Grid User Management Systemv110

Project Documentation

Brookhaven National Laboratory 21 July 2005 0132 EDT

Table of Contents

1 Manual11 Learning about GUMS

111 What is GUMS 1

112 GUMS and Privilege 4

113 Understanding GUMS installation 11

12 Installation

121 HOW TO VDT installation 17

122 HOW TO Manual installation 18

123 HOW TO Upgrade from 10 23

13 Using GUMS

131 Configuration 26

1311 gumsconfig 27

1312 Examples 39

132 GUMS commands 43

1321 bingums 44

1322 bingums-host 49

133 GUMS logs 52

1331 Logging implementation details 54

14 Site integration 56

15 FAQ 59

16 Troubleshooting FAQ 62

17 Changes 64

T A B L E O F C O N T E N T S i

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

TABLE OF CONTENTS ii

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 Learning about GUMS

1 1 L E A R N I N G A B O U T G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 LEARNING ABOUT GUMS 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

111 What is GUMS

What is GUMS

What does GUMS do

Implementing Site Policies

1 1 1 W H A T I S G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Table of Contents

1 Manual11 Learning about GUMS

111 What is GUMS 1

112 GUMS and Privilege 4

113 Understanding GUMS installation 11

12 Installation

121 HOW TO VDT installation 17

122 HOW TO Manual installation 18

123 HOW TO Upgrade from 10 23

13 Using GUMS

131 Configuration 26

1311 gumsconfig 27

1312 Examples 39

132 GUMS commands 43

1321 bingums 44

1322 bingums-host 49

133 GUMS logs 52

1331 Logging implementation details 54

14 Site integration 56

15 FAQ 59

16 Troubleshooting FAQ 62

17 Changes 64

T A B L E O F C O N T E N T S i

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

TABLE OF CONTENTS ii

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 Learning about GUMS

1 1 L E A R N I N G A B O U T G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 LEARNING ABOUT GUMS 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

111 What is GUMS

What is GUMS

What does GUMS do

Implementing Site Policies

1 1 1 W H A T I S G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

TABLE OF CONTENTS ii

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 Learning about GUMS

1 1 L E A R N I N G A B O U T G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 LEARNING ABOUT GUMS 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

111 What is GUMS

What is GUMS

What does GUMS do

Implementing Site Policies

1 1 1 W H A T I S G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 Learning about GUMS

1 1 L E A R N I N G A B O U T G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 LEARNING ABOUT GUMS 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

111 What is GUMS

What is GUMS

What does GUMS do

Implementing Site Policies

1 1 1 W H A T I S G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

11 LEARNING ABOUT GUMS 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

111 What is GUMS

What is GUMS

What does GUMS do

Implementing Site Policies

1 1 1 W H A T I S G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

111 What is GUMS

What is GUMS

What does GUMS do

Implementing Site Policies

1 1 1 W H A T I S G U M S 1

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

The GUMS callout interface

GUMS and other tools

The development of GUMS

1 1 1 W H A T I S G U M S 2

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS in the future

1 1 1 W H A T I S G U M S 3

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

112 GUMS and Privilege

GUMS and the Privilege architecture

What does GUMS do

Specifying the mapping

1 1 2 G U M S A N D P R I V I L E G E 4

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS client tools

Workflow

1 1 2 G U M S A N D P R I V I L E G E 5

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS in the grid architecture

1 1 2 G U M S A N D P R I V I L E G E 6

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 7

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

112 GUMS and Privilege

GUMS and the Privilege architecture

What does GUMS do

Specifying the mapping

1 1 2 G U M S A N D P R I V I L E G E 4

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS client tools

Workflow

1 1 2 G U M S A N D P R I V I L E G E 5

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS in the grid architecture

1 1 2 G U M S A N D P R I V I L E G E 6

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 7

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS client tools

Workflow

1 1 2 G U M S A N D P R I V I L E G E 5

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS in the grid architecture

1 1 2 G U M S A N D P R I V I L E G E 6

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 7

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

GUMS in the grid architecture

1 1 2 G U M S A N D P R I V I L E G E 6

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 7

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 7

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 8

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 9

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

112 GUMS AND PRIVILEGE 10

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

113 Understanding GUMS installation

Understanding GUMS installation

Please refer to the quick installation guide if you prefer to get up and running and need thecommand line

The pieces

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 11

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Root vs non-root

Firewall and security considerations

Prepare the database

[rootwww gums-service] cat varsqlsetupDatabasemysqlCREATE DATABASE GUMS_1_1

GRANT ALLON GUMS_1_1TO USERSERVER IDENTIFIED BY PASSWORD

USE GUMS_1_1

CREATE TABLE `USER` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`GROUP_NAME` VARCHAR(255) NOT NULL`DN` varchar(255) NOT NULL`FQAN` varchar(255) default NULL

) TYPE=InnoDB

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 12

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

CREATE INDEX complete ON USER (GROUP_NAME(10) DN(70) FQAN(30))

CREATE TABLE `MAPPING` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`MAP` VARCHAR(255) NOT NULL`DN` varchar(255) default NULL`ACCOUNT` varchar(255) default NULL

) TYPE=InnoDB

CREATE INDEX complete ON MAPPING (MAP(10) DN(70))

[rootwww sbin] cat varsqladdAdminmysqlUSE GUMS_1_1

INSERT INTO USER SET DN=ADMINDN GROUP_NAME=admins

Installing the service

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 13

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 1 2 G U M S A N D P R I V I L E G E 9

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

112 GUMS AND PRIVILEGE 10

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

113 Understanding GUMS installation

Understanding GUMS installation

Please refer to the quick installation guide if you prefer to get up and running and need thecommand line

The pieces

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 11

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Root vs non-root

Firewall and security considerations

Prepare the database

[rootwww gums-service] cat varsqlsetupDatabasemysqlCREATE DATABASE GUMS_1_1

GRANT ALLON GUMS_1_1TO USERSERVER IDENTIFIED BY PASSWORD

USE GUMS_1_1

CREATE TABLE `USER` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`GROUP_NAME` VARCHAR(255) NOT NULL`DN` varchar(255) NOT NULL`FQAN` varchar(255) default NULL

) TYPE=InnoDB

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 12

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

CREATE INDEX complete ON USER (GROUP_NAME(10) DN(70) FQAN(30))

CREATE TABLE `MAPPING` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`MAP` VARCHAR(255) NOT NULL`DN` varchar(255) default NULL`ACCOUNT` varchar(255) default NULL

) TYPE=InnoDB

CREATE INDEX complete ON MAPPING (MAP(10) DN(70))

[rootwww sbin] cat varsqladdAdminmysqlUSE GUMS_1_1

INSERT INTO USER SET DN=ADMINDN GROUP_NAME=admins

Installing the service

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 13

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

112 GUMS AND PRIVILEGE 10

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

113 Understanding GUMS installation

Understanding GUMS installation

Please refer to the quick installation guide if you prefer to get up and running and need thecommand line

The pieces

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 11

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Root vs non-root

Firewall and security considerations

Prepare the database

[rootwww gums-service] cat varsqlsetupDatabasemysqlCREATE DATABASE GUMS_1_1

GRANT ALLON GUMS_1_1TO USERSERVER IDENTIFIED BY PASSWORD

USE GUMS_1_1

CREATE TABLE `USER` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`GROUP_NAME` VARCHAR(255) NOT NULL`DN` varchar(255) NOT NULL`FQAN` varchar(255) default NULL

) TYPE=InnoDB

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 12

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

CREATE INDEX complete ON USER (GROUP_NAME(10) DN(70) FQAN(30))

CREATE TABLE `MAPPING` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`MAP` VARCHAR(255) NOT NULL`DN` varchar(255) default NULL`ACCOUNT` varchar(255) default NULL

) TYPE=InnoDB

CREATE INDEX complete ON MAPPING (MAP(10) DN(70))

[rootwww sbin] cat varsqladdAdminmysqlUSE GUMS_1_1

INSERT INTO USER SET DN=ADMINDN GROUP_NAME=admins

Installing the service

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 13

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

113 Understanding GUMS installation

Understanding GUMS installation

Please refer to the quick installation guide if you prefer to get up and running and need thecommand line

The pieces

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 11

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Root vs non-root

Firewall and security considerations

Prepare the database

[rootwww gums-service] cat varsqlsetupDatabasemysqlCREATE DATABASE GUMS_1_1

GRANT ALLON GUMS_1_1TO USERSERVER IDENTIFIED BY PASSWORD

USE GUMS_1_1

CREATE TABLE `USER` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`GROUP_NAME` VARCHAR(255) NOT NULL`DN` varchar(255) NOT NULL`FQAN` varchar(255) default NULL

) TYPE=InnoDB

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 12

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

CREATE INDEX complete ON USER (GROUP_NAME(10) DN(70) FQAN(30))

CREATE TABLE `MAPPING` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`MAP` VARCHAR(255) NOT NULL`DN` varchar(255) default NULL`ACCOUNT` varchar(255) default NULL

) TYPE=InnoDB

CREATE INDEX complete ON MAPPING (MAP(10) DN(70))

[rootwww sbin] cat varsqladdAdminmysqlUSE GUMS_1_1

INSERT INTO USER SET DN=ADMINDN GROUP_NAME=admins

Installing the service

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 13

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Root vs non-root

Firewall and security considerations

Prepare the database

[rootwww gums-service] cat varsqlsetupDatabasemysqlCREATE DATABASE GUMS_1_1

GRANT ALLON GUMS_1_1TO USERSERVER IDENTIFIED BY PASSWORD

USE GUMS_1_1

CREATE TABLE `USER` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`GROUP_NAME` VARCHAR(255) NOT NULL`DN` varchar(255) NOT NULL`FQAN` varchar(255) default NULL

) TYPE=InnoDB

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 12

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

CREATE INDEX complete ON USER (GROUP_NAME(10) DN(70) FQAN(30))

CREATE TABLE `MAPPING` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`MAP` VARCHAR(255) NOT NULL`DN` varchar(255) default NULL`ACCOUNT` varchar(255) default NULL

) TYPE=InnoDB

CREATE INDEX complete ON MAPPING (MAP(10) DN(70))

[rootwww sbin] cat varsqladdAdminmysqlUSE GUMS_1_1

INSERT INTO USER SET DN=ADMINDN GROUP_NAME=admins

Installing the service

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 13

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

CREATE INDEX complete ON USER (GROUP_NAME(10) DN(70) FQAN(30))

CREATE TABLE `MAPPING` (`ID` INTEGER AUTO_INCREMENT PRIMARY KEY`MAP` VARCHAR(255) NOT NULL`DN` varchar(255) default NULL`ACCOUNT` varchar(255) default NULL

) TYPE=InnoDB

CREATE INDEX complete ON MAPPING (MAP(10) DN(70))

[rootwww sbin] cat varsqladdAdminmysqlUSE GUMS_1_1

INSERT INTO USER SET DN=ADMINDN GROUP_NAME=admins

Installing the service

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 13

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltConnector port=8443maxThreads=150 minSpareThreads=25 maxSpareThreads=75enableLookups=false disableUploadTimeout=trueacceptCount=100 debug=0 scheme=https secure=true

sSLImplementation=orgglitesecuritytrustmanagertomcatTMSSLImplementationsslCAFiles=etcgrid-securitycertificates0crlFiles=etcgrid-securitycertificatesr0sslCertFile=etcgrid-securityhostcertpemsslKey=etctomcathostkeypem

log4jConfFile=opttomcat-5028-egeesecconflog4j-trustmanagerpropertiesclientAuth=true sslProtocol=TLS gt

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 14

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Installing the client tools

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 15

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

12 Installation

1 2 I N S T A L L A T I O N 16

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

121 HOW TO VDT installation

HOW TO GUMS VDT installation

What is VDT and why you should use it to install GUMS

Installing through VDT

1 2 1 H O W T O V D T I N S T A L L A T I O N 17

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Installing the client tools

1 1 3 U N D E R S T A N D I N G G U M S I N S T A L L A T I O N 15

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

12 Installation

1 2 I N S T A L L A T I O N 16

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

121 HOW TO VDT installation

HOW TO GUMS VDT installation

What is VDT and why you should use it to install GUMS

Installing through VDT

1 2 1 H O W T O V D T I N S T A L L A T I O N 17

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

12 Installation

1 2 I N S T A L L A T I O N 16

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

121 HOW TO VDT installation

HOW TO GUMS VDT installation

What is VDT and why you should use it to install GUMS

Installing through VDT

1 2 1 H O W T O V D T I N S T A L L A T I O N 17

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

121 HOW TO VDT installation

HOW TO GUMS VDT installation

What is VDT and why you should use it to install GUMS

Installing through VDT

1 2 1 H O W T O V D T I N S T A L L A T I O N 17

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

122 HOW TO Manual installation

HOW TO GUMS Service quick-start installation

Preparing java

[rootgums root] java -versionjava version 142_04Java(TM) 2 Runtime Environment Standard Edition (build 142_04-b05)Java HotSpot(TM) Client VM (build 142_04-b05 mixed mode)

Preparing the certificate directory

Prepare the database

Preparing Tomcat + EGEE security

[rootgums root] cd opt[rootgums opt] wget

1 2 2 H O W T O M A N U A L I N S T A L L A T I O N 18

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

httpgridracfbnlgovmavengumstargzstomcat-5028-egeesectargz

[rootgums opt] tar -xzvf tomcat-5028-egeesectargz

[rootgums opt] vi tomcat-5028-egeesecconfserverxml

ltConnector port=8443maxThreads=150 minSpareThreads=25 maxSpareThreads=75enableLookups=false disableUploadTimeout=trueacceptCount=100 debug=0 scheme=https secure=true

sSLImplementation=orgglitesecuritytrustmanagertomcatTMSSLImplementationsslCAFiles=etcgrid-securitycertificates0crlFiles=etcgrid-securitycertificatesr0sslCertFile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemlog4jConfFile=opttomcat-5028-egeesecconflog4j-trustmanagerpropertiesclientAuth=true sslProtocol=TLS gt

[rootgums opt] tomcat-5028-egeesecbincatalinash start

Install the service

[rootgums root] cd opt

1 2 2 H O W T O M A N U A L I N S T A L L A T I O N 19

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootgums opt] wgethttpgridracfbnlgovmavengumstargzsgums-service-SNAPSHOTtargz [rootgums opt] tar -xzvf gums-service-SNAPSHOTtargz

[rootgums opt] cd gums-servicesbin[rootgums sbin] setupDatabaseUsage setupDatabase [mysql user for GUMS] [GUMS server host] [GUMS mysqlpassword]

ExamplessetupDatabase gums gumsmysitecom secret

This will make mysql authenticate as root with a password (-p) create a gumsuser with password secret authorized to connect from gumsmysitecom

[rootgums sbin] setupDatabase gums gumsmysitecom secret

[rootgums sbin] cat setupDatabasebinshMYSQLPARAM=-p

[rootgums sbin] addAdminAdds an admin in the GUMS database on localhostUsage addAdmin [DN for administrator]

ExampleaddAdmin DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345[rootgums sbin] addAdmin DC=orgDC=doegridsOU=PeopleCN=Your Self 83753

[rootgums sbin] cd [rootgums opt] ln -s gums-servicevarwartomcat-5028-egeesecwebappsgums

1 2 2 H O W T O M A N U A L I N S T A L L A T I O N 20

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltenv-entrygtltenv-entry-namegtupdateGroupsMinutesltenv-entry-namegtltenv-entry-typegtjavalangIntegerltenv-entry-typegtltenv-entry-valuegt720ltenv-entry-valuegt

ltenv-entrygt

Installing the client

[rootgums root] wgethttpgridracfbnlgovmavengumsnoarchrpmsgums-client-SNAPSHOTnoarchrpm [rootgums root] rpm -Uvh gums-client-SNAPSHOTnoarchrpm

[rootgums root] cd optgumsbin[rootgums bin] gumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given hostgenerateGridMapfile - Generate grid-mapfile for a given hostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular user

1 2 2 H O W T O M A N U A L I N S T A L L A T I O N 21

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

mapfileCache-refresh - Regerates mapfiles in the cacheupdateGroups - Contact VO servers and retrieve user lists

For help on any commandgums command --help

[rootgums bin] cat etcgums-clientpropertiesgumslocation=httpslocalhost8443gumsservicesGUMSAdmingumsauthz=httpslocalhost8443gumsservicesGUMSAuthorizationServicePort

[rootgums bin] vi etcgums-clientproperties[rootgums bin] cat etcgums-clientpropertiesgumslocation=httpsgumsmysitecom8443gumsservicesGUMSAdmingumsauthz=httpsgumsmysitecom8443gumsservicesGUMSAuthorizationServicePort

[rootgums bin] su - username[usernamegums bin] grid-proxy-init[usernamegums bin] gums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=testingtestgov

Problems

1 2 2 H O W T O M A N U A L I N S T A L L A T I O N 22

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

123 HOW TO Upgrade from 10

HOW TO Upgrade from 10 to 11

Database

Configuration file

Main differences

1 2 3 H O W T O U P G R A D E F R O M 1 0 23

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Compatibility with PRIMA

Compatibility with GUMS Client

gums generateGridMapfile DC=orgDC=doegridsOU=ServicesCN=testmysiteorg

1 2 3 H O W T O U P G R A D E F R O M 1 0 24

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

13 Using GUMS

1 3 U S I N G G U M S 25

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

131 Configuration

Configuring GUMS

1 3 1 C O N F I G U R A T I O N 26

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

mapfileCache-refresh - Regerates mapfiles in the cacheupdateGroups - Contact VO servers and retrieve user lists

For help on any commandgums command --help

[rootgums bin] cat etcgums-clientpropertiesgumslocation=httpslocalhost8443gumsservicesGUMSAdmingumsauthz=httpslocalhost8443gumsservicesGUMSAuthorizationServicePort

[rootgums bin] vi etcgums-clientproperties[rootgums bin] cat etcgums-clientpropertiesgumslocation=httpsgumsmysitecom8443gumsservicesGUMSAdmingumsauthz=httpsgumsmysitecom8443gumsservicesGUMSAuthorizationServicePort

[rootgums bin] su - username[usernamegums bin] grid-proxy-init[usernamegums bin] gums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=testingtestgov

Problems

1 2 2 H O W T O M A N U A L I N S T A L L A T I O N 22

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

123 HOW TO Upgrade from 10

HOW TO Upgrade from 10 to 11

Database

Configuration file

Main differences

1 2 3 H O W T O U P G R A D E F R O M 1 0 23

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Compatibility with PRIMA

Compatibility with GUMS Client

gums generateGridMapfile DC=orgDC=doegridsOU=ServicesCN=testmysiteorg

1 2 3 H O W T O U P G R A D E F R O M 1 0 24

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

13 Using GUMS

1 3 U S I N G G U M S 25

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

131 Configuration

Configuring GUMS

1 3 1 C O N F I G U R A T I O N 26

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

123 HOW TO Upgrade from 10

HOW TO Upgrade from 10 to 11

Database

Configuration file

Main differences

1 2 3 H O W T O U P G R A D E F R O M 1 0 23

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Compatibility with PRIMA

Compatibility with GUMS Client

gums generateGridMapfile DC=orgDC=doegridsOU=ServicesCN=testmysiteorg

1 2 3 H O W T O U P G R A D E F R O M 1 0 24

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

13 Using GUMS

1 3 U S I N G G U M S 25

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

131 Configuration

Configuring GUMS

1 3 1 C O N F I G U R A T I O N 26

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Compatibility with PRIMA

Compatibility with GUMS Client

gums generateGridMapfile DC=orgDC=doegridsOU=ServicesCN=testmysiteorg

1 2 3 H O W T O U P G R A D E F R O M 1 0 24

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

13 Using GUMS

1 3 U S I N G G U M S 25

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

131 Configuration

Configuring GUMS

1 3 1 C O N F I G U R A T I O N 26

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

13 Using GUMS

1 3 U S I N G G U M S 25

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

131 Configuration

Configuring GUMS

1 3 1 C O N F I G U R A T I O N 26

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

131 Configuration

Configuring GUMS

1 3 1 C O N F I G U R A T I O N 26

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1311 gumsconfig

gumsconfig

ltgumsgtltpersistenceFactoriesgtltpersistenceFactorygt

ltpersistenceFactoriesgtltadminUserGroupgtltgroupMappingsgtltgroupMappinggt

ltuserGroupgtltaccountMappinggt

ltgroupMappinggtltgroupMappinggt

ltuserGroupgtltcompositeAccountMappinggtltaccountMappinggtltaccountMappinggtltaccountMappinggt

ltcompositeAccountMappinggtltgroupMappinggt

ltgroupMappingsgt

lthostGroupsgtlthostGroupgt

lthostGroupsgtltgumsgt

Understanding the GUMS configuration file

persistenceFactories

1 3 1 1 G U M S C O N F I G 27

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

groupMappings

hostGroups

lthostGroupsgtlt-- RHIC gatekeepers --gtlthostGroup className=govbnlgumsCertificateHostGroup cn=starbnlgov

gtlthostGroup className=govbnlgumsCertificateHostGroup cn=phenixbnlgov

gt

lt-- ATLAS test gatekeeper --gtlthostGroup className=govbnlgumsCertificateHostGroup

cn=mygkusatlasbnlgov gt

lt-- Rest of ATLAS gatekeepers --gtlthostGroup className=govbnlgumsCertificateHostGroup cn=usatlasbnlgov

gtlthostGroupsgt

in the order specified

lthostGroup className=govbnlgumsCertificateHostGroupcn=mygkusatlasbnlgovgroups=atlasProdusatlasPoolivdglPool gt

in the order specified

The firstmatch will define the map

1 3 1 1 G U M S C O N F I G 28

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=atlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=atlasProdvoGroup=atlasvoRole=productionsslCertfile=etcgrid-securitygumscertpemsslKey=etcgrid-securitygumskeypem gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

ltgroupMapping name=usatlasPool accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=osgusatlasvoGroup=atlasusatlassslCertfile=etcgrid-securitygumscertpemsslKey=etcgrid-securitygumskeypemacceptProxiesWithoutFQAN=truegt

ltcompositeAccountMappinggtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltcompositeAccountMappinggt

ltgroupMappinggt

1 3 1 1 G U M S C O N F I G 29

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

in the order listed

persistenceFactories

ltpersistenceFactoriesgtltpersistenceFactory name=mysql

className=govbnlgumsMySQLPersistenceFactory gtltpersistenceFactoriesgt

persistenceFactory

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

mysqlfilesldap

className The class that is going to provide theimplementation for the persistence layer Itmust implement govbnlgumsPersistenceFactory

govbnlgumshibernateHibernatePersistenceFactoryorgmysiteHRDatabaseFactory

govbnlgumsHibernatePersistenceFactory

ltpersistenceFactory name=mysqlclassName=govbnlgumshibernateHibernatePersistenceFactoryhibernateconnectionusername=gumshibernateconnectionpassword=mysecret

1 3 1 1 G U M S C O N F I G 30

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

hibernateconnectionurl=jdbcmysqlmydbmysiteorgGUMS_1_1hibernateconnectiondriver_class=commysqljdbcDriverhibernatedialect=netsfhibernatedialectMySQLDialecthibernateconnectionpool_size=3 gt

adminUserGroup

groupMappings

groupMapping

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

atlasstarphenix

accountingVo The lower case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasivdgl

accountingDesc The upper case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasiVDgL

userGroup

Attribute Description Examples

className The class that is going to provide theimplementation for the user group It mustimplement govbnlgumsUserGroup

govbnlgumsLDAPGroupgovbnlgumsVOMSGroupgovbnlgumsManualGroup

govbnlgumsLDAPGroup

1 3 1 1 G U M S C O N F I G 31

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

server The LDAP server from which to retrieve theinformation

grid-vonikhefnl

query The query to be used on the server ou=usatlaso=atlasdc=eu-datagriddc=orgou=Peopleo=atlasdc=eu-datagriddc=org

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasusatlas

ltuserGroup className=govbnlgumsLDAPGroupserver=grid-vonikhefnlquery=ou=Peopleo=atlasdc=eu-datagriddc=orgpersistanceFactory=mysql name=atlas gt

govbnlgumsVOMSGroup

Attribute Description Examples

url The url of the web services for VOMS Noticethat it needs the full url of the service it wontbe constructed from the server name or vo

httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

voGroup The group defined within the VO atlastestatlasgroupsubgroup

voRole The role defined within the VO productionmyrole

1 3 1 1 G U M S C O N F I G 32

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

groupMappings

hostGroups

lthostGroupsgtlt-- RHIC gatekeepers --gtlthostGroup className=govbnlgumsCertificateHostGroup cn=starbnlgov

gtlthostGroup className=govbnlgumsCertificateHostGroup cn=phenixbnlgov

gt

lt-- ATLAS test gatekeeper --gtlthostGroup className=govbnlgumsCertificateHostGroup

cn=mygkusatlasbnlgov gt

lt-- Rest of ATLAS gatekeepers --gtlthostGroup className=govbnlgumsCertificateHostGroup cn=usatlasbnlgov

gtlthostGroupsgt

in the order specified

lthostGroup className=govbnlgumsCertificateHostGroupcn=mygkusatlasbnlgovgroups=atlasProdusatlasPoolivdglPool gt

in the order specified

The firstmatch will define the map

1 3 1 1 G U M S C O N F I G 28

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=atlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=atlasProdvoGroup=atlasvoRole=productionsslCertfile=etcgrid-securitygumscertpemsslKey=etcgrid-securitygumskeypem gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

ltgroupMapping name=usatlasPool accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=osgusatlasvoGroup=atlasusatlassslCertfile=etcgrid-securitygumscertpemsslKey=etcgrid-securitygumskeypemacceptProxiesWithoutFQAN=truegt

ltcompositeAccountMappinggtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltcompositeAccountMappinggt

ltgroupMappinggt

1 3 1 1 G U M S C O N F I G 29

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

in the order listed

persistenceFactories

ltpersistenceFactoriesgtltpersistenceFactory name=mysql

className=govbnlgumsMySQLPersistenceFactory gtltpersistenceFactoriesgt

persistenceFactory

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

mysqlfilesldap

className The class that is going to provide theimplementation for the persistence layer Itmust implement govbnlgumsPersistenceFactory

govbnlgumshibernateHibernatePersistenceFactoryorgmysiteHRDatabaseFactory

govbnlgumsHibernatePersistenceFactory

ltpersistenceFactory name=mysqlclassName=govbnlgumshibernateHibernatePersistenceFactoryhibernateconnectionusername=gumshibernateconnectionpassword=mysecret

1 3 1 1 G U M S C O N F I G 30

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

hibernateconnectionurl=jdbcmysqlmydbmysiteorgGUMS_1_1hibernateconnectiondriver_class=commysqljdbcDriverhibernatedialect=netsfhibernatedialectMySQLDialecthibernateconnectionpool_size=3 gt

adminUserGroup

groupMappings

groupMapping

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

atlasstarphenix

accountingVo The lower case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasivdgl

accountingDesc The upper case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasiVDgL

userGroup

Attribute Description Examples

className The class that is going to provide theimplementation for the user group It mustimplement govbnlgumsUserGroup

govbnlgumsLDAPGroupgovbnlgumsVOMSGroupgovbnlgumsManualGroup

govbnlgumsLDAPGroup

1 3 1 1 G U M S C O N F I G 31

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

server The LDAP server from which to retrieve theinformation

grid-vonikhefnl

query The query to be used on the server ou=usatlaso=atlasdc=eu-datagriddc=orgou=Peopleo=atlasdc=eu-datagriddc=org

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasusatlas

ltuserGroup className=govbnlgumsLDAPGroupserver=grid-vonikhefnlquery=ou=Peopleo=atlasdc=eu-datagriddc=orgpersistanceFactory=mysql name=atlas gt

govbnlgumsVOMSGroup

Attribute Description Examples

url The url of the web services for VOMS Noticethat it needs the full url of the service it wontbe constructed from the server name or vo

httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

voGroup The group defined within the VO atlastestatlasgroupsubgroup

voRole The role defined within the VO productionmyrole

1 3 1 1 G U M S C O N F I G 32

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=atlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=atlasProdvoGroup=atlasvoRole=productionsslCertfile=etcgrid-securitygumscertpemsslKey=etcgrid-securitygumskeypem gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

ltgroupMapping name=usatlasPool accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=osgusatlasvoGroup=atlasusatlassslCertfile=etcgrid-securitygumscertpemsslKey=etcgrid-securitygumskeypemacceptProxiesWithoutFQAN=truegt

ltcompositeAccountMappinggtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltcompositeAccountMappinggt

ltgroupMappinggt

1 3 1 1 G U M S C O N F I G 29

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

in the order listed

persistenceFactories

ltpersistenceFactoriesgtltpersistenceFactory name=mysql

className=govbnlgumsMySQLPersistenceFactory gtltpersistenceFactoriesgt

persistenceFactory

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

mysqlfilesldap

className The class that is going to provide theimplementation for the persistence layer Itmust implement govbnlgumsPersistenceFactory

govbnlgumshibernateHibernatePersistenceFactoryorgmysiteHRDatabaseFactory

govbnlgumsHibernatePersistenceFactory

ltpersistenceFactory name=mysqlclassName=govbnlgumshibernateHibernatePersistenceFactoryhibernateconnectionusername=gumshibernateconnectionpassword=mysecret

1 3 1 1 G U M S C O N F I G 30

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

hibernateconnectionurl=jdbcmysqlmydbmysiteorgGUMS_1_1hibernateconnectiondriver_class=commysqljdbcDriverhibernatedialect=netsfhibernatedialectMySQLDialecthibernateconnectionpool_size=3 gt

adminUserGroup

groupMappings

groupMapping

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

atlasstarphenix

accountingVo The lower case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasivdgl

accountingDesc The upper case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasiVDgL

userGroup

Attribute Description Examples

className The class that is going to provide theimplementation for the user group It mustimplement govbnlgumsUserGroup

govbnlgumsLDAPGroupgovbnlgumsVOMSGroupgovbnlgumsManualGroup

govbnlgumsLDAPGroup

1 3 1 1 G U M S C O N F I G 31

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

server The LDAP server from which to retrieve theinformation

grid-vonikhefnl

query The query to be used on the server ou=usatlaso=atlasdc=eu-datagriddc=orgou=Peopleo=atlasdc=eu-datagriddc=org

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasusatlas

ltuserGroup className=govbnlgumsLDAPGroupserver=grid-vonikhefnlquery=ou=Peopleo=atlasdc=eu-datagriddc=orgpersistanceFactory=mysql name=atlas gt

govbnlgumsVOMSGroup

Attribute Description Examples

url The url of the web services for VOMS Noticethat it needs the full url of the service it wontbe constructed from the server name or vo

httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

voGroup The group defined within the VO atlastestatlasgroupsubgroup

voRole The role defined within the VO productionmyrole

1 3 1 1 G U M S C O N F I G 32

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

in the order listed

persistenceFactories

ltpersistenceFactoriesgtltpersistenceFactory name=mysql

className=govbnlgumsMySQLPersistenceFactory gtltpersistenceFactoriesgt

persistenceFactory

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

mysqlfilesldap

className The class that is going to provide theimplementation for the persistence layer Itmust implement govbnlgumsPersistenceFactory

govbnlgumshibernateHibernatePersistenceFactoryorgmysiteHRDatabaseFactory

govbnlgumsHibernatePersistenceFactory

ltpersistenceFactory name=mysqlclassName=govbnlgumshibernateHibernatePersistenceFactoryhibernateconnectionusername=gumshibernateconnectionpassword=mysecret

1 3 1 1 G U M S C O N F I G 30

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

hibernateconnectionurl=jdbcmysqlmydbmysiteorgGUMS_1_1hibernateconnectiondriver_class=commysqljdbcDriverhibernatedialect=netsfhibernatedialectMySQLDialecthibernateconnectionpool_size=3 gt

adminUserGroup

groupMappings

groupMapping

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

atlasstarphenix

accountingVo The lower case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasivdgl

accountingDesc The upper case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasiVDgL

userGroup

Attribute Description Examples

className The class that is going to provide theimplementation for the user group It mustimplement govbnlgumsUserGroup

govbnlgumsLDAPGroupgovbnlgumsVOMSGroupgovbnlgumsManualGroup

govbnlgumsLDAPGroup

1 3 1 1 G U M S C O N F I G 31

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

server The LDAP server from which to retrieve theinformation

grid-vonikhefnl

query The query to be used on the server ou=usatlaso=atlasdc=eu-datagriddc=orgou=Peopleo=atlasdc=eu-datagriddc=org

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasusatlas

ltuserGroup className=govbnlgumsLDAPGroupserver=grid-vonikhefnlquery=ou=Peopleo=atlasdc=eu-datagriddc=orgpersistanceFactory=mysql name=atlas gt

govbnlgumsVOMSGroup

Attribute Description Examples

url The url of the web services for VOMS Noticethat it needs the full url of the service it wontbe constructed from the server name or vo

httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

voGroup The group defined within the VO atlastestatlasgroupsubgroup

voRole The role defined within the VO productionmyrole

1 3 1 1 G U M S C O N F I G 32

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

hibernateconnectionurl=jdbcmysqlmydbmysiteorgGUMS_1_1hibernateconnectiondriver_class=commysqljdbcDriverhibernatedialect=netsfhibernatedialectMySQLDialecthibernateconnectionpool_size=3 gt

adminUserGroup

groupMappings

groupMapping

Attribute Description Examples

name The name that will be used by the othercomponents to refer to thispersistenceFactory

atlasstarphenix

accountingVo The lower case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasivdgl

accountingDesc The upper case OSG accounting name thatwill be used to generate the inverse maps forthis group

atlasiVDgL

userGroup

Attribute Description Examples

className The class that is going to provide theimplementation for the user group It mustimplement govbnlgumsUserGroup

govbnlgumsLDAPGroupgovbnlgumsVOMSGroupgovbnlgumsManualGroup

govbnlgumsLDAPGroup

1 3 1 1 G U M S C O N F I G 31

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

server The LDAP server from which to retrieve theinformation

grid-vonikhefnl

query The query to be used on the server ou=usatlaso=atlasdc=eu-datagriddc=orgou=Peopleo=atlasdc=eu-datagriddc=org

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasusatlas

ltuserGroup className=govbnlgumsLDAPGroupserver=grid-vonikhefnlquery=ou=Peopleo=atlasdc=eu-datagriddc=orgpersistanceFactory=mysql name=atlas gt

govbnlgumsVOMSGroup

Attribute Description Examples

url The url of the web services for VOMS Noticethat it needs the full url of the service it wontbe constructed from the server name or vo

httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

voGroup The group defined within the VO atlastestatlasgroupsubgroup

voRole The role defined within the VO productionmyrole

1 3 1 1 G U M S C O N F I G 32

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

server The LDAP server from which to retrieve theinformation

grid-vonikhefnl

query The query to be used on the server ou=usatlaso=atlasdc=eu-datagriddc=orgou=Peopleo=atlasdc=eu-datagriddc=org

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasusatlas

ltuserGroup className=govbnlgumsLDAPGroupserver=grid-vonikhefnlquery=ou=Peopleo=atlasdc=eu-datagriddc=orgpersistanceFactory=mysql name=atlas gt

govbnlgumsVOMSGroup

Attribute Description Examples

url The url of the web services for VOMS Noticethat it needs the full url of the service it wontbe constructed from the server name or vo

httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

voGroup The group defined within the VO atlastestatlasgroupsubgroup

voRole The role defined within the VO productionmyrole

1 3 1 1 G U M S C O N F I G 32

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

matchFQAN Defines how the VOMS attribute (or role) ismatched There are 4 possible waysbull exact (default) - the FQAN in the proxy

has to be the same as what voGroup andvoRole specify

bull group - the FQAN in the proxy has to bethe same group or any subgroup role isignored

bull vo - the FQAN in the proxy has to be ofthe same vo

bull ignore - the FQAN in the proxy iscompletely ignored

exactgroupvoignore

acceptProxyWithoutFQAN Defines whether normal proxies that isnon-VOMS proxies are to be accepted Iftrue a non-VOMS proxy with the DN as partof the group will be accepted

truefalse

sslCertfile The certificate to be used to connect toVOMS

etcgrid-securityhostcertpem

sslKey The private key to be used to connect toVOMS

etcgrid-securityhostkeypem

sslKeyPasswd The password of the key to be used toconnect to VOMS Do not set if the keydoesnt have a password (such as whenusing host certificates)

mysecret

sslCAFiles The set of CA certificate files to be used toconnect to VOMS The value is a wildcardthat matches the cert files

etcgrid-securitycertificates0

persistenceFactory

The persistence layer to be used to storelocally the list of users The string must beone of the names defined within thepersistenceFactories section

mysql

name The name of the cache within the persistencefactory Refer to the specifics of thepersistence factory itself

atlasTestatlasGroupSubgroup

ltuserGroup className=govbnlgumsVOMSGroupurl=httpsvoracfbnlgov8443edg-voms-adminatlasservicesVOMSAdmin

persistanceFactory=mysql name=atlasvoGroup=atlastest

1 3 1 1 G U M S C O N F I G 33

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

govbnlgumsManualGroup

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thelist of users The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the group within the persistencefactory Refer to the specifics of thepersistence factory itself

testtestbedAadmins

ltuserGroup className=govbnlgumsManualUserGrouppersistanceFactory=mysql name=testGroup gt

compositeAccountMapping

accountMapping

1 3 1 1 G U M S C O N F I G 34

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the mapping It mustimplement govbnlgumsAccountMapping

govbnlgumsManualAccountMappergovbnlgumsGecosLdapAccountMappergovbnlgumsGecosNisAccountMappergovbnlgumsAccountPoolMappergovbnlgumsGroupAccountMapper

govbnlgumsGecosNisAccountMapper

Attribute Description Examples

jndiNisUrl The url as defined in the Java JNDI driverthat allows to specify the NIS server and thedomain

nisnisbnlgovatlas

ltaccountMapping className=govbnlgumsGecosNisAccountMapperjndiNisUrl=nisnismysiteorgdomain gt

govbnlgumsGecosLdapAccountMapper

Attribute Description Examples

jndiLdapUrl The url as defined in the Java JNDI driverthat allows to specify the LDAP server andthe domain

ldapldapbnlgovdc=usatlasdc=bnldc=gov

ltaccountMapping className=govbnlgumsGecosLdapAccountMapperjndiLdapUrl=ldapldapmysiteorgdc=domaindc=mysitedc=gov gt

govbnlgumsAccountPoolMapper

1 3 1 1 G U M S C O N F I G 35

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

persistenceFactory

The persistence layer to be used to store thepool mapping The string must be one of thenames defined within thepersistenceFactories section

mysql

name The name of the pool within the persistencefactory Refer to the specifics of thepersistence factory itself

mysitePoolosgPool

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

govbnlgumsGroupAccountMapper

Attribute Description Examples

groupName The name of the account atlastestAccount

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=atlas gt

hostGroups

hostGroup

1 3 1 1 G U M S C O N F I G 36

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

className The class that is going to provide theimplementation for the hostGroup It mustimplement govbnlgumsHostGroup

govbnlgumsCertificateHostGroup

groups A list of groupMappings in the order ofpreference To determine which group shouldbe used for a particular user GUMS will startfrom the beginning of the list until it finds amatch Therefore if there would be more thanone match (ie a user is part of more groups)the first one in the list is used

group1group2

govbnlgumsWildcardHostGroup (deprecated)

Attribute Description Examples

wildcard The wildcard for the set of hosts to beincluded The wildcard is a string where canbe substituted with any character except That is bnlgov wouldnt matchmyhostusatlasbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorg

lthostGroup className=govbnlgumsWildcardHostGroupwildcard=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

govbnlgumsCertificateHostGroup

1 3 1 1 G U M S C O N F I G 37

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Attribute Description Examples

cn The wildcard on the CN for the set of servicesto be included The cn is a string where canbe substituted with any character except or = That is bnlgov wouldnt matchmyhostusatlasbnlgov or hosttestbnlgov

myhostmysiteorgatlasmysiteorgatlasmysiteorghostmysiteorggridftpmysiteorg

dn The wildcard on the DN for the set of servicesto be included The wildcard is a string where can be substituted with any characterexcept or =

DC=orgDC=doegridsOU=ServicesCN=mycompanycom

lthostGroup className=govbnlgumsCertificateHostGroupcn=usatlasbnlgovgroups=gridexsdssuscmsusatlasGroupbtevligoivdgl gt

1 3 1 1 G U M S C O N F I G 38

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1312 Examples

Configuration examples

Mapping people from a VOMS server

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemmatchFQAN=VO acceptProxyWithoutFQAN=true gt

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatlas1 gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

Allowing ad-hoc list of people

ltgroupMapping name=testersgtltuserGroup className=govbnlgumsManualUserGroup

persistenceFactory=mysql name=testers gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

ltgroupMappinggt

1 3 1 2 E X A M P L E S 39

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=testers gt

Using account pools

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsAccountPoolMapper

persistenceFactory=mysql name=bnlPool gtltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlas gt

gt bingums pool-addRange mysql bnlPool grid0000-199

Composite mapping

1 3 1 2 E X A M P L E S 40

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltcompositeAccountMappinggt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=bnlMap gt

ltaccountMapping className=govbnlgumsAccountPoolMapperpersistenceFactory=mysql name=bnlPool gt

ltcompositeAccountMappinggtltgroupMappinggt

Mapping based on groupsroles

ltgroupMapping name=usatlas accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasvoGroup=atlasusatlas sslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgtltaccountMapping className=govbnlgumsGroupAccountMapper

groupName=usatlas1 gtltgroupMappinggt

ltgroupMapping name=usatlasProd accountingVo=usatlas accountingDesc=ATLASgtltuserGroup className=govbnlgumsVOMSGroupurl=httpsvomscernch8443edg-voms-adminatlasservicesVOMSAdminpersistenceFactory=mysql name=usatlasProdvoGroup=atlas voRole=productionsslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypemgt

1 3 1 2 E X A M P L E S 41

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltaccountMapping className=govbnlgumsGroupAccountMappergroupName=usatprod gt

ltgroupMappinggt

lthostGroup className=govbnlgumsCertificateHostGroupcn=mysitecom groups=usatlasProdusatlas gt

1 3 1 2 E X A M P L E S 42

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

132 GUMS commands

GUMS command line tools

List of client tools

List of server tools

1 3 2 G U M S C O M M A N D S 43

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1321 bingums

bingums

Authentication and authorization

bingums commands

[carcassiatestgk01 ~]$ optgumsbingumsusage gums command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for a given servicehostgenerateGridMapfile - Generate grid-mapfile for a given servicehostmanualGroup-add - Includes a DN in a groupmanualGroup-remove - Removes a DN from a groupmanualMapping-add - Adds a DN-to-username in a mappingmanualMapping-remove - Removes a DN from a mappingmapUser - Local credential used for a particular usermapfileCache-refresh - Regerates mapfiles in the cachepool-addRange - Adds accounts to an account poolupdateGroups - Contact VO servers and retrieve user listsversion - Retrieve GUMS client version

For help on any commandgums command --help

[carcassiatestgk01 ~]$ optgumsbingums mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

1 3 2 1 B I N G U M S 44

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at atime-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums mapUser

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[carcassiatestgk01 ~]$ optgumsbingums mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

1 3 2 1 B I N G U M S 45

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

gums generateGridMapfile

[carcassiatestgk01 ~]$ optgumsbingums generateGridMapfileDC=orgDC=doegridsOU=ServicesCN=gatekeepermysitecom---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[carcassiatestgk01 ~]$ optgumsbingums generateGrid3UserVoMapDC=orgDC=doegridsOU=ServicesCN=testmysitecomUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

Manual groups and mappings managements commands

1 3 2 1 B I N G U M S 46

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

ltgroupMapping name=example1 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsManualUserGroup persistenceFactory=mysql

name=group1 gtltaccountMapping className=govbnlgumsGroupAccountMapper groupName=myacc

gtltgroupMappinggt

ltgroupMapping name=example2 accountingVo=myvo accountingDesc=myVogtltuserGroup className=govbnlgumsVOMSGroup

url=httpsvomsmysitecom8443edg-voms-admin-myvoservicesVOMSAdminpersistenceFactory=mysql name=myvovoGroup=myvosslCertfile=etcgrid-securityhostcertpemsslKey=etcgrid-securityhostkeypem gt

ltaccountMapping className=govbnlgumsManualAccountMapperpersistenceFactory=mysql name=map1gt

ltgroupMappinggt

gums manualGroup-add

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-add mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualGroup-remove

[carcassiatestgk01 ~]$ optgumsbingums manualGroup-remove mysql group1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

gums manualMapping-add

1 3 2 1 B I N G U M S 47

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-add mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345 carcassi

gums manualMapping-remove

[carcassiatestgk01 ~]$ optgumsbingums manualMapping-remove mysql map1DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

Other commands

gums updateGroups

[carcassiatestgk01 ~]$ optgumsbingums updateGroups

gums pool-addRange

[carcassiatestgk01 ~]$ optgumsbingums pool-addRange mysql pool1 grid0020-40

1 3 2 1 B I N G U M S 48

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1322 bingums-host

bingums-host

Authentication and authorization

bingums-host commands

[rootmygk bin]$ gums-hostusage gums-host command [command-options]CommandsgenerateGrid3UserVoMap - Generate grid3-user-vo-maptxt for this hostgenerateGridMapfile - Generate grid-mapfile for this hostmapUser - Local credential used for a particular userversion - Retrieve GUMS client version

For help on any commandgums-host command --help

[rootmygk bin] gums-host mapUser --helpusage gums mapUser [-s SERVICEDN] [-n TIMES] [-t NREQUESTS] [-b] [-f

FQAN] [-i FQANISSUER] USERDN1 [USERDN2] Maps the grid identity to the local userOptions-s--service ltarggt DN of the service When using gums-host it defaults

to the host credential DN-f--fqan ltarggt Fully Qualified Attribute Name as it would be

selected using voms-proxy-init no extended information bydefault-t--timing ltarggt enables timing grouping the requests For example

-t 100 will give you timing information on 100 requests at a

1 3 2 2 B I N G U M S - H O S T 49

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

time-b--bypassCallout connects directly to GUMS instead of using the

callout-i--issuer ltarggt Fully Qualified Attribute Name Issuer that is the

DN of the VOMS service that issued the attribute certificate-n--ntimes ltarggt number of times the request will be repeated

--help print this message

Service mapping generation commands

gums-host mapUser

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName grid12345]

[rootmygk bin] gums-host mapUser -s DC=orgDC=doegridsOU=ServiceCN=mygkmysitecom -f myvoRole=role1 -i DC=orgDC=doegridsOU=ServiceCN=vomsmysitecom DC=orgDC=doegridsOU=PeopleCN=Gabriele Carcassi 12345

LocalId[userName special1]

gums generateGridMapfile

1 3 2 2 B I N G U M S - H O S T 50

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootmygk bin] gums-host generateGridMapfile---- members of vo usatlas ----C=CHO=CERNOU=GRIDCN=Frederik Orellana 5894 usatlas1C=CHO=CERNOU=GRIDCN=Michela Biglietti 4798 usatlas1C=CHO=CERNOU=GRIDCN=Miguel De Oliveira Branco 2423 usatlas1C=CHO=CERNOU=GRIDCN=Shulamit Moed 9840 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alden Stradling 409738 usatlas1DC=orgDC=doegridsOU=PeopleCN=Aldo Saavedra 942457 usatlas1DC=orgDC=doegridsOU=PeopleCN=Alexandre V Vaniachine 778117 usatlas1

gums generateGrid3UserVoMap

[rootmygk bin] gums-host generateGrid3UserVoMapUser-VO map comment line format of each regular line line account VO Next 2 lines with VO names same order all lowercase with case (lines startingwith voi VOc)voi usatlas ivdgl ligo btev uscms sdss gridex graseVOc ATLAS iVDgL LIGO BTeV CMS SDSS GRIDEX GRASE---- accounts for vo usatlas ----usatlas1 usatlas---- accounts for vo ivdgl ----ivdgl ivdgl

1 3 2 2 B I N G U M S - H O S T 51

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

133 GUMS logs

GUMS Logs

Administrators log (gums-service-adminlog)

Developers log

Site security log

1 3 3 G U M S L O G S 52

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

[rootatlasgrid13 log] cat etcsysconfigsyslog Options to syslogd -m 0 disables MARK messages -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r See syslogd(8) for more detailsSYSLOGD_OPTIONS=-r -m 0 Options to klogd -2 prints all kernel oops messages twice once for klogd to decode and once for processing with ksymoops -x disables all klogd processing of oops messages entirely See klogd(8) for more detailsKLOGD_OPTIONS=-x

1 3 3 G U M S L O G S 53

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1331 Logging implementation details

Log implementation details

Administrators log

Developers log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 54

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Site security log

1 3 3 1 L O G G I N G I M P L E M E N T A T I O N D E T A I L S 55

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

14 Site integration

Integrating GUMS and site services

if you choose to print this you might alsowant to print the code to which the online version of this article links

Changing storage for GUMS data

1 4 S I T E I N T E G R A T I O N 56

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

throw new javalangUnsupportedOperationException()

Creating a mapping policy

ltaccountMapping className=govbnlgumsGroupAccountMapper groupName=test gt

1 4 S I T E I N T E G R A T I O N 57

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Creating a group

throw new javalangUnsupportedOperationException(Group cannot be enumerated)

1 4 S I T E I N T E G R A T I O N 58

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

15 FAQ

Frequently Asked Questions

General

Using GUMS

Building GUMS

Comparing GUMS with other tools

General

1 5 F A Q 59

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Using GUMS

Building GUMS

Comparing GUMS with other tools

1 5 F A Q 60

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 5 F A Q 61

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

16 Troubleshooting FAQ

Troubleshooting FAQ

General tips

Access problems

General tips

1 6 T R O U B L E S H O O T I N G F A Q 62

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Access problems

GUMS encountered an errorError Type govbnlgumsadminAuthorizationDeniedExceptionError Message Authorization denied

VDT_LOCATIONapachelogs[Tue Jun 07 150245 2005] [error] Certificate Verification Error (20) unableto get local issuer certificate

1 6 T R O U B L E S H O O T I N G F A Q 63

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

17 Changes

Release History

Version Date Description

110 2005-07-20

101 2005-04-07

100 2005-03-16

071 2005-02-01

07 2005-01-14

061 2004-08-10

06 2004-07-01

05 2004-05-20

undetermined before March 2004

Release 110 - 2005-07-20

Type Changes By

Review GUMS maven structure (ie plug-independencies projectxml)

carcassi

Fix tomcat deployment in build (ie devserver being down once in a while)

carcassi

Mapping according to Gecos field available inboth NIS and LDAP

carcassi

One can filter on the full CN of a hostcertificate

carcassi

The Service Certificate DN is now theidentifier for hosts and machines

carcassi

Release version in command line carcassi

1 7 C H A N G E S 64

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Using GUMS

Building GUMS

Comparing GUMS with other tools

1 5 F A Q 60

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 5 F A Q 61

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

16 Troubleshooting FAQ

Troubleshooting FAQ

General tips

Access problems

General tips

1 6 T R O U B L E S H O O T I N G F A Q 62

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Access problems

GUMS encountered an errorError Type govbnlgumsadminAuthorizationDeniedExceptionError Message Authorization denied

VDT_LOCATIONapachelogs[Tue Jun 07 150245 2005] [error] Certificate Verification Error (20) unableto get local issuer certificate

1 6 T R O U B L E S H O O T I N G F A Q 63

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

17 Changes

Release History

Version Date Description

110 2005-07-20

101 2005-04-07

100 2005-03-16

071 2005-02-01

07 2005-01-14

061 2004-08-10

06 2004-07-01

05 2004-05-20

undetermined before March 2004

Release 110 - 2005-07-20

Type Changes By

Review GUMS maven structure (ie plug-independencies projectxml)

carcassi

Fix tomcat deployment in build (ie devserver being down once in a while)

carcassi

Mapping according to Gecos field available inboth NIS and LDAP

carcassi

One can filter on the full CN of a hostcertificate

carcassi

The Service Certificate DN is now theidentifier for hosts and machines

carcassi

Release version in command line carcassi

1 7 C H A N G E S 64

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

1 5 F A Q 61

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

16 Troubleshooting FAQ

Troubleshooting FAQ

General tips

Access problems

General tips

1 6 T R O U B L E S H O O T I N G F A Q 62

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Access problems

GUMS encountered an errorError Type govbnlgumsadminAuthorizationDeniedExceptionError Message Authorization denied

VDT_LOCATIONapachelogs[Tue Jun 07 150245 2005] [error] Certificate Verification Error (20) unableto get local issuer certificate

1 6 T R O U B L E S H O O T I N G F A Q 63

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

17 Changes

Release History

Version Date Description

110 2005-07-20

101 2005-04-07

100 2005-03-16

071 2005-02-01

07 2005-01-14

061 2004-08-10

06 2004-07-01

05 2004-05-20

undetermined before March 2004

Release 110 - 2005-07-20

Type Changes By

Review GUMS maven structure (ie plug-independencies projectxml)

carcassi

Fix tomcat deployment in build (ie devserver being down once in a while)

carcassi

Mapping according to Gecos field available inboth NIS and LDAP

carcassi

One can filter on the full CN of a hostcertificate

carcassi

The Service Certificate DN is now theidentifier for hosts and machines

carcassi

Release version in command line carcassi

1 7 C H A N G E S 64

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

16 Troubleshooting FAQ

Troubleshooting FAQ

General tips

Access problems

General tips

1 6 T R O U B L E S H O O T I N G F A Q 62

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Access problems

GUMS encountered an errorError Type govbnlgumsadminAuthorizationDeniedExceptionError Message Authorization denied

VDT_LOCATIONapachelogs[Tue Jun 07 150245 2005] [error] Certificate Verification Error (20) unableto get local issuer certificate

1 6 T R O U B L E S H O O T I N G F A Q 63

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

17 Changes

Release History

Version Date Description

110 2005-07-20

101 2005-04-07

100 2005-03-16

071 2005-02-01

07 2005-01-14

061 2004-08-10

06 2004-07-01

05 2004-05-20

undetermined before March 2004

Release 110 - 2005-07-20

Type Changes By

Review GUMS maven structure (ie plug-independencies projectxml)

carcassi

Fix tomcat deployment in build (ie devserver being down once in a while)

carcassi

Mapping according to Gecos field available inboth NIS and LDAP

carcassi

One can filter on the full CN of a hostcertificate

carcassi

The Service Certificate DN is now theidentifier for hosts and machines

carcassi

Release version in command line carcassi

1 7 C H A N G E S 64

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Access problems

GUMS encountered an errorError Type govbnlgumsadminAuthorizationDeniedExceptionError Message Authorization denied

VDT_LOCATIONapachelogs[Tue Jun 07 150245 2005] [error] Certificate Verification Error (20) unableto get local issuer certificate

1 6 T R O U B L E S H O O T I N G F A Q 63

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

17 Changes

Release History

Version Date Description

110 2005-07-20

101 2005-04-07

100 2005-03-16

071 2005-02-01

07 2005-01-14

061 2004-08-10

06 2004-07-01

05 2004-05-20

undetermined before March 2004

Release 110 - 2005-07-20

Type Changes By

Review GUMS maven structure (ie plug-independencies projectxml)

carcassi

Fix tomcat deployment in build (ie devserver being down once in a while)

carcassi

Mapping according to Gecos field available inboth NIS and LDAP

carcassi

One can filter on the full CN of a hostcertificate

carcassi

The Service Certificate DN is now theidentifier for hosts and machines

carcassi

Release version in command line carcassi

1 7 C H A N G E S 64

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

17 Changes

Release History

Version Date Description

110 2005-07-20

101 2005-04-07

100 2005-03-16

071 2005-02-01

07 2005-01-14

061 2004-08-10

06 2004-07-01

05 2004-05-20

undetermined before March 2004

Release 110 - 2005-07-20

Type Changes By

Review GUMS maven structure (ie plug-independencies projectxml)

carcassi

Fix tomcat deployment in build (ie devserver being down once in a while)

carcassi

Mapping according to Gecos field available inboth NIS and LDAP

carcassi

One can filter on the full CN of a hostcertificate

carcassi

The Service Certificate DN is now theidentifier for hosts and machines

carcassi

Release version in command line carcassi

1 7 C H A N G E S 64

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

If gumsconfig isnt found the first time atomcat restart was needed

carcassi

Minor updates to the web interface carcassi

VOMS Admin v10x (glite) compatibility carcassi

Support for mapfile cache terminated webservice door only

carcassi

FQAN allows for - _ and in the vo grouprole and capability

carcassi

DB reviewed better indexing and transationuse

carcassi

Updating from VOMS is no longer blocking carcassi

Release 101 - 2005-04-07

Type Changes By

Including setupDatabase with the modificationmade for VDT

carcassi

gums-client rpm now obsoletes gums-hostand gums-admin (no need to remove package)

carcassi

Error code from scripts was incorrect thatcaused cron job to update maps in case oferror too

carcassi

Release 100 - 2005-03-16

Type Changes By

Repackaging of the client componentsmerged admin and host and named it client

carcassi

Fixed minor issues with authorizationobligations for storage system

mlorch

Double add to a manual group now fails carcassi

1 7 C H A N G E S 65

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script that creates the database and changesthe configuration accordingly

carcassi

Repackaging of the service component carcassi

Server identity is now gums host name carcassi

GUMS accept new style proxies carcassi

The accounts in the pool are used inalphabetical order

carcassi

Inverse map is now generated exploring allthe DNFQAN combinations

carcassi

Gridmapfile is generated simulating userswith no FQAN

carcassi

LDAP integration for primary gid change atBNL once an account is assigned

carcassi

Release 071 - 2005-02-01

Type Changes By

Log names review so that they both client andserver can stay (through links) in the samedirectory

carcassi

NIS update is done every hour and is nowthread safe

carcassi

Log file permission for the command line toolsare set so multiple users can use it (importantfor admin)

carcassi

GUMS host can now be used for stresstesting and timing the server response

carcassi

Added connection pooling on mysql server carcassi

Solved a race condition that would makeGUMS hang in some circumstances

carcassi

AuthZ callout without GT3 both client andserver stubs

mlorch

Added code for Privilege Project in GUMSrepository and build process

carcassi

1 7 C H A N G E S 66

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Release 07 - 2005-01-14

Type Changes By

Better logging server logs all commands withboth input and output

carcassi

More complete command line interface carcassi

Web service implementation carcassi

HostWildcards can be more than one commaseparated

carcassi

Support for VOMS Fully Qualified Attributenames

carcassi

AuthZ service to be contacted by Globuscallout

carcassi

Support for grid3-user-vo-maptxt generation carcassi

Many many other refinements carcassi

Release 061 - 2004-08-10

Type Changes By

Nightly build and reporting with Maven carcassi

Removed all the old code from 06 carcassi

Better log system logs for developerresource admin and site admin in place

carcassi

Ability to retrieve groups from within a VOMSserver (finally)

carcassi

No more duplication in the mapfiles carcassi

Improved database caching for grid-mapfileyou specify on the server which gatekeepermaps should be generated

carcassi

Improved error handling (ie a failed updateon one group doesnt block the others)

carcassi

1 7 C H A N G E S 67

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Installation through RPMs (cron jobs installedautomatically)

carcassi

Unit tests to Grid3 VOs included carcassi

LDAP access improved can access LCG devVO

carcassi

Release 06 - 2004-07-01

Type Changes By

XML configuration file for mapping policy carcassi

Log infrastructure carcassi

More flexible architecture carcassi

Decoupled grid-mapfile generation fromdatabase caching for distribution ongatekeeper

carcassi

Web interface to generate grid-mapfiles andmap users

carcassi

Better command line interfaces (feel like Unixcommands)

carcassi

Release 05 - 2004-05-20

Type Changes By

GUMS in production at BNL carcassi

NISMapperretrieves the GECOS field andmatches with certificate CN

carcassi

Architecture to allow different type ofmappings for different hosts

carcassi

Release undetermined - before March 2004

1 7 C H A N G E S 68

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D

Type Changes By

Script to fetch user from VOMS dtyu

Script to map user to local account tomw

1 7 C H A N G E S 69

copy 2 0 0 3 B R O O K H A V E N N A T I O N A L L A B O R A T O R Y bull A L L R I G H T S R E S E R V E D