diff --git a/ada/ada b/ada/ada
index 9d269d9..b4fdb5a 100755
--- a/ada/ada
+++ b/ada/ada
@@ -7,6 +7,7 @@
 # Latest version is available at: https://github.com/sara-nl/SpiderScripts
 #
 # Changes:
+# 2025-01-14 - Onno    - Add support for extended attributes
 # 2024-12-30 - Onno    - Add support for labels
 # 2024-12-27 - Onno    - Improved token validation
 # 2024-12-12 - Haili   - Implement unit testing
@@ -100,12 +101,6 @@ usage() {
 	  --mv <file|directory> <destination>
 	      Rename or move a file or directory.
 
-	  --setlabel <file> <label>
-	      Attach a label to a file.
-
-	  --rmlabel <file> <label>
-	      Remove a label from a file.
-
 	  --delete <file|directory> [--recursive [--force]]
 	      Delete a file or directory.
 	      To recursively delete a directory and ALL of its
@@ -114,6 +109,41 @@ usage() {
 	      Please note, that dCache storage systems usually
 	      don't have an undelete option.
 
+	  --setlabel <file> <label>
+	      Attach a label to a file.
+	  --rmlabel <file> <label>
+	  --rmlabel <file> --all
+	      Remove one or all label from a file.
+	  --lslabel <file> [label]
+	      List labels of a file.
+	      If label is provided, only list that label.
+	  --findlabel <directory> <label> [--recursive]
+	      Find files in this directory that have this label.
+	      If --recursive is specified, search also in
+	      subdirectories.
+
+	  --setxattr <file> <file-with-attributes>
+	      Add extended attributes to a file.
+	      This will read the extended attributes from a file,
+	      or from stdin if no file, or a '-', is specified.
+	      The attributes should be a list of key-value pairs
+	      separated by an equal sign (=), a comma (,) or a tab,
+	      or it can be a JSON object.
+	  --rmxattr <file> <key>
+	  --rmxattr <file> --all
+	      Remove one or all key-value pairs from the extended
+	      attributes.
+	  --lsxattr <file> [key]
+	      List extended attributes of a file.
+	      If key is provided, only list that key-value pair.
+	  --findxattr <directory> <key> <value> [--recursive]
+	  --findxattr <directory> --all <value> [--recursive]
+	      Find files in the directory that match the key-value pair.
+	      The value is a regular expression (example: '^keyword$').
+	      If --all is specified, search in all attributes.
+	      If --recursive is specified, search also in
+	      subdirectories.
+
 	  --checksum <file>
 	      Show MD5/Adler32 checksums for file.
 	  --checksum <directory> [--recursive]
@@ -407,10 +437,85 @@ get_args() {
         label="$3"
         shift ; shift ; shift
         ;;
+      --lslabel )
+        command='lslabel'
+        path="$2"
+        shift ; shift
+        # Optinal argument: a label the user wants to see.
+        case $1 in
+          --* | '' )
+            # Next argument is another option or absent; not a label.
+            ;;
+          * )
+            # This must be a label
+            label="$1"
+            shift
+            ;;
+        esac
+        ;;
       --findlabel )
         command='findlabel'
+        path=$(echo "$2" | sed 's:/*$::')
+        regex="$3"
+        shift ; shift ; shift
+        ;;
+      --setxattr )
+        command='setxattr'
         path="$2"
-        label="$3"
+        shift ; shift
+        # Optinal argument: filename containing the attributes (or - for stdin)
+        case $1 in
+          --* | '' )
+            # Next argument is another option or absent; not a file name.
+            # We will read attributes from stdin.
+            echo "No file with attributes specified. Will read attributes from stdin."
+            xattr_file='/dev/stdin'
+            ;;
+          - )
+            # User wants to read attributes from stdin.
+            xattr_file='/dev/stdin'
+            shift
+            ;;
+          * )
+            # This must be a file name
+            if [ -f "$1" ] ; then
+              xattr_file="$1"
+            else
+              echo 1>&2 "ERROR: Can't read attributes from file '$1'. Does it exist?"
+              exit 1
+            fi
+            shift
+            ;;
+        esac
+        ;;
+      --lsxattr )
+        command='lsxattr'
+        path="$2"
+        shift ; shift
+        # Optinal argument: name of an attribute
+        case $1 in
+          --* | '' )
+            # Next argument is another option or absent; not an attribute name.
+            ;;
+          * )
+            # This must be an attribute name
+            attribute_name="$1"
+            shift
+            ;;
+        esac
+        ;;
+      --findxattr )
+        command='findxattr'
+        # Strip trailing slashes
+        path=$(echo "$2" | sed 's:/*$::')
+        attribute_name="$3"
+        regex="$4"
+        shift ; shift ; shift ; shift
+        ;;
+      --rmxattr )
+        command='rmxattr'
+        path="$2"
+        attribute_name="$3"
         shift ; shift ; shift
         ;;
       --checksum )
@@ -520,7 +625,7 @@ get_args() {
 
 
 #
-# Define internal functions ada needs 
+# Define internal functions ada needs
 #
 
 
@@ -553,7 +658,7 @@ view_token() {
     if [ -z "$macaroon_decoded" ]; then
       echo "Invalid macaroon: cannot decode"
       return 1
-  fi
+    fi
 
     # Show macaroon without signature
     echo -e "\033[34m\n$macaroon_decoded\n\033[0m" | grep -v 'signature' | sed -e 's/^/  /'
@@ -576,8 +681,8 @@ check_token() {
     if [ -z "$payload" ]; then
       echo 1>&2 "ERROR: Invalid token: cannot decode payload"
       echo 1>&2 "$token_debug_info"
-        return 1
-      fi
+      return 1
+    fi
 
     # Extract expiration time (exp) from payload
     exp=$(echo "$payload" | jq -r '.exp' 2>/dev/null)
@@ -689,15 +794,28 @@ pathtype () {
   # REGULAR = file
   # LINK    = symbolic link
   # <empty> = something went wrong... no permission?
-  local path=$(urlencode "$1")
-  command='curl "${curl_authorization[@]}" \
-       "${curl_options_no_errors[@]}" \
-       -X GET "$api/namespace/$path" \
-  | jq -r .fileType'
+  local result
+  encoded_path=$(urlencode "$1")
+  command='$debug && set -x
+          curl "${curl_authorization[@]}" \
+          -H "accept: application/json" \
+          --silent \
+          -X GET "$api/namespace/$encoded_path"'
   if $dry_run ; then
     echo "$command"
   else
-    eval "$command"
+    result=$(eval "$command")
+    valid=$(echo "$result" | jq 'has("fileType")')
+    if [[ $valid == 'true' ]] ; then
+      echo "$result" | jq -r .fileType
+    else
+      # Something went wrong. The result should contain an error message in JSON format.
+      {
+        echo "Error while getting information about '$path':"
+        echo "$result" | jq .
+      } 1>&2
+      exit 1
+    fi
   fi
 }
 
@@ -783,6 +901,115 @@ dir_has_items () {
 }
 
 
+find_label () {
+  local path
+  local regex
+  local recursive
+  path="$1"
+  regex="$2"
+  recursive="$3"
+  encoded_path=$(urlencode "$path")
+  # We can only search dirs. Searching a file doesn't make sense, because we have found it.
+  if [[ $(pathtype $path) == "REGULAR" ]] ; then
+    echo 1>&2 "ERROR: $path is a file. Please specify a directory."
+    exit 1
+  fi
+  # We search for files in this dir with a label that matches the regex.
+  (
+    $debug && set -x
+    curl "${curl_authorization[@]}" \
+         "${curl_options_common[@]}" \
+         -X GET "$api/namespace/$encoded_path?children=true&labels=true" \
+    | jq -r \
+         --arg path "$path/" \
+         --arg regex "$regex" \
+         '.children[]
+          | {fileName: ($path + .fileName), matchingLabels: ([.labels[]? | select(test($regex))])}
+          | select(.matchingLabels | length > 0)
+          | [ .fileName, (.matchingLabels | join(",")) ]
+          | @tsv'
+  )
+  #
+  # If recursion was requested, we search for subdirs in $path, and do the same thing.
+  if $recursive ; then
+    for subdir in $(get_subdirs "$path") ; do
+      find_label "$path/$subdir" "$regex" "$recursive"
+    done
+  fi
+}
+
+
+find_xattr () {
+  local path
+  local attribute_name
+  local regex
+  local recursive
+  path="$1"
+  attribute_name="$2"
+  regex="$3"
+  recursive="$4"
+  encoded_path=$(urlencode "$path")
+  # We can only search dirs. Searching a file doesn't make sense, because we have found it.
+  if [[ $(pathtype "$path") == "REGULAR" ]] ; then
+    echo 1>&2 "ERROR: '$path' is a file. Please specify a directory."
+    exit 1
+  fi
+  # We search for files in this dir with a attribute value that matches the regex.
+  if [[ $attribute_name == '--all' ]] ; then
+    (
+      $debug && set -x
+      curl "${curl_authorization[@]}" \
+           "${curl_options_common[@]}" \
+           -X GET "$api/namespace/$encoded_path?children=true&xattr=true" \
+      | jq -r \
+           --arg  path "$path/" \
+           --arg  regex "$regex" \
+           '
+             .children[]
+             | select(.extendedAttributes | to_entries | any(.value | test($regex)))
+             | [
+                 ($path + .fileName),
+                 (.extendedAttributes | to_entries | map(select(.value | test($regex)) | "\(.key)=\(.value)") | join(", "))
+               ]
+             | @tsv
+           '
+    )
+  else
+    # Searching for a value of a specific attribute
+    (
+      $debug && set -x
+      curl "${curl_authorization[@]}" \
+           "${curl_options_common[@]}" \
+           -X GET "$api/namespace/$encoded_path?children=true&xattr=true" \
+      | jq -r \
+           --arg attr_name "$attribute_name" \
+           --arg path "$path/" \
+           --arg regex "$regex" \
+           '
+             .children[]
+             | select(
+                 .extendedAttributes[$attr_name] != null
+                 and (.extendedAttributes[$attr_name] | type == "string")
+                 and (.extendedAttributes[$attr_name] | test($regex))
+               )
+             | [
+                 ($path + .fileName),
+                 "\($attr_name)=\(.extendedAttributes[$attr_name])"
+               ]
+             | @tsv
+           '
+    )
+  fi
+  #
+  # If recursion was requested, we search for subdirs in $path, and do the same thing.
+  if $recursive ; then
+    for subdir in $(get_subdirs "$path") ; do
+      find_xattr "$path/$subdir" "$attribute_name" "$regex" "$recursive"
+    done
+  fi
+}
+
+
 get_confirmation () {
   prompt="$1"
   while true ; do
@@ -929,10 +1156,12 @@ bulk_request() {
         expand=NONE
         ;;
       '' )
-        echo "Warning: could not determine object type of '$filepath'."
+        echo "ERROR: could not determine object type of '$filepath'." 1>&2
+        exit 1
         ;;
       * )
-        echo "Unknown object type '$type'. Please create an issue for this in Github."
+        echo "Unknown object type '$type'. Please create an issue for this in Github." 1>&2
+        exit 1
         ;;
     esac
   else
@@ -1335,6 +1564,51 @@ get_dcache_versions () {
 }
 
 
+to_json () {
+  # Analyze metadata and convert it to JSON so we can feed it to "set-xattr"
+  #
+  # This function handles key-value pair input with various delimiters.
+  # It will first detect which delimiter is being used (equal sign, comma or tab)
+  #
+  # Is it empty?
+  if [ -z "$1" ] ; then
+    echo "ERROR: Provided metadata is empty. Nothing to do."
+    exit 1
+  fi
+  # Is it JSON?
+  if echo "$1" | jq empty > /dev/null 2>&1 ; then
+    # It is already JSON. No need to convert! Just compact it to one line.
+    echo "$1" | jq --compact-output .
+    return 0
+  fi
+  # We need to know which is the delimiter of the input data.
+  # Each line must have such a delimiter, otherwise it can't be the right delimiter.
+  # Test: If we remove all lines containing the delimiter, is the result empty?
+  if ! echo "$1" | grep --silent -v '=' ; then
+    delimiter='='
+  elif ! echo "$1" | grep --silent -v $'\t' ; then
+    delimiter=$'\t'
+  elif ! echo "$1" | grep --silent -v ',' ; then
+    delimiter=','
+  else
+    echo "ERROR: unable to detect the format of the provided metadata."
+    exit 1
+  fi
+  echo "$1" | awk -F "$delimiter" '
+    {
+      # Split the line based on the delimiter
+      split($0, a, FS)
+      # Trim whitespace
+      gsub(/^[ \t]+|[ \t]+$/, "", a[1])
+      gsub(/^[ \t]+|[ \t]+$/, "", a[2])
+      # Remove surrounding quotes
+      gsub(/^["'"'"']|["'"'"']$/, "", a[1])
+      gsub(/^["'"'"']|["'"'"']$/, "", a[2])
+      # Print key-value pairs in JSON format
+      print "{ \"" a[1] "\": \"" a[2] "\" }"
+    }
+  ' | jq --slurp --compact-output add
+}
 #
 # End of internal functions
 #
@@ -1442,7 +1716,10 @@ validate_input() {
   esac
 
   case $command in
-    list | stat | mkdir | mv | delete | events | report-staged )
+    list | stat | mkdir | mv | delete | \
+    setlabel | lslabel | findlabel | rmlabel | \
+    setxattr | lsxattr | findxattr | rmxattr | \
+    events | report-staged )
       if [[ -z $path || $path =~ ^-- ]] ; then
         echo 1>&2 "ERROR: command $command requires a path."
         exit 1
@@ -1454,6 +1731,28 @@ validate_input() {
             exit 1
           fi
           ;;
+        setlabel | rmlabel )
+          if [[ -z $label || $label =~ ^-- ]] ; then
+            echo 1>&2 "ERROR: command $command requires a label."
+            exit 1
+          fi
+          ;;
+        findlabel )
+          if [[ -z $regex || $regex =~ ^-- ]] ; then
+            echo 1>&2 "ERROR: command $command requires a regular expression."
+            exit 1
+          fi
+          ;;
+        findxattr )
+          if [[ -z $attribute_name ]] ; then
+            echo 1>&2 "ERROR: command $command requires an attribute name, or '--all' to search through all attribute values."
+            exit 1
+          fi
+          if [[ -z $regex || $regex =~ ^-- ]] ; then
+            echo 1>&2 "ERROR: command $command requires a regular expression."
+            exit 1
+          fi
+          ;;
         events )
           if [[ -z $channelname || $channelname =~ ^-- ]] ; then
             echo 1>&2 "ERROR: command $command requires a channel name."
@@ -1468,12 +1767,19 @@ validate_input() {
         exit 1
       fi
       ;;
+    viewtoken )
+      if [ -z "$token" ] ; then
+        echo 1>&2 "ERROR: command --viewtoken requires a token, but no token was found."
+        echo 1>&2 "Please refer to the help text on how to provide a token."
+        exit 1
+      fi
+      ;;
+    whoami | channels | space )
+      ;;
     '' )
       echo 1>&2 "ERROR. Please specify a command. See --help for more information."
       exit 1
       ;;
-    whoami | channels | space )
-      ;;
     * )
       echo 1>&2 "ERROR: command '$command' is not implemented."
       exit 1
@@ -1584,10 +1890,12 @@ api_call () {
           ;;
         '' )
           # The path may not exist, or we may not have permission to see it.
-          echo "Warning: could not determine object type for '$path'"
+          echo "ERROR: could not determine object type for '$path'" 1>&2
+          exit 1
           ;;
         * )
-          echo "Unknown object type '$type'. Please create an issue for this in Github."
+          echo "Unknown object type '$type'. Please create an issue for this in Github." 1>&2
+          exit 1
           ;;
       esac
       ;;
@@ -1633,10 +1941,12 @@ api_call () {
             ;;
           '' )
             # The path may not exist, or we may not have permission to see it.
-            echo "Warning: could not determine object type for '$path'"
+            echo "ERROR: could not determine object type for '$path'" 1>&2
+            exit 1
             ;;
           * )
-            echo "Unknown object type '$type'. Please create an issue for this in Github."
+            echo "Unknown object type '$type'. Please create an issue for this in Github." 1>&2
+            exit 1
             ;;
         esac
       done <<<"$pathlist" \
@@ -1696,14 +2006,16 @@ api_call () {
           ;;
         '' )
           # The path may not exist, or we may not have permission to see it.
-          echo "Warning: could not determine object type for '$path'"
+          echo "ERROR: could not determine object type for '$path'" 1>&2
+          exit 1
           ;;
         * )
-          echo "Unknown object type '$type'. Please create an issue for this in Github."
+          echo "ERROR: unknown object type '$type'. Please create an issue for this in Github."
+          exit 1
           ;;
       esac
       ;;
-    setlabel | rmlabel )
+    setlabel | lslabel | rmlabel )
       case $(pathtype "$path") in
         DIR )
           echo 1>&2 "ERROR: target '$path' is a directory. dCache does not support labels on directories."
@@ -1715,21 +2027,161 @@ api_call () {
                     "Ada will continue. But if this symlink point to a direcory, the result may be unexpected."
           ;;
       esac
+      encoded_path=$(urlencode "$path")
       case $command in
-        setlabel )  action='set-label' ;;
-        rmlabel  )  action='rm-label'  ;;
-        * )         echo 1>&2 "Unexpected label command '$command'." ; exit 1 ;;
+        setlabel )
+          (
+            $debug && set -x   # If --debug is specified, show (only) curl command
+            curl "${curl_authorization[@]}" \
+                 "${curl_options_common[@]}" \
+                 "${curl_options_post[@]}" \
+                 -X POST "$api/namespace/$encoded_path" \
+                 -d "{\"action\":\"set-label\",\"label\":\"$label\"}"
+          ) \
+          | jq -r .status
+          ;;
+        rmlabel  )
+          (
+            $debug && set -x   # If --debug is specified, show (only) curl command
+            curl "${curl_authorization[@]}" \
+                 "${curl_options_common[@]}" \
+                 "${curl_options_post[@]}" \
+                 -X POST "$api/namespace/$encoded_path" \
+                 -d "{\"action\":\"rm-label\",\"label\":\"$label\"}"
+          ) \
+          | jq -r .status
+          ;;
+        lslabel )
+          labels=$(
+                    $debug && set -x   # If --debug is specified, show (only) curl command
+                    curl "${curl_authorization[@]}" \
+                    "${curl_options_common[@]}" \
+                    "${curl_options_post[@]}" \
+                    -X GET "$api/namespace/$encoded_path?labels=true"
+                  )
+          if [ -n "$label"  ] ; then
+            result=$(echo "$labels" \
+                     | jq -r 'if (.labels | index("'$label'")) then "'$label'" else null end'
+                    )
+            if [ "$result" == "null" ]; then
+                echo "ERROR: file '$path' does not have label '$label'."
+                exit 1
+            else
+                echo "$result"
+            fi
+          else
+            echo "$labels" | jq -r '.labels | sort | .[]'
+          fi
+          ;;
+        * )
+        echo 1>&2 "Unexpected label command '$command'."
+        exit 1
+        ;;
+    esac
+    ;;
+  findlabel )
+    find_label "$path" "$regex" "$recursive"
+    ;;
+  setxattr | lsxattr | rmxattr )
+    case $(pathtype "$path") in
+      DIR )
+        echo 1>&2 "ERROR: target '$path' is a directory." \
+                  "dCache does not support extended attributes on directories."
+        exit 1
+        ;;
+      LINK )
+        echo 1>&2 "WARNING: target '$path' is a symlink. A symlink can point to a file or a directory." \
+                  "dCache does not support extended attributes on directories." \
+                  "Ada will continue. But if this symlink point to a direcory," \
+                  "the result may be unexpected."
+        ;;
       esac
       encoded_path=$(urlencode "$path")
-      (
-        $debug && set -x   # If --debug is specified, show (only) curl command
-        curl "${curl_authorization[@]}" \
-             "${curl_options_common[@]}" \
-             "${curl_options_post[@]}" \
-             -X POST "$api/namespace/$encoded_path" \
-             -d "{\"action\":\"$action\",\"label\":\"$label\"}"
-      ) \
-      | jq -r .status
+      case $command in
+        setxattr )
+          attributes=$(cat $attr_file)
+          xattr_json=$(to_json "$attributes")
+          echo "$xattr_json"
+          (
+            $debug && set -x   # If --debug is specified, show (only) curl command
+            curl "${curl_authorization[@]}" \
+                 "${curl_options_common[@]}" \
+                 "${curl_options_post[@]}" \
+                 -X POST "$api/namespace/$encoded_path" \
+                   -d "{\"action\":\"set-xattr\",\"attributes\":$xattr_json}"
+          ) \
+          | jq -r .status
+          ;;
+        lsxattr )
+          attributes=$(
+                        $debug && set -x   # If --debug is specified, show (only) curl command
+                        curl "${curl_authorization[@]}" \
+                        "${curl_options_common[@]}" \
+                        "${curl_options_post[@]}" \
+                        -X GET "$api/namespace/$encoded_path?xattr=true"
+                      )
+          if [ -n "$attribute_name"  ] ; then
+            attribute_value=$(echo "$attributes" | jq ".extendedAttributes.$attribute_name")
+            if [ "$attribute_value" == "null" ]; then
+                echo "ERROR: file '$path' does not have attribute '$attribute_name'."
+                exit 1
+            else
+                echo "$attribute_value"
+            fi
+          else
+            echo "$attributes" | jq .extendedAttributes
+          fi
+          ;;
+        rmxattr  )
+          case $attribute_name in
+            --all )
+              # User wants to remove all attributes of this file. We ask the API for a list.
+              names_json=$(
+                            $debug && set -x   # If --debug is specified, show (only) curl command
+                            curl "${curl_authorization[@]}" \
+                            "${curl_options_common[@]}" \
+                            "${curl_options_post[@]}" \
+                            -X GET "$api/namespace/$encoded_path?xattr=true" \
+                            | jq --compact-output '.extendedAttributes | keys'
+                          )
+              if [ "$names_json" == "[]" ] ; then
+                echo "No attributes to remove."
+                exit 0
+              else
+                echo "Removing attributes: $names_json"
+              fi
+              ;;
+            --* )
+              echo 1>&2 "ERROR: unexpected argument '$attribute_name'."
+              exit 1
+              ;;
+            '' )
+              echo 1>&2 "ERROR: expected attribute names to remove, or --all."
+              exit 1
+              ;;
+            * )
+              # User specified which attribute(s) must be removed.
+              names_json=$(echo "$attribute_name"  | jq -R 'split(",")')
+              ;;
+          esac
+          (
+            $debug && set -x   # If --debug is specified, show (only) curl command
+            curl "${curl_authorization[@]}" \
+                 "${curl_options_common[@]}" \
+                 "${curl_options_post[@]}" \
+                 -X POST "$api/namespace/$encoded_path" \
+                 -d "{\"action\":\"rm-xattr\",\"names\":$names_json}"
+          ) \
+          | jq -r .status
+          ;;
+        * )
+          echo 1>&2 "Unexpected xattr command '$command'."
+          exit 1
+          ;;
+      esac
+      ;;
+    findxattr )
+      find_xattr "$path" "$attribute_name" "$regex" "$recursive"
       ;;
     checksum )
       while read -r path ; do
@@ -1795,7 +2247,7 @@ api_call () {
         echo "$channelname" > "${ada_dir}/channels/channel-name-${channel_id}"
         # Set channel timeout
         (
-         	$debug && set -x
+          $debug && set -x
           curl "${curl_authorization[@]}" \
                "${curl_options_common[@]}" \
                "${curl_options_post[@]}" \
diff --git a/tests/unit_test.sh b/tests/unit_test.sh
index 94f45a5..57ca491 100755
--- a/tests/unit_test.sh
+++ b/tests/unit_test.sh
@@ -13,10 +13,11 @@ test_urlencode() {
 
 test_pathtype() {
   result=`pathtype "/test/a/b/c"`
-  expected='curl "${curl_authorization[@]}" \
-       "${curl_options_no_errors[@]}" \
-       -X GET "$api/namespace/$path" \
-  | jq -r .fileType'
+  expected='$debug && set -x
+          curl "${curl_authorization[@]}" \
+          -H "accept: application/json" \
+          --silent \
+          -X GET "$api/namespace/$encoded_path"'
   assertEquals \
       "the result of pathtype() was wrong" \
       "${expected}" "${result}"