(r4) DynaFed < HEPrc

Tags: view all tags
---+ Dynafed installation and user authentication


---++ manual installation

   * start with minimal CentOS 7    
   * enable repos:   
      * epel-release   
      * egi    
      * wlcg   
   * install:   
      * httpd   
      * dynafed   
      * dynafed-http-plugin   
      * dynafed-dmlite-plugin   
      * dynafed-dmlite-frontend   
      * memcached   
      * mod_ssl  
      * openssh (update)   
      * fetch-crl   
      * gridsite   
      * edg-mkgridmap   
      * lcg-CA
         * all site certificates
   * disable selinux  
   * replace _/etc/httpd/conf.d/ssl.conf_ with an empty file
   * change ServerName in _/etc/httpd/conf/httpd.conf_ to the correct one
   * place host certificate and key in _/etc/grid-security_
      * make sure the permissions are correct
      * remove password from the hostkey file
   * in  [[%ATTACHURLPATH%/ugr.conf][/etc/ugr/ugr.conf]]
      * make sure _extcache.memcached.ttl_ is set to the same value as _infohandler.itemmaxttl_
   * rename _/etc/httpd/conf.d/zgridsite.conf_ in a way that it is read after _zlcgdm-ugr-dav.conf_
   * delete:
      * /etc/httpd/conf.modules.d/00-dav.conf<br>
       /etc/httpd/conf.modules.d/00-ssl.conf
   * in [[%ATTACHURLPATH%/zlcgdm-ugr-dav.conf][/etc/httpd/conf.d/zlcgdm-ugr-dav.conf]]
      * enable SSL section
      * change port to 8443
      * add
         * LoadModule ssl_module modules/mod_ssl.so<br>
          LoadModule gridsite_module   /usr/lib64/httpd/modules/mod_gridsite.so
   * enable service at boot time: _httpd_ and _memcached_
   * make sure firewall is configured to allow access to port 8443
   * start services: _httpd_ and _memcached_



---++ automatic install
An Ansible module will be uploaded.    

location: ???


---++ adding S3 endpoints
   * create a file ending with ".conf" in _/etc/ugr/conf.d/_
   * add the endpoint to this file
      * <verbatim>
         glb.locplugin[]: libugrlocplugin_s3.so UGR-ID 2 https://s3-SERVER/Bucket
         locplugin.UGR-ID.xlatepfx: /S3-Atlas /
         locplugin.UGR-ID.s3.priv_key: PRIVATE KEY GOES HERE
         locplugin.UGR-ID.s3.pub_key: PUBLIC KEY GOES HERE
         locplugin.UGR-ID.s3.alternate: yes
        </verbatim>
   * restart _httpd_ and _memcached_


---++ Authentication
---+++ for clients using voms proxy
   * add in _/etc/ugr/ugr.conf_
      * glb.allowgroups[]: /atlas/* /myfed/S3-Atlas  rl
   * restart _httpd_ and _memcached_

This will allow read and listing of everything under _/myfed/S3-Atlas_ for everyone with a valid Atlas voms proxy.  <br>
However, the dynafed endpoint will no longer be usable through a web browser even for Atlas users since dynafed by default does not evaluate certificates.

---+++ certificate based authentication
   * works only if SSL is enabled
   * DynaFed doesn't support certificate evaluation by default but it allows python based authentication using own modules
      * needs a grid-mapfile
      * in _/etc/ugr/conf.d_  create the file  [[https://wiki.heprc.uvic.ca/twiki/bin/viewfile/HEPrc/DynaFed?filename=ugrauth_gridmap.py.txt][ugrauth_gridmap.py.txt]]
         * downloaded file needs to be renamed to remove ".txt" at the end
      * add to _/etc/ugr/ugr.conf_ the line:<br> 
        glb.authorizationplugin[]: libugrauthplugin_python27.so authplug1 ugrauth_gridmap isallowed
         * depending on OS and python version it needs to be python27 or python26
         * the correct version is in _/usr/lib64/ugr/_
      * in _/etc/grid-security/_ create the file _accessfile_
         * _accessfile_ contains a line per directory and access mode
            * e.g.:  /myfed/S3-Atlas atlas rl
               * this will allow everyone registered with Atlas to read and list everything in _/myfed/S3-Atlas_ (and below) using a browser
            * [[%ATTACHURLPATH%/accessfile][example file]]
   * restart _httpd_ and _memcached_

This also works for voms proxy based access on the command line. 


---++++ grid-mapfile generation
   * needs a list of voms server in config files
      * e.g. _/etc/edg-mkgridmap-atlas-prod.conf_ contains2 lines:
         * group vomss://lcg-voms2.cern.ch:8443/voms/atlas?/atlas/Role=production atlas-prod<br>
           group vomss://voms2.cern.ch:8443/voms/atlas?/atlas/Role=production atlas-prod
      * create one config file for each VO and each role within each VO
   * create a single file that contains all certificates for all VOs and all roles, e.g. with something like this:
          <verbatim> #!/bin/bash

TMPFILE=/tmp/gridmap.out
if [ -f $TMPFILE ]
then
 rm $TMPFILE
fi
touch $TMPFILE


for VO in belle belle-prod belle-lcgadmin atlas atlas-prod atlas-lcgadmin
do
 edg-mkgridmap --conf=/etc/edg-mkgridmap-$VO.conf --output=- >>$TMPFILE
done
sort $TMPFILE >/etc/grid-security/grid-mapfile
</verbatim>


---++ cronjobs and other considerations
   * cronjobs need to be installed for
      * grid-mapfile generation
      * certificate updates
   * *if* dynafed is used to list also other sites (e.g. DPM/dCache sites), then :
      * register host certificate with the VOs 
      * create a voms proxy using the host certificate
      * install cronjob that renews the voms proxy



          

-- %USERSIG{mebert - 2017-05-18}%

---++ Comments

%COMMENT%
Attachments
Topic attachments
I	Attachment	History	Action	Size	Date	Who	Comment
EXT	accessfile	r1	manage	0.1 K	2017-05-18 - 21:59	UnknownUser	example for the accessfile
conf	ugr.conf	r1	manage	0.9 K	2017-05-18 - 21:59	UnknownUser	dynafed config file
txt	ugrauth_gridmap.py.txt	r1	manage	3.1 K	2017-05-18 - 21:59	UnknownUser	python code for certificate based authentication using a grid-mapfile
conf	zlcgdm-ugr-dav.conf	r1	manage	3.4 K	2017-05-18 - 21:59	UnknownUser	http ssl config for dynafed
Topic revision: r4 - 2017-05-26 - mebert
~~Edit~~
~~Attach~~