Changes between Version 32 and Version 33 of client_installation_guide_rpm

Timestamp:

10/02/12 08:49:43 (12 years ago)

Author:

piontek

Comment:

--

client_installation_guide_rpm

@@ -5 +5 @@
 
 = Requirements =
+* '''PL-Grid LDAP integration'''
+ The machine where the client is to be installed has to be configured to allow users to log in to the their "plg" accounts.
 * '''Packages requirements'''. 
  All packages required by QCG-Broker client will be automatically installed by YUM during the installation of qcg-broker-client package.
  * '''Java (>= 1.5)'''\\
 * '''The X.509 certificate and key (signed by the Polish Grid CA'''
- The certificate is needed in case when the dedicated gridFTP service is installed for the QCG client.
+ The certificate is optional and it is needed in the case when the dedicated gridFTP service is installed for the QCG client.
 * '''trusted CA certificates'''
  To enable secure communication between client and QCG-Broker service set of trusted CA certificates must be copied either into the `/etc/grid-security/certificates` directory or configured for every user.
+
 
 For the PL-Grid project: Install Polish Grid and PL-Grid Simple-CA certificates:
@@ -132 +135 @@
 }}}
 
-* configuation of grid-ftp server
-
 The grid-ftp server requires the X.509 certificate and key to be present in following locations
 * ''/etc/grid-security/hostcert.pem''
 * ''/etc/grid-security/hostkey.pem''
+
+== the Grid Mapfile ==
+This tutorial assumes that the QCG-Computing service is configured in such way, that every authenticated user must be authorized against the `grid-mapfile`. This file can be created manually by an administrator (if the service is run in "test mode") or generated automatically based on the LDAP directory service.
+=== Manually created grid mapfile (for testing purpose only) ===
+{{{
+#!div style="font-size: 90%"
+{{{#!default
+#for test purpose only add mapping for your account
+echo '"MyCertDN" myaccount' >> /etc/grid-security/grid-mapfile
+}}}
+}}}
+=== LDAP generated grid mapfile ===
+{{{
+#!div style="font-size: 90%"
+{{{#!default
+#
+# 1. install qcg grid-mapfile generator
+#
+yum install qcg-gridmapfilegenerator
+#
+# 2.  configure gridmapfilegenerator - remember to change 
+# * url property to your local ldap replica
+# * search base
+# * filter expression
+# * security context
+vim  /opt/plgrid/qcg/etc/qcg-comp/plggridmapfilegenerator.conf 
+#
+# 3. run the gridmapfile generator in order to generate gridmapfile now
+#
+/opt/plgrid/qcg/sbin/qcg-gridmapfilegenerator.sh 
+}}}
+}}}
+
+After installing and running this tool one can find three files:
+ * /etc/grid-security/grid-mapfile.local - here you can put list of DN and local unix accounts name that will be merged with data acquired from local LDAP server
+ * /etc/grid-security/grid-mapfile.deny - here you can put list od DN's (only DNs!) that you want to deny access to the QCG-Computing service
+ * /etc/grid-security/grid-mapfile - the final gridmap file generated using the above two files and information available in local LDAP server. Do not edit this file as it is generated automatically!
+
+This gridmapfile generator script is run every 10 minutes. Moreover its issues  `su - $USERNAME -c 'true' > /dev/null`  for every new user that do not have yet home directory (thus triggering pam_mkhomedir if installed).
 
 * install QCG-Broker client using YUM Package Manager: