Changes between Version 23 and Version 24 of iRODSwithGSI

Timestamp:

12/04/12 12:24:40 (11 years ago)

Author:

Jeanne Ohren

Comment:

--

iRODSwithGSI

@@ -207 +207 @@
 === Setting up the certificates ===
 
-I configured three different types of certificates:  CILogon, GENI/GCF certificates with grid-proxy-init, and GENI/GCF with openssl generated proxy.
+I configured four different types of certificates:  CILogon, regular GENI/GCF certificates, GENI/GCF certificates with grid-proxy-init, and GENI/GCF with openssl generated proxy.
 
 In all cases, I needed the following:
@@ -361 +361 @@
 
 8.  Now you will be able to run ils.
+{{{
+johren@pc:/tmp$ ils
+/tempZone/home/alice:
+}}}
+
+==== GENI/GCF certificates ====
+
+I downloaded the GCF code () to generate GENI certificates from my own clearing house.
+
+
+1.  Ran src/gen-certs.py to generate certificates for both host and client.
+{{{
+   ./src/gen-certs.py
+   ./src/gen-certs.py --notAll --exp -u host
+   ./src/gen-certs.py --notAll --exp -u alice
+}}}
+
+2.  Configure the root CA certificates.  These can be found in the trusted_roots directory generated above.
+     However, a hash link and signing_policy need to be created for each cert.
+
+2a.  Go to the trusted_roots directory
+{{{
+   cd trusted_roots
+}}}
+
+2b.  For each certificate, determine the hash for the certificate and create the link
+{{{
+globus@pc-0:~/irodscerts/trusted_roots$ openssl x509 -in ch-cert.pem -hash -noout
+0894ffd6
+globus@pc-0:~/irodscerts/trusted_roots$ ln -s ch-cert.pem 0894ffd6.0
+}}}
+
+2c.  Determine the issuer of each certificate
+{{{
+  openssl x509 -in <certificate-file> -issuer -noout
+}}}
+
+2d.  Create the signing_policy file (e.g. ch-cert.signing_policy) with contents like the following (where access_id_CA is the issuer of the CA found in step 2c).
+{{{
+access_id_CA   X509    '/CN=geni//gpo//gcf.authority.sa'
+pos_rights     globus  CA:sign
+cond_subjects  globus  '/*'
+}}}
+
+2e.  Create a symlink to the signing policy using the hash determined above.
+{{{
+   ln -s ch-cert.signing_policy 0894ffd6.0
+}}}
+
+You should end up with the following:
+  * A cert/key pair for the iRODS client
+  * A cert/key pair for the iRODS server (must be named hostcert.pem and hostkey.pem)
+  * The CA certificate directory
+
+Your CA certificate directory (e.g. trusted_roots) should looks something like this:
+{{{
+pc:~/.globus/certificates% ls -l
+total 28
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   11 Nov 28 09:33 0894ffd6.0 -> ch-cert.pem
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   22 Nov 28 09:57 0894ffd6.signing_policy -> ch-cert.signing_policy
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   11 Nov 28 09:33 18f0c2ad.0 -> ma-cert.pem
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   22 Nov 28 09:57 18f0c2ad.signing_policy -> ma-cert.signing_policy
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   10 Nov 28 09:32 aacaba34.0 -> cacert.pem
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   21 Nov 28 09:56 aacaba34.signing_policy -> cacert.signing_policy
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  916 Nov 28 09:31 cacert.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  111 Nov 28 09:53 cacert.signing_policy
+-rw-r--r-- 1 johren pgeni-gpolab-bbn 3023 Nov 28 09:31 CATedCACerts.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  834 Nov 28 12:31 ch-cert.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  116 Nov 28 09:54 ch-cert.signing_policy
+-rw-r--r-- 1 johren pgeni-gpolab-bbn 1273 Nov 28 09:31 ma-cert.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  111 Nov 28 09:55 ma-cert.signing_policy
+}}}
+===== Server =====
+
+1.  Create the directory /home/globus/.globus (if it doesn't alredy exist)
+{{{
+    mkdir /home/globus/.globus
+}}}
+
+2.  Place the hostkey.pem and hostcert.pem files (generated above) in /home/globus/.globus
+{{{
+    mv /tmp/hostkey.pem /home/globus/.globus
+    mv /tmp/hostcert.pem /home/globus/.globus
+}}}
+
+3.  Change the permissions of the hostkey.pem to 0600
+{{{
+    chmod 600 /home/globus/.globus/hostkey.pem
+}}}
+
+4.  Copy the CA certificates created above to /home/globus/.globus/certificates
+{{{
+mkdir /home/globus/.globus/certificates
+cp trusted_roots/* /home/globus/.globus/certificates
+}}}
+
+
+
+===== Client =====
+
+1.  Create the directory /home/globus/.globus (if it doesn't already exist)
+{{{
+    mkdir /home/globus/.globus
+}}}
+
+2.  Place the alicekey.pem and alicecert.pem files in /home/globus/.globus
+{{{
+    mv /tmp/alicekey.pem /home/globus/.globus
+    mv /tmp/alicecert.pem /home/globus/.globus
+}}}
+
+3.  Change the permissions of the alicekey.pem to 0600
+{{{
+    chmod 600 /home/globus/.globus/alicekey.pem
+}}}
+
+4.  Copy the CA certificates created above to /home/globus/.globus/certificates
+{{{
+mkdir /home/globus/.globus/certificates
+cp trusted_roots/* /home/globus/.globus/certificates
+}}}
+
+5. Set the environment
+{{{
+    export X509_CERT_DIR=/home/globus/.globus/certificates
+    export X509_USER_CERT=/home/globus/.globus/alicecert.pem
+    export X509_USER_KEY=/home/globus/.globus/alicekey.pem
+}}}
+
+6.  Get the subject DN from the certificate:
+{{{
+globus@pc:~$ openssl x509 -in .globus/alice-cert.pem -subject -noout
+subject= /CN=geni//gpo//gcf.user.alice
+}}}
+
+7.  Go back to the '''iRODS server''' and add the user authentication id.
+{{{
+   iadmin aua alice '/CN=geni//gpo//gcf.user.alice'
+}}}
+
+8.  Now you will be able to run ils.
+{{{
+johren@pc:/tmp$ ils
+/tempZone/home/alice:
+}}}
+
+==== GENI/GCF certificate with server authentication ====
+
+Follow the same steps 1-5 above.
+
+6.  Get the subject DN from the certificate on the iRODS server
+{{{
+globus@pc-0:~$ openssl x509 -in .globus/hostcert.pem -subject -noout
+subject= /CN=geni//gpo//gcf.user.irods
+}}}
+
+7.  Add this DN to the .irodsEnv on the iRODS client (/home/globus/.irods/.irodsEnv)
+{{{
+irodsHost 'pc201.emulab.net'
+# iRODS server port number:
+irodsPort 1247
+
+# Default storage resource name:
+irodsDefResource 'demoResc'
+# Home directory in iRODS:
+irodsHome '/tempZone/home/alice'
+# Current directory in iRODS:
+irodsCwd '/tempZone/home/alice'
+# Account name:
+irodsUserName 'alice'
+# Zone:
+irodsZone 'tempZone'
+
+irodsAuthScheme GSI
+irodsServerDn '/CN=geni//gpo//gcf.user.irods'
+}}}
+
+8.  Now you will be able to run ils on the client.
 {{{
 johren@pc:/tmp$ ils