| 17 | | == User’s credential == |
| 18 | | |
| 19 | | To configure the security settings please create or edit the ''~/.globus/cog.properties'' file. |
| 20 | | |
| 21 | | Client expects the access either to the pair of user certificate and private key files in "pem" format or to the proxy certificate file. |
| 22 | | |
| 23 | | '''IMPORTANT:''' If the user has the certificate in p12 format, the certificate has to be first converted to the pem format files. |
| 24 | | {{{ |
| 25 | | openssl pkcs12 -nocerts -in cert.p12 -out userkey.pem |
| 26 | | openssl pkcs12 -clcerts -nokeys -in cert.p12 -out usercert.pem |
| 27 | | }}} |
| 28 | | |
| 29 | | Add or edit the location of key/certificate files in the cog.properties file. |
| 30 | | |
| 31 | | {{{ |
| 32 | | usercert=/home/piontek/.globus/usercert.pem |
| 33 | | userkey=/home/piontek/.globus/userkey.pem |
| 34 | | }}} |
| 35 | | |
| 36 | | As an alternative the path to the user proxy certificate file can be specified. |
| 37 | | |
| 38 | | {{{ |
| 39 | | proxy=/tmp/x509up_u501 |
| 40 | | }}} |
| 41 | | |
| 42 | | If certificate and key are specified and exist the user proxy certificate is automatically created by the client. Otherwise the proxy certificate has to be created somehow else (e.g. using the `grid-proxy-init` tool) and copied to the location pointed out by the ''proxy'' variable. In the second case checking of the key format must be disabled in the qcg configuration. Please see the ''QCG_ENV_SKIP_KEY_CHECK'' variable in the next section. |
| 43 | | |
| 44 | | == Configuration of the client == |
| 45 | | One can overwrite global client configuration crating or editing the ~/.qcg/qcg.conf file and setting the following variables: |
| 46 | | * QCG_ENV_PROXY_DURATION - default lifetime (in hours) of the proxy certificate created by the client, |
| 47 | | * QCG_ENV_PROXY_DURATION_MIN - minimal liefetime of the proxy certificate in hours. If the remaining lifetime is shorter then the given value the proxy is automatically recreated by the client |
| 48 | | * QCG_ENV_CONNECT_TIMEOUT - maximal time (in seconds) that the client waits to connect to the interactive sesion, |
| 49 | | * QCG_ENV_SKIP_KEY_CHECK - If the variable is not empty client do not check the correctness of the key format. Must be check if the client is configured to use the proxy and the key/certificate are not provided. |
