= QCG Broker Client Installation =

[[PageOutline]] 


= Requirements =
* '''PL-Grid LDAP integration'''
 The machine where the client is to be installed has to be configured to allow users to log in to the their "plg" accounts.
* '''Packages requirements'''. 
 All packages required by QCG-Broker client will be automatically installed by YUM during the installation of qcg-broker-client package.
 * '''Java (>= 1.5)'''\\
* '''The X.509 certificate and key (signed by the Polish Grid CA'''
 The certificate is optional and it is needed in the case when the dedicated gridFTP service is installed for the QCG client.
* '''trusted CA certificates'''
 To enable secure communication between client and QCG-Broker service set of trusted CA certificates must be copied either into the `/etc/grid-security/certificates` directory or configured for every user.


For the PL-Grid project: Install Polish Grid and PL-Grid Simple-CA certificates:

-Add appropriate YUM repositories
{{{
#!div style="font-size: 90%"
{{{#!sh
cat > /etc/yum.repos.d/plgrid.repo << EOF
[PLGRID-general]
name=PLGRID general packages repository
baseurl=http://software.plgrid.pl/packages/general/
enabled=1
metadata_expire=300
gpgcheck=0
EOF
}}}
}}}

{{{
#!div style="font-size: 90%"
{{{#!sh
cat > /etc/yum.repos.d/eugridpma.repo << EOF
[EUGRIDPMA-igtf]
name=EUGRIDPMA igtf repository
baseurl=https://dist.eugridpma.info/distribution/igtf/current
enabled=1
metadata_expire=300
gpgcheck=0

[EUGRIDPMA-fetch-crl]
name=EUGRIDPMA fetch-crl repository
baseurl=https://dist.eugridpma.info/distribution/util/fetch-crl/
enabled=1
metadata_expire=300
gpgcheck=0
EOF
}}}
}}}

-Install certificates
{{{
#!div style="font-size: 90%"
{{{#!sh
yum install ca_PolishGrid
yum install ca_PLGRID-SimpleCA
}}}
}}}

-Install certificate revocation list fetching utility 
{{{
#!div style="font-size: 90%"
{{{#!sh
yum install fetch-crl
}}}
}}}

-Get fresh CRLs now
{{{
#!div style="font-size: 90%"
{{{#!sh
/usr/sbin/fetch-crl 
}}}
}}}

-Install cron job for it
{{{
#!div style="font-size: 90%"
{{{#!sh
cat > /etc/cron.daily/fetch-crl.cron << EOF
#!/bin/sh 
/usr/sbin/fetch-crl
EOF
}}}
}}}

{{{
#!div style="font-size: 90%"
{{{#!sh
chmod a+x /etc/cron.daily/fetch-crl.cron
}}}
}}}

= Installation =
The packages are designed for Scientific Linux 5.x
The installation process requires root privileges.

== Software repository ==
* Install PL-Grid or/and QCG repositories:
 * Official PL-Grid repository
{{{
#!div style="font-size: 90%"
{{{#!sh
rpm -Uvh http://software.plgrid.pl/packages/repos/plgrid-repos-2010-2.noarch.rpm
}}}
}}}
 * !QosCosGrid testing repository
{{{
#!div style="font-size: 90%"
{{{#!sh
cat > /etc/yum.repos.d/qcg.repo << EOF
[qcg]
name=QosCosGrid YUM repository
baseurl=http://fury.man.poznan.pl/qcg-packages/sl/x86_64/
enabled=1
gpgcheck=0
EOF
}}}
}}}

== GridFTP service ==
For the user convenience QCG client is able to stage in input data accessible from the host where it is installed and also to stage out output data there. The functionality require the data to be accessible via gridFTP service. The gridFTP service can be installed on the client machine or it can be any gridFTP service having access to the data on client machine.

* install grid-ftp server using YUM Package Manager:
{{{
#!div style="font-size: 90%"
{{{#!sh
yum install qcg-dep-gridftp-server
}}}
}}}

The grid-ftp server requires the X.509 certificate and key to be present in following locations
* ''/etc/grid-security/hostcert.pem''
* ''/etc/grid-security/hostkey.pem''

== the Grid Mapfile ==
To have access do data every authenticated user must be authorized against the `grid-mapfile`. This file can be created manually by an administrator (if the service is run in "test mode") or generated automatically based on the LDAP directory service.
=== Manually created grid mapfile (for testing purpose only) ===
{{{
#!div style="font-size: 90%"
{{{#!default
#for test purpose only add mapping for your account
echo '"MyCertDN" myaccount' >> /etc/grid-security/grid-mapfile
}}}
}}}
=== LDAP generated grid mapfile ===
{{{
#!div style="font-size: 90%"
{{{#!default
#
# 1. install qcg grid-mapfile generator
#
yum install qcg-gridmapfilegenerator
#
# 2.  configure gridmapfilegenerator - remember to change 
# * url property to your local ldap replica
# * search base
# * filter expression
# * security context
vim  /opt/plgrid/qcg/etc/qcg-comp/plggridmapfilegenerator.conf 
#
# 3. run the gridmapfile generator in order to generate gridmapfile now
#
/opt/plgrid/qcg/sbin/qcg-gridmapfilegenerator.sh 
}}}
}}}

After installing and running this tool one can find three files:
 * /etc/grid-security/grid-mapfile.local - here you can put list of DN and local unix accounts name that will be merged with data acquired from local LDAP server
 * /etc/grid-security/grid-mapfile.deny - here you can put list od DN's (only DNs!) that you want to deny access to the QCG-Computing service
 * /etc/grid-security/grid-mapfile - the final gridmap file generated using the above two files and information available in local LDAP server. Do not edit this file as it is generated automatically!

This gridmapfile generator script is run every 10 minutes. Moreover its issues  `su - $USERNAME -c 'true' > /dev/null`  for every new user that do not have yet home directory (thus triggering pam_mkhomedir if installed).

== QCG-Broker client ==
* install QCG-Broker client using YUM Package Manager:
{{{
#!div style="font-size: 90%"
{{{#!sh
yum install qcg-broker-client
}}}
}}}