Difference between revisions of "Creating Pool Accounts With LDAP"

From PDP/Grid Wiki
Jump to navigationJump to search
m
m
Line 2: Line 2:
 
The list of valid users of the NDPF is kept in a central LDAP directory, currently hosted on <tt>trog.nikhef.nl</tt>. This directory contains both the "local" users as well as all poolaccounts and all automount map entries. The structure of the directory is:
 
The list of valid users of the NDPF is kept in a central LDAP directory, currently hosted on <tt>trog.nikhef.nl</tt>. This directory contains both the "local" users as well as all poolaccounts and all automount map entries. The structure of the directory is:
  
  + dc=farmnet,dc=nikhef,dc=nl
+
+ dc=farmnet,dc=nikhef,dc=nl
    |
+
  |
    + ou=Managers
+
  + ou=Managers
    + ou=LocalGroups (<i>contains all groups!</i>)
+
  + ou=LocalGroups (<i>contains all groups!</i>)
    + ou=LocalUsers
+
  + ou=LocalUsers
    + ou=Poolaccounts
+
  + ou=Poolaccounts
    + ou=automount
+
  + ou=automount
      |
+
    |
      + ou=auto.home
+
    + ou=auto.home
      + ou=lcgprod
+
    + ou=lcgprod
        |
+
      |
        + ou=auto.sedata
+
      + ou=auto.sedata
        + ou=auto.share
+
      + ou=auto.share
        + ou=auto.stage
+
      + ou=auto.stage
        + ou=auto.sedata2
+
      + ou=auto.sedata2
  
 
The <tt>ou=Poolaccounts</tt> entry contains the list of all pool accounts, without any further hierarchy. Each account is named by its <tt>uid</tt>, and is of objectClass "posixAccount". For each account named here, there should be a corresponsing entry in the <tt>ou=pool,ou=auto.home,ou=automount</tt> branch of the tree as well (of objectClass "automount").  
 
The <tt>ou=Poolaccounts</tt> entry contains the list of all pool accounts, without any further hierarchy. Each account is named by its <tt>uid</tt>, and is of objectClass "posixAccount". For each account named here, there should be a corresponsing entry in the <tt>ou=pool,ou=auto.home,ou=automount</tt> branch of the tree as well (of objectClass "automount").  
Line 39: Line 39:
 
Its use is best explained by an example:
 
Its use is best explained by an example:
  
  ./gen_poolacc_ldif --vo atlas -g 2002 -b 43000 -n 200
+
./gen_poolacc_ldif --vo atlas -g 2002 -b 43000 -n 200
  
 
will spit out lots of ldif, like  
 
will spit out lots of ldif, like  
  
  dn: uid=atlas000, ou=PoolAccounts, dc=farmnet,dc=nikhef,dc=nl
+
dn: uid=atlas000, ou=PoolAccounts, dc=farmnet,dc=nikhef,dc=nl
  objectclass: top
+
objectclass: top
  objectclass: posixAccount
+
objectclass: posixAccount
  cn: PoolAccount 0 of atlas
+
cn: PoolAccount 0 of atlas
  uid: atlas000
+
uid: atlas000
  uidNumber: 43000
+
uidNumber: 43000
  gidNumber: 2002
+
gidNumber: 2002
  homeDirectory: /home/atlas000
+
homeDirectory: /home/atlas000
  ...
+
...
  
 
this must be added to the directory with <tt>ldapadd</tt>:
 
this must be added to the directory with <tt>ldapadd</tt>:
  
  ldapadd -H ldaps://trog.nikhef.nl/ -W -x -D "cn=<i>My Name</i>,ou=managers,dc=farmnet,dc=nikhef,dc=nl"  
+
ldapadd -H ldaps://trog.nikhef.nl/ -W -x -D "cn=<i>My Name</i>,ou=managers,dc=farmnet,dc=nikhef,dc=nl"  
  
 
Valid managers are "David Groep", "Jeff Templon@nikhef.nl", "Davide Salomoni", and "backup" (the last one can only read, though). The two commands can be combined in a single pipe.
 
Valid managers are "David Groep", "Jeff Templon@nikhef.nl", "Davide Salomoni", and "backup" (the last one can only read, though). The two commands can be combined in a single pipe.
Line 61: Line 61:
 
In due course, the new accounts will appear on the farm, and you can check their presence with the "id" and "ls" commands:
 
In due course, the new accounts will appear on the farm, and you can check their presence with the "id" and "ls" commands:
  
  id -a atlas000
+
id -a atlas000
  ls -l /home/atlas000/
+
ls -l /home/atlas000/
  
 
There may be a slight delay if the system you are trying this on is running <tt>nscd</tt>, or is looking at a slave LDAP server (hooimijt or tbn06 instead of trog).
 
There may be a slight delay if the system you are trying this on is running <tt>nscd</tt>, or is looking at a slave LDAP server (hooimijt or tbn06 instead of trog).
Line 72: Line 72:
 
You can also extend an existing range, by specifying a "start" value to <tt>gen_poolacc_ldif</tt>, but remember: the "base" value <b>must remain the same</b>. So, to generate an additional 100 atlas accounts, the command would be
 
You can also extend an existing range, by specifying a "start" value to <tt>gen_poolacc_ldif</tt>, but remember: the "base" value <b>must remain the same</b>. So, to generate an additional 100 atlas accounts, the command would be
  
  ./gen_poolacc_ldif --vo atlas -g 2002 -b 43000 -n 300 -s 200
+
./gen_poolacc_ldif --vo atlas -g 2002 -b 43000 -n 300 -s 200
  
 
to start at 200 and ensure that there are 300 accounts in total.
 
to start at 200 and ensure that there are 300 accounts in total.
Line 85: Line 85:
 
To generate the home directories for the "phicos" VO, use:
 
To generate the home directories for the "phicos" VO, use:
  
  ./make_poolacc_dir --uid=phicos > /tmp/schapen
+
./make_poolacc_dir --uid=phicos > /tmp/schapen
  sh /tmp/schapen
+
sh /tmp/schapen
  
 
To so the same for the additional 100 atlas accounts created from "atlas200" to
 
To so the same for the additional 100 atlas accounts created from "atlas200" to
 
"atlas299", use:
 
"atlas299", use:
  
  ./make_poolacc_dir --uid=atlas2 > /tmp/lam
+
./make_poolacc_dir --uid=atlas2 > /tmp/lam
  sh /tmp/lam
+
sh /tmp/lam
  
 
The current version of <tt>make_poolacc_dir</tt> ensures that the .ssh directory
 
The current version of <tt>make_poolacc_dir</tt> ensures that the .ssh directory
Line 101: Line 101:
 
Creating the inodes is done with <tt>populate_gridmapdir</tt>. This script is even more trivial than the other two: it extracts all uid's from the <tt>ou=Poolaccounts,dc=farmnet,dc=nikhef,dc=nl</tt> tree and prepends it with "/export/perm/share/gridmapdir":
 
Creating the inodes is done with <tt>populate_gridmapdir</tt>. This script is even more trivial than the other two: it extracts all uid's from the <tt>ou=Poolaccounts,dc=farmnet,dc=nikhef,dc=nl</tt> tree and prepends it with "/export/perm/share/gridmapdir":
  
  ./populate_gridmapdir
+
./populate_gridmapdir
  
 
results in
 
results in
  
  /export/perm/share/gridmapdir/alice000
+
/export/perm/share/gridmapdir/alice000
  /export/perm/share/gridmapdir/alice001
+
/export/perm/share/gridmapdir/alice001
  /export/perm/share/gridmapdir/alice002
+
/export/perm/share/gridmapdir/alice002
  /export/perm/share/gridmapdir/alice003
+
/export/perm/share/gridmapdir/alice003
  /export/perm/share/gridmapdir/alice004
+
/export/perm/share/gridmapdir/alice004
  ...
+
...
  
 
To filter out the new ones, use grep, and pipe the results through xargs so as to touch the files:
 
To filter out the new ones, use grep, and pipe the results through xargs so as to touch the files:
  
  ./populate_gridmapdir | grep atlas2 | xargs touch
+
./populate_gridmapdir | grep atlas2 | xargs touch
  
 
will do the job for the 100 additional atlas accounts, for instance.
 
will do the job for the 100 additional atlas accounts, for instance.
Line 122: Line 122:
 
For this you need the backup file that's generated nightly by the <tt>poolmaplog</tt> script from cron. The file format is simple:
 
For this you need the backup file that's generated nightly by the <tt>poolmaplog</tt> script from cron. The file format is simple:
  
  uid  subjectDN_in_lowercase
+
uid  subjectDN_in_lowercase
  ...
+
...
  
 
btu for use in the gridmapdir the special chars (so painstackingly converted to readable format by poolmaplog) must be concerted back. This is the task of the <tt>repair-pool</tt> script. As far as I know, these are the special characters:
 
btu for use in the gridmapdir the special chars (so painstackingly converted to readable format by poolmaplog) must be concerted back. This is the task of the <tt>repair-pool</tt> script. As far as I know, these are the special characters:
  
  % / &lt;space&gt; = ( ) - . @
+
% / &lt;space&gt; = ( ) - . @
  
 
the repair-pool script will translate these to URL-escaped characters (ie. "=" becomes "%3D" -- note that we must thus convert any %-signs first!)  
 
the repair-pool script will translate these to URL-escaped characters (ie. "=" becomes "%3D" -- note that we must thus convert any %-signs first!)  
Line 133: Line 133:
 
The script will automatically relink the poolaccounts to the proper DN for those accounts that were in use (i.e. has a DN assigned to them).  You should only attempt repair if the pooldir is empty!
 
The script will automatically relink the poolaccounts to the proper DN for those accounts that were in use (i.e. has a DN assigned to them).  You should only attempt repair if the pooldir is empty!
  
  ./repair-pool < /export/perm/share/gridmapdir/.poolmap.20050816
+
./repair-pool < /export/perm/share/gridmapdir/.poolmap.20050816
  
 
and watch the results.
 
and watch the results.

Revision as of 19:23, 18 August 2005

The LDAP directory structure

The list of valid users of the NDPF is kept in a central LDAP directory, currently hosted on trog.nikhef.nl. This directory contains both the "local" users as well as all poolaccounts and all automount map entries. The structure of the directory is:

+ dc=farmnet,dc=nikhef,dc=nl
  |
  + ou=Managers
  + ou=LocalGroups (contains all groups!)
  + ou=LocalUsers
  + ou=Poolaccounts
  + ou=automount
    |
    + ou=auto.home
    + ou=lcgprod
      |
      + ou=auto.sedata
      + ou=auto.share
      + ou=auto.stage
      + ou=auto.sedata2

The ou=Poolaccounts entry contains the list of all pool accounts, without any further hierarchy. Each account is named by its uid, and is of objectClass "posixAccount". For each account named here, there should be a corresponsing entry in the ou=pool,ou=auto.home,ou=automount branch of the tree as well (of objectClass "automount").


Creating accounts for a new VO

To use the scripts, login on the fileserver "hooimijt.nikhef.nl", and make sure that /export/perm/adm/bin is in your path (it contains all the relevant scripts), or go there. Also, make sure you know your LDAP manager password.

You need to:

  1. add the accounts to the LDAP directory
  2. create the homedirectories for these users on hooimijt
  3. add the inodes to the gridmapdir

(and of course add the VO itself to the proper Quattor profiles for the selected facilities, but this is outside the scope of this page).

Generating the LDIF

Adding users to the directory needs two commands (or one pipe). The gen_poolacc_ldif script generates ldif files, that need to be piped in to "ldapadd" to be inserted in the directory.

Its use is best explained by an example:

./gen_poolacc_ldif --vo atlas -g 2002 -b 43000 -n 200

will spit out lots of ldif, like

dn: uid=atlas000, ou=PoolAccounts, dc=farmnet,dc=nikhef,dc=nl
objectclass: top
objectclass: posixAccount
cn: PoolAccount 0 of atlas
uid: atlas000
uidNumber: 43000
gidNumber: 2002
homeDirectory: /home/atlas000
...

this must be added to the directory with ldapadd:

ldapadd -H ldaps://trog.nikhef.nl/ -W -x -D "cn=My Name,ou=managers,dc=farmnet,dc=nikhef,dc=nl" 

Valid managers are "David Groep", "Jeff Templon@nikhef.nl", "Davide Salomoni", and "backup" (the last one can only read, though). The two commands can be combined in a single pipe.

In due course, the new accounts will appear on the farm, and you can check their presence with the "id" and "ls" commands:

id -a atlas000
ls -l /home/atlas000/

There may be a slight delay if the system you are trying this on is running nscd, or is looking at a slave LDAP server (hooimijt or tbn06 instead of trog).

The number of digits appended to the vo name is three (3) by default, but can be changed with the -l option. And, of course, the "voname" specified here is completely unrelated to the VO name in the information system or used in the GlueAccessControlBaseRules.

Extending an existing poolaccount range

You can also extend an existing range, by specifying a "start" value to gen_poolacc_ldif, but remember: the "base" value must remain the same. So, to generate an additional 100 atlas accounts, the command would be

./gen_poolacc_ldif --vo atlas -g 2002 -b 43000 -n 300 -s 200

to start at 200 and ensure that there are 300 accounts in total.


Generating the home directories

Once the accounts have been added to the directory, you can create the home directories on hooimijt. This must be done as root, and on hooimijt itself. The command to use is make_poolacc_dir, which takes one argument: the uid prefix to select on. By default, it will generate a shell script that tries to (re)create the homedirectories for all poolaccounts, so beware.

To generate the home directories for the "phicos" VO, use:

./make_poolacc_dir --uid=phicos > /tmp/schapen
sh /tmp/schapen

To so the same for the additional 100 atlas accounts created from "atlas200" to "atlas299", use:

./make_poolacc_dir --uid=atlas2 > /tmp/lam
sh /tmp/lam

The current version of make_poolacc_dir ensures that the .ssh directory contains an empty "authorized_keys" file and is immutable ("chattr =i .ssh").

Creating the inodes

Creating the inodes is done with populate_gridmapdir. This script is even more trivial than the other two: it extracts all uid's from the ou=Poolaccounts,dc=farmnet,dc=nikhef,dc=nl tree and prepends it with "/export/perm/share/gridmapdir":

./populate_gridmapdir

results in

/export/perm/share/gridmapdir/alice000
/export/perm/share/gridmapdir/alice001
/export/perm/share/gridmapdir/alice002
/export/perm/share/gridmapdir/alice003
/export/perm/share/gridmapdir/alice004
...

To filter out the new ones, use grep, and pipe the results through xargs so as to touch the files:

./populate_gridmapdir | grep atlas2 | xargs touch

will do the job for the 100 additional atlas accounts, for instance.

Repairing an empty gridmapdir

For this you need the backup file that's generated nightly by the poolmaplog script from cron. The file format is simple:

uid   subjectDN_in_lowercase
...

btu for use in the gridmapdir the special chars (so painstackingly converted to readable format by poolmaplog) must be concerted back. This is the task of the repair-pool script. As far as I know, these are the special characters:

% / <space> = ( ) - . @

the repair-pool script will translate these to URL-escaped characters (ie. "=" becomes "%3D" -- note that we must thus convert any %-signs first!)

The script will automatically relink the poolaccounts to the proper DN for those accounts that were in use (i.e. has a DN assigned to them). You should only attempt repair if the pooldir is empty!

./repair-pool < /export/perm/share/gridmapdir/.poolmap.20050816

and watch the results.