Poweruser0 and new Pilot Role Support on ATLAS CA Tier-2s

WARNING: This page is obsolete.

Supported ATLAS Roles

The following are the different ATLAS VOMS roles to be supported at the CA T1 and T2 sites. Those marked in bold are the new roles to be added.

• /atlas
• /atlas/Role=lcgadmin
• /atlas/Role=production
• /atlas/Role=pilot
• /atlas/ca
• /atlas/ca/Role=pilot
• /atlas/ca/Role=poweruser0

Changes to CE

STEP 1: Add additional needed pool accounts corresponding to the above roles.

How you define it at your site can be different but the key element is that each role must map to a different set of pool accounts, and the groups associated with these accounts must all be sub-groups of the overall ATLAS group. Each account must also have a home directory.

At Alberta we have the following additional set of pool accounts defined, over and above the existing pool accounts (your specific user and group names, userid and groupid may differ):

/etc/passwd:

atcanpt1:x:46201:1314:mapped user for group ID atcanpt:/lcgusers/atcanpt1:/bin/bash 
atcanpt2:x:46202:1314:mapped user for group ID atcanpt:/lcgusers/atcanpt2:/bin/bash  
atcanpt3:x:46203:1314:mapped user for group ID atcanpt:/lcgusers/atcanpt3:/bin/bash  
atcanpt4:x:46204:1314:mapped user for group ID atcanpt:/lcgusers/atcanpt4:/bin/bash  
atcanpt5:x:46205:1314:mapped user for group ID atcanpt:/lcgusers/atcanpt5:/bin/bash  
atlaspt1:x:46211:1312:mapped user for group ID atlaspt:/lcgusers/atlaspt1:/bin/bash  
atlaspt2:x:46212:1312:mapped user for group ID atlaspt:/lcgusers/atlaspt2:/bin/bash  
atlaspt3:x:46213:1312:mapped user for group ID atlaspt:/lcgusers/atlaspt3:/bin/bash  
atlaspt4:x:46214:1312:mapped user for group ID atlaspt:/lcgusers/atlaspt4:/bin/bash  
atlaspt5:x:46215:1312:mapped user for group ID atlaspt:/lcgusers/atlaspt5:/bin/bash  
atcanpu1:x:46221:1313:mapped user for group ID atcanpu:/lcgusers/atcanpu1:/bin/bash  
atcanpu2:x:46222:1313:mapped user for group ID atcanpu:/lcgusers/atcanpu2:/bin/bash  
atcanpu3:x:46223:1313:mapped user for group ID atcanpu:/lcgusers/atcanpu3:/bin/bash  
atcanpu4:x:46224:1313:mapped user for group ID atcanpu:/lcgusers/atcanpu4:/bin/bash  
atcanpu5:x:46225:1313:mapped user for group ID atcanpu:/lcgusers/atcanpu5:/bin/bash

/etc/group:

atcanpt:x:1314: 
atlaspt:x:1312: 
atcanpu:x:1313:

• Note 1: Multiple pilot and poweruser0 pool accounts are created so as to accommodate pilot submissions from multiple factories (if needed) as well as submissions from multiple people who have been assigned the poweruser0 role. There will also be the poweruser0 pilots.

• Note 2: All the new pool accounts should be also members of your site's generic atlas unix group.

• Note 3: A file for each new user name should be added to the /etc/grid-security/gridmapdir/ directory.

• Note 4: The new pool accounts must also be visible to the WNs, the MON box and to the machine running the Torque/Maui services.

STEP 2: Update the configuration files on the CE that specify the mappings of groups and roles to the local userIDs.

/etc/grid-security/groupmapfile

"/atlas/Role=lcgadmin/Capability=NULL" atlassgm
"/atlas/Role=lcgadmin" atlassgm
"/atlas/Role=production/Capability=NULL" atlasprd
"/atlas/Role=production" atlasprd
"/atlas/Role=pilot/Capability=NULL" atlaspt
"/atlas/Role=pilot" atlaspt
"/atlas/ca/Role=poweruser0/Capability=NULL" atcanpu
"/atlas/ca/Role=poweruser0" atcanpu
"/atlas/ca/Role=pilot/Capability=NULL" atcanpt
"/atlas/ca/Role=pilot" atcanpt
"/atlas/ca/Role=NULL/Capability=NULL" atlascdn
"/atlas/ca" atlascdn
"/atlas/Role=NULL/Capability=NULL" atlas
"/atlas" atlas

/etc/grid-security/voms-grid-mapfile

"/atlas/Role=lcgadmin/Capability=NULL" .sgmatl
"/atlas/Role=lcgadmin" .sgmatl
"/atlas/Role=production/Capability=NULL" .prdatl
"/atlas/Role=production" .prdatl
"/atlas/Role=pilot/Capability=NULL" .atlaspt
"/atlas/Role=pilot" .atlaspt
"/atlas/ca/Role=poweruser0/Capability=NULL" .atcanpu
"/atlas/ca/Role=poweruser0" .atcanpu
"/atlas/ca/Role=pilot/Capability=NULL" .atcanpt
"/atlas/ca/Role=pilot" .atcanpt
"/atlas/ca/Role=NULL/Capability=NULL" .atcan
"/atlas/ca" .atcan
"/atlas/Role=NULL/Capability=NULL" .atlas
"/atlas" .atlas

STEP 3: Rerun the command contained in the edg-mkgrid-map crontab entry to generate new grid-mapfile.

• Warning: You may want to backup your original grid-mapfile and voms-grid-mapfile before running this.

/opt/edg/sbin/edg-mkgridmap     --output=/etc/grid-security/grid-mapfile \\
--safe >> /var/log/edg-mkgridmap.log 2>&1 ;  \\
cat /etc/grid-security/voms-grid-mapfile >> /etc/grid-security/grid-mapfile

Changes to SE

NOTE: The current dCache configuration at Alberta uses a combination of grid-vorolemap and the older kpwd authorization methods. The grid-vorolemap authorization method was the only method installed at first but the kpwd was added so as to properly support having a fallback mechanism to handle users coming with the poweruser0 role but where the site did not support it.

vo-rolemap Authorization

The configuration files of dCache which specify the mappings are:

/opt/d-cache/etc/dcachesrm-gplazma.policy
/opt/d-cache/etc/dcacheVoms2Gplasma.conf
/opt/d-cache/etc/LinkGroupAuthorization.conf

Looking at each file individually at Alberta we have:

• /opt/d-cache/etc/dcachesrm-gplazma.policy

...
# Switches
saml-vo-mapping="OFF"
kpwd="ON"
grid-mapfile="OFF"
gplazmalite-vorole-mapping="ON"

# Priorities
saml-vo-mapping-priority="1"
kpwd-priority="3"
grid-mapfile-priority="4"
gplazmalite-vorole-mapping-priority="2"
...

• /opt/d-cache/etc/dcacheVoms2Gplasma.conf

# grid-vorolemap path
vorolemap /etc/grid-security/grid-vorolemap

# authzdb path
authzdb /etc/grid-security/storage-authzdb

# Mapping atlas members to atlas001
group https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=/atlas atlas001

# Mapping atlas members to sgmatl01
group https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=/atlas/Role=lcgadmin sgmatl01

# Mapping atlas members to prdatl01
group https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=/atlas/Role=production prdatl01

# Mapping usatlas members to prdatl01
group https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=/atlas/usatlas/Role=production prdatl01

# Mapping atlas/ca members to atlas001
group https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=/atlas/ca atlas001

# Mapping atlas/ca/Role=poweruser0 members to atlas001
group https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=/atlas/ca/Role=poweruser0 atlas001
...

• /opt/d-cache/etc/LinkGroupAuthorization.conf

LinkGroup atlas-disk-link-group
/Role=

Following any changes to the handling of roles in dCache the grid-vorolemap must be rebuilt.

/opt/d-cache/sbin/dcacheVoms2Gplasma.py -r -a \
-c /opt/d-cache/etc/dcacheVoms2Gplasma.conf -q

kpwd Authorization

For the kpwd authorization: if it is not already installed at your site you will need to have the following packages installed (via yum for example): lcg-expiregridmapdir , edg-mkgridmap, edg-mkgridmap-conf and fetch-crl

Build the grid-mapfile:

/opt/edg/sbin/edg-mkgridmap --output=/etc/grid-security/grid-mapfile --safe

Download and install the grid-mapfile2dcache-kpwd script that will generate the dcache.kpwd from the grid-mapfile:

• wget http://hep.kbfi.ee/uploads/IT/grid-mapfile2dcache-kpwd
• or install d-cache-lcg-6.2.0-1.noarch.rpm

Update your crontab entry for edg-mkgridmap to include the step of running grid-mapfile2dcache-kpwd

10 5,11,17,23 * * * root (date; /opt/edg/sbin/edg-mkgridmap --output=/etc/grid-security/grid-mapfile --safe) \\ 
                             >> /var/log/edg-mkgridmap.log 2>&1; (date;/opt/d-cache/bin/grid-mapfile2dcache-kpwd) \\
                             >>/var/log/edg-mkgridmap.log 2>&1

-- BryanCaron - 21 Jul 2009