDB.Load()
+		user, err := GetUser(ctx)
+
+		// If just one server is enabled, redirect to that server
+		if len(config.GetEnabledServerString(true)) == 1 && requestPath == "/index.html" {
+			ctx.Redirect(http.StatusFound, "/view/"+config.GetEnabledServerString(true)[0]+"/")
+			return
+		}
+
+		// If requesting servers other than the registry
+		if !strings.HasPrefix(requestPath, "/registry") {
+
+			// Redirect initialized users from initialization pages
+			if strings.HasPrefix(requestPath, "/initialization") && strings.HasSuffix(requestPath, "index.html") {
+
+				// If the user has been initialized previously
+				if db != nil {
+					ctx.Redirect(http.StatusFound, "/view/")
+					return
+				}
+			}
+
+			// Redirect authenticated users from login pages
+			if strings.HasPrefix(requestPath, "/login") && strings.HasSuffix(requestPath, "index.html") {
+
+				// If the user has been authenticated previously
+				if err == nil && user != "" {
+					ctx.Redirect(http.StatusFound, "/view/")
+					return
+				}
+			}
+
+			// Direct uninitialized users to initialization pages
+			if !strings.HasPrefix(requestPath, "/initialization") && strings.HasSuffix(requestPath, "index.html") {
+
+				// If the user has not been initialized previously
+				if db == nil {
+					ctx.Redirect(http.StatusFound, "/view/initialization/code/")
+					return
+				}
+			}
+
+			// Direct unauthenticated initialized users to login pages
+			if !strings.HasPrefix(requestPath, "/login") && strings.HasSuffix(requestPath, "index.html") {
+
+				// If the user is not authenticated but initialized
+				if (err != nil || user == "") && db != nil {
+					ctx.Redirect(http.StatusFound, "/view/login/")
+					return
+				}
+			}
+		}
+
+		filePath := "frontend/out" + requestPath
+		file, _ := webAssets.ReadFile(filePath)
+
+		// If the file is not found, return 404
+		if file == nil {
+			notFoundFilePath := "frontend/out/404/index.html"
+			file, _ := webAssets.ReadFile(notFoundFilePath)
+			ctx.Data(
+				http.StatusOK,
+				mime.TypeByExtension(notFoundFilePath),
+				file,
+			)
+		} else {
+			// If the file is found, return the file
+			ctx.Data(
+				http.StatusOK,
+				mime.TypeByExtension(filePath),
+				file,
+			)
+		}
+	})
+
+	engine.GET("/api/v1.0/docs", func(ctx *gin.Context) {
+
+		filePath := "frontend/out/api/docs/index.html"
+		file, _ := webAssets.ReadFile(filePath)
+		ctx.Data(
+			http.StatusOK,
+			mime.TypeByExtension(filePath),
+			file,
+		)
+	})
+
+	return nil
+}
+
+// Configure common endpoint available to all server web UI which are located at /api/v1.0/*
+func configureCommonEndpoints(engine *gin.Engine) error {
+	engine.GET("/api/v1.0/config", AuthHandler, getConfigValues)
+	engine.GET("/api/v1.0/servers", AuthHandler, getEnabledServers)
+	// Health check endpoint for web engine
+	engine.GET("/api/v1.0/health", func(ctx *gin.Context) {
+		ctx.JSON(http.StatusOK, gin.H{"message": fmt.Sprintf("Web Engine Running. Time: %s", time.Now().String())})
+	})
+	return nil
+}
+
+// Configure metrics related endpoints, including Prometheus and /health API
+func configureMetrics(ctx context.Context, engine *gin.Engine) error {
+	// Add authorization to /metric endpoint
+	engine.Use(promMetricAuthHandler)
 
 	prometheusMonitor := ginprometheus.NewPrometheus("gin")
 	prometheusMonitor.Use(engine)
 
-	engine.GET("/api/v1.0/health", func(ctx *gin.Context) {
+	engine.GET("/api/v1.0/metrics/health", AuthHandler, func(ctx *gin.Context) {
 		healthStatus := metrics.GetHealthStatus()
 		ctx.JSON(http.StatusOK, healthStatus)
 	})
 	return nil
 }
 
+// Send the one-time code for initial web UI login to stdout and periodically
+// re-generate one-time code if user hasn't finished setup
+func waitUntilLogin(ctx context.Context) error {
+	if authDB.Load() != nil {
+		return nil
+	}
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
+
+	hostname := param.Server_Hostname.GetString()
+	port := param.Server_WebPort.GetInt()
+	isTTY := false
+	if term.IsTerminal(int(os.Stdout.Fd())) {
+		isTTY = true
+		fmt.Printf("\n\n\n\n")
+	}
+	activationFile := param.Server_UIActivationCodeFile.GetString()
+
+	defer func() {
+		if err := os.Remove(activationFile); err != nil {
+			log.Warningf("Failed to remove activation code file (%v): %v\n", activationFile, err)
+		}
+	}()
+	for {
+		previousCode.Store(currentCode.Load())
+		newCode := fmt.Sprintf("%06v", rand.Intn(1000000))
+		currentCode.Store(&newCode)
+		newCodeWithNewline := fmt.Sprintf("%v\n", newCode)
+		if err := os.WriteFile(activationFile, []byte(newCodeWithNewline), 0600); err != nil {
+			log.Errorf("Failed to write activation code to file (%v): %v\n", activationFile, err)
+		}
+
+		if isTTY {
+			fmt.Printf("\033[A\033[A\033[A\033[A")
+			fmt.Printf("\033[2K\n")
+			fmt.Printf("\033[2K\rPelican admin interface is not initialized\n\033[2KTo initialize, "+
+				"login at \033[1;34mhttps://%v:%v/view/initialization/code/\033[0m with the following code:\n",
+				hostname, port)
+			fmt.Printf("\033[2K\r\033[1;34m%v\033[0m\n", *currentCode.Load())
+		} else {
+			fmt.Printf("Pelican admin interface is not initialized\n To initialize, login at https://%v:%v/view/initialization/code/ with the following code:\n", hostname, port)
+			fmt.Println(*currentCode.Load())
+		}
+		start := time.Now()
+		for time.Since(start) < 30*time.Second {
+			select {
+			case <-sigs:
+				return errors.New("Process terminated...")
+			case <-ctx.Done():
+				return nil
+			default:
+				time.Sleep(100 * time.Millisecond)
+			}
+			if authDB.Load() != nil {
+				return nil
+			}
+		}
+	}
+}
+
+// Configure endpoints for server web APIs. This function does not configure any UI
+// specific paths but just redirect root path to /view.
+//
+// You need to mount the static resources for UI in a separate function
+func ConfigureServerWebAPI(ctx context.Context, engine *gin.Engine, egrp *errgroup.Group) error {
+	if err := configureCommonEndpoints(engine); err != nil {
+		return err
+	}
+	if err := configureMetrics(ctx, engine); err != nil {
+		return err
+	}
+	if param.Server_EnableUI.GetBool() {
+		if err := configureAuthEndpoints(ctx, engine, egrp); err != nil {
+			return err
+		}
+		if err := configureWebResource(engine); err != nil {
+			return err
+		}
+	}
+
+	// Redirect root to /view for web UI
+	engine.GET("/", func(c *gin.Context) {
+		c.Redirect(http.StatusFound, "/view/")
+	})
+	return nil
+}
+
+// Setup the initial server web login by sending the one-time code to stdout
+// and record health status of the WebUI based on the success of the initialization
+func InitServerWebLogin(ctx context.Context) error {
+	metrics.SetComponentHealthStatus(metrics.Server_WebUI, metrics.StatusWarning, "Authentication not initialized")
+
+	if err := waitUntilLogin(ctx); err != nil {
+		log.Errorln("Failure when waiting for web UI to be initialized:", err)
+		return err
+	}
+	metrics.SetComponentHealthStatus(metrics.Server_WebUI, metrics.StatusOK, "")
+	return nil
+}
+
 func GetEngine() (*gin.Engine, error) {
 	gin.SetMode(gin.ReleaseMode)
 	engine := gin.New()
@@ -64,21 +334,92 @@ func GetEngine() (*gin.Engine, error) {
 			"resource": ctx.Request.URL.Path},
 		).Info("Served Request")
 	})
-	if err := ConfigureMetrics(engine); err != nil {
-		return nil, err
-	}
 	return engine, nil
 }
 
-func RunEngine(engine *gin.Engine) {
-	certFile := viper.GetString("TLSCertificate")
-	keyFile := viper.GetString("TLSKey")
+// Run the gin engine.
+//
+// Will use a background golang routine to periodically reload the certificate
+// utilized by the UI.
+func RunEngine(ctx context.Context, engine *gin.Engine, egrp *errgroup.Group) error {
+	addr := fmt.Sprintf("%v:%v", param.Server_WebHost.GetString(), param.Server_WebPort.GetInt())
+
+	ln, err := net.Listen("tcp", addr)
+	if err != nil {
+		return err
+	}
+
+	defer ln.Close()
+
+	return runEngineWithListener(ctx, ln, engine, egrp)
+}
+
+// Run the engine with a given listener.
+// This was split out from RunEngine to allow unit tests to provide a Unix domain socket'
+// as a listener.
+func runEngineWithListener(ctx context.Context, ln net.Listener, engine *gin.Engine, egrp *errgroup.Group) error {
+	certFile := param.Server_TLSCertificate.GetString()
+	keyFile := param.Server_TLSKey.GetString()
 
-	addr := fmt.Sprintf("%v:%v", viper.GetString("WebAddress"), viper.GetInt("WebPort"))
+	port := param.Server_WebPort.GetInt()
+	addr := fmt.Sprintf("%v:%v", param.Server_WebHost.GetString(), port)
 
-	log.Debugln("Starting web engine at address", addr)
-	err := engine.RunTLS(addr, certFile, keyFile)
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
 	if err != nil {
 		panic(err)
 	}
+
+	var certPtr atomic.Pointer[tls.Certificate]
+	certPtr.Store(&cert)
+
+	server_utils.LaunchWatcherMaintenance(
+		ctx,
+		[]string{filepath.Dir(param.Server_TLSCertificate.GetString())},
+		"server TLS maintenance",
+		2*time.Minute,
+		func(notifyEvent bool) error {
+			cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+			if err == nil {
+				log.Debugln("Loaded new X509 key pair")
+				certPtr.Store(&cert)
+			} else if notifyEvent {
+				log.Debugln("Failed to load new X509 key pair after filesystem event (may succeed eventually):", err)
+				return nil
+			}
+			return err
+		},
+	)
+
+	getCert := func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		return certPtr.Load(), nil
+	}
+
+	config := &tls.Config{
+		GetCertificate: getCert,
+	}
+	server := &http.Server{
+		Addr:      addr,
+		Handler:   engine.Handler(),
+		TLSConfig: config,
+	}
+	log.Debugln("Starting web engine at address", addr)
+
+	// Once the context has been canceled, shutdown the HTTPS server.  Give it
+	// 10 seconds to shutdown existing requests.
+	egrp.Go(func() error {
+		<-ctx.Done()
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		err = server.Shutdown(ctx)
+		if err != nil {
+			log.Errorln("Failed to shutdown server:", err)
+		}
+		return err
+	})
+
+	if err := server.ServeTLS(ln, "", ""); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return err
+	}
+
+	return nil
 }
diff --git a/web_ui/ui_test.go b/web_ui/ui_test.go
new file mode 100644
index 000000000..fa4d6545d
--- /dev/null
+++ b/web_ui/ui_test.go
@@ -0,0 +1,101 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
+)
+
+var (
+	tempPasswdFile *os.File
+	router         *gin.Engine
+)
+
+func TestMain(m *testing.M) {
+	gin.SetMode(gin.TestMode)
+	ctx, cancel := context.WithCancel(context.Background())
+	egrp, ctx := errgroup.WithContext(ctx)
+	defer func() {
+		if err := egrp.Wait(); err != nil {
+			fmt.Println("Failure when shutting down service:", err)
+			os.Exit(1)
+		}
+	}()
+	defer cancel()
+
+	//set a temporary password file:
+	tempFile, err := os.CreateTemp("", "web-ui-passwd")
+	if err != nil {
+		fmt.Println("Failed to setup web-ui-passwd file")
+		os.Exit(1)
+	}
+	tempPasswdFile = tempFile
+	//Override viper default for testing
+	viper.Set("Server.UIPasswordFile", tempPasswdFile.Name())
+
+	//Make a testing issuer.jwk file to get a cookie
+	tempJWKDir, err := os.MkdirTemp("", "tempDir")
+	if err != nil {
+		fmt.Println("Error making temp jwk dir")
+		os.Exit(1)
+	}
+
+	//Override viper default for testing
+	viper.Set("IssuerKey", filepath.Join(tempJWKDir, "issuer.jwk"))
+
+	// Ensure we load up the default configs.
+	config.InitConfig()
+	if err := config.InitServer(ctx, config.OriginType); err != nil {
+		fmt.Println("Failed to configure the test module")
+		os.Exit(1)
+	}
+
+	//Get keys
+	_, err = config.GetIssuerPublicJWKS()
+	if err != nil {
+		fmt.Println("Error issuing jwks")
+		os.Exit(1)
+	}
+	router = gin.Default()
+
+	//Configure Web API
+	err = ConfigureServerWebAPI(ctx, router, egrp)
+	if err != nil {
+		fmt.Println("Error configuring web UI")
+		os.Exit(1)
+	}
+	//Run the tests
+	exitCode := m.Run()
+
+	//Clean up created files by removing them and exit
+	os.Remove(tempPasswdFile.Name())
+	os.RemoveAll(tempJWKDir)
+	os.Exit(exitCode)
+}
diff --git a/web_ui/ui_unix.go b/web_ui/ui_unix.go
new file mode 100644
index 000000000..3074914d1
--- /dev/null
+++ b/web_ui/ui_unix.go
@@ -0,0 +1,147 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func doReload() error {
+	db := authDB.Load()
+	if db == nil {
+		log.Debug("Cannot reload auth database - not configured")
+		return nil
+	}
+	fileName := param.Server_UIPasswordFile.GetString()
+	fp, err := os.OpenFile(fileName, os.O_WRONLY|os.O_CREATE, 0600)
+	if err != nil {
+		log.Warning("Failed to open auth database for reload:", err)
+		return err
+	}
+	defer fp.Close()
+	if err = syscall.Flock(int(fp.Fd()), syscall.LOCK_SH); err != nil {
+		log.Warning("Failed to lock the auth database for read:", err)
+		return err
+	}
+	defer func() {
+		if err := syscall.Flock(int(fp.Fd()), syscall.LOCK_UN); err != nil {
+			log.Warning("Failed to unlock the auth database:", err)
+		}
+	}()
+
+	err = db.Reload(nil)
+	if err != nil {
+		log.Warningln("Failed to reload auth database:", err)
+		return err
+	}
+	log.Debug("Successfully reloaded the auth database")
+	return nil
+}
+
+func writePasswordEntryImpl(user, password string) error {
+	fileName := param.Server_UIPasswordFile.GetString()
+	passwordBytes := []byte(password)
+	if len(passwordBytes) > 72 {
+		return errors.New("Password too long")
+	}
+	hashed, err := bcrypt.GenerateFromPassword(passwordBytes, bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+
+	directory := filepath.Dir(fileName)
+	err = os.MkdirAll(directory, 0750)
+	if err != nil {
+		return err
+	}
+	fp, err := os.OpenFile(fileName, os.O_RDWR|os.O_CREATE, 0600)
+	if err != nil {
+		return err
+	}
+	defer fp.Close()
+
+	if _, err := fp.Seek(0, 0); err != nil {
+		log.Warning("Failed to seek to the beginning of the auth database:", err)
+		return err
+	}
+
+	if err = syscall.Flock(int(fp.Fd()), syscall.LOCK_EX); err != nil {
+		log.Warning("Failed to lock the auth database for read:", err)
+		return err
+	}
+	defer func() {
+		if err := syscall.Flock(int(fp.Fd()), syscall.LOCK_UN); err != nil {
+			log.Warning("Failed to unlock the auth database:", err)
+		}
+	}()
+
+	credentials := make(map[string]string)
+	scanner := bufio.NewScanner(fp)
+	scanner.Split(bufio.ScanLines)
+	for scanner.Scan() {
+		info := strings.SplitN(scanner.Text(), ":", 2)
+		if len(info) == 1 {
+			log.Warning("Invalid line in the authdb file:", scanner.Text())
+			continue
+		}
+		credentials[info[0]] = info[1]
+	}
+	credentials[user] = string(hashed)
+
+	fp2, err := os.OpenFile(fileName, os.O_RDWR|os.O_TRUNC|os.O_APPEND, 0600)
+	if err != nil {
+		return err
+	}
+	defer fp2.Close()
+
+	for user, pass := range credentials {
+		entry := fmt.Sprintf("%s:%s\n", user, pass)
+		if _, err = fp2.Write([]byte(entry)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func WritePasswordEntry(user, password string) error {
+	if err := writePasswordEntryImpl(user, password); err != nil {
+		return err
+	}
+
+	db := authDB.Load()
+	if db != nil {
+		if err := db.Reload(nil); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/web_ui/ui_windows.go b/web_ui/ui_windows.go
new file mode 100644
index 000000000..efaa5fe04
--- /dev/null
+++ b/web_ui/ui_windows.go
@@ -0,0 +1,45 @@
+//go:build windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package web_ui
+
+import (
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+func doReload() error {
+	db := authDB.Load()
+	if db == nil {
+		log.Debug("Cannot reload auth database - not configured")
+		return nil
+	}
+	err := db.Reload(nil)
+	if err != nil {
+		log.Warningln("Failed to reload auth database:", err)
+		return err
+	}
+	log.Debug("Successfully reloaded the auth database")
+	return nil
+}
+
+func WritePasswordEntry(_, _ string) error {
+	return errors.New("WritePasswordEntry not implemented on Windows")
+}
diff --git a/xrootd/authorization.go b/xrootd/authorization.go
new file mode 100644
index 000000000..f7be81292
--- /dev/null
+++ b/xrootd/authorization.go
@@ -0,0 +1,572 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+//
+// This file generates the authorization configuration for the XRootD
+// server.  Particularly, it generates the scitokens.cfg the server will
+// use to interpret the tokens.
+//
+
+package xrootd
+
+import (
+	"bufio"
+	"bytes"
+	_ "embed"
+	"encoding/json"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+	"unicode"
+
+	"github.com/go-ini/ini"
+	"github.com/pelicanplatform/pelican/cache_ui"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/origin_ui"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+)
+
+type (
+
+	// XRootD server-wide configurations for SciTokens.
+	GlobalCfg struct {
+		Audience []string
+	}
+
+	// Per-issuer configuration
+	Issuer struct {
+		Name            string
+		Issuer          string
+		BasePaths       []string
+		RestrictedPaths []string
+		MapSubject      bool
+		DefaultUser     string
+		UsernameClaim   string
+		NameMapfile     string
+	}
+
+	// Top-level configuration object for the template
+	ScitokensCfg struct {
+		Global    GlobalCfg
+		IssuerMap map[string]Issuer
+	}
+
+	openIdConfig struct {
+		Issuer               string   `json:"issuer"`
+		JWKSURI              string   `json:"jwks_uri"`
+		TokenEndpoint        string   `json:"token_endpoint,omitempty"`
+		UserInfoEndpoint     string   `json:"userinfo_endpoint,omitempty"`
+		RevocationEndpoint   string   `json:"revocation_endpoint,omitempty"`
+		GrantTypesSupported  []string `json:"grant_types_supported,omitempty"`
+		ScopesSupported      []string `json:"scopes_supported,omitempty"`
+		TokenAuthMethods     []string `json:"token_endpoint_auth_methods_supported,omitempty"`
+		RegistrationEndpoint string   `json:"registration_endpoint,omitempty"`
+		DeviceEndpoint       string   `json:"device_authorization_endpoint,omitempty"`
+	}
+)
+
+var (
+	//go:embed resources/scitokens.cfg
+	scitokensCfgTemplate string
+)
+
+// Remove a trailing carriage return from a slice.  Used by scanLinesWithCont
+func dropCR(data []byte) []byte {
+	if len(data) > 0 && data[len(data)-1] == '\r' {
+		return data[0 : len(data)-1]
+	}
+	return data
+}
+
+// Scan through the lines of a file, respecting line continuation characters.  That is,
+//
+// ```
+// foo \
+// bar
+// ```
+//
+// Would be parsed as a single line, `foo bar`.
+//
+// Follows the ScanFunc interface defined by bufio.
+func ScanLinesWithCont(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+	curData := data
+	for {
+		firstControl := bytes.IndexAny(curData, "\\\n")
+		if firstControl < 0 {
+			if atEOF {
+				// EOF and no more control characters; gobble up the rest
+				token = append(token, curData...)
+				advance += len(curData)
+				return
+			} else {
+				// Not the end of the stream -- ask for more data to see if we get a full line.
+				return 0, nil, nil
+			}
+		} else if curData[firstControl] == '\\' {
+			// There's a line continuation.  Ignore the rest of the whitespace, advance to new line.
+			token = append(token, curData[0:firstControl]...)
+			idx := firstControl + 1
+			for {
+				if idx == len(curData) {
+					break
+				} else if curData[idx] == '\n' {
+					idx += 1
+					break
+				} else if unicode.IsSpace(rune(curData[idx])) {
+					idx += 1
+				} else {
+					return 0, nil, errors.Errorf("invalid character after line continuation: %s", string(curData[idx]))
+				}
+			}
+			curData = curData[idx:]
+			advance += idx
+		} else { // must be a newline.  Return.
+			token = dropCR(append(token, curData[0:firstControl]...))
+			advance += firstControl + 1
+			return
+		}
+	}
+}
+
+// Given a reference to a Scitokens configuration, write it out to a known location
+// on disk for the xrootd server
+func writeScitokensConfiguration(modules config.ServerType, cfg *ScitokensCfg) error {
+
+	JSONify := func(v any) (string, error) {
+		result, err := json.Marshal(v)
+		return string(result), err
+	}
+	templ := template.Must(template.New("scitokens.cfg").
+		Funcs(template.FuncMap{"StringsJoin": strings.Join, "JSONify": JSONify}).
+		Parse(scitokensCfgTemplate))
+
+	gid, err := config.GetDaemonGID()
+	if err != nil {
+		return err
+	}
+
+	xrootdRun := param.Xrootd_RunLocation.GetString()
+	configPath := filepath.Join(xrootdRun, "scitokens-generated.cfg.tmp")
+	file, err := os.OpenFile(configPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
+	if err != nil {
+		return errors.Wrapf(err, "Failed to create a temporary scitokens file %s", configPath)
+	}
+	defer file.Close()
+	if err = os.Chown(configPath, -1, gid); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of generated scitokens"+
+			" configuration file %v to desired daemon gid %v", configPath, gid)
+	}
+
+	err = templ.Execute(file, cfg)
+	if err != nil {
+		return errors.Wrapf(err, "Unable to create scitokens.cfg template")
+	}
+
+	// Note that we write to the file then rename it into place.  This is because the
+	// xrootd daemon will periodically reload the scitokens.cfg and, in some cases,
+	// we may want to update it without restarting the server.
+	finalConfigPath := filepath.Join(xrootdRun, "scitokens-origin-generated.cfg")
+	if modules.IsEnabled(config.CacheType) {
+		finalConfigPath = filepath.Join(xrootdRun, "scitokens-cache-generated.cfg")
+	}
+	if err = os.Rename(configPath, finalConfigPath); err != nil {
+		return errors.Wrapf(err, "Failed to rename scitokens.cfg to final location")
+	}
+	return nil
+}
+
+// Parse the input xrootd authfile, add any default configurations, and then save it
+// into the xrootd runtime directory
+func EmitAuthfile(server server_utils.XRootDServer) error {
+	authfile := param.Xrootd_Authfile.GetString()
+	log.Debugln("Location of input authfile:", authfile)
+	contents, err := os.ReadFile(authfile)
+	if err != nil {
+		return errors.Wrapf(err, "Failed to read xrootd authfile from %s", authfile)
+	}
+
+	sc := bufio.NewScanner(strings.NewReader(string(contents)))
+	sc.Split(ScanLinesWithCont)
+	output := new(bytes.Buffer)
+	foundPublicLine := false
+	log.Debugln("Parsing the input authfile")
+	for sc.Scan() {
+		lineContents := sc.Text()
+		words := strings.Fields(lineContents)
+		if len(words) >= 2 && words[0] == "u" && words[1] == "*" {
+			// There exists a public access already in the authfile
+			if server.GetServerType().IsEnabled(config.OriginType) {
+				// If Origin, add the /.well-known to the authfile
+				output.Write([]byte("u * /.well-known lr " + strings.Join(words[2:], " ") + "\n"))
+			} else {
+				output.Write([]byte(lineContents + "\n"))
+			}
+			foundPublicLine = true
+		} else {
+			// Copy over entry verbatim
+			output.Write([]byte(lineContents + "\n"))
+		}
+	}
+	// If Origin and no authfile already exists, add the ./well-known to the authfile
+	if !foundPublicLine && server.GetServerType().IsEnabled(config.OriginType) {
+		output.Write([]byte("u * /.well-known lr\n"))
+	}
+
+	// For the cache, add the public namespaces
+	if server.GetServerType().IsEnabled(config.CacheType) {
+		// If nothing has been written to the output yet
+		var outStr string
+		if !foundPublicLine {
+			outStr = "u * "
+		}
+		for _, ad := range server.GetNamespaceAds() {
+			if !ad.RequireToken && ad.BasePath != "" {
+				outStr += ad.BasePath + " lr "
+			}
+		}
+		// A public namespace exists, so a line needs to be printed
+		if len(outStr) > 4 {
+			output.Write([]byte(outStr + "\n"))
+		}
+	}
+
+	gid, err := config.GetDaemonGID()
+	if err != nil {
+		return err
+	}
+
+	xrootdRun := param.Xrootd_RunLocation.GetString()
+	finalAuthPath := filepath.Join(xrootdRun, "authfile-origin-generated")
+	if server.GetServerType().IsEnabled(config.CacheType) {
+		finalAuthPath = filepath.Join(xrootdRun, "authfile-cache-generated")
+	}
+	file, err := os.OpenFile(finalAuthPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
+	if err != nil {
+		return errors.Wrapf(err, "Failed to create a generated authfile %s", finalAuthPath)
+	}
+	defer file.Close()
+	if err = os.Chown(finalAuthPath, -1, gid); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of generated auth"+
+			"file %v to desired daemon gid %v", finalAuthPath, gid)
+	}
+	if _, err := output.WriteTo(file); err != nil {
+		return errors.Wrapf(err, "Failed to write to generated authfile %v", finalAuthPath)
+	}
+
+	return nil
+}
+
+// Given a filename, load and parse the file into a ScitokensCfg object
+func LoadScitokensConfig(fileName string) (cfg ScitokensCfg, err error) {
+	configIni, err := ini.Load(fileName)
+	if err != nil {
+		return cfg, errors.Wrapf(err, "Unable to load the scitokens.cfg at %s", fileName)
+	}
+
+	cfg.IssuerMap = make(map[string]Issuer)
+
+	if section, err := configIni.GetSection("Global"); err == nil {
+		if audienceKey := section.Key("audience"); audienceKey != nil {
+			for _, audience := range audienceKey.Strings(",") {
+				cfg.Global.Audience = append(cfg.Global.Audience, strings.TrimSpace(audience))
+			}
+		}
+		if audienceKey := section.Key("audience_json"); audienceKey != nil && audienceKey.String() != "" {
+			var audiences []string
+			if err := json.Unmarshal([]byte(audienceKey.String()), &audiences); err != nil {
+				return cfg, errors.Wrapf(err, "Unable to parse audience_json from %s", fileName)
+			}
+			for _, audience := range audiences {
+				cfg.Global.Audience = append(cfg.Global.Audience, strings.TrimSpace(audience))
+			}
+		}
+	}
+
+	for _, sectionName := range configIni.Sections() {
+		if !strings.HasPrefix(sectionName.Name(), "Issuer ") {
+			continue
+		}
+
+		var newIssuer Issuer
+		newIssuer.Name = sectionName.Name()[len("Issuer "):]
+		if issuerKey := sectionName.Key("issuer"); issuerKey != nil {
+			newIssuer.Issuer = issuerKey.String()
+		}
+
+		if basePathsKey := sectionName.Key("base_path"); basePathsKey != nil {
+			for _, path := range basePathsKey.Strings(",") {
+				newIssuer.BasePaths = append(newIssuer.BasePaths, strings.TrimSpace(path))
+			}
+		}
+
+		if mapSubjectKey := sectionName.Key("map_subject"); mapSubjectKey != nil {
+			newIssuer.MapSubject = mapSubjectKey.MustBool()
+		}
+
+		if defaultUserKey := sectionName.Key("default_user"); defaultUserKey != nil {
+			newIssuer.DefaultUser = defaultUserKey.String()
+		}
+
+		if nameMapfileKey := sectionName.Key("name_mapfile"); nameMapfileKey != nil {
+			newIssuer.NameMapfile = nameMapfileKey.String()
+		}
+
+		if usernameClaimKey := sectionName.Key("username_claim"); usernameClaimKey != nil {
+			newIssuer.UsernameClaim = usernameClaimKey.String()
+		}
+
+		cfg.IssuerMap[newIssuer.Issuer] = newIssuer
+	}
+
+	return cfg, nil
+}
+
+// We have a special issuer just for self-monitoring the origin.
+func GenerateMonitoringIssuer() (issuer Issuer, err error) {
+	if val := param.Origin_SelfTest.GetBool(); !val {
+		return
+	}
+	issuer.Name = "Built-in Monitoring"
+	issuerUrl, err := server_utils.GetServerIssuerURL()
+	if err != nil {
+		return
+	}
+	issuer.Issuer = issuerUrl.String()
+	issuer.BasePaths = []string{"/pelican/monitoring"}
+	issuer.DefaultUser = "xrootd"
+
+	return
+}
+
+func GenerateOriginIssuer(exportedPaths []string) (issuer Issuer, err error) {
+	// TODO: Return to this and figure out how to get a proper unmarshal to work
+	if len(exportedPaths) == 0 {
+		return
+	}
+	issuer.Name = "Origin"
+	issuerUrl, err := server_utils.GetServerIssuerURL()
+	if err != nil {
+		return
+	}
+	issuer.Issuer = issuerUrl.String()
+	issuer.BasePaths = exportedPaths
+	issuer.RestrictedPaths = param.Origin_ScitokensRestrictedPaths.GetStringSlice()
+	issuer.MapSubject = param.Origin_ScitokensMapSubject.GetBool()
+	issuer.DefaultUser = param.Origin_ScitokensDefaultUser.GetString()
+	issuer.UsernameClaim = param.Origin_ScitokensUsernameClaim.GetString()
+
+	return
+}
+
+// We have a special issuer just for self-monitoring the origin.
+func GenerateDirectorMonitoringIssuer() (issuer Issuer, err error) {
+	if val := param.Federation_DirectorUrl.GetString(); val == "" {
+		return
+	}
+	issuer.Name = "Director-based Monitoring"
+	issuer.Issuer = param.Federation_DirectorUrl.GetString()
+	issuer.BasePaths = []string{"/pelican/monitoring"}
+	issuer.DefaultUser = "xrootd"
+
+	return
+}
+
+// Makes the general scitokens config to be used by both the origin and the cache
+func makeSciTokensCfg() (cfg ScitokensCfg, err error) {
+	gid, err := config.GetDaemonGID()
+	if err != nil {
+		return cfg, err
+	}
+
+	// Create the scitokens.cfg file if it's not already present
+	scitokensCfg := param.Xrootd_ScitokensConfig.GetString()
+
+	err = config.MkdirAll(filepath.Dir(scitokensCfg), 0755, -1, gid)
+	if err != nil {
+		return cfg, errors.Wrapf(err, "Unable to create directory %v",
+			filepath.Dir(scitokensCfg))
+	}
+	// We only open the file without chmod to daemon group as we will make
+	// a copy of this file and save it into xrootd run location
+	if file, err := os.OpenFile(scitokensCfg, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0640); err == nil {
+		file.Close()
+	} else if !errors.Is(err, os.ErrExist) {
+		return cfg, err
+	}
+	cfg, err = LoadScitokensConfig(scitokensCfg)
+	if err != nil {
+		return cfg, errors.Wrapf(err, "Failed to load scitokens configuration at %s", scitokensCfg)
+	}
+
+	return cfg, nil
+}
+
+// Writes out the server's scitokens.cfg configuration
+func EmitScitokensConfig(server server_utils.XRootDServer) error {
+	if originServer, ok := server.(*origin_ui.OriginServer); ok {
+		return WriteOriginScitokensConfig(originServer.GetAuthorizedPrefixes())
+	} else if cacheServer, ok := server.(*cache_ui.CacheServer); ok {
+		return WriteCacheScitokensConfig(cacheServer.GetNamespaceAds())
+	} else {
+		return errors.New("Internal error: server object is neither cache nor origin")
+	}
+}
+
+// Writes out the origin's scitokens.cfg configuration
+func WriteOriginScitokensConfig(exportedPaths []string) error {
+	cfg, err := makeSciTokensCfg()
+	if err != nil {
+		return err
+	}
+	if issuer, err := GenerateMonitoringIssuer(); err == nil && len(issuer.Name) > 0 {
+		if val, ok := cfg.IssuerMap[issuer.Issuer]; ok {
+			val.BasePaths = append(val.BasePaths, issuer.BasePaths...)
+			cfg.IssuerMap[issuer.Issuer] = val
+		} else {
+			cfg.IssuerMap[issuer.Issuer] = issuer
+			cfg.Global.Audience = append(cfg.Global.Audience, issuer.Issuer)
+		}
+	}
+	if issuer, err := GenerateOriginIssuer(exportedPaths); err == nil && len(issuer.Name) > 0 {
+		if val, ok := cfg.IssuerMap[issuer.Issuer]; ok {
+			val.BasePaths = append(val.BasePaths, issuer.BasePaths...)
+			cfg.IssuerMap[issuer.Issuer] = val
+		} else {
+			cfg.IssuerMap[issuer.Issuer] = issuer
+			cfg.Global.Audience = append(cfg.Global.Audience, issuer.Issuer)
+		}
+	}
+	if issuer, err := GenerateDirectorMonitoringIssuer(); err == nil && len(issuer.Name) > 0 {
+		if val, ok := cfg.IssuerMap[issuer.Issuer]; ok {
+			val.BasePaths = append(val.BasePaths, issuer.BasePaths...)
+			cfg.IssuerMap[issuer.Issuer] = val
+		} else {
+			cfg.IssuerMap[issuer.Issuer] = issuer
+		}
+	}
+
+	return writeScitokensConfiguration(config.OriginType, &cfg)
+}
+
+// Writes out the cache's scitokens.cfg configuration
+func WriteCacheScitokensConfig(nsAds []director.NamespaceAd) error {
+
+	cfg, err := makeSciTokensCfg()
+	if err != nil {
+		return err
+	}
+	for _, ad := range nsAds {
+		if ad.RequireToken {
+			if ad.Issuer.String() != "" && ad.BasePath != "" {
+				if val, ok := cfg.IssuerMap[ad.Issuer.String()]; ok {
+					val.BasePaths = append(val.BasePaths, ad.BasePath)
+					cfg.IssuerMap[ad.Issuer.String()] = val
+				} else {
+					cfg.IssuerMap[ad.Issuer.String()] = Issuer{Issuer: ad.Issuer.String(), BasePaths: []string{ad.BasePath}, Name: ad.Issuer.String()}
+					cfg.Global.Audience = append(cfg.Global.Audience, ad.Issuer.String())
+				}
+			}
+		}
+	}
+
+	return writeScitokensConfiguration(config.CacheType, &cfg)
+}
+
+func EmitIssuerMetadata(exportPath string) error {
+	gid, err := config.GetDaemonGID()
+	if err != nil {
+		return err
+	}
+
+	keys, err := config.GetIssuerPublicJWKS()
+	if err != nil {
+		return err
+	}
+	wellKnownPath := filepath.Join(exportPath, ".well-known")
+	err = config.MkdirAll(wellKnownPath, 0755, -1, gid)
+	if err != nil {
+		return err
+	}
+	file, err := os.OpenFile(filepath.Join(wellKnownPath, "issuer.jwks"),
+		os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	buf, err := json.MarshalIndent(keys, "", " ")
+	if err != nil {
+		return errors.Wrap(err, "Failed to marshal public keys")
+	}
+	_, err = file.Write(buf)
+	if err != nil {
+		return errors.Wrap(err, "Failed to write public key set to export directory")
+	}
+
+	openidFile, err := os.OpenFile(filepath.Join(wellKnownPath, "openid-configuration"),
+		os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	defer openidFile.Close()
+
+	originUrlStr := param.Origin_Url.GetString()
+	jwksUrl, err := url.Parse(originUrlStr)
+	if err != nil {
+		return err
+	}
+	jwksUrl.Path = "/.well-known/issuer.jwks"
+
+	cfg := openIdConfig{
+		Issuer:  param.Origin_Url.GetString(),
+		JWKSURI: jwksUrl.String(),
+	}
+
+	// If we have the built-in issuer enabled, fill in the URLs for OA4MP
+	if param.Origin_EnableIssuer.GetBool() {
+		serviceUri := param.Server_ExternalWebUrl.GetString() + "/api/v1.0/issuer"
+		cfg.TokenEndpoint = serviceUri + "/token"
+		cfg.UserInfoEndpoint = serviceUri + "/userinfo"
+		cfg.RevocationEndpoint = serviceUri + "/revoke"
+		cfg.GrantTypesSupported = []string{"refresh_token", "urn:ietf:params:oauth:grant-type:device_code", "authorization_code"}
+		cfg.ScopesSupported = []string{"openid", "offline_access", "wlcg", "storage.read:/",
+			"storage.modify:/", "storage.create:/"}
+		cfg.TokenAuthMethods = []string{"client_secret_basic", "client_secret_post"}
+		cfg.RegistrationEndpoint = serviceUri + "/oidc-cm"
+		cfg.DeviceEndpoint = serviceUri + "/device_authorization"
+	}
+
+	buf, err = json.MarshalIndent(cfg, "", " ")
+	if err != nil {
+		return errors.Wrap(err, "Failed to marshal OpenID configuration file contents")
+	}
+	_, err = openidFile.Write(buf)
+	if err != nil {
+		return errors.Wrap(err, "Failed to write OpenID configuration file")
+	}
+
+	return nil
+}
diff --git a/xrootd/authorization_test.go b/xrootd/authorization_test.go
new file mode 100644
index 000000000..fb9f65c19
--- /dev/null
+++ b/xrootd/authorization_test.go
@@ -0,0 +1,436 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package xrootd
+
+import (
+	"bufio"
+	"context"
+	_ "embed"
+	"fmt"
+	"io/fs"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/pelicanplatform/pelican/cache_ui"
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/origin_ui"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	//go:embed resources/test-scitokens-empty.cfg
+	emptyOutput string
+
+	//go:embed resources/test-scitokens-issuer.cfg
+	simpleOutput string
+
+	//go:embed resources/test-scitokens-2issuers.cfg
+	dualOutput string
+
+	// For now, this unit test uses the same input as the prior one;
+	// duplicating the variable name to make it clear these are different
+	// tests.
+	//go:embed resources/test-scitokens-2issuers.cfg
+	toMergeOutput string
+
+	//go:embed resources/test-scitokens-monitoring.cfg
+	monitoringOutput string
+
+	//go:embed resources/test-scitokens-cache-issuer.cfg
+	cacheSciOutput string
+
+	//go:embed resources/test-scitokens-cache-empty.cfg
+	cacheEmptyOutput string
+
+	sampleMultilineOutput = `foo \
+	bar
+	baz
+	abc \`
+
+	sampleMultilineOutputParsed = []string{"foo \tbar", "\tbaz", "\tabc "}
+
+	cacheAuthfileMultilineInput = `
+u * /user/ligo -rl \
+/Gluex rl \
+/NSG/PUBLIC rl \
+/VDC/PUBLIC rl`
+
+	cacheAuthfileOutput = "u * /.well-known lr /user/ligo -rl /Gluex rl /NSG/PUBLIC rl /VDC/PUBLIC rl\n"
+
+	// Configuration snippet from bug report #601
+	scitokensCfgAud = `
+[Global]
+audience = GLOW, HCC, IceCube, NRP, OSG, PATh, UCSD
+
+[Issuer https://ap20.uc.osg-htc.org:1094/ospool/ap20]
+issuer = https://ap20.uc.osg-htc.org:1094/ospool/ap20
+base_path = /ospool/ap20
+`
+
+	// Actual authfile entries here are from the bug report #568
+	otherAuthfileEntries = `# DN: /CN=sc-origin.chtc.wisc.edu
+u 5a42185a.0 /chtc/PROTECTED/sc-origin lr
+# DN: /DC=org/DC=incommon/C=US/ST=California/O=University of California, San Diego/CN=osg-stash-sfu-computecanada-ca.nationalresearchplatform.org
+u 4ff08838.0 /chtc/PROTECTED/sc-origin lr
+# DN: /DC=org/DC=incommon/C=US/ST=Georgia/O=Georgia Institute of Technology/OU=Office of Information Technology/CN=osg-gftp2.pace.gatech.edu
+u 3af6a420.0 /chtc/PROTECTED/sc-origin lr
+`
+
+	mergedAuthfileEntries = otherAuthfileEntries + "u * /.well-known lr\n"
+)
+
+func TestAuthfileMultiline(t *testing.T) {
+	sc := bufio.NewScanner(strings.NewReader(sampleMultilineOutput))
+	sc.Split(ScanLinesWithCont)
+	idx := 0
+	for sc.Scan() {
+		require.Less(t, idx, len(sampleMultilineOutputParsed))
+		assert.Equal(t, string(sampleMultilineOutputParsed[idx]), sc.Text())
+		idx += 1
+	}
+	assert.Equal(t, idx, len(sampleMultilineOutputParsed))
+}
+
+func TestEmitAuthfile(t *testing.T) {
+	tests := []struct {
+		desc    string
+		authIn  string
+		authOut string
+	}{
+		{
+			desc:    "merge-multi-lines",
+			authIn:  cacheAuthfileMultilineInput,
+			authOut: cacheAuthfileOutput,
+		},
+		{
+			desc:    "merge-other-entries",
+			authIn:  otherAuthfileEntries,
+			authOut: mergedAuthfileEntries,
+		},
+	}
+	for _, testInput := range tests {
+		t.Run(testInput.desc, func(t *testing.T) {
+			dirName := t.TempDir()
+			viper.Reset()
+			viper.Set("Xrootd.Authfile", filepath.Join(dirName, "authfile"))
+			viper.Set("Xrootd.RunLocation", dirName)
+			server := &origin_ui.OriginServer{}
+
+			err := os.WriteFile(filepath.Join(dirName, "authfile"), []byte(testInput.authIn), fs.FileMode(0600))
+			require.NoError(t, err)
+
+			err = EmitAuthfile(server)
+			require.NoError(t, err)
+
+			contents, err := os.ReadFile(filepath.Join(dirName, "authfile-origin-generated"))
+			require.NoError(t, err)
+
+			assert.Equal(t, testInput.authOut, string(contents))
+		})
+	}
+}
+
+func TestEmitCfg(t *testing.T) {
+	dirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Xrootd.RunLocation", dirname)
+	err := config.InitClient()
+	assert.Nil(t, err)
+
+	configTester := func(cfg *ScitokensCfg, configResult string) func(t *testing.T) {
+		return func(t *testing.T) {
+			err = writeScitokensConfiguration(config.OriginType, cfg)
+			assert.NoError(t, err)
+
+			genCfg, err := os.ReadFile(filepath.Join(dirname, "scitokens-origin-generated.cfg"))
+			assert.NoError(t, err)
+
+			assert.Equal(t, string(configResult), string(genCfg))
+		}
+	}
+
+	globalCfg := GlobalCfg{Audience: []string{"test_audience"}}
+	t.Run("EmptyConfig", configTester(&ScitokensCfg{Global: globalCfg}, emptyOutput))
+
+	issuer := Issuer{Name: "Demo", Issuer: "https://demo.scitokens.org", BasePaths: []string{"/foo", "/bar"}, DefaultUser: "osg"}
+	t.Run("SimpleIssuer", configTester(&ScitokensCfg{Global: globalCfg, IssuerMap: map[string]Issuer{issuer.Issuer: issuer}}, simpleOutput))
+	issuer2 := Issuer{Name: "WLCG", Issuer: "https://wlcg.cnaf.infn.it", BasePaths: []string{"/baz"}}
+	t.Run("DualIssuers", configTester(&ScitokensCfg{Global: globalCfg, IssuerMap: map[string]Issuer{issuer.Issuer: issuer, issuer2.Issuer: issuer2}}, dualOutput))
+}
+
+func TestLoadScitokensConfig(t *testing.T) {
+	dirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Xrootd.RunLocation", dirname)
+	err := config.InitClient()
+	assert.Nil(t, err)
+
+	configTester := func(configResult string) func(t *testing.T) {
+		return func(t *testing.T) {
+			cfgFname := filepath.Join(dirname, "scitokens-test.cfg")
+			err := os.WriteFile(cfgFname, []byte(configResult), 0600)
+			require.NoError(t, err)
+
+			cfg, err := LoadScitokensConfig(cfgFname)
+			require.NoError(t, err)
+
+			err = writeScitokensConfiguration(config.OriginType, &cfg)
+			assert.NoError(t, err)
+
+			genCfg, err := os.ReadFile(filepath.Join(dirname, "scitokens-origin-generated.cfg"))
+			assert.NoError(t, err)
+
+			assert.Equal(t, string(configResult), string(genCfg))
+		}
+	}
+
+	t.Run("EmptyConfig", configTester(emptyOutput))
+	t.Run("SimpleIssuer", configTester(simpleOutput))
+	t.Run("DualIssuers", configTester(dualOutput))
+}
+
+// Test that merging the configuration works without throwing any errors
+func TestMergeConfig(t *testing.T) {
+	dirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Xrootd.RunLocation", dirname)
+	scitokensConfigFile := filepath.Join(dirname, "scitokens-input.cfg")
+	viper.Set("Xrootd.ScitokensConfig", scitokensConfigFile)
+
+	configTester := func(configInput string, postProcess func(*testing.T, ScitokensCfg)) func(t *testing.T) {
+		return func(t *testing.T) {
+			ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+			defer func() { require.NoError(t, egrp.Wait()) }()
+			defer cancel()
+
+			err := os.WriteFile(scitokensConfigFile, []byte(configInput), fs.FileMode(0600))
+			require.NoError(t, err)
+
+			err = config.InitServer(ctx, config.OriginType)
+			require.NoError(t, err)
+
+			err = EmitScitokensConfig(&origin_ui.OriginServer{})
+			require.NoError(t, err)
+
+			cfg, err := LoadScitokensConfig(filepath.Join(dirname, "scitokens-origin-generated.cfg"))
+			require.NoError(t, err)
+
+			postProcess(t, cfg)
+		}
+	}
+
+	t.Run("AudienceNoJson", configTester(scitokensCfgAud, func(t *testing.T, cfg ScitokensCfg) {
+		assert.True(t, reflect.DeepEqual([]string{"GLOW", "HCC", "IceCube", "NRP", "OSG", "PATh", "UCSD", param.Server_IssuerUrl.GetString()}, cfg.Global.Audience))
+	}))
+}
+
+func TestGenerateConfig(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	viper.Set("Origin.SelfTest", false)
+	issuer, err := GenerateMonitoringIssuer()
+	require.NoError(t, err)
+	assert.Equal(t, issuer.Name, "")
+
+	viper.Set("Origin.SelfTest", true)
+	err = config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	issuer, err = GenerateMonitoringIssuer()
+	require.NoError(t, err)
+	assert.Equal(t, issuer.Name, "Built-in Monitoring")
+	assert.Equal(t, issuer.Issuer, "https://"+param.Server_Hostname.GetString()+":"+fmt.Sprint(param.Xrootd_Port.GetInt()))
+	require.Equal(t, len(issuer.BasePaths), 1)
+	assert.Equal(t, issuer.BasePaths[0], "/pelican/monitoring")
+	assert.Equal(t, issuer.DefaultUser, "xrootd")
+
+	viper.Reset()
+	viper.Set("Origin.SelfTest", false)
+	viper.Set("Origin.ScitokensDefaultUser", "user1")
+	viper.Set("Origin.ScitokensMapSubject", true)
+	err = config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	issuer, err = GenerateOriginIssuer([]string{"/foo/bar/baz", "/another/exported/path"})
+	require.NoError(t, err)
+	assert.Equal(t, issuer.Name, "Origin")
+	assert.Equal(t, issuer.Issuer, "https://"+param.Server_Hostname.GetString()+":"+fmt.Sprint(param.Xrootd_Port.GetInt()))
+	require.Equal(t, len(issuer.BasePaths), 2)
+	assert.Equal(t, issuer.BasePaths[0], "/foo/bar/baz")
+	assert.Equal(t, issuer.BasePaths[1], "/another/exported/path")
+	assert.Equal(t, issuer.DefaultUser, "user1")
+	assert.Equal(t, issuer.MapSubject, true)
+}
+
+func TestWriteOriginAuthFiles(t *testing.T) {
+
+	originAuthTester := func(server server_utils.XRootDServer, authStart string, authResult string) func(t *testing.T) {
+		return func(t *testing.T) {
+
+			dirname := t.TempDir()
+			viper.Reset()
+			viper.Set("Xrootd.RunLocation", dirname)
+			viper.Set("Xrootd.ScitokensConfig", filepath.Join(dirname, "scitokens-generated.cfg"))
+			viper.Set("Xrootd.Authfile", filepath.Join(dirname, "authfile"))
+			xAuthFile := filepath.Join(param.Xrootd_RunLocation.GetString(), "authfile-origin-generated")
+
+			authfileProvided := param.Xrootd_Authfile.GetString()
+
+			err := os.WriteFile(authfileProvided, []byte(authStart), 0600)
+			assert.NoError(t, err)
+
+			err = EmitAuthfile(server)
+			assert.NoError(t, err)
+
+			authGen, err := os.ReadFile(xAuthFile)
+			assert.NoError(t, err)
+			assert.Equal(t, authResult, string(authGen))
+		}
+	}
+	nsAds := []director.NamespaceAd{}
+
+	originServer := &origin_ui.OriginServer{}
+	originServer.SetNamespaceAds(nsAds)
+
+	t.Run("MultiIssuer", originAuthTester(originServer, "u * t1 lr t2 lr t3 lr", "u * /.well-known lr t1 lr t2 lr t3 lr\n"))
+
+	nsAds = []director.NamespaceAd{}
+	originServer.SetNamespaceAds(nsAds)
+
+	t.Run("EmptyAuth", originAuthTester(originServer, "", "u * /.well-known lr\n"))
+}
+
+func TestWriteCacheAuthFiles(t *testing.T) {
+
+	cacheAuthTester := func(server server_utils.XRootDServer, sciTokenResult string, authResult string) func(t *testing.T) {
+		return func(t *testing.T) {
+
+			dirname := t.TempDir()
+			viper.Reset()
+			viper.Set("Xrootd.RunLocation", dirname)
+			if server.GetServerType().IsEnabled(config.OriginType) {
+				viper.Set("Xrootd.ScitokensConfig", filepath.Join(dirname, "scitokens-origin-generated.cfg"))
+				viper.Set("Xrootd.Authfile", filepath.Join(dirname, "authfile-origin-generated"))
+			} else {
+				viper.Set("Xrootd.ScitokensConfig", filepath.Join(dirname, "scitokens-cache-generated.cfg"))
+				viper.Set("Xrootd.Authfile", filepath.Join(dirname, "authfile-cache-generated"))
+			}
+			authFile := param.Xrootd_Authfile.GetString()
+			err := os.WriteFile(authFile, []byte(""), 0600)
+			assert.NoError(t, err)
+
+			err = WriteCacheScitokensConfig(server.GetNamespaceAds())
+			assert.NoError(t, err)
+
+			sciFile := param.Xrootd_ScitokensConfig.GetString()
+			genSciToken, err := os.ReadFile(sciFile)
+			assert.NoError(t, err)
+
+			assert.Equal(t, sciTokenResult, string(genSciToken))
+
+			err = EmitAuthfile(server)
+			assert.NoError(t, err)
+
+			authGen, err := os.ReadFile(authFile)
+			assert.NoError(t, err)
+			assert.Equal(t, authResult, string(authGen))
+		}
+	}
+
+	issuer1URL := url.URL{}
+	issuer1URL.Scheme = "https"
+	issuer1URL.Host = "issuer1.com"
+
+	issuer2URL := url.URL{}
+	issuer2URL.Scheme = "https"
+	issuer2URL.Host = "issuer2.com"
+
+	issuer3URL := url.URL{}
+	issuer3URL.Scheme = "https"
+	issuer3URL.Host = "issuer3.com"
+
+	issuer4URL := url.URL{}
+	issuer4URL.Scheme = "https"
+	issuer4URL.Host = "issuer4.com"
+
+	nsAds := []director.NamespaceAd{
+		{RequireToken: true, Issuer: issuer1URL, BasePath: "/p1"},
+		{RequireToken: true, Issuer: issuer2URL, BasePath: "/p2/path"},
+		{RequireToken: false, Issuer: issuer3URL, BasePath: "/p3"},
+		{RequireToken: true, Issuer: issuer1URL, BasePath: "/p1_again"},
+		{RequireToken: false, Issuer: issuer4URL, BasePath: "/p4/depth"},
+		{RequireToken: false, Issuer: issuer2URL, BasePath: "/p2_noauth"},
+	}
+
+	cacheServer := &cache_ui.CacheServer{}
+	cacheServer.SetNamespaceAds(nsAds)
+
+	t.Run("MultiIssuer", cacheAuthTester(cacheServer, cacheSciOutput, "u * /p3 lr /p4/depth lr /p2_noauth lr \n"))
+
+	nsAds = []director.NamespaceAd{}
+	cacheServer.SetNamespaceAds(nsAds)
+
+	t.Run("EmptyNS", cacheAuthTester(cacheServer, cacheEmptyOutput, ""))
+}
+
+func TestWriteOriginScitokensConfig(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	dirname := t.TempDir()
+	os.Setenv("PELICAN_XROOTD_RUNLOCATION", dirname)
+	defer os.Unsetenv("PELICAN_XROOTD_RUNLOCATION")
+	config_dirname := t.TempDir()
+	viper.Set("Origin.SelfTest", true)
+	viper.Set("ConfigDir", config_dirname)
+	viper.Set("Xrootd.RunLocation", dirname)
+	viper.Set("Xrootd.Port", 8443)
+	viper.Set("Server.Hostname", "origin.example.com")
+	err := config.InitServer(ctx, config.OriginType)
+	require.Nil(t, err)
+
+	scitokensCfg := param.Xrootd_ScitokensConfig.GetString()
+	err = config.MkdirAll(filepath.Dir(scitokensCfg), 0755, -1, -1)
+	require.NoError(t, err)
+	err = os.WriteFile(scitokensCfg, []byte(toMergeOutput), 0640)
+	require.NoError(t, err)
+
+	err = WriteOriginScitokensConfig([]string{"/foo/bar"})
+	require.NoError(t, err)
+
+	genCfg, err := os.ReadFile(filepath.Join(dirname, "scitokens-origin-generated.cfg"))
+	require.NoError(t, err)
+
+	assert.Equal(t, string(monitoringOutput), string(genCfg))
+}
diff --git a/xrootd/launch.go b/xrootd/launch.go
index 6679bd123..4197543f7 100644
--- a/xrootd/launch.go
+++ b/xrootd/launch.go
@@ -21,202 +21,70 @@
 package xrootd
 
 import (
-	"bufio"
-	"context"
 	_ "embed"
-	"io"
-	"os"
-	"os/exec"
-	"os/signal"
 	"path/filepath"
-	"syscall"
-	"time"
 
 	"github.com/pelicanplatform/pelican/config"
-	"github.com/pelicanplatform/pelican/metrics"
-	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
+	"github.com/pelicanplatform/pelican/daemon"
+	"github.com/pelicanplatform/pelican/param"
 )
 
 type (
-	XrootdLauncher interface {
-		Launch(ctx context.Context, daemonName string, configPath string) (context.Context, int, error)
+	PrivilegedXrootdLauncher struct {
+		daemonName string
+		configPath string
 	}
 
-	PrivilegedXrootdLauncher struct{}
-
-	UnprivilegedXrootdLauncher struct{}
+	UnprivilegedXrootdLauncher struct {
+		daemon.DaemonLauncher
+	}
 )
 
-func forwardCommandToLogger(ctx context.Context, daemonName string, cmdStdout io.ReadCloser, cmdStderr io.ReadCloser) {
-	cmd_logger := log.WithFields(log.Fields{"daemon": daemonName})
-	stdout_scanner := bufio.NewScanner(cmdStdout)
-	stdout_lines := make(chan string, 10)
-
-	stderr_scanner := bufio.NewScanner(cmdStderr)
-	stderr_lines := make(chan string, 10)
-	go func() {
-		defer close(stdout_lines)
-		for stdout_scanner.Scan() {
-			stdout_lines <- stdout_scanner.Text()
-		}
-	}()
-	go func() {
-		defer close(stderr_lines)
-		for stderr_scanner.Scan() {
-			stderr_lines <- stderr_scanner.Text()
-		}
-	}()
-	for {
-		select {
-		case stdout_line, ok := <-stdout_lines:
-			if ok {
-				cmd_logger.Info(stdout_line)
-			} else {
-				stdout_lines = nil
-			}
-		case stderr_line, ok := <-stderr_lines:
-			if ok {
-				cmd_logger.Info(stderr_line)
-			} else {
-				stderr_lines = nil
-			}
-		}
-		if stdout_lines == nil && stderr_lines == nil {
-			break
-		}
-	}
-	<-ctx.Done()
+func (launcher PrivilegedXrootdLauncher) Name() string {
+	return launcher.daemonName
 }
 
-func (UnprivilegedXrootdLauncher) Launch(ctx context.Context, daemonName string, configPath string) (context.Context, int, error) {
-	xrootdRun := viper.GetString("XrootdRun")
+func makeUnprivilegedXrootdLauncher(daemonName string, configPath string) (result UnprivilegedXrootdLauncher, err error) {
+	result.DaemonName = daemonName
+	result.Uid = -1
+	result.Gid = -1
+	xrootdRun := param.Xrootd_RunLocation.GetString()
 	pidFile := filepath.Join(xrootdRun, "xrootd.pid")
-
-	cmd := exec.CommandContext(ctx, daemonName, "-f", "-s", pidFile, "-c", configPath)
-	if cmd.Err != nil {
-		return ctx, -1, cmd.Err
-	}
-	cmdStdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return ctx, -1, err
-	}
-	cmdStderr, err := cmd.StderrPipe()
-	if err != nil {
-		return ctx, -1, err
-	}
+	result.Args = []string{daemonName, "-s", pidFile, "-c", configPath}
 
 	if config.IsRootExecution() {
-		cmd.SysProcAttr = &syscall.SysProcAttr{}
-		uid, err := config.GetDaemonUID()
+		result.Uid, err = config.GetDaemonUID()
 		if err != nil {
-			return ctx, -1, err
+			return
 		}
-		gid, err := config.GetDaemonGID()
+		result.Gid, err = config.GetDaemonGID()
 		if err != nil {
-			return ctx, -1, err
+			return
 		}
-		cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(uid), Gid: uint32(gid)}
-	}
-
-	if err := cmd.Start(); err != nil {
-		return ctx, -1, err
 	}
-	go forwardCommandToLogger(ctx, daemonName, cmdStdout, cmdStderr)
-
-	ctx_result, cancel := context.WithCancelCause(ctx)
-	go func() {
-		cancel(cmd.Wait())
-	}()
-	return ctx_result, cmd.Process.Pid, nil
+	return
 }
 
-func LaunchXrootd(privileged bool, configPath string) (err error) {
-	var launcher XrootdLauncher
+func ConfigureLaunchers(privileged bool, configPath string, useCMSD bool) (launchers []daemon.Launcher, err error) {
 	if privileged {
-		launcher = PrivilegedXrootdLauncher{}
+		launchers = append(launchers, PrivilegedXrootdLauncher{"xrootd", configPath})
+		if useCMSD {
+			launchers = append(launchers, PrivilegedXrootdLauncher{"cmsd", configPath})
+		}
 	} else {
-		launcher = UnprivilegedXrootdLauncher{}
-	}
-	ctx := context.Background()
-
-	xrootdCtx, xrootdPid, err := launcher.Launch(ctx, "xrootd", configPath)
-	if err != nil {
-		return errors.Wrap(err, "Failed to launch xrootd daemon")
-	}
-	log.Info("Successfully launched xrootd")
-	if err := metrics.SetComponentHealthStatus("xrootd", "ok", ""); err != nil {
-		return err
-	}
-
-	cmsdCtx, cmsdPid, err := launcher.Launch(ctx, "cmsd", configPath)
-	if err != nil {
-		return errors.Wrap(err, "Failed to launch cmsd daemon")
-	}
-	log.Info("Successfully launched cmsd")
-	if err := metrics.SetComponentHealthStatus("cmsd", "ok", ""); err != nil {
-		return err
-	}
-
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
-	var xrootdExpiry time.Time
-	var cmsdExpiry time.Time
-	for {
-		timer := time.NewTimer(time.Second)
-		select {
-		case sig := <-sigs:
-			if sys_sig, ok := sig.(syscall.Signal); ok {
-				log.Warnf("Forwarding signal %v to xrootd daemons\n", sys_sig)
-				if err = syscall.Kill(xrootdPid, sys_sig); err != nil {
-					return errors.Wrap(err, "Failed to forward signal to xrootd process")
-				}
-				if err = syscall.Kill(cmsdPid, sys_sig); err != nil {
-					return errors.Wrap(err, "Failed to forward signal to cmsd process")
-				}
-			} else {
-				panic(errors.New("Unable to convert signal to syscall.Signal"))
-			}
-			xrootdExpiry = time.Now().Add(10 * time.Second)
-			cmsdExpiry = time.Now().Add(10 * time.Second)
-		case <-xrootdCtx.Done():
-			if waitResult := context.Cause(xrootdCtx); waitResult != nil {
-				if !xrootdExpiry.IsZero() {
-					return nil
-				}
-				if err = metrics.SetComponentHealthStatus("xrootd", "critical",
-					"xrootd process failed unexpectedly"); err != nil {
-					return err
-				}
-				return errors.Wrap(waitResult, "xrootd process failed unexpectedly")
-			}
-			log.Debugln("Xrootd daemon has shut down successfully")
-			return nil
-		case <-cmsdCtx.Done():
-			if waitResult := context.Cause(cmsdCtx); waitResult != context.Canceled {
-				if !cmsdExpiry.IsZero() {
-					return nil
-				}
-				if err = metrics.SetComponentHealthStatus("cmsd", "critical",
-					"cmsd process failed unexpectedly"); err != nil {
-					return nil
-				}
-				return errors.Wrap(waitResult, "cmsd process failed unexpectedly")
-			}
-			log.Debugln("Cmsd daemon has shut down successfully")
-			return nil
-		case <-timer.C:
-			if !xrootdExpiry.IsZero() && time.Now().After(xrootdExpiry) {
-				if err = syscall.Kill(xrootdPid, syscall.SIGKILL); err != nil {
-					return errors.Wrap(err, "Failed to SIGKILL the xrootd process")
-				}
-			}
-			if !cmsdExpiry.IsZero() && time.Now().After(cmsdExpiry) {
-				if err = syscall.Kill(cmsdPid, syscall.SIGKILL); err != nil {
-					return errors.Wrap(err, "Failed to SIGKILL the cmsd process")
-				}
+		var result UnprivilegedXrootdLauncher
+		result, err = makeUnprivilegedXrootdLauncher("xrootd", configPath)
+		if err != nil {
+			return
+		}
+		launchers = append(launchers, result)
+		if useCMSD {
+			result, err = makeUnprivilegedXrootdLauncher("cmsd", configPath)
+			if err != nil {
+				return
 			}
+			launchers = append(launchers, result)
 		}
 	}
+	return
 }
diff --git a/xrootd/launch_default.go b/xrootd/launch_default.go
index 3d7db2b86..0dd81d69c 100644
--- a/xrootd/launch_default.go
+++ b/xrootd/launch_default.go
@@ -26,6 +26,6 @@ import (
 	"github.com/pkg/errors"
 )
 
-func (PrivilegedXrootdLauncher) Launch(ctx context.Context, daemonName string, configPath string) (context.Context, int, error) {
+func (PrivilegedXrootdLauncher) Launch(ctx context.Context) (context.Context, int, error) {
 	return ctx, -1, errors.New("Privileged process launching not supported on this platform")
 }
diff --git a/xrootd/launch_linux.go b/xrootd/launch_linux.go
index a3e64a51e..34eaed617 100644
--- a/xrootd/launch_linux.go
+++ b/xrootd/launch_linux.go
@@ -28,9 +28,10 @@ import (
 	"syscall"
 
 	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/daemon"
+	"github.com/pelicanplatform/pelican/param"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"github.com/spf13/viper"
 	"kernel.org/pub/linux/libs/security/libcap/cap"
 )
 
@@ -71,24 +72,24 @@ func findDaemon(daemonName string) (string, error) {
 	return "", errors.Errorf("No executable by name of %s found", daemonName)
 }
 
-func (PrivilegedXrootdLauncher) Launch(ctx context.Context, daemonName string, configPath string) (context.Context, int, error) {
+func (plauncher PrivilegedXrootdLauncher) Launch(ctx context.Context) (context.Context, int, error) {
 	readStdout, writeStdout, err := os.Pipe()
 	if err != nil {
-		return ctx, -1, errors.Wrapf(err, "Unable to create stdout pipe for %s", daemonName)
+		return ctx, -1, errors.Wrapf(err, "Unable to create stdout pipe for %s", plauncher.Name())
 	}
 	readStderr, writeStderr, err := os.Pipe()
 	if err != nil {
-		return ctx, -1, errors.Wrapf(err, "Unable to create stderr pipe for %s", daemonName)
+		return ctx, -1, errors.Wrapf(err, "Unable to create stderr pipe for %s", plauncher.Name())
 	}
 
-	xrootdRun := viper.GetString("XrootdRun")
+	xrootdRun := param.Xrootd_RunLocation.GetString()
 	pidFile := filepath.Join(xrootdRun, "xrootd.pid")
 
-	executable, err := findDaemon(daemonName)
+	executable, err := findDaemon(plauncher.Name())
 	if err != nil {
 		return ctx, -1, err
 	}
-	launcher := cap.NewLauncher(executable, []string{daemonName, "-f", "-s", pidFile, "-c", configPath}, nil)
+	launcher := cap.NewLauncher(executable, []string{plauncher.Name(), "-f", "-s", pidFile, "-c", plauncher.configPath}, nil)
 	launcher.Callback(func(attrs *syscall.ProcAttr, _ interface{}) error {
 		attrs.Files[1] = writeStdout.Fd()
 		attrs.Files[2] = writeStderr.Fd()
@@ -139,7 +140,7 @@ func (PrivilegedXrootdLauncher) Launch(ctx context.Context, daemonName string, c
 
 	writeStdout.Close()
 	writeStderr.Close()
-	go forwardCommandToLogger(ctx, daemonName, readStdout, readStderr)
+	go daemon.ForwardCommandToLogger(ctx, plauncher.Name(), readStdout, readStderr)
 
 	ctx_result, cancel := context.WithCancelCause(ctx)
 	go func() {
diff --git a/xrootd/launch_windows.go b/xrootd/launch_windows.go
index ea28c2a7d..d30a9dca5 100644
--- a/xrootd/launch_windows.go
+++ b/xrootd/launch_windows.go
@@ -17,15 +17,6 @@
  * limitations under the License.
  *
  ***************************************************************/
-
 package xrootd
 
-import (
-	"github.com/pkg/errors"
-)
-
 type PrivilegedXrootdLauncher struct{}
-
-func LaunchOrigin() error {
-	return errors.New("'origin serve' command is not supported on Windows")
-}
diff --git a/xrootd/origin_test.go b/xrootd/origin_test.go
new file mode 100644
index 000000000..3750c265e
--- /dev/null
+++ b/xrootd/origin_test.go
@@ -0,0 +1,240 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package xrootd
+
+import (
+	"bytes"
+	"context"
+	"crypto/elliptic"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/daemon"
+	"github.com/pelicanplatform/pelican/origin_ui"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/test_utils"
+	"github.com/pelicanplatform/pelican/utils"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/require"
+)
+
+func originMockup(ctx context.Context, egrp *errgroup.Group, t *testing.T) context.CancelFunc {
+	originServer := &origin_ui.OriginServer{}
+
+	// Create our own temp directory (for some reason t.TempDir() does not play well with xrootd)
+	tmpPathPattern := "XRootD-Test_Origin*"
+	tmpPath, err := os.MkdirTemp("", tmpPathPattern)
+	require.NoError(t, err)
+
+	// Need to set permissions or the xrootd process we spawn won't be able to write PID/UID files
+	permissions := os.FileMode(0755)
+	err = os.Chmod(tmpPath, permissions)
+	require.NoError(t, err)
+
+	viper.Set("ConfigDir", tmpPath)
+	viper.Set("Xrootd.RunLocation", filepath.Join(tmpPath, "xrootd"))
+	t.Cleanup(func() {
+		os.RemoveAll(tmpPath)
+	})
+
+	// Increase the log level; otherwise, its difficult to debug failures
+	viper.Set("Logging.Level", "Debug")
+	config.InitConfig()
+	err = config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+
+	err = config.GeneratePrivateKey(param.Server_TLSKey.GetString(), elliptic.P256())
+	require.NoError(t, err)
+	err = config.GenerateCert()
+	require.NoError(t, err)
+
+	err = CheckXrootdEnv(originServer)
+	require.NoError(t, err)
+
+	shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
+
+	err = SetUpMonitoring(shutdownCtx, egrp)
+	require.NoError(t, err)
+
+	configPath, err := ConfigXrootd(shutdownCtx, true)
+	require.NoError(t, err)
+
+	launchers, err := ConfigureLaunchers(false, configPath, false)
+	require.NoError(t, err)
+
+	err = daemon.LaunchDaemons(shutdownCtx, launchers, egrp)
+	require.NoError(t, err)
+
+	return shutdownCancel
+}
+
+func TestOrigin(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+
+	viper.Set("Origin.ExportVolume", t.TempDir()+":/test")
+	viper.Set("Origin.Mode", "posix")
+	// Disable functionality we're not using (and is difficult to make work on Mac)
+	viper.Set("Origin.EnableCmsd", false)
+	viper.Set("Origin.EnableMacaroons", false)
+	viper.Set("Origin.EnableVoms", false)
+	viper.Set("TLSSkipVerify", true)
+
+	mockupCancel := originMockup(ctx, egrp, t)
+	defer mockupCancel()
+
+	// In this case a 403 means its running
+	err := server_utils.WaitUntilWorking(ctx, "GET", param.Origin_Url.GetString(), "xrootd", 403)
+	if err != nil {
+		t.Fatalf("Unsuccessful test: Server encountered an error: %v", err)
+	}
+	fileTests := utils.TestFileTransferImpl{}
+	ok, err := fileTests.RunTests(ctx, param.Origin_Url.GetString(), param.Origin_Url.GetString(), utils.OriginSelfFileTest)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	viper.Reset()
+}
+
+func TestS3OriginConfig(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	viper.Reset()
+	tmpDir := t.TempDir()
+
+	// We need to start up a minio server, which is how we emulate S3. Open to better ways to do this!
+	minIOServerCmd := exec.CommandContext(ctx, "minio", "server", "--quiet", tmpDir)
+	minIOServerCmd.Env = []string{fmt.Sprintf("HOME=%s", tmpDir)}
+
+	// Create a few buffers to grab outputs
+	var outb, errb bytes.Buffer
+	minIOServerCmd.Stdout = &outb
+	minIOServerCmd.Stderr = &errb
+
+	err := minIOServerCmd.Start()
+	require.NoError(t, err)
+	// Check for any other errors in the outputs
+	if strings.Contains(strings.ToLower(outb.String()), "error") {
+		t.Fatalf("Could not start the MinIO server: %s", outb.String())
+	} else if errb.String() != "" {
+		t.Fatalf("Could not start the MinIO server: %s", errb.String())
+	}
+
+	// Check if MinIO is running (by default at localhost:9000)
+	endpoint := "localhost:9000"
+	// Expect a 403 from this endpoint -- that means it's running
+	err = server_utils.WaitUntilWorking(ctx, "GET", fmt.Sprintf("http://%s", endpoint), "xrootd", 403)
+	if err != nil {
+		t.Fatalf("Unsuccessful test: Server encountered an error: %v", err)
+	}
+
+	defer func() {
+		err = minIOServerCmd.Process.Kill()
+		require.NoError(t, err)
+	}()
+
+	// Let's create an unauthenticated bucket. First we set up a client instance
+	// By default, the endpoint will require access/secret key with these values. Note that this doesn't
+	// necessarily mean the bucket we create needs those keys, as the bucket will have its own IAM
+	accessKey := "minioadmin"
+	secretKey := "minioadmin"
+	useSSL := false
+
+	minioClient, err := minio.New(endpoint, &minio.Options{
+		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
+		Secure: useSSL,
+	})
+	require.NoError(t, err)
+
+	// Create a new unauthenticated bucket. Under the hood, this will access the minio server endpoint
+	// and do a PUT
+	bucketName := "test-bucket"
+	regionName := "test-region"
+	serviceName := "test-name"
+	err = minioClient.MakeBucket(context.Background(), bucketName, minio.MakeBucketOptions{})
+	require.NoError(t, err)
+
+	// Set bucket policy for public read access
+	policy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::` + bucketName + `/*"]}]}`
+	err = minioClient.SetBucketPolicy(context.Background(), bucketName, policy)
+	require.NoError(t, err)
+
+	// Upload a test file to the bucket
+	testFilePath := filepath.Join(tmpDir, "test-file.txt")
+	content := []byte("This is the content of the test file.")
+	err = os.WriteFile(testFilePath, content, 0644)
+	require.NoError(t, err)
+
+	objectName := "test-file.txt"
+	contentType := "application/octet-stream"
+	_, err = minioClient.FPutObject(context.Background(), bucketName, objectName, testFilePath, minio.PutObjectOptions{ContentType: contentType})
+	require.NoError(t, err)
+
+	// All the setup to create the S3 server, add a bucket with a publicly-readable object is done. Now onto Pelican stuff
+	// Set up the origin and try to pull a file
+	viper.Set("Origin.Mode", "s3")
+	viper.Set("Origin.S3Region", regionName)
+	viper.Set("Origin.S3Bucket", bucketName)
+	viper.Set("Origin.S3ServiceName", serviceName)
+	viper.Set("Origin.S3ServiceUrl", fmt.Sprintf("http://%s", endpoint))
+	// Disable functionality we're not using (and is difficult to make work on Mac)
+	viper.Set("Origin.EnableCmsd", false)
+	viper.Set("Origin.EnableMacaroons", false)
+	viper.Set("Origin.EnableVoms", false)
+	viper.Set("Origin.SelfTest", false)
+	viper.Set("TLSSkipVerify", true)
+
+	mockupCancel := originMockup(ctx, egrp, t)
+	defer mockupCancel()
+
+	// FOR NOW, we consider the test a success if the origin's xrootd server boots.
+	// TODO: When we've made it easier to come back and test whole pieces of this process by disentangling our
+	// *serve* commands, come back and make this e2e. The reason I'm punting is that in S3 mode, we also need all
+	// of the web_ui stuff initialized to export the public signing keys (as we can't export via XRootD) and we
+	// need a real token. These become much easier when we have an internally workable set of commands to do so.
+
+	originEndpoint := fmt.Sprintf("%s/%s/%s/%s/%s", param.Origin_Url.GetString(), serviceName, regionName, bucketName, objectName)
+	// Until we sort out the things we mentioned above, we should expect a 403 because we don't try to pass tokens
+	// and we don't actually export any keys for token validation.
+	err = server_utils.WaitUntilWorking(ctx, "GET", originEndpoint, "xrootd", 403)
+	if err != nil {
+		t.Fatalf("Unsucessful test: Server encountered an error: %v", err)
+	}
+
+	// One other quick check to do is that the namespace was correctly parsed:
+	require.Equal(t, fmt.Sprintf("/%s/%s/%s", serviceName, regionName, bucketName), param.Origin_NamespacePrefix.GetString())
+	viper.Reset()
+}
diff --git a/cmd/resources/robots.txt b/xrootd/resources/robots.txt
similarity index 100%
rename from cmd/resources/robots.txt
rename to xrootd/resources/robots.txt
diff --git a/xrootd/resources/scitokens.cfg b/xrootd/resources/scitokens.cfg
new file mode 100644
index 000000000..6573ed904
--- /dev/null
+++ b/xrootd/resources/scitokens.cfg
@@ -0,0 +1,46 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+{{if .Global.Audience}}[Global]
+audience_json = {{JSONify .Global.Audience}}{{end}}
+
+{{range $key, $value := .IssuerMap -}}
+[Issuer {{.Name}}]
+issuer = {{.Issuer}}
+base_path = {{ StringsJoin .BasePaths ", " }}
+{{- if .RestrictedPaths}}
+restricted_path = {{ StringsJoin .RestrictedPaths ", "}}
+{{- end}}
+{{- if .MapSubject}}
+map_subject = {{.MapSubject}}
+{{- end}}
+{{- if .DefaultUser}}
+default_user = {{.DefaultUser}}
+{{- end}}
+{{- if .NameMapfile}}
+name_mapfile = {{.NameMapfile}}
+{{- end}}
+{{- if .UsernameClaim}}
+username_claim = {{.UsernameClaim}}
+{{- end}}
+
+{{end -}}
+# End of config
diff --git a/xrootd/resources/test-scitokens-2issuers.cfg b/xrootd/resources/test-scitokens-2issuers.cfg
new file mode 100644
index 000000000..c685b5442
--- /dev/null
+++ b/xrootd/resources/test-scitokens-2issuers.cfg
@@ -0,0 +1,34 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+[Global]
+audience_json = ["test_audience"]
+
+[Issuer Demo]
+issuer = https://demo.scitokens.org
+base_path = /foo, /bar
+default_user = osg
+
+[Issuer WLCG]
+issuer = https://wlcg.cnaf.infn.it
+base_path = /baz
+
+# End of config
diff --git a/xrootd/resources/test-scitokens-cache-empty.cfg b/xrootd/resources/test-scitokens-cache-empty.cfg
new file mode 100644
index 000000000..2fa88623d
--- /dev/null
+++ b/xrootd/resources/test-scitokens-cache-empty.cfg
@@ -0,0 +1,24 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+
+
+# End of config
diff --git a/xrootd/resources/test-scitokens-cache-issuer.cfg b/xrootd/resources/test-scitokens-cache-issuer.cfg
new file mode 100644
index 000000000..dc76f67af
--- /dev/null
+++ b/xrootd/resources/test-scitokens-cache-issuer.cfg
@@ -0,0 +1,33 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+[Global]
+audience_json = ["https://issuer1.com","https://issuer2.com"]
+
+[Issuer https://issuer1.com]
+issuer = https://issuer1.com
+base_path = /p1, /p1_again
+
+[Issuer https://issuer2.com]
+issuer = https://issuer2.com
+base_path = /p2/path
+
+# End of config
diff --git a/xrootd/resources/test-scitokens-empty.cfg b/xrootd/resources/test-scitokens-empty.cfg
new file mode 100644
index 000000000..a76f40f9b
--- /dev/null
+++ b/xrootd/resources/test-scitokens-empty.cfg
@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+[Global]
+audience_json = ["test_audience"]
+
+# End of config
diff --git a/xrootd/resources/test-scitokens-issuer.cfg b/xrootd/resources/test-scitokens-issuer.cfg
new file mode 100644
index 000000000..7e55f2e7b
--- /dev/null
+++ b/xrootd/resources/test-scitokens-issuer.cfg
@@ -0,0 +1,30 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+[Global]
+audience_json = ["test_audience"]
+
+[Issuer Demo]
+issuer = https://demo.scitokens.org
+base_path = /foo, /bar
+default_user = osg
+
+# End of config
diff --git a/xrootd/resources/test-scitokens-monitoring.cfg b/xrootd/resources/test-scitokens-monitoring.cfg
new file mode 100644
index 000000000..03430e10e
--- /dev/null
+++ b/xrootd/resources/test-scitokens-monitoring.cfg
@@ -0,0 +1,39 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This is a generated configuration file -- DO NOT HAND EDIT.
+# It will be overwritten on the next startup of pelican.
+#
+
+[Global]
+audience_json = ["test_audience","https://origin.example.com:8443"]
+
+[Issuer Demo]
+issuer = https://demo.scitokens.org
+base_path = /foo, /bar
+default_user = osg
+
+[Issuer Built-in Monitoring]
+issuer = https://origin.example.com:8443
+base_path = /pelican/monitoring, /foo/bar
+default_user = xrootd
+
+[Issuer WLCG]
+issuer = https://wlcg.cnaf.infn.it
+base_path = /baz
+
+# End of config
diff --git a/xrootd/resources/xrootd-cache.cfg b/xrootd/resources/xrootd-cache.cfg
new file mode 100644
index 000000000..30897d27d
--- /dev/null
+++ b/xrootd/resources/xrootd-cache.cfg
@@ -0,0 +1,72 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+all.role server
+if exec xrootd
+  xrd.port {{.Xrootd.Port}}
+  xrd.protocol http:{{.Xrootd.Port}} libXrdHttp.so
+fi
+ofs.osslib libXrdPss.so
+pss.cachelib libXrdPfc.so
+xrd.tls {{.Xrootd.RunLocation}}/copied-tls-creds.crt {{.Xrootd.RunLocation}}/copied-tls-creds.crt
+{{if .Server.TLSCACertificateDirectory}}
+xrd.tlsca certdir {{.Server.TLSCACertificateDirectory}}
+{{else}}
+xrd.tlsca certfile {{.Server.TLSCACertificateFile}}
+{{end}}
+http.header2cgi Authorization authz
+{{if .Cache.EnableVoms}}
+http.secxtractor /usr/lib64/libXrdVoms.so
+{{end}}
+http.staticpreload http://static/robots.txt {{.Xrootd.RobotsTxtFile}}
+{{if .Xrootd.Sitename}}
+all.sitename {{.Xrootd.Sitename}}
+{{end}}
+{{if .Xrootd.SummaryMonitoringHost}}
+xrd.report {{.Xrootd.SummaryMonitoringHost}}:{{.Xrootd.SummaryMonitoringPort}},127.0.0.1:{{.Xrootd.LocalMonitoringPort}} every 30s
+{{end}}
+xrootd.monitor all auth flush 30s window 5s fstat 60 lfn ops xfr 5 {{if .Xrootd.DetailedMonitoringHost -}} dest redir fstat info files user pfc tcpmon ccm {{.Xrootd.DetailedMonitoringHost}}:{{.Xrootd.DetailedMonitoringPort}} {{- end}} dest redir fstat info files user pfc tcpmon ccm 127.0.0.1:{{.Xrootd.LocalMonitoringPort}}
+all.adminpath {{.Xrootd.RunLocation}}
+all.pidpath {{.Xrootd.RunLocation}}
+xrootd.seclib libXrdSec.so
+sec.protocol ztn
+ofs.authorize 1
+acc.audit deny grant
+acc.authdb {{.Xrootd.RunLocation}}/authfile-cache-generated
+ofs.authlib ++ libXrdAccSciTokens.so config={{.Xrootd.RunLocation}}/scitokens-cache-generated.cfg
+all.export {{.Cache.ExportLocation}}
+xrootd.chksum max 2 md5 adler32 crc32
+xrootd.trace emsg login stall redirect
+pfc.trace info
+xrootd.tls all
+pfc.blocksize 128k
+pfc.prefetch 20
+pfc.writequeue 16 4
+pfc.ram 4g
+pfc.diskusage 0.90 0.95 purgeinterval 300s
+pss.origin {{.Cache.DirectorUrl}}
+# FIXME: the oss.space meta / data only works if the meta and data directories are different physical devices.
+# Otherwise, no data space is setup and the cache simply doesn't write out data.
+oss.localroot {{.Cache.DataLocation}}
+#pfc.spaces data meta
+#oss.space meta {{.Cache.DataLocation}}/meta*
+#oss.space data {{.Cache.DataLocation}}/data*
+pss.debug
+pss.setopt DebugLevel 3
+pss.trace all
+ofs.trace all
+xrd.trace all -sched
+cms.trace all
+scitokens.trace all
diff --git a/xrootd/resources/xrootd-origin.cfg b/xrootd/resources/xrootd-origin.cfg
new file mode 100644
index 000000000..7cd3c99a2
--- /dev/null
+++ b/xrootd/resources/xrootd-origin.cfg
@@ -0,0 +1,90 @@
+#
+# Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you
+# may not use this file except in compliance with the License.  You may
+# obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+{{if .Origin.EnableCmsd}}
+all.manager {{.Xrootd.ManagerHost}}+ {{.Xrootd.ManagerPort}}
+{{end}}
+all.role server
+if exec xrootd
+  xrd.port {{.Xrootd.Port}}
+  xrd.protocol http:{{.Xrootd.Port}} libXrdHttp.so
+fi
+xrd.tls {{.Xrootd.RunLocation}}/copied-tls-creds.crt {{.Xrootd.RunLocation}}/copied-tls-creds.crt
+{{if .Server.TLSCACertificateDirectory}}
+xrd.tlsca certdir {{.Server.TLSCACertificateDirectory}}
+{{else}}
+xrd.tlsca certfile {{.Server.TLSCACertificateFile}}
+{{end}}
+{{if eq .Origin.EnableDirListing false}}
+http.listingdeny true
+{{end}}
+{{if .Origin.EnableMacaroons}}
+http.exthandler xrdmacaroons libXrdMacaroons.so
+macaroons.secretkey {{.Xrootd.MacaroonsKeyFile}}
+ofs.authlib ++ libXrdMacaroons.so
+{{end}}
+http.header2cgi Authorization authz
+{{if .Origin.EnableVoms}}
+http.secxtractor /usr/lib64/libXrdVoms.so
+{{end}}
+http.staticpreload http://static/robots.txt {{.Xrootd.RobotsTxtFile}}
+{{if .Xrootd.Sitename}}
+all.sitename {{.Xrootd.Sitename}}
+{{end}}
+{{if .Xrootd.SummaryMonitoringHost}}
+xrd.report {{.Xrootd.SummaryMonitoringHost}}:{{.Xrootd.SummaryMonitoringPort}},127.0.0.1:{{.Xrootd.LocalMonitoringPort}} every 30s
+{{end}}
+xrootd.monitor all auth flush 30s window 5s fstat 60 lfn ops xfr 5 {{if .Xrootd.DetailedMonitoringHost -}} dest redir fstat info files user pfc tcpmon ccm {{.Xrootd.DetailedMonitoringHost}}:{{.Xrootd.DetailedMonitoringPort}} {{- end}} dest redir fstat info files user pfc tcpmon ccm 127.0.0.1:{{.Xrootd.LocalMonitoringPort}}
+all.adminpath {{.Xrootd.RunLocation}}
+all.pidpath {{.Xrootd.RunLocation}}
+{{if eq .Origin.Mode "posix"}}
+oss.localroot {{.Xrootd.Mount}}
+{{else if eq .Origin.Mode "s3"}}
+ofs.osslib libXrdS3.so
+# The S3 plugin doesn't currently support async mode
+xrootd.async off
+s3.service_name {{.Origin.S3ServiceName}}
+s3.region {{.Origin.S3Region}}
+s3.service_url {{.Origin.S3ServiceUrl}}
+{{- if .Origin.S3AccessKeyfile}}
+s3.access_key_file {{.Origin.S3AccessKeyfile}}
+{{- end -}}
+{{if .Origin.S3SecretKeyfile}}
+s3.secret_key_file {{.Origin.S3SecretKeyfile}}
+{{- end}}
+{{end}}
+xrootd.seclib libXrdSec.so
+sec.protocol ztn
+ofs.authorize 1
+acc.audit deny grant
+acc.authdb {{.Xrootd.RunLocation}}/authfile-origin-generated
+ofs.authlib ++ libXrdAccSciTokens.so config={{.Xrootd.RunLocation}}/scitokens-origin-generated.cfg
+all.export {{.Origin.NamespacePrefix}}
+{{if .Origin.SelfTest}}
+# Note we don't want to export this via cmsd; only for self-test
+xrootd.export /pelican/monitoring
+xrootd.export /.well-known
+{{end}}
+{{if .Origin.Multiuser}}
+ofs.osslib libXrdMultiuser.so default
+ofs.ckslib * libXrdMultiuser.so
+{{end}}
+xrootd.chksum max 2 md5 adler32 crc32
+xrootd.trace emsg login stall redirect
+pfc.trace info
+pss.setopt DebugLevel 1
+xrootd.tls all
+scitokens.trace all
diff --git a/xrootd/xrootd_config.go b/xrootd/xrootd_config.go
new file mode 100644
index 000000000..ab981bb6e
--- /dev/null
+++ b/xrootd/xrootd_config.go
@@ -0,0 +1,619 @@
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package xrootd
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	_ "embed"
+	"encoding/base64"
+	builtin_errors "errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/director"
+	"github.com/pelicanplatform/pelican/metrics"
+	"github.com/pelicanplatform/pelican/origin_ui"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/server_utils"
+	"github.com/pelicanplatform/pelican/utils"
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
+)
+
+var (
+	//go:embed resources/xrootd-origin.cfg
+	xrootdOriginCfg string
+	//go:embed resources/xrootd-cache.cfg
+	xrootdCacheCfg string
+	//go:embed resources/robots.txt
+	robotsTxt string
+
+	errBadKeyPair error = errors.New("Bad X509 keypair")
+)
+
+type (
+	OriginConfig struct {
+		Multiuser        bool
+		EnableCmsd       bool
+		EnableMacaroons  bool
+		EnableVoms       bool
+		EnableDirListing bool
+		SelfTest         bool
+		NamespacePrefix  string
+		Mode             string
+		S3Bucket         string
+		S3Region         string
+		S3ServiceName    string
+		S3ServiceUrl     string
+		S3AccessKeyfile  string
+		S3SecretKeyfile  string
+	}
+
+	CacheConfig struct {
+		UseCmsd        bool
+		EnableVoms     bool
+		ExportLocation string
+		DataLocation   string
+		DirectorUrl    string
+	}
+
+	XrootdOptions struct {
+		Port                   int
+		ManagerHost            string
+		ManagerPort            string
+		MacaroonsKeyFile       string
+		RobotsTxtFile          string
+		Sitename               string
+		SummaryMonitoringHost  string
+		SummaryMonitoringPort  int
+		DetailedMonitoringHost string
+		DetailedMonitoringPort int
+		RunLocation            string
+		Authfile               string
+		ScitokensConfig        string
+		Mount                  string
+		LocalMonitoringPort    int
+	}
+
+	ServerConfig struct {
+		TLSCertificate            string
+		TLSKey                    string
+		TLSCACertificateDirectory string
+		TLSCACertificateFile      string
+	}
+
+	XrootdConfig struct {
+		Server ServerConfig
+		Origin OriginConfig
+		Xrootd XrootdOptions
+		Cache  CacheConfig
+	}
+)
+
+func CheckOriginXrootdEnv(exportPath string, uid int, gid int, groupname string) (string, error) {
+	originMode := param.Origin_Mode.GetString()
+	if originMode == "posix" {
+		// If we use "volume mount" style options, configure the export directories.
+		volumeMount := param.Origin_ExportVolume.GetString()
+		if volumeMount != "" {
+			volumeMount, err := filepath.Abs(volumeMount)
+			if err != nil {
+				return exportPath, err
+			}
+			volumeMountSrc := volumeMount
+			volumeMountDst := volumeMount
+			volumeMountInfo := strings.SplitN(volumeMount, ":", 2)
+			if len(volumeMountInfo) == 2 {
+				volumeMountSrc = volumeMountInfo[0]
+				volumeMountDst = volumeMountInfo[1]
+			}
+			volumeMountDst = filepath.Clean(volumeMountDst)
+			if volumeMountDst == "" {
+				return exportPath, fmt.Errorf("export volume %v has empty destination path", volumeMount)
+			}
+			if volumeMountDst[0:1] != "/" {
+				return "", fmt.Errorf("export volume %v has a relative destination path",
+					volumeMountDst)
+			}
+			destPath := path.Clean(filepath.Join(exportPath, volumeMountDst[1:]))
+			err = config.MkdirAll(filepath.Dir(destPath), 0755, uid, gid)
+			if err != nil {
+				return exportPath, errors.Wrapf(err, "Unable to create export directory %v",
+					filepath.Dir(destPath))
+			}
+			err = os.Symlink(volumeMountSrc, destPath)
+			if err != nil {
+				return exportPath, errors.Wrapf(err, "Failed to create export symlink")
+			}
+			viper.Set("Origin.NamespacePrefix", volumeMountDst)
+		} else {
+			mountPath := param.Xrootd_Mount.GetString()
+			namespacePrefix := param.Origin_NamespacePrefix.GetString()
+			if mountPath == "" || namespacePrefix == "" {
+				return exportPath, errors.New(`
+	The origin should have parsed export information prior to this point, but has failed to do so.
+	Was the mount passed via the command line flag:
+
+		-v /mnt/foo:/bar
+
+	or via the parameters.yaml file:
+
+		# Option 1
+		Origin.ExportVolume: /mnt/foo:/bar
+
+		# Option 2
+		Xrootd
+			Mount: /mnt/foo
+		Origin:
+			NamespacePrefix: /bar
+				`)
+			}
+			mountPath, err := filepath.Abs(mountPath)
+			if err != nil {
+				return exportPath, err
+			}
+			mountPath = filepath.Clean(mountPath)
+			namespacePrefix = filepath.Clean(namespacePrefix)
+			if namespacePrefix[0:1] != "/" {
+				return exportPath, fmt.Errorf("namespace prefix %v must have an absolute path",
+					namespacePrefix)
+			}
+			destPath := path.Clean(filepath.Join(exportPath, namespacePrefix[1:]))
+			err = config.MkdirAll(filepath.Dir(destPath), 0755, uid, gid)
+			if err != nil {
+				return exportPath, errors.Wrapf(err, "Unable to create export directory %v",
+					filepath.Dir(destPath))
+			}
+			srcPath := filepath.Join(mountPath, namespacePrefix[1:])
+			err = os.Symlink(srcPath, destPath)
+			if err != nil {
+				return exportPath, errors.Wrapf(err, "Failed to create export symlink")
+			}
+		}
+		viper.Set("Xrootd.Mount", exportPath)
+	} else if originMode == "s3" {
+		// Our "namespace prefix" is actually just
+		// /<Origin.S3ServiceName>/<Origin.S3Region>/<Origin.S3Bucket>
+		nsPrefix := filepath.Join("/", param.Origin_S3ServiceName.GetString(),
+			param.Origin_S3Region.GetString(), param.Origin_S3Bucket.GetString())
+		viper.Set("Origin.NamespacePrefix", nsPrefix)
+	}
+
+	if param.Origin_SelfTest.GetBool() {
+		if err := origin_ui.ConfigureXrootdMonitoringDir(); err != nil {
+			return exportPath, err
+		}
+	}
+	// If macaroons secret does not exist, create one
+	macaroonsSecret := param.Xrootd_MacaroonsKeyFile.GetString()
+	if _, err := os.Open(macaroonsSecret); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			err = config.MkdirAll(path.Dir(macaroonsSecret), 0755, -1, gid)
+			if err != nil {
+				return exportPath, errors.Wrapf(err, "Unable to create directory %v",
+					path.Dir(macaroonsSecret))
+			}
+			file, err := os.OpenFile(macaroonsSecret, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0640)
+			if err != nil {
+				return exportPath, errors.Wrap(err, "Failed to create a new macaroons key")
+			}
+			defer file.Close()
+			buf := make([]byte, 64)
+			_, err = rand.Read(buf)
+			if err != nil {
+				return exportPath, err
+			}
+			encoded := base64.StdEncoding.EncodeToString(buf) + "\n"
+			if _, err = file.WriteString(encoded); err != nil {
+				return exportPath, errors.Wrap(err, "Failed to write out a macaroons key")
+			}
+		} else {
+			return exportPath, err
+		}
+	}
+	if err := os.Chown(macaroonsSecret, -1, gid); err != nil {
+		return exportPath, errors.Wrapf(err, "Unable to change ownership of macaroons secret %v"+
+			" to desired daemon group %v", macaroonsSecret, groupname)
+	}
+	// If the scitokens.cfg does not exist, create one
+	// Set up exportedPaths, which we later use to grant access to the origin's issuer.
+	exportedPaths := viper.GetStringSlice("Origin.NamespacePrefix")
+	if err := WriteOriginScitokensConfig(exportedPaths); err != nil {
+		return exportPath, errors.Wrap(err, "Failed to create scitokens configuration for the origin")
+	}
+
+	if err := origin_ui.ConfigureXrootdMonitoringDir(); err != nil {
+		return exportPath, err
+	}
+
+	return exportPath, nil
+}
+
+func CheckCacheXrootdEnv(exportPath string, uid int, gid int, nsAds []director.NamespaceAd) (string, error) {
+	viper.Set("Xrootd.Mount", exportPath)
+	filepath.Join(exportPath, "/")
+	err := config.MkdirAll(exportPath, 0775, uid, gid)
+	if err != nil {
+		return "", errors.Wrapf(err, "Unable to create export directory %v",
+			filepath.Dir(exportPath))
+	}
+	dataPath := filepath.Join(param.Cache_DataLocation.GetString(), "data/")
+	dataPath = filepath.Clean(dataPath)
+	err = config.MkdirAll(dataPath, 0775, uid, gid)
+	if err != nil {
+		return "", errors.Wrapf(err, "Unable to create data directory %v",
+			filepath.Dir(dataPath))
+	}
+	metaPath := filepath.Join(param.Cache_DataLocation.GetString(), "meta/")
+	metaPath = filepath.Clean(metaPath)
+	err = config.MkdirAll(metaPath, 0775, uid, gid)
+	if err != nil {
+		return "", errors.Wrapf(err, "Unable to create meta directory %v",
+			filepath.Dir(metaPath))
+	}
+
+	err = config.DiscoverFederation()
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to pull information from the federation")
+	}
+	viper.Set("Cache.DirectorUrl", param.Federation_DirectorUrl.GetString())
+
+	if err := WriteCacheScitokensConfig(nsAds); err != nil {
+		return "", errors.Wrap(err, "Failed to create scitokens configuration for the cache")
+	}
+
+	return exportPath, nil
+}
+
+func CheckXrootdEnv(server server_utils.XRootDServer) error {
+	uid, err := config.GetDaemonUID()
+	if err != nil {
+		return err
+	}
+	gid, err := config.GetDaemonGID()
+	if err != nil {
+		return err
+	}
+	username, err := config.GetDaemonUser()
+	if err != nil {
+		return err
+	}
+	groupname, err := config.GetDaemonGroup()
+	if err != nil {
+		return err
+	}
+
+	// Ensure the runtime directory exists
+	runtimeDir := param.Xrootd_RunLocation.GetString()
+	err = config.MkdirAll(runtimeDir, 0755, uid, gid)
+	if err != nil {
+		return errors.Wrapf(err, "Unable to create runtime directory %v", runtimeDir)
+	}
+	if err = os.Chown(runtimeDir, uid, -1); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of runtime directory %v"+
+			" to desired daemon user %v", runtimeDir, username)
+	}
+
+	// The scitokens library will write its JWKS cache into the user's home direct by
+	// default.  By setting $XDG_CACHE_HOME, we move the JWKS cache into our runtime dir.
+	// This makes the Pelican instance more self-contained inside the runtime dir -- and two
+	// Pelican instances (such as parallel unit tests) don't end up sharing the JWKS caches,
+	// or sharing JWKS caches between test runs
+	cacheDir := filepath.Join(runtimeDir, "jwksCache")
+	if err = config.MkdirAll(cacheDir, 0700, uid, gid); err != nil {
+		return errors.Wrapf(err, "Unable to create cache directory %v", cacheDir)
+	}
+	if err = os.Chown(cacheDir, uid, -1); err != nil {
+		return errors.Wrapf(err, "Unable to change ownership of the cache directory %v"+
+			" to desired daemon user %v", cacheDir, username)
+	}
+	if err = os.Setenv("XDG_CACHE_HOME", cacheDir); err != nil {
+		return errors.Wrap(err, "Unable to set $XDG_CACHE_HOME for scitokens library")
+	}
+
+	exportPath := filepath.Join(runtimeDir, "export")
+	if _, err := os.Stat(exportPath); err == nil {
+		if err = os.RemoveAll(exportPath); err != nil {
+			return errors.Wrap(err, "Failure when cleaning up temporary export tree")
+		}
+	}
+
+	if err = CopyXrootdCertificates(); err != nil {
+		return err
+	}
+
+	if server.GetServerType().IsEnabled(config.OriginType) {
+		exportPath, err = CheckOriginXrootdEnv(exportPath, uid, gid, groupname)
+	} else {
+		exportPath, err = CheckCacheXrootdEnv(exportPath, uid, gid, server.GetNamespaceAds())
+	}
+	if err != nil {
+		return err
+	}
+
+	if err = EmitIssuerMetadata(exportPath); err != nil {
+		return err
+	}
+
+	// If no robots.txt, create a ephemeral one for xrootd to use
+	robotsTxtFile := param.Xrootd_RobotsTxtFile.GetString()
+	if _, err := os.Open(robotsTxtFile); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			newPath := filepath.Join(runtimeDir, "robots.txt")
+			err = config.MkdirAll(path.Dir(newPath), 0755, -1, gid)
+			if err != nil {
+				return errors.Wrapf(err, "Unable to create directory %v",
+					path.Dir(newPath))
+			}
+			file, err := os.OpenFile(newPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+			if err != nil {
+				return errors.Wrap(err, "Failed to create a default robots.txt file")
+			}
+			defer file.Close()
+			if _, err := file.WriteString(robotsTxt); err != nil {
+				return errors.Wrap(err, "Failed to write out a default robots.txt file")
+			}
+			viper.Set("Xrootd.RobotsTxtFile", newPath)
+		} else {
+			return err
+		}
+	}
+
+	// If the authfile does not exist, create one.
+	authfile := param.Xrootd_Authfile.GetString()
+	err = config.MkdirAll(path.Dir(authfile), 0755, -1, gid)
+	if err != nil {
+		return errors.Wrapf(err, "Unable to create directory %v",
+			path.Dir(authfile))
+	}
+	// For user-provided authfile, we don't chmod to daemon group as EmitAuthfile will
+	// make a copy of it and save it to xrootd run location
+	if file, err := os.OpenFile(authfile, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0640); err == nil {
+		file.Close()
+	} else if !errors.Is(err, os.ErrExist) {
+		return err
+	}
+	if err := EmitAuthfile(server); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Copies the server certificate/key files into the XRootD runtime
+// directory.  Combines the two files into a single one so the new
+// certificate shows up atomically from XRootD's perspective.
+// Adjusts the ownership and mode to match that expected
+// by the XRootD framework.
+func CopyXrootdCertificates() error {
+	user, err := config.GetDaemonUserInfo()
+	if err != nil {
+		return errors.Wrap(err, "Unable to copy certificates to xrootd runtime directory; failed xrootd user lookup")
+	}
+
+	certFile := param.Server_TLSCertificate.GetString()
+	certKey := param.Server_TLSKey.GetString()
+	if _, err = tls.LoadX509KeyPair(certFile, certKey); err != nil {
+		return builtin_errors.Join(err, errBadKeyPair)
+	}
+
+	destination := filepath.Join(param.Xrootd_RunLocation.GetString(), "copied-tls-creds.crt")
+	tmpName := destination + ".tmp"
+	destFile, err := os.OpenFile(tmpName, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fs.FileMode(0400))
+	if err != nil {
+		return errors.Wrap(err, "Failure when opening temporary certificate key pair file for xrootd")
+	}
+	defer destFile.Close()
+
+	if err = os.Chown(tmpName, user.Uid, user.Gid); err != nil {
+		return errors.Wrap(err, "Failure when chown'ing certificate key pair file for xrootd")
+	}
+
+	srcFile, err := os.Open(param.Server_TLSCertificate.GetString())
+	if err != nil {
+		return errors.Wrap(err, "Failure when opening source certificate for xrootd")
+	}
+	defer srcFile.Close()
+
+	if _, err = io.Copy(destFile, srcFile); err != nil {
+		return errors.Wrapf(err, "Failure when copying source certificate for xrootd")
+	}
+
+	if _, err = destFile.Write([]byte{'\n', '\n'}); err != nil {
+		return errors.Wrap(err, "Failure when writing into copied key pair for xrootd")
+	}
+
+	srcKeyFile, err := os.Open(param.Server_TLSKey.GetString())
+	if err != nil {
+		return errors.Wrap(err, "Failure when opening source key for xrootd")
+	}
+	defer srcKeyFile.Close()
+
+	if _, err = io.Copy(destFile, srcKeyFile); err != nil {
+		return errors.Wrapf(err, "Failure when copying source key for xrootd")
+	}
+
+	if err = os.Rename(tmpName, destination); err != nil {
+		return errors.Wrapf(err, "Failure when moving key pair for xrootd")
+	}
+
+	return nil
+}
+
+// Launch a separate goroutine that performs the XRootD maintenance tasks.
+// For maintenance that is periodic, `sleepTime` is the maintenance period.
+func LaunchXrootdMaintenance(ctx context.Context, server server_utils.XRootDServer, sleepTime time.Duration) {
+	server_utils.LaunchWatcherMaintenance(
+		ctx,
+		[]string{
+			filepath.Dir(param.Server_TLSCertificate.GetString()),
+			filepath.Dir(param.Xrootd_Authfile.GetString()),
+			filepath.Dir(param.Xrootd_ScitokensConfig.GetString()),
+		},
+		"xrootd maintenance",
+		sleepTime,
+		func(notifyEvent bool) error {
+			err := CopyXrootdCertificates()
+			if notifyEvent && errors.Is(err, errBadKeyPair) {
+				log.Debugln("Bad keypair encountered when doing xrootd certificate maintenance:", err)
+				return nil
+			} else {
+				log.Debugln("Successfully updated the Xrootd TLS certificates")
+			}
+			lastErr := err
+			if err := EmitAuthfile(server); err != nil {
+				if lastErr != nil {
+					log.Errorln("Failure when generating authfile:", err)
+				}
+				lastErr = err
+			} else {
+				log.Debugln("Successfully updated the Xrootd authfile")
+			}
+			if err := EmitScitokensConfig(server); err != nil {
+				if lastErr != nil {
+					log.Errorln("Failure when emitting the scitokens.cfg:", err)
+				}
+				lastErr = err
+			} else {
+				log.Debugln("Successfully updated the Xrootd scitokens configuration")
+			}
+			return lastErr
+		},
+	)
+}
+
+func ConfigXrootd(ctx context.Context, origin bool) (string, error) {
+	gid, err := config.GetDaemonGID()
+	if err != nil {
+		return "", err
+	}
+
+	var xrdConfig XrootdConfig
+	xrdConfig.Xrootd.LocalMonitoringPort = -1
+	if err := viper.Unmarshal(&xrdConfig); err != nil {
+		return "", err
+	}
+
+	runtimeCAs := filepath.Join(param.Xrootd_RunLocation.GetString(), "ca-bundle.crt")
+	caCount, err := utils.LaunchPeriodicWriteCABundle(ctx, runtimeCAs, 2*time.Minute)
+	if err != nil {
+		return "", errors.Wrap(err, "Failed to setup the runtime CA bundle")
+	}
+	log.Debugf("A total of %d CA certificates were written", caCount)
+	if caCount > 0 {
+		xrdConfig.Server.TLSCACertificateFile = runtimeCAs
+	}
+
+	if origin {
+		if xrdConfig.Origin.Multiuser {
+			ok, err := config.HasMultiuserCaps()
+			if err != nil {
+				return "", errors.Wrap(err, "Failed to determine if the origin can run in multiuser mode")
+			}
+			if !ok {
+				return "", errors.New("Origin.Multiuser is set to `true` but the command was run without sufficient privilege; was it launched as root?")
+			}
+		}
+	} else if xrdConfig.Cache.DirectorUrl != "" {
+		// Workaround for a bug in XRootD 5.6.3: if the director URL is missing a port number, then
+		// XRootD crashes.
+		urlParsed, err := url.Parse(xrdConfig.Cache.DirectorUrl)
+		if err != nil {
+			return "", errors.Errorf("Director URL (%s) does not parse as a URL", xrdConfig.Cache.DirectorUrl)
+		}
+		if !strings.Contains(urlParsed.Host, ":") {
+			switch urlParsed.Scheme {
+			case "http":
+				urlParsed.Host += ":80"
+			case "https":
+				urlParsed.Host += ":443"
+			default:
+				log.Warningf("The Director URL (%s) does not contain an explicit port number; XRootD 5.6.3 and earlier are known to segfault in thie case", xrdConfig.Cache.DirectorUrl)
+			}
+			xrdConfig.Cache.DirectorUrl = urlParsed.String()
+		}
+	}
+
+	var xrootdCfg string
+	if origin {
+		xrootdCfg = xrootdOriginCfg
+	} else {
+		xrootdCfg = xrootdCacheCfg
+	}
+
+	templ := template.Must(template.New("xrootd.cfg").Parse(xrootdCfg))
+
+	xrootdRun := param.Xrootd_RunLocation.GetString()
+	configPath := filepath.Join(xrootdRun, "xrootd.cfg")
+	file, err := os.OpenFile(configPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
+	if err != nil {
+		return "", err
+	}
+	if err = os.Chown(configPath, -1, gid); err != nil {
+		return "", errors.Wrapf(err, "Unable to change ownership of configuration file %v"+
+			" to desired daemon gid %v", configPath, gid)
+	}
+
+	defer file.Close()
+
+	err = templ.Execute(file, xrdConfig)
+	if err != nil {
+		return "", err
+	}
+
+	if log.IsLevelEnabled(log.DebugLevel) {
+		buffer := new(bytes.Buffer)
+		err = templ.Execute(buffer, xrdConfig)
+		if err != nil {
+			return "", err
+		}
+		log.Debugln("XRootD configuration file contents:\n", buffer.String())
+	}
+
+	return configPath, nil
+}
+
+// Set up xrootd monitoring
+//
+// The `ctx` is the context for listening to server shutdown event in order to cleanup internal cache eviction
+// goroutine and `wg` is the wait group to notify when the clean up goroutine finishes
+func SetUpMonitoring(ctx context.Context, egrp *errgroup.Group) error {
+	monitorPort, err := metrics.ConfigureMonitoring(ctx, egrp)
+	if err != nil {
+		return err
+	}
+
+	viper.Set("Xrootd.LocalMonitoringPort", monitorPort)
+
+	return nil
+}
diff --git a/xrootd/xrootd_config_test.go b/xrootd/xrootd_config_test.go
new file mode 100644
index 000000000..7cc45e980
--- /dev/null
+++ b/xrootd/xrootd_config_test.go
@@ -0,0 +1,252 @@
+//go:build !windows
+
+/***************************************************************
+ *
+ * Copyright (C) 2023, Pelican Project, Morgridge Institute for Research
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you
+ * may not use this file except in compliance with the License.  You may
+ * obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ***************************************************************/
+
+package xrootd
+
+import (
+	"bytes"
+	"context"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pelicanplatform/pelican/config"
+	"github.com/pelicanplatform/pelican/origin_ui"
+	"github.com/pelicanplatform/pelican/param"
+	"github.com/pelicanplatform/pelican/test_utils"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestXrootDOriginConfig(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Xrootd.RunLocation", dirname)
+	configPath, err := ConfigXrootd(ctx, true)
+	require.NoError(t, err)
+	assert.NotNil(t, configPath)
+}
+
+func TestXrootDCacheConfig(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	dirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Xrootd.RunLocation", dirname)
+	configPath, err := ConfigXrootd(ctx, false)
+	require.NoError(t, err)
+	assert.NotNil(t, configPath)
+}
+
+func TestUpdateAuth(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	runDirname := t.TempDir()
+	configDirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Logging.Level", "Debug")
+	viper.Set("Xrootd.RunLocation", runDirname)
+	viper.Set("ConfigDir", configDirname)
+	authfileName := filepath.Join(configDirname, "authfile")
+	viper.Set("Xrootd.Authfile", authfileName)
+	scitokensName := filepath.Join(configDirname, "scitokens.cfg")
+	viper.Set("Xrootd.ScitokensConfig", scitokensName)
+	viper.Set("Origin.NamespacePrefix", "/test")
+	config.InitConfig()
+
+	err := config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+
+	scitokensCfgDemo := `
+[Issuer DEMO]
+issuer = https://demo.scitokens.org
+base_path = /test1
+default_user = user1
+`
+	scitokensCfgDemo2 := `
+[Issuer DEMO2]
+issuer = https://demo2.scitokens.org
+base_path = /test2
+default_user = user2
+`
+
+	authfileFooter := "u * /.well-known lr\n"
+	authfileDemo := "u testing /test3 lr\n"
+	authfileDemo2 := `u testing /test4 lr`
+
+	err = os.WriteFile(scitokensName, []byte(scitokensCfgDemo), fs.FileMode(0600))
+	require.NoError(t, err)
+	err = os.WriteFile(authfileName, []byte(authfileDemo), fs.FileMode(0600))
+	require.NoError(t, err)
+
+	server := &origin_ui.OriginServer{}
+	err = EmitScitokensConfig(server)
+	require.NoError(t, err)
+
+	err = EmitAuthfile(server)
+	require.NoError(t, err)
+
+	destScitokensName := filepath.Join(param.Xrootd_RunLocation.GetString(), "scitokens-origin-generated.cfg")
+	assert.FileExists(t, destScitokensName)
+	destAuthfileName := filepath.Join(param.Xrootd_RunLocation.GetString(), "authfile-origin-generated")
+	assert.FileExists(t, destAuthfileName)
+
+	scitokensContents, err := os.ReadFile(destScitokensName)
+	require.NoError(t, err)
+	assert.True(t, strings.Contains(string(scitokensContents), scitokensCfgDemo))
+
+	authfileContents, err := os.ReadFile(destAuthfileName)
+	require.NoError(t, err)
+	assert.Equal(t, authfileDemo+authfileFooter, string(authfileContents))
+
+	LaunchXrootdMaintenance(ctx, server, 2*time.Hour)
+
+	err = os.WriteFile(scitokensName+".tmp", []byte(scitokensCfgDemo2), fs.FileMode(0600))
+	require.NoError(t, err)
+	err = os.Rename(scitokensName+".tmp", scitokensName)
+	require.NoError(t, err)
+
+	waitForCopy := func(name, sampleContents string) bool {
+		for idx := 0; idx < 10; idx++ {
+			time.Sleep(50 * time.Millisecond)
+			log.Debug("Re-reading destination file")
+			destContents, err := os.ReadFile(name)
+			require.NoError(t, err)
+			if strings.Contains(string(destContents), sampleContents) {
+				return true
+			}
+			log.Debugln("Destination contents:", string(destContents))
+		}
+		return false
+	}
+
+	assert.True(t, waitForCopy(destScitokensName, scitokensCfgDemo2))
+
+	err = os.WriteFile(authfileName+".tmp", []byte(authfileDemo2), fs.FileMode(0600))
+	require.NoError(t, err)
+	err = os.Rename(authfileName+".tmp", authfileName)
+	require.NoError(t, err)
+	assert.True(t, waitForCopy(destAuthfileName, authfileDemo2))
+}
+
+func TestCopyCertificates(t *testing.T) {
+	ctx, cancel, egrp := test_utils.TestContext(context.Background(), t)
+	defer func() { require.NoError(t, egrp.Wait()) }()
+	defer cancel()
+
+	runDirname := t.TempDir()
+	configDirname := t.TempDir()
+	viper.Reset()
+	viper.Set("Logging.Level", "Debug")
+	viper.Set("Xrootd.RunLocation", runDirname)
+	viper.Set("ConfigDir", configDirname)
+	config.InitConfig()
+
+	// First, invoke CopyXrootdCertificates directly, ensure it works.
+	err := CopyXrootdCertificates()
+	assert.ErrorIs(t, err, errBadKeyPair)
+
+	err = config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+	err = config.MkdirAll(path.Dir(param.Xrootd_Authfile.GetString()), 0755, -1, -1)
+	require.NoError(t, err)
+	err = CopyXrootdCertificates()
+	require.NoError(t, err)
+	destKeyPairName := filepath.Join(param.Xrootd_RunLocation.GetString(), "copied-tls-creds.crt")
+	assert.FileExists(t, destKeyPairName)
+
+	keyPairContents, err := os.ReadFile(destKeyPairName)
+	require.NoError(t, err)
+	certName := param.Server_TLSCertificate.GetString()
+	firstCertContents, err := os.ReadFile(certName)
+	require.NoError(t, err)
+	keyName := param.Server_TLSKey.GetString()
+	firstKeyContents, err := os.ReadFile(keyName)
+	require.NoError(t, err)
+	firstKeyPairContents := append(firstCertContents, '\n', '\n')
+	firstKeyPairContents = append(firstKeyPairContents, firstKeyContents...)
+	assert.True(t, bytes.Equal(firstKeyPairContents, keyPairContents))
+
+	err = os.Rename(certName, certName+".orig")
+	require.NoError(t, err)
+
+	err = CopyXrootdCertificates()
+	assert.ErrorIs(t, err, errBadKeyPair)
+
+	err = os.Rename(keyName, keyName+".orig")
+	require.NoError(t, err)
+
+	err = config.InitServer(ctx, config.OriginType)
+	require.NoError(t, err)
+
+	err = CopyXrootdCertificates()
+	require.NoError(t, err)
+
+	secondKeyPairContents, err := os.ReadFile(destKeyPairName)
+	require.NoError(t, err)
+	assert.False(t, bytes.Equal(firstKeyPairContents, secondKeyPairContents))
+
+	originServer := &origin_ui.OriginServer{}
+	LaunchXrootdMaintenance(ctx, originServer, 2*time.Hour)
+
+	// Helper function to wait for a copy of the first cert to show up
+	// in the destination
+	waitForCopy := func() bool {
+		for idx := 0; idx < 10; idx++ {
+			time.Sleep(50 * time.Millisecond)
+			log.Debug("Re-reading destination cert")
+			destContents, err := os.ReadFile(destKeyPairName)
+			require.NoError(t, err)
+			if bytes.Equal(destContents, firstKeyPairContents) {
+				return true
+			}
+		}
+		return false
+	}
+
+	// The maintenance thread should only copy if there's a valid keypair
+	// Thus, if we only copy one, we shouldn't see any changes
+	err = os.Rename(certName+".orig", certName)
+	require.NoError(t, err)
+	log.Debug("Will wait to see if the new certs are not copied")
+	assert.False(t, waitForCopy())
+
+	// Now, if we overwrite the key, the maintenance thread should notice
+	// and overwrite the destination
+	err = os.Rename(keyName+".orig", keyName)
+	require.NoError(t, err)
+	log.Debug("Will wait to see if the new certs are copied")
+	assert.True(t, waitForCopy())
+
+}