Difference between revisions of "RCauth Delegation Server & MasterPortal - Credential Lifetimes"
From PDP/Grid Wiki
Jump to navigationJump to search (outline with basic tables) |
(short lived proxies) |
||
| Line 1: | Line 1: | ||
= Introduction = | = Introduction = | ||
| + | |||
| + | The scenario described by the [[AARC_Pilot_-_RCAuth.eu#Credential_Lifetimes | RCAuth.eu]] setup deals with certificates no multiple levels. The credential released to the Service Provider Portal (Science Gateway) is a certificate chain containing : a short lived proxy certificate, a long lived proxy certificate, and an end entity certificate. All three certificates can be created with a different lifetime, therefore lifetime configurations within this setup can be confusing. This page is dedicated to explaining every lifetime configuration you might encounter in the [[AARC_Pilot_-_RCAuth.eu | RCAuth.eu]] setup, with explanation about their location, default value and function. | ||
= Short Lived Proxy = | = Short Lived Proxy = | ||
| + | |||
| + | The lifetime of a Short Lived Proxy Certificate is determined by the following set of configurations. | ||
{| class="wikitable" | {| class="wikitable" | ||
|| '''Component''' | || '''Component''' | ||
|| '''Sub-Component''' | || '''Sub-Component''' | ||
| − | || '''Name''' | + | | style="width: 15%;"| '''Name''' |
| − | || '''Default''' | + | | style="width: 5%;" | '''Default''' |
|| '''Location''' | || '''Location''' | ||
|| '''Description''' | || '''Description''' | ||
| Line 16: | Line 20: | ||
|| ''proxylifetime'' | || ''proxylifetime'' | ||
|| - | || - | ||
| − | || | + | || [[OAuth_for_MyProxy_GetProxy_Endpoint | /getproxy]] request |
| − | || | + | || Client requested lifetime value. |
|- | |- | ||
| Line 24: | Line 28: | ||
|| ''defaultLifetime'' | || ''defaultLifetime'' | ||
|| 12h | || 12h | ||
| − | || | + | || [[AARC_Pilot_-_Master_Portal_Administrator_Guide#Configuration | MP Server configuration]] |
| − | || | + | || In case of missing ''proxylifetime'' from the [[OAuth_for_MyProxy_GetProxy_Endpoint | /getproxy]] request, this value is used to request a short lived proxy. |
|- | |- | ||
| Line 32: | Line 36: | ||
|| ''max_proxy_lifetime - tolerance'' | || ''max_proxy_lifetime - tolerance'' | ||
|| 11d - 1d | || 11d - 1d | ||
| − | || | + | || [[AARC_Pilot_-_Master_Portal_Administrator_Guide#Configuration | MP Server configuration]] |
| − | || | + | || Used within LifetimeValidator for validating the requested proxy lifetime value. These values are only used for validation and they do not SET any the effective proxy lifetime. The ''max_proxy_lifetime'' value should match the value of the lifetime configuration with the same name in the Credential Store. |
|- | |- | ||
| Line 40: | Line 44: | ||
|| ''max_proxy_lifetime'' | || ''max_proxy_lifetime'' | ||
|| 11d | || 11d | ||
| − | || | + | || [[AARC_Pilot_-_Master_Portal_Administrator_Guide#MyProxy_Server | Credential Store configuration]] |
| − | || | + | || Server side maximum enforced by the MyProxy Store on every released proxy. This should match the value of the MP Server configuration with the same name. |
|} | |} | ||
Revision as of 14:06, 30 August 2016
Introduction
The scenario described by the RCAuth.eu setup deals with certificates no multiple levels. The credential released to the Service Provider Portal (Science Gateway) is a certificate chain containing : a short lived proxy certificate, a long lived proxy certificate, and an end entity certificate. All three certificates can be created with a different lifetime, therefore lifetime configurations within this setup can be confusing. This page is dedicated to explaining every lifetime configuration you might encounter in the RCAuth.eu setup, with explanation about their location, default value and function.
Short Lived Proxy
The lifetime of a Short Lived Proxy Certificate is determined by the following set of configurations.
| Component | Sub-Component | Name | Default | Location | Description |
| Client Portal | - | proxylifetime | - | /getproxy request | Client requested lifetime value. |
| Master Portal | MP Server | defaultLifetime | 12h | MP Server configuration | In case of missing proxylifetime from the /getproxy request, this value is used to request a short lived proxy. |
| Master Portal | MP Server | max_proxy_lifetime - tolerance | 11d - 1d | MP Server configuration | Used within LifetimeValidator for validating the requested proxy lifetime value. These values are only used for validation and they do not SET any the effective proxy lifetime. The max_proxy_lifetime value should match the value of the lifetime configuration with the same name in the Credential Store. |
| Master Portal | Credential Store | max_proxy_lifetime | 11d | Credential Store configuration | Server side maximum enforced by the MyProxy Store on every released proxy. This should match the value of the MP Server configuration with the same name. |
Long Lived Proxy
| Component | Sub-Component | Name | Default | Location | Description |
| Master Portal | MP Client | lifetime | 11d | zxc | zxc |
End Entity Certificate
| Component | Sub-Component | Name | Default | Location | Description |
| Master Portal | MP Client | lifetime | 11d | zxc | zxc |
| Delegation Server | Delegation Server | - | 10d | zxc | zxc |
| Delegation Server | Online CA | MAX_LIFETIME | 11d | zxc | zxc |
