LToS - Revision history

Stephane GERARD at 12:57, 19 May 2016

2016-05-19T12:57:46Z

← Older revision		Revision as of 12:57, 19 May 2016
Line 142:		Line 142:
	uri : voms01.begrid.be:18004		uri : voms01.begrid.be:18004
	</pre>		</pre>

			== Further reading ==

			* https://wiki.egi.eu/wiki/Usage_of_the_per_user_sub_proxy_in_EGI
			* https://wiki.egi.eu/wiki/MAN12

Stephane GERARD: /* Creation of per-user sub-proxies for beapps VO */

2016-05-18T20:25:56Z

Creation of per-user sub-proxies for beapps VO

← Older revision		Revision as of 20:25, 18 May 2016
Line 121:		Line 121:
	</pre>		</pre>
	The --noregen option is important because you just want to add voms extensions to the pusp proxy that already exists in /tmp/x509up_u20533.		The --noregen option is important because you just want to add voms extensions to the pusp proxy that already exists in /tmp/x509up_u20533.

			Now, it looks like a good old usual beapps proxy :
			<pre>
			voms-proxy-info --all

			subject : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be/CN=user:mdupont/CN=730118287
			issuer : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be/CN=user:mdupont
			identity : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be
			type : RFC3820 compliant impersonation proxy
			strength : 1024
			path : /tmp/x509up_u20533
			timeleft : 11:59:57
			key usage : Digital Signature, Key Encipherment
			=== VO beapps extension information ===
			VO : beapps
			subject : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be
			issuer : /DC=org/DC=terena/DC=tcs/C=BE/ST=Brussels/L=Brussels/O=Le reseau telematique belge de la recherche/CN=voms01.begrid.be
			attribute : /beapps/Role=NULL/Capability=NULL
			timeleft : 11:59:56
			uri : voms01.begrid.be:18004
			</pre>

Stephane GERARD: /* Creation of per-user sub-proxies for beapps VO */

2016-05-18T20:23:13Z

Creation of per-user sub-proxies for beapps VO

← Older revision		Revision as of 20:23, 18 May 2016
Line 106:		Line 106:
	<pre>		<pre>
	voms-proxy-info --all		voms-proxy-info --all

	subject : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be/CN=user:mdupont		subject : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be/CN=user:mdupont
	issuer : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be		issuer : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be

Stephane GERARD: /* Creation of per-user sub-proxies for beapps VO */

2016-05-18T20:22:57Z

Creation of per-user sub-proxies for beapps VO

← Older revision		Revision as of 20:22, 18 May 2016
Line 106:		Line 106:
	<pre>		<pre>
	voms-proxy-info --all		voms-proxy-info --all
			subject : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be/CN=user:mdupont
			issuer : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be
			identity : /DC=org/DC=terena/DC=tcs/C=BE/O=Vrije Universiteit Brussel/CN=Robot - STEPHANE GERARD stgerard@vub.ac.be
			type : RFC3820 compliant impersonation proxy
			strength : 1024
			path : /tmp/x509up_u20533
			timeleft : 23:59:51
			key usage : Digital Signature, Key Encipherment
	</pre>		</pre>
	you will see that the voms extensions are missing from this proxy. To add the beapps voms extension :		you will see that the voms extensions are missing from this proxy. To add the beapps voms extension :

Stephane GERARD: /* Creation of per-user sub-proxies for beapps VO */

2016-05-18T20:22:12Z

Creation of per-user sub-proxies for beapps VO

← Older revision		Revision as of 20:22, 18 May 2016
Line 99:		Line 99:

	== Creation of per-user sub-proxies for beapps VO ==		== Creation of per-user sub-proxies for beapps VO ==
	First of all, you (= the VO admin) need to get a robot certificate that you will register in beapps VO. After that, you have to extract the usercert and the private key in a directory (.globus_pusp) directory and set the correct permissions. Thanks to this [~~script~~ https://ndpfsvn.nikhef.nl/viewvc/mwsec/trunk/lcmaps-plugins-robot/tools/], you can create a PUSP for a given user (mdupont) by issuing the following command :		First of all, you (= the VO admin) need to get a robot certificate that you will register in beapps VO. After that, you have to extract the usercert and the private key in a directory (.globus_pusp) directory and set the correct permissions. Thanks to this [https://ndpfsvn.nikhef.nl/viewvc/mwsec/trunk/lcmaps-plugins-robot/tools/ script], you can create a PUSP for a given user (mdupont) by issuing the following command :
	<pre>		<pre>
	./create_pusp -u mdupont -c ~/.globus_pusp/usercert.pem -k ~/.globus_pusp/userkey.pem		./create_pusp -u mdupont -c ~/.globus_pusp/usercert.pem -k ~/.globus_pusp/userkey.pem
	</pre>		</pre>
			Now, if you issue the command :
			<pre>
			voms-proxy-info --all
			</pre>
			you will see that the voms extensions are missing from this proxy. To add the beapps voms extension :
			<pre>
			voms-proxy-init --voms beapps --noregen
			</pre>
			The --noregen option is important because you just want to add voms extensions to the pusp proxy that already exists in /tmp/x509up_u20533.

Stephane GERARD at 20:15, 18 May 2016

2016-05-18T20:15:48Z

← Older revision		Revision as of 20:15, 18 May 2016
Line 96:		Line 96:
	vomslocalaccount -> posixenf \| vomspoolaccount		vomslocalaccount -> posixenf \| vomspoolaccount
	vomspoolaccount -> posixenf		vomspoolaccount -> posixenf
			</pre>

			== Creation of per-user sub-proxies for beapps VO ==
			First of all, you (= the VO admin) need to get a robot certificate that you will register in beapps VO. After that, you have to extract the usercert and the private key in a directory (.globus_pusp) directory and set the correct permissions. Thanks to this [script https://ndpfsvn.nikhef.nl/viewvc/mwsec/trunk/lcmaps-plugins-robot/tools/], you can create a PUSP for a given user (mdupont) by issuing the following command :
			<pre>
			./create_pusp -u mdupont -c ~/.globus_pusp/usercert.pem -k ~/.globus_pusp/userkey.pem
	</pre>		</pre>

Stephane GERARD: /* Configuration of the CE */

2016-05-18T19:52:43Z

Configuration of the CE

@@ Line 1: / Line 1: @@
 == Configuration of the CE ==
-This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE. However, if you apply these recipes to the letter, it will break the CE. Here are the real configurations we have applied :
+This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE. However, if you apply these recipes to the letter, it will break the CE. Here are the actual configurations we have applied :
 * /etc/glexec.conf
 <pre>
@@ Line 25: / Line 25: @@
 user_identity_switch_by=lcmaps
 user_white_list=tomcat
 </pre>

Stephane GERARD at 19:45, 18 May 2016

2016-05-18T19:45:06Z

← Older revision		Revision as of 19:45, 18 May 2016
Line 1:		Line 1:
	== Configuration of the CE ==		== Configuration of the CE ==
	This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE. However, if you apply these recipes to the letter, it will break the CE. Here are the real configurations we have applied :		This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE. However, if you apply these recipes to the letter, it will break the CE. Here are the real configurations we have applied :
			* /etc/glexec.conf
			<pre>
			[glexec]
			create_target_proxy=no
			lcas_db_file=/etc/lcas/lcas-glexec.db
			lcas_debug_level=5
			lcas_log_file=/var/log/glexec/lcas_lcmaps.log
			lcas_log_level=5
			lcmaps_db_file=/etc/lcmaps/lcmaps.db.glexec.pusp
			lcmaps_debug_level=5
			lcmaps_get_account_policy=combi_mapping
			lcmaps_log_file=/var/log/glexec/lcas_lcmaps.log
			lcmaps_log_level=5
			lcmaps_voms_verification=no
			linger=no
			log_destination=file
			log_file=/var/log/glexec/glexec.log
			log_level=5
			omission_private_key_white_list=tomcat
			preserve_env_variables=
			silent_logging=no
			use_lcas=no
			user_identity_switch_by=lcmaps
			user_white_list=tomcat
			</pre>

Stephane GERARD at 14:50, 18 May 2016

2016-05-18T14:50:41Z

← Older revision		Revision as of 14:50, 18 May 2016
Line 1:		Line 1:
	== Configuration of the CE ==		== Configuration of the CE ==
	This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE.		This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE. However, if you apply these recipes to the letter, it will break the CE. Here are the real configurations we have applied :

Stephane GERARD: /* Configuration of the CE */

2016-05-18T14:48:07Z

Configuration of the CE

← Older revision		Revision as of 14:48, 18 May 2016
Line 1:		Line 1:
	== Configuration of the CE ==		== Configuration of the CE ==
	This [~~link~~ https://wiki.egi.eu/wiki/MAN12] explains how to set up the PUSP mechanism on the CE.		This [https://wiki.egi.eu/wiki/MAN12 link] explains how to set up the PUSP mechanism on the CE.