Changes between Version 2 and Version 3 of iRODSwithGSI

Timestamp:

11/30/12 10:11:23 (11 years ago)

Author:

Jeanne Ohren

Comment:

--

iRODSwithGSI

@@ -105 +105 @@
 }}}
 
+=== Configuring iRODS ===
+
+==== Server ====
+
+1.  Configure the client to use the rods user on the iRODS server in file /home/globus/.irods/.irodsEnv
+{{{
+# iRODS server host name:
+irodsHost 'pc475.emulab.net'
+# iRODS server port number:
+irodsPort 1247
+
+# Default storage resource name:
+irodsDefResource 'demoResc'
+# Home directory in iRODS:
+irodsHome '/tempZone/home/rods'
+# Current directory in iRODS:
+irodsCwd '/tempZone/home/rods'
+# Account name:
+irodsUserName 'rods'
+# Zone:
+irodsZone 'tempZone'
+}}}
+
+2.  Create users (I had alice).  Password is not needed since we will be using GSI.
+{{{
+   iadmin mkuser alice rodsuser
+}}}
+
+3.  We will add user authentication ids later after we set up certificates.
+
+==== Client ====
+
+1.  Configured the irods client to use GSI authentication and the alice user.
+{{{
+irodsHost 'pc475.emulab.net'
+# iRODS server port number:
+irodsPort 1247
+
+# Default storage resource name:
+irodsDefResource 'demoResc'
+# Home directory in iRODS:
+irodsHome '/tempZone/home/alice'
+# Current directory in iRODS:
+irodsCwd '/tempZone/home/alice'
+# Account name:
+irodsUserName 'alice'
+# Zone:
+irodsZone 'tempZone'
+
+irodsAuthScheme GSI
+}}}
+
+
 === Setting up the certificates ===
 
-I configured two different types of certificates:  CILogon and GENI/GCF certificates.
+I configured three different types of certificates:  CILogon, GENI/GCF certificates with grid-proxy-init, and GENI/GCF with openssl generated proxy.
 
 In both cases, I needed the following:
    * Two different cert/key pairs:  one for the client and one for the server.
+   * Proxy certificate
    * The CA certificates
 
-==== CiLogon ====
+==== !CiLogon ====
 
 I logged into https://cilogon.org and used two different Google accounts to get the two cert/key pairs.
@@ -208 +262 @@
 Output should look something like this:
 {{{
-User Cert File: /users/johren/.globus/cilogon/usercert.pem
-User Key File: /users/johren/.globus/cilogon/userkey.pem
+User Cert File: /users/johren/.globus/usercert.pem
+User Key File: /users/johren/.globus/userkey.pem
 
 Trusted CA Cert Dir: (null)
@@ -215 +269 @@
 Output File: /tmp/x509up_u20001
 Your identity: /DC=org/DC=cilogon/C=US/O=Google/CN=Jeanne Ohren A1700
+Enter GRID pass phrase for this identity:
+Creating proxy .++++++++++++
+....................++++++++++++
+ Done
+Your proxy is valid until: Fri Nov 30 19:26:51 2012
 }}}
 
@@ -222 +281 @@
 }}}
 
-
-
-=== Configuring iRODS ===
-
-==== Server ====
-==== Client ====
+Output should look something like this:
+{{{
+User Cert File: /users/johren/.globus/usercert.pem
+User Key File: /users/johren/.globus/userkey.pem
+
+Trusted CA Cert Dir: /users/johren/.globus/certificates/
+
+Output File: /tmp/x509up_u20001
+Your identity: /DC=org/DC=cilogon/C=US/O=Google/CN=Jeanne Ohren A1700
+Enter GRID pass phrase for this identity:
+Creating proxy ..............................++++++++++++
+......++++++++++++
+ Done
+Proxy Verify OK
+Your proxy is valid until: Fri Nov 30 19:27:15 2012
+}}}
+
+6.  Unset X509_USER_CERT and X509_USER_KEY so it uses the proxy certificate:
+{{{
+unset X509_USER_CERT
+unset X509_USER_KEY
+}}}
+
+7.  Go back to the '''iRODS server''' and add the user authentication id.
+    Identity is the one specified in the output of grid-proxy-init above.
+{{{
+   iadmin aua alice '/DC=org/DC=cilogon/C=US/O=Google/CN=Jeanne Ohren A1700'
+}}}
+
+8.  Now you should be able to run ils.
+{{{
+johren@pc:/tmp$ ils
+/tempZone/home/alice:
+}}}
+
+==== GCF w/ grid-proxy-init ====
+
+I downloaded the GCF code () to generate GENI certificates from my own clearing house.
+
+
+1.  Ran src/gen-certs.py to generate certificates for both host and client.
+{{{
+   ./src/gen-certs.py
+   ./src/gen-certs.py --notAll --exp -u host
+   ./src/gen-certs.py --notAll --exp -u alice
+}}}
+
+2.  Configure the root CA certificates.  These can be found in the trusted_roots directory generated above.
+     However, a hash link and signing_policy need to be created for each cert.
+
+2a.  Move the trusted_roots directory to /home/johren/.globus/certificates.
+
+2b.  Determine the hash for the certificate and create the link
+{{{
+}}}
+
+2c.  Create the signing_policy file and create a hash link for this.
+{{{
+}}}
+
+You should end up with the following:
+  * A cert/key pair for the iRODS client
+  * A cert/key pair for the iRODS server (must be named hostcert.pem and hostkey.pem)
+  * The CA certificate directory
+
+===== Server =====
+
+1.  Place the hostkey.pem and hostcert.pem files (generated above) in /home/globus/.globus
+{{{
+    mv /tmp/hostkey.pem /home/globus/.globus
+    mv /tmp/hostcert.pem /home/globus/.globus
+}}}
+
+2.  Change the permissions of the hostkey.pem to 0600
+{{{
+    chmod 600 /home/globus/.globus/hostkey.pem
+}}}
+
+3.  Copy the CA certificates created above to /home/globus/.globus/certificates
+
+
+===== Client =====
+
+
+1.  Place the alicekey.pem and alicecert.pem files in /home/johren/.globus
+{{{
+    mv /tmp/alicekey.pem /home/johren/.globus
+    mv /tmp/alicecert.pem /home/johren/.globus
+}}}
+
+3.  Change the permissions of the alicekey.pem to 0600
+{{{
+    chmod 600 /home/johren/.globus/alicekey.pem
+}}}
+
+3.  Copy the CA certificates created above to /home/johren/.globus/certificates
+
+4. Set the environment
+{{{
+    export X509_CERT_DIR=/home/johren/.globus/certificates
+    export X509_USER_CERT=/home/johren/.globus/alicecert.pem
+    export X509_USER_KEY=/home/johren/.globus/alicekey.pem
+}}}
+
+4.  Create the proxy certificate
+{{{
+    cd /home/johren/.globus
+    /usr/local/johren/bin/grid-proxy-init -debug
+}}}
+
+Output should look something like this:
+{{{
+
+User Cert File: /users/johren/.globus/alice-cert.pem
+User Key File: /users/johren/.globus/alice-key.pem
+
+Trusted CA Cert Dir: (null)
+
+Output File: /tmp/x509up_u20001
+Your identity: /CN=geni//gpo//gcf.user.alice
+Creating proxy .......................................++++++++++++
+.........++++++++++++
+ Done
+Your proxy is valid until: Fri Nov 30 19:57:41 2012
+}}}
+
+5.  Verify the proxy certificate
+{{{
+    /usr/local/johren/bin/grid-proxy-init -debug -verify
+}}}
+
+Output should look something like this:
+{{{
+User Cert File: /users/johren/.globus/alice-cert.pem
+User Key File: /users/johren/.globus/alice-key.pem
+
+Trusted CA Cert Dir: /users/johren/.globus/certificates/
+
+Output File: /tmp/x509up_u20001
+Your identity: /CN=geni//gpo//gcf.user.alice
+Creating proxy .++++++++++++
+.....++++++++++++
+ Done
+Proxy Verify OK
+Your proxy is valid until: Fri Nov 30 19:57:56 2012
+}}}
+
+6.  Unset X509_USER_CERT and X509_USER_KEY so it uses the proxy certificate:
+{{{
+unset X509_USER_CERT
+unset X509_USER_KEY
+}}}
+
+7.  Go back to the '''iRODS server''' and add the user authentication id.
+    Identity is the one specified in the output of grid-proxy-init above.
+{{{
+   iadmin aua alice '/CN=geni//gpo//gcf.user.alice'
+}}}
+
+8.  Now you should be able to run ils.
+{{{
+johren@pc:/tmp$ ils
+/tempZone/home/alice:
+}}}
+
+==== GCF w/ openssl proxy cert ====
+
+===== Server =====
+
+Same as GCF w/ grid-proxy-init.
+
+===== Client =====
+
+Steps 1-3 are the same as GCF w/ grid-proxy-init.
+
+4.  Get the identity from the GCF cert.
+
+5.  Create the CSR.
+{{{
+}}}
+
+6.  Create the proxy certificate.
+
+7.  Concatenate the new proxy cert, new private key, and original certificate to a file named x509up_uXXXXX where XXXXX is the same as the proxy cert generated by grid-proxy-init.
+
+8.  Copy the concatenated certificate to /tmp.
+
+9.  Run grid-proxy-info to get the identity of the proxy certificate.
+
+10.  Go back to the '''iRODS server''' and add the user authentication id.
+{{{
+   iadmin aua alice '/CN=geni//gpo//gcf.user.alice'
+}}}
+
+8.  Now you should be able to run ils.
+{{{
+johren@pc:/tmp$ ils
+/tempZone/home/alice:
+}}}
 
 === References ===
+https://code.renci.org/gf/project/jargon/tracker/?action=TrackerItemEdit&tracker_item_id=132 
+http://www.nordugrid.org/documents/certificate_howto.html 
+https://cilogon.org/
+https://www.irods.org/index.php/Grid_Security_Infrastructure