Difference between revisions of "Using the SCAS"

From PDP/Grid Wiki
Jump to navigationJump to search
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
The LCAS/LCMAPS GT4-interface for Globus GridFTPd, Gatekeeper and GSI-OpenSSHd and [[gLExec]] all share the [[LCMAPS]] framework as their mapping back-end. It can be configured to use the [[SCAS]] client LCMAPS plug-in. This will contact the SCAS service to trigger an authorization decision and, on a positive result, return a mapping result. This will then be input for the LCMAPS user mapping back-end of gLExec to continue.
 
The LCAS/LCMAPS GT4-interface for Globus GridFTPd, Gatekeeper and GSI-OpenSSHd and [[gLExec]] all share the [[LCMAPS]] framework as their mapping back-end. It can be configured to use the [[SCAS]] client LCMAPS plug-in. This will contact the SCAS service to trigger an authorization decision and, on a positive result, return a mapping result. This will then be input for the LCMAPS user mapping back-end of gLExec to continue.
 
  
 
== Installation ==
 
== Installation ==
  
Add the [http://etics-repository.cern.ch:8080/repository/download/registered/org.glite/org.glite.security.lcmaps-plugins-scas-client scas-client plugin] to the set of RPMs on your machine, and configure the SCAS client by editing the '''lcmaps.db''' file on your system.
+
Add the [http://etics-repository.cern.ch:8080/repository/download/registered/org.glite/org.glite.security.lcmaps-plugins-scas-client scas-client plugin] to the set of RPMs on your machine. The SCAS client LCMAPS plug-in has a requirement on the [http://etics-repository.cern.ch:8080/repository/download/registered/org.glite/org.glite.security.saml2-xacml2-c-lib SAML2-XACML2 C Library].
  
 
== Configuration ==
 
== Configuration ==
Line 24: Line 23:
  
 
Note: This example assumes a verify_proxy and posix_enf plug-in to be configured in the same lcmaps.db file.
 
Note: This example assumes a verify_proxy and posix_enf plug-in to be configured in the same lcmaps.db file.
 +
 +
== More information ==
 +
 +
To test your setup then you can find more information on the page for [[Debugging hints]].

Latest revision as of 20:39, 5 February 2010

The LCAS/LCMAPS GT4-interface for Globus GridFTPd, Gatekeeper and GSI-OpenSSHd and gLExec all share the LCMAPS framework as their mapping back-end. It can be configured to use the SCAS client LCMAPS plug-in. This will contact the SCAS service to trigger an authorization decision and, on a positive result, return a mapping result. This will then be input for the LCMAPS user mapping back-end of gLExec to continue.

Installation

Add the scas-client plugin to the set of RPMs on your machine. The SCAS client LCMAPS plug-in has a requirement on the SAML2-XACML2 C Library.

Configuration

Configure the LCMAPS You would add to /opt/glite/etc/lcmaps/lcmaps.db or /opt/glite/etc/lcmaps/lcmaps-glexec.db:

scasclient = "lcmaps_scas_client.mod"
            " -capath /etc/grid-security/certificates/"
            " -endpoint https://graszaad.nikhef.nl:8443"
            " -resourcetype wn"
            " -actiontype execute-now"

and the following policy execution flow at the end:

# policies
glexec_get_account:
verify_proxy  -> scasclient
scasclient -> posix_enf

Note: This example assumes a verify_proxy and posix_enf plug-in to be configured in the same lcmaps.db file.

More information

To test your setup then you can find more information on the page for Debugging hints.