GridWiki - Recent changes [en]

NDPF System Functions

2012-05-16T08:12:15Z

GridSRV:

GLExec

2012-05-15T09:59:24Z

← Older revision		Revision as of 09:59, 15 May 2012
Line 4:		Line 4:

	The latest stable versions released are:		The latest stable versions released are:
-	* gLite: 0.8.1	+	* gLite-3.2: 0.8.1
-	* EMI: 0.8.10	+	* EMI-1: 0.8.10

	Latest version available: 0.9.6, to be released in EMI-2 and OSG.		Latest version available: 0.9.6, to be released in EMI-2 and OSG.

EES installation instructions

2012-05-15T09:17:38Z

Basic installation:

← Older revision		Revision as of 09:17, 15 May 2012
Line 13:		Line 13:
	* You can use the [http://software.nikhef.nl/security/nagios-plugins-ees/ EES nagios plugin] to test it is working correctly. When using the EMI repository you can do a		* You can use the [http://software.nikhef.nl/security/nagios-plugins-ees/ EES nagios plugin] to test it is working correctly. When using the EMI repository you can do a
	yum install nagios-plugins-emi.ees		yum install nagios-plugins-emi.ees
		+	/usr/libexec/grid-monitoring/probes/nagios-plugins-emi.ees/check_ees
		+	When using the (more) EPEL compliant build from the [http://software.nikhef.nl/dist/redhat/testing/el5/mwsec/ Nikhef testing repository] run
		+	yum install nagios-plugins-ees
		+	/usr/lib64/nagios/plugins/check_ees

	== Installation of Argus Obligation Handler ==		== Installation of Argus Obligation Handler ==

User:Wvengen@nikhef.nl/Globus certificates for Users

2012-05-15T09:06:44Z

Approaches: use relative link

← Older revision		Revision as of 09:06, 15 May 2012
(One intermediate revision not shown)
Line 20:		Line 20:
	* [http://wiki.ngs.ac.uk/index.php?title=Libbrowser libbrowser]: access browser certificates from Java		* [http://wiki.ngs.ac.uk/index.php?title=Libbrowser libbrowser]: access browser certificates from Java
	* Storing the user's key and certificate on a remote secure server. This would allow seamsless integration with web-based portals (though it would need to be updated and maintained).		* Storing the user's key and certificate on a remote secure server. This would allow seamsless integration with web-based portals (though it would need to be updated and maintained).
-	* Use a robot certificate for each application. The user then interacts with a portal with its own authentication. ([http://www.nikhef.nl/~janjust/presentations/poster-egee07.pdf 1]) ([https://www.egi.eu/indico/contributionDisplay.py?sessionId=20&contribId=51&confId=207 2]) This is persued in our [https://github.com/wvengen/LGIportal LGIportal] project, together with [~~http://www.nikhef.nl/pub/projects/grid/gridwiki/index.php/LGI_Pilotjob_Framework~~ lgipilot].	+	* Use a robot certificate for each application. The user then interacts with a portal with its own authentication. ([http://www.nikhef.nl/~janjust/presentations/poster-egee07.pdf 1]) ([https://www.egi.eu/indico/contributionDisplay.py?sessionId=20&contribId=51&confId=207 2]) This is persued in our [https://github.com/wvengen/LGIportal LGIportal] project, together with the [[LGI Pilotjob Framework\|lgipilot]].

	==Operating system support==		==Operating system support==
	* Linux		* Linux
	** GTK		** GTK
-	*** [http://~~library~~.gnome.org/devel/gp/stable/ GP11] PKCS#11	+	*** [http://developer.gnome.org/devel/gp11/stable/ GP11] PKCS#11
-	*** [http://~~library~~.gnome.org/devel/libcryptui/stable/ libcryptui] certificate support	+	*** [http://developer.gnome.org/devel/libcryptui/stable/ libcryptui] certificate support
	* Mac OS X		* Mac OS X
	* Windows		* Windows

EMI-2 gLExec release test report

2012-05-14T14:08:04Z

Savannah: https://savannah.cern.ch/bugs/?93187:

← Older revision		Revision as of 14:08, 14 May 2012
(8 intermediate revisions not shown)
Line 247:		Line 247:
	DESCRIPTION: glexec fails with a misleading error message if the configuration cannot be read		DESCRIPTION: glexec fails with a misleading error message if the configuration cannot be read

-	REPRODUCE: install glexec in setuid mode (-r-sr-sr-s root.glexec) and the config file as (-r--r----- root.root)	+	REPRODUCE: install glexec in setuid mode
		+	-r-sr-sr-s root.glexec /usr/sbin/glexec
		+	and the config file as
		+	-r--r----- root.root /etc/glexec.conf

	CHECK: Error message		CHECK: Error message

-	FAILED: Get “[gLExec]: The user, uid=502(tester), is not whitelisted. The calling user account is not privileged to execute and use gLExec.”	+	FAILED: Get
		+	[gLExec]: The user, uid=502(tester), is not whitelisted. The calling user account is not privileged to execute and use gLExec.

-	PASSED: [gLExec]: User tester (uid=502) is not whitelisted, i.e. may not invoke gLExec.	+	PASSED:
-	If this is unexpected, ask the sysadmin to check the syslog and the	+	[gLExec]: User tester (uid=502) is not whitelisted, i.e. may not invoke gLExec.
-	permissions of the config file.	+	If this is unexpected, ask the sysadmin to check the syslog and the
		+	permissions of the config file.

	==== Savannah: https://savannah.cern.ch/bugs/?77767 ====		==== Savannah: https://savannah.cern.ch/bugs/?77767 ====
Line 272:		Line 277:

	REPRODUCE:		REPRODUCE:
-	install and configure yaim-glexec-wn	+	* install and configure yaim-glexec-wn
-	configure site-info.def to use ARGUS: set	+	* configure site-info.def to use ARGUS: set in <tt>siteinfo/services/glite-glexec_wn</tt>
	GLEXEC_WN_ARGUS_ENABLED=yes		GLEXEC_WN_ARGUS_ENABLED=yes
-	~~in siteinfo/services/glite-glexec_wn~~	+	* run YAIM
-	run YAIM	+
-	~~CHECK: contents of /etc/glexec.conf~~	+

-	~~FAILED~~: ~~configuration file contains use_lcas = yes~~	+	CHECK: contents of <tt>/etc/glexec.conf</tt>

-	PASSED: configuration file must contain use_lcas = no (default is to use LCAS). ~~(this test passed; where do I record this?)~~	+	FAILED: configuration file contains <tt>use_lcas = yes</tt>
		+
		+	PASSED: configuration file must contain <tt>use_lcas = no</tt> (default is to use LCAS).

	==== Savannah: https://savannah.cern.ch/bugs/?86453 ====		==== Savannah: https://savannah.cern.ch/bugs/?86453 ====
Line 319:		Line 324:
	REPRODUCE: Run YAIM to observe the configuration in the glexec.conf and lcmaps.db		REPRODUCE: Run YAIM to observe the configuration in the glexec.conf and lcmaps.db

-	CHECK: Check if the posix_enf plugin is NOT configured in the lcmaps.db and that the glexec.conf has the configuration: user_identity_switch_by = {glexec,lcmaps} to use ‘glexec’ as the ‘switch by’ setting.	+	CHECK: Check if the posix_enf plugin is NOT configured in the lcmaps.db and that the glexec.conf has the configuration: user_identity_switch_by = {glexec,lcmaps} to use ‘glexec’ as the ‘switch by’ setting or has no setting at all (default is switch by glexec).

	FAILED: If the configuration in the glexec.conf or lcmaps.db does not reflect a working ‘user_identity_switch_by = glexec’ configuration		FAILED: If the configuration in the glexec.conf or lcmaps.db does not reflect a working ‘user_identity_switch_by = glexec’ configuration
Line 337:		Line 342:

	REPRODUCE: run glexec and flood it with signals after a very small delay, such that it traps signals e.g. during a syslog call. E.g. run several times:		REPRODUCE: run glexec and flood it with signals after a very small delay, such that it traps signals e.g. during a syslog call. E.g. run several times:
-	#!/bin/bash	+	<pre>
-	export GLEXEC_CLIENT_CERT=/tmp/x509up_u`id -u`	+	#!/bin/bash
-	export X509_USER_PROXY=/tmp/x509up_u`id -u`	+	export GLEXEC_CLIENT_CERT=/tmp/x509up_u`id -u`
-	/usr/sbin/glexec /usr/bin/id -a &	+	export X509_USER_PROXY=/tmp/x509up_u`id -u`
-	pid=$!	+	/usr/sbin/glexec /usr/bin/id -a &
-	ps -fp $pid	+	pid=$!
-	for ((i=1; i<100; i++));do	+	ps -fp $pid
-	s=$((i%64+1))	+	for ((i=1; i<100; i++));do
-	((s==9 \|\| s==19 \|\| s==32 \|\| s==33)) && s=11	+	s=$((i%64+1))
-	kill -$s $pid	+	((s==9 \|\| s==19 \|\| s==32 \|\| s==33)) && s=11
-	done	+	kill -$s $pid
		+	done
		+	</pre>

	CHECK: gLExec does not hang up, even after many times.		CHECK: gLExec does not hang up, even after many times.

-	FAIL: gLExec locks up and can only be killed with a kill -9, an strace will show gLExec hangs is a lock.	+	FAIL: gLExec locks up and can only be killed with a kill -9, an strace will show gLExec hangs in a lock.

	PASSED: gLExec will get interrupted or killed in a clean way.		PASSED: gLExec will get interrupted or killed in a clean way.
Line 377:		Line 384:
	CHECK: with preserve_env_variables there should be no problem in running glexec		CHECK: with preserve_env_variables there should be no problem in running glexec

-	FAILED: [gLExec]: Premature exit due to signal, signal: 11	+	FAILED:
		+	[gLExec]: Premature exit due to signal, signal: 11

-	PASSED: no error message	+	PASSED: no error message, normal execution.

	==== Savannah: https://savannah.cern.ch/bugs/?92812 ====		==== Savannah: https://savannah.cern.ch/bugs/?92812 ====
Line 411:		Line 419:
	==== Savannah: https://savannah.cern.ch/bugs/?93187 ====		==== Savannah: https://savannah.cern.ch/bugs/?93187 ====
	DESCRIPTION: glexec-configure script contains some errors		DESCRIPTION: glexec-configure script contains some errors
		+
		+	REPRODUCE: run
		+	/usr/sbin/glexec-configure -o /tmp/glexec.conf -d /tmp/lcmaps.db argus argus.testbed
		+
		+	CHECK: the contents of /tmp/glexec.conf and /tmp/lcmaps.db
		+
		+	FAIL: e.g. endpoint line in pepc entry is missing a " at the end of the line
		+
		+	PASS: glexec-configure produces valid, working glexec.conf and lcmaps.db files

	==== Savannah: https://savannah.cern.ch/bugs/?93190 ====		==== Savannah: https://savannah.cern.ch/bugs/?93190 ====

EMI-2 gLExec release test report

2012-05-14T13:31:01Z

Savannah: https://savannah.cern.ch/bugs/?91835:

Show changes

Testbed Update Plan

2012-05-10T10:12:00Z

Installing Debian on blade 13 and 14 with Fiber Channel:

← Older revision		Revision as of 10:12, 10 May 2012
Line 431:		Line 431:
	wwid 3600508e000000000d6c6de44c0416105		wwid 3600508e000000000d6c6de44c0416105
	}		}
		+
		+
		+	==== A bonnie test of a VM with disk on local disk vs. a VM with disk on FC: ====
		+
		+	* lofarwn.testbed had its disk locally
		+	Version 1.03e ------Sequential Output------ --Sequential Input- --Random-
		+	-Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
		+	Machine Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP /sec %CP
		+	lofarwn 4G 20869 35 30172 5 23198 6 45957 85 510971 84 +++++ +++
		+	------Sequential Create------ --------Random Create--------
		+	-Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
		+	files /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP
		+	16 16759 99 +++++ +++ +++++ +++ 16810 100 +++++ +++ +++++ +++
		+	lofarwn,4G,20869,35,30172,5,23198,6,45957,85,510971,84,+++++,+++,16,16759,99,+++++,+++,+++++,+++,16810,100,+++++,+++,+++++,+++
		+	* ige-cert.testbed has disk on LVM via FC.
		+	Version 1.03e ------Sequential Output------ --Sequential Input- --Random-
		+	-Per Chr- --Block-- -Rewrite- -Per Chr- --Block-- --Seeks--
		+	Machine Size K/sec %CP K/sec %CP K/sec %CP K/sec %CP K/sec %CP /sec %CP
		+	ige-cert 4G 53384 96 216611 37 102283 24 51060 95 689474 79 +++++ +++
		+	------Sequential Create------ --------Random Create--------
		+	-Create-- --Read--- -Delete-- -Create-- --Read--- -Delete--
		+	files /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP /sec %CP
		+	16 12676 100 +++++ +++ +++++ +++ 12761 99 +++++ +++ +++++ +++
		+	ige-cert,4G,53384,96,216611,37,102283,24,51060,95,689474,79,+++++,+++,16,12676,100,+++++,+++,+++++,+++,12761,99,+++++,+++,+++++,+++

User:Wvengen@nikhef.nl/OAuth2

2012-05-10T08:26:49Z

Documents: now proper flow diagrams link

← Older revision		Revision as of 08:26, 10 May 2012
(7 intermediate revisions not shown)
Line 1:		Line 1:
	For CLARIN's [[User:Wvengen@nikhef.nl/Security_for_web_services\|security for web services]] OAuth 2.0 was identified as one of the possible solutions. We are currently creating a test service.		For CLARIN's [[User:Wvengen@nikhef.nl/Security_for_web_services\|security for web services]] OAuth 2.0 was identified as one of the possible solutions. We are currently creating a test service.
		+
		+	Discussing takes place at the mailing-list [https://mailman.nikhef.nl/mailman/listinfo/biggrid-clarin-security-discuss biggrid-clarin-security-discuss].

	[[Media:Report-devel-status-A004.pdf\|Status report (A004)]]		[[Media:Report-devel-status-A004.pdf\|Status report (A004)]]
Line 12:		Line 14:
	* tokens: [http://msdn.microsoft.com/en-us/library/windowsazure/gg185950.aspx Simple Web Token (SWT)] [http://tools.ietf.org/html/draft-jones-json-web-token JSON Web Token (JWT)]		* tokens: [http://msdn.microsoft.com/en-us/library/windowsazure/gg185950.aspx Simple Web Token (SWT)] [http://tools.ietf.org/html/draft-jones-json-web-token JSON Web Token (JWT)]
	* [http://2011.cloudidentitysummit.com/local/upload/NYC-Synergies-of-Cloud-Identity.pdf Synergies of Cloud Identity] - relating SAML, OAuth, OpenID Connect, UMA		* [http://2011.cloudidentitysummit.com/local/upload/NYC-Synergies-of-Cloud-Identity.pdf Synergies of Cloud Identity] - relating SAML, OAuth, OpenID Connect, UMA
-	* some good [https://github.com/~~jricher~~/OpenID-Connect-Java-Spring-Server/tree/master/docs flow diagrams] on OAuth2 and OpenID Connect	+	* some good [https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/tree/master/docs flow diagrams] on OAuth2 and OpenID Connect
	* Nested invocation		* Nested invocation
	** [http://travisspencer.com/blog/2011/10/calling-an-oauth-10a-api-from.html OAuth 1.0a from 2.0]		** [http://travisspencer.com/blog/2011/10/calling-an-oauth-10a-api-from.html OAuth 1.0a from 2.0]
Line 31:		Line 33:
	** [http://www.dailymile.com/api/documentation/oauth dailymile] draft 11, code+implicit flow		** [http://www.dailymile.com/api/documentation/oauth dailymile] draft 11, code+implicit flow
	** [http://support.thelevelup.com/entries/20927761-api-documentation LevelUp] draft 11, owner flow		** [http://support.thelevelup.com/entries/20927761-api-documentation LevelUp] draft 11, owner flow
-	** Deutsche Telekom (see [http://www.ietf.org/mail-archive/web/oauth/current/msg06844.html here])	+	** Deutsche Telekom (see [http://www.ietf.org/mail-archive/web/oauth/current/msg06844.html here] and [http://www.developergarden.com/de/apis/blog-events/blog/artikel/article/developer-garden-bei-der-web-devcon-1718-oktober-2011-hamburg/ here]) draft 10, (revoke,bulk,) ''([http://www.developergarden.com/index.php?id=511&L=0 not yet] fully in use)''
	** Pinterest (see [http://www.programmableweb.com/api/pinterest here], [https://github.com/kellan/pinterest.api.php here] and [http://tijn.bo.lt/pinterest-api here]) code flow		** Pinterest (see [http://www.programmableweb.com/api/pinterest here], [https://github.com/kellan/pinterest.api.php here] and [http://tijn.bo.lt/pinterest-api here]) code flow
	** Yapp		** Yapp
Line 41:		Line 43:
	** [https://developer.yammer.com/api/oauth2.html Yammer] draft 20, code+implicit flow		** [https://developer.yammer.com/api/oauth2.html Yammer] draft 20, code+implicit flow
	** [http://developer.eventbrite.com/doc/authentication/oauth2/ Eventbrite] code+implicit flow		** [http://developer.eventbrite.com/doc/authentication/oauth2/ Eventbrite] code+implicit flow
		+	** [https://developers.addtotrip.co/home/Auth Add to Trip] code+implicit flow ''(perhaps not fully compliant, SDK omits the response_type parameter)''
		+	** [https://live.numote.com/developers/docs Numote Live]
	* Google's [https://code.google.com/oauthplayground/ OAuth playground], for client-side testing		* Google's [https://code.google.com/oauthplayground/ OAuth playground], for client-side testing