Práctica Autenticación y Autorización en GLITE

Transcripción

1 Práctica Autenticación y Autorización en GLITE 15º & 16º Tutoriales Grid de EELA Miguel Cárdenas Montes Manuel Rubio del Solar Antonio Gómez Iglesias Roque Salinas Escribano

2 SERVER: glite-tutor.ct.infn.it glite-tutor2.ct.infn.it USERNAME: meridaxx Como acceder al UI PASSWORD: GridMERXX where XX = 01 30

3 Certificado Personal.globus: your personal certificate, two separate files (public and private keys) Check the permissions (you won t be able to create a proxy if they are wrong) ls l.globus -rw-r--r-- usercert.pem -r userkey.pem

4 Certificado Personal Look inside your certificate grid-cert-info Important information Creation and expiration date Name and subject of the CA Common Name (CN) of the certificate owner Certificate subject

5 Creación de un proxy con extensión voms This step is comparable to a login on the grid. voms-proxy-init --voms gilda

6 Información del VOMS Proxy To get info about your proxy voms-proxy-info -all It shows two different lifetimes: First is related to the proxy itself The second one is referred to the AC infos added by the VOMS server. Important: your proxy has 12 hours of live

7 Creación de un Long Living Proxy Allows you to create and store a long term proxy certificate myproxy-init --voms gilda The s option allows you to specify the name of the myproxy server you want to contact myproxy-init --voms gilda s grid001.ct.infn.it

8 The d option allows you to create and store a long term proxy with your DN. myproxy-init --voms gilda s grid001.ct.infn.it -d Without this option, the name of the stored proxy is the same of the user in the local machine

9 The l option allows you to create and store a long term proxy with a name specified by the user myproxy-init --voms gilda s grid001.ct.infn.it l GILDA_TUTOR Each user can create and store several proxies in a myproxy server, but each remote proxy is linked to the specified username

10 You can get info on myproxy server about your proxy myproxy-info s grid001.ct.infn.it If the credentials have been initialized with the d switch, you also have to specify it when using myproxy-info myproxy-info s grid001.ct.infn.it -d

11 If the credentials have been initialized with the l switch, you also have to specify it when using myproxy-info myproxy-info s grid001.ct.infn.it l GILDA_TUTOR

12 If in your UI there is no local proxy, it s not possible to be authenticated in the myproxy server In this case is needed to get a delegate proxy form the MyProxy sever or create a local proxy with voms-proxy-init

13 Get a delegated proxy from the MyProxy server It allow you to get a proxy from the myproxy server Destroy the proxy in the local machine and verify it doesn-t exist anymore voms-proxy-destroy voms-proxy-info couldn t find a valid proxy

14 Get a delegated proxy from the MyProxy server Now in your UI (virtual o real), there is no local proxy. To get a proxy from the myproxy sever myproxy-get-delegation s grid001.ct.infn.it

15 Get a delegated proxy from the MyProxy server With d option myproxy-get-delegation s grid001.ct.infn.it d Verify now that the user has a local proxy voms-proxy-info

16 Destroy remote proxy You can destroy your remote proxy myproxy-destroy s grid001.ct.infn.it Check your remote proxy myproxy-info s grid001.ct.infn.it

17 Destroy remote proxy Destroy your remote proxy with -d myproxy-destroy s grid001.ct.infn.it -d Check your remote proxy with -d myproxy-info s grid001.ct.infn.it -d

18 Destroy remote proxy Destroy your remote proxy with -l myproxy-destroy s grid001.ct.infn.it l GILDA_TUTOR Check your remote proxy with -L myproxy-info s grid001.ct.infn.it l GILDA_TUTOR