OpenID - Revision history

Admin: /* Register your OpenID identity at T2B */

2025-03-31T08:47:45Z

← Older revision		Revision as of 08:47, 31 March 2025
Line 34:		Line 34:
	== Register your OpenID identity at T2B ==		== Register your OpenID identity at T2B ==

	Go to your [https://cms-auth~~.web~~.cern.ch/manage/user/profile user page] on the IAM page and send us the value of the field labelled 'sub'.		Go to your [https://cms-auth.cern.ch/manage/user/profile user page] on the IAM page and send us the value of the field labelled 'sub'.

	It should be of this form:		It should be of this form:

Admin at 08:32, 31 March 2025

2025-03-31T08:32:12Z

← Older revision		Revision as of 08:32, 31 March 2025
Line 5:		Line 5:

	== Getting an OpenID identity ==		== Getting an OpenID identity ==
	* Go the CMS IAM service at https://cms-auth~~.web~~.cern.ch/ and log in		* Go the CMS IAM service at https://cms-auth.cern.ch/ and log in
	* At the left, click 'Manage Active Tokens'. At the moment, you have none.		* At the left, click 'Manage Active Tokens'. At the moment, you have none.
	* Go to the M machines and issue the following commands:		* Go to the M machines and issue the following commands:

Admin at 08:31, 31 March 2025

2025-03-31T08:31:46Z

← Older revision		Revision as of 08:31, 31 March 2025
Line 10:		Line 10:
	<pre>		<pre>
	eval `oidc-agent-service use`		eval `oidc-agent-service use`
	oidc-gen --iss https://cms-auth~~.web~~.cern.ch/ --scope openid -w device cms-id		oidc-gen --iss https://cms-auth.cern.ch/ --scope openid -w device cms-id

	Options:		Options:

Admin: /* Creating a token */

2023-10-26T14:10:51Z

Creating a token

← Older revision		Revision as of 14:10, 26 October 2023
Line 51:		Line 51:
	</pre>		</pre>
	Notice the use of 'cms-id' that must be the same name as the ID you created in the previous step.		Notice the use of 'cms-id' that must be the same name as the ID you created in the previous step.

			If you forgot the name of your ID, you can always find it back via this command:
			<pre>oidc-add --list</pre>
			Details about your configuration can be retrieved via:
			<pre>oidc-add --print cms-id</pre>


	You can also limit your token to specific tasks. If you want to give read access to your files to a colleague, you can send her/him a token created like this:		You can also limit your token to specific tasks. If you want to give read access to your files to a colleague, you can send her/him a token created like this:

Admin: /* Getting an OpenID identity */

2023-05-12T07:43:35Z

Getting an OpenID identity

← Older revision		Revision as of 07:43, 12 May 2023
Line 9:		Line 9:
	* Go to the M machines and issue the following commands:		* Go to the M machines and issue the following commands:
	<pre>		<pre>
	eval $(oidc-agent)		eval `oidc-agent-service use`
	oidc-gen --iss https://cms-auth.web.cern.ch/ --scope openid -w device cms-id		oidc-gen --iss https://cms-auth.web.cern.ch/ --scope openid -w device cms-id

Admin: /* Using your token at T2B */

2023-05-09T09:37:46Z

Using your token at T2B

← Older revision		Revision as of 09:37, 9 May 2023
Line 71:		Line 71:
	export BEARER_TOKEN=$(oidc-token cms-id)		export BEARER_TOKEN=$(oidc-token cms-id)
	</pre>		</pre>
	Now all the gfal ~~commnds~~ will use your token to identify.		Now all the gfal commnads will use your token to identify. However, only the webdav protocol is supported as of now. This command will get you started:
			<pre>
			gfal-ls https://dcache6-shadow.iihe.ac.be:2880/pnfs/iihe/cms/ph/sc4/
			</pre>

Admin: /* Getting an OpenID identity */

2023-05-09T09:10:06Z

Getting an OpenID identity

← Older revision		Revision as of 09:10, 9 May 2023
Line 7:		Line 7:
	* Go the CMS IAM service at https://cms-auth.web.cern.ch/ and log in		* Go the CMS IAM service at https://cms-auth.web.cern.ch/ and log in
	* At the left, click 'Manage Active Tokens'. At the moment, you have none.		* At the left, click 'Manage Active Tokens'. At the moment, you have none.
	* Go to the M machines and issue the following ~~command~~:		* Go to the M machines and issue the following commands:
	<pre>		<pre>
			eval $(oidc-agent)
	oidc-gen --iss https://cms-auth.web.cern.ch/ --scope openid -w device cms-id		oidc-gen --iss https://cms-auth.web.cern.ch/ --scope openid -w device cms-id

Line 30:		Line 31:
	oidc-gen -p cms-id \| jq .		oidc-gen -p cms-id \| jq .
	</pre>		</pre>


	== Register your OpenID identity at T2B ==		== Register your OpenID identity at T2B ==

Admin at 08:58, 9 May 2023

2023-05-09T08:58:31Z

← Older revision		Revision as of 08:58, 9 May 2023
Line 13:		Line 13:
	Options:		Options:
	iss: IAM site of your virtual organisation		iss: IAM site of your virtual organisation
	scope: ~~set~~ of pre-defined rules that limit what you can do with your tokens. The most encompassing is --scope max		scope: Set of pre-defined rules that limit what you can do with your tokens. The most encompassing is --scope max
	w: ~~way~~ to connect the local 'id' to the IAM one. In this case 'device' means you will need to go a specific webpage and insert a code that oidc-gen will specify. The other ~~option~~ do not work well at T2B		w: Way to connect the local 'id' to the IAM one.
	cms-id: ~~your~~ local id name.		In this case 'device' means you will need to go a specific webpage and insert a code that oidc-gen will specify.
			The other options do not work well at T2B
			cms-id: Your local id name.
	</pre>		</pre>

Admin: /* Register your OpenID identity at T2B */

2023-05-09T08:44:20Z

← Older revision		Revision as of 08:44, 9 May 2023
Line 32:		Line 32:
	== Register your OpenID identity at T2B ==		== Register your OpenID identity at T2B ==

	~~for now, I have no idea on how~~ to ~~do this~~.~~You need to tell me when you connect~~ and ~~then I~~'ll be ~~able to get the correct result.~~		Go to your [https://cms-auth.web.cern.ch/manage/user/profile user page] on the IAM page and send us the value of the field labelled 'sub'.

			It should be of this form:
			<pre>
			xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
			</pre>

	== Creating a token ==		== Creating a token ==

Admin at 08:37, 9 May 2023

2023-05-09T08:37:25Z

← Older revision		Revision as of 08:37, 9 May 2023
Line 1:		Line 1:
	Grid facilities in general and CMS in particular ar slowly moving from a certificate/proxy based authentication towards an OpenID/token based authentication.		Grid facilities in general and CMS in particular are slowly moving from a certificate/proxy based authentication towards an OpenID/token based authentication.

	This page explains how to use them yourself at T2B [BR]		This page explains how to use them yourself at T2B [BR]
Line 19:		Line 19:

	* Follow the onscreen instructions.		* Follow the onscreen instructions.
	* 'cms-id' now contains the reference to your online identity and will be used in subsequent commands. Feel free to use your ~~own name~~.		* 'cms-id' now contains the reference to your online identity and will be used in subsequent commands. Feel free to use your imagination here.
	* You can now go back to the IAM site and see that you have just created this identity with the 'openid' scope.		* You can now go back to the IAM site and see that you have just created this identity with the 'openid' scope.
	* It has also created 2 tokens for your. More on this in a later section.		* It has also created 2 tokens for your. More on this in a later section.
Line 45:		Line 45:
	Notice the use of 'cms-id' that must be the same name as the ID you created in the previous step.		Notice the use of 'cms-id' that must be the same name as the ID you created in the previous step.

	You can also limit your token to specific tasks. If you want to give read access to your files to a colleague, you can ~~pass~~ a token created like this:		You can also limit your token to specific tasks. If you want to give read access to your files to a colleague, you can send her/him a token created like this:
	<pre>		<pre>
	oidc-token -s storage.read:/ cms-id		oidc-token -s storage.read:/ cms-id
Line 60:		Line 60:
	If your ID is registered at T2B and you made a new token, you can now use it easily via the usual 'gfal' commands.		If your ID is registered at T2B and you made a new token, you can now use it easily via the usual 'gfal' commands.

	The gfal commands can take ~~on both~~ a proxy ~~and~~ a token depending on a environment variable. In the case of tokens, the variable can be set in the following way:		The gfal commands can take either a proxy or a token, depending on an environment variable. In the case of tokens, the variable can be set in the following way:
	<pre>		<pre>
	export BEARER_TOKEN=$(oidc-token cms-id)		export BEARER_TOKEN=$(oidc-token cms-id)
	</pre>		</pre>
	Now all the gfal commnds will ~~take~~ your token to identify.		Now all the gfal commnds will use your token to identify.