Set up gLExec with SCAS

Setting up gLExec on the worker node to query SCAS for authorization decisions is preferably done through YAIM, but some set-ups require manual configuration as outlined below.

This page is part of the guide on HOWTO set up gLExec on the worker node.

Installation

For the installation and configuration of SCAS, see the gLite page on SCAS[1].

For the installation of gLExec on the worker node, see the release notes and the installation manual.

Typical gLite installation is done with

wget -O /etc/yum.repos.d/glite-GLEXEC_wn.repo http://grid-deployment.web.cern.ch/grid-deployment/glite/repos/3.2/glite-GLEXEC_wn.repo
yum install glite-GLEXEC_wn

Configuration with YAIM

Please see the YAIM guide for general instructions on using YAIM, and the list of variables that need to be set in site-info.def, or services/glite-glexec_wn.

Important variables:

GLEXEC_WN_OPMODE=setuid
GLEXEC_WN_SCAS_ENABLED=yes
SCAS_ENDPOINTS="https://scas1.example.com:8443 https://scas2.example.com:8443"

In this example there are two endpoints, that gLExec will use in a randomized fashion to even the load. It will try all the endpoints in case the first one doesn't respond.

After setting the variables, running YAIM is usually done as follows:

/opt/glite/yaim/bin/yaim -c -s site-info.def -n TORQUE_client -n WN -n GLEXEC_wn

Manual configuration

Simple configuration. The following assumes you have pool accounts that are expected to use gLExec named pilota001, pilota002, etc. and pilotb001, etc.

Edit /opt/glite/etc/glexec.conf as follows. Make sure the file's mode is

-rw-r----- 1 root glexec  /opt/glite/etc/glexec.conf

[glexec]
silent_logging               = no
log_level                    = 0
user_white_list              = .pilota,.pilotb
linger                       = yes
lcmaps_db_file               = /opt/glite/etc/lcmaps/lcmaps-glexec.db
lcmaps_log_file              = /var/log/glexec/lcas_lcmaps.log
lcmaps_debug_level           = 0
lcmaps_log_level             = 1
lcmaps_get_account_policy    = glexec_get_account
lcmaps_verify_account_policy = glexec_verify_account

lcas_db_file                 = /opt/glite/etc/lcas/lcas-glexec.db
lcas_log_file                = /var/log/glexec/lcas_lcmaps.log
lcas_debug_level             = 0
lcas_log_level               = 1
user_identity_switch_by      = lcmaps
preserve_env_variables       = no
log_destination              = file
log_file                     = /var/log/glexec/glexec_log

Place this in /opt/glite/etc/lcas/lcas-glexec.db:

pluginname=/opt/glite/lib64/modules/lcas_userban.mod,pluginargs=/opt/glite/etc/lcas/ban_users.db

Place this in /opt/glite/etc/lcmaps/lcmaps-glexec.db:

path = /opt/glite/lib64/modules
verify_proxy = "lcmaps_verify_proxy.mod" 
               " -certdir /etc/grid-security/certificates/"
               " --allow-limited-proxy"

posix_enf = "lcmaps_posix_enf.mod"
            " -maxuid 1"
            " -maxpgid 1"
            " -maxsgid 32"

scasclient = "lcmaps_scas_client.mod"
             " -capath /etc/grid-security/certificates/"
             "--endpoint https://scas1.example.com:8443 --endpoint https://scas2.example.com:8443"
             " -resourcetype wn"
             " -actiontype execute-now"

glexec_get_account:
verify_proxy -> scasclient
scasclient -> posix_enf