Changes between Version 2 and Version 3 of iRODSwithGSI


Ignore:
Timestamp:
11/30/12 10:11:23 (7 years ago)
Author:
Jeanne Ohren
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • iRODSwithGSI

    v2 v3  
    105105}}}
    106106
     107=== Configuring iRODS ===
     108
     109==== Server ====
     110
     1111.  Configure the client to use the rods user on the iRODS server in file /home/globus/.irods/.irodsEnv
     112{{{
     113# iRODS server host name:
     114irodsHost 'pc475.emulab.net'
     115# iRODS server port number:
     116irodsPort 1247
     117
     118# Default storage resource name:
     119irodsDefResource 'demoResc'
     120# Home directory in iRODS:
     121irodsHome '/tempZone/home/rods'
     122# Current directory in iRODS:
     123irodsCwd '/tempZone/home/rods'
     124# Account name:
     125irodsUserName 'rods'
     126# Zone:
     127irodsZone 'tempZone'
     128}}}
     129
     1302.  Create users (I had alice).  Password is not needed since we will be using GSI.
     131{{{
     132   iadmin mkuser alice rodsuser
     133}}}
     134
     1353.  We will add user authentication ids later after we set up certificates.
     136
     137==== Client ====
     138
     1391.  Configured the irods client to use GSI authentication and the alice user.
     140{{{
     141irodsHost 'pc475.emulab.net'
     142# iRODS server port number:
     143irodsPort 1247
     144
     145# Default storage resource name:
     146irodsDefResource 'demoResc'
     147# Home directory in iRODS:
     148irodsHome '/tempZone/home/alice'
     149# Current directory in iRODS:
     150irodsCwd '/tempZone/home/alice'
     151# Account name:
     152irodsUserName 'alice'
     153# Zone:
     154irodsZone 'tempZone'
     155
     156irodsAuthScheme GSI
     157}}}
     158
     159
    107160=== Setting up the certificates ===
    108161
    109 I configured two different types of certificates:  CILogon and GENI/GCF certificates.
     162I configured three different types of certificates:  CILogon, GENI/GCF certificates with grid-proxy-init, and GENI/GCF with openssl generated proxy.
    110163
    111164In both cases, I needed the following:
    112165   * Two different cert/key pairs:  one for the client and one for the server.
     166   * Proxy certificate
    113167   * The CA certificates
    114168
    115 ==== CiLogon ====
     169==== !CiLogon ====
    116170
    117171I logged into https://cilogon.org and used two different Google accounts to get the two cert/key pairs.
     
    208262Output should look something like this:
    209263{{{
    210 User Cert File: /users/johren/.globus/cilogon/usercert.pem
    211 User Key File: /users/johren/.globus/cilogon/userkey.pem
     264User Cert File: /users/johren/.globus/usercert.pem
     265User Key File: /users/johren/.globus/userkey.pem
    212266
    213267Trusted CA Cert Dir: (null)
     
    215269Output File: /tmp/x509up_u20001
    216270Your identity: /DC=org/DC=cilogon/C=US/O=Google/CN=Jeanne Ohren A1700
     271Enter GRID pass phrase for this identity:
     272Creating proxy .++++++++++++
     273....................++++++++++++
     274 Done
     275Your proxy is valid until: Fri Nov 30 19:26:51 2012
    217276}}}
    218277
     
    222281}}}
    223282
    224 
    225 
    226 === Configuring iRODS ===
    227 
    228 ==== Server ====
    229 ==== Client ====
     283Output should look something like this:
     284{{{
     285User Cert File: /users/johren/.globus/usercert.pem
     286User Key File: /users/johren/.globus/userkey.pem
     287
     288Trusted CA Cert Dir: /users/johren/.globus/certificates/
     289
     290Output File: /tmp/x509up_u20001
     291Your identity: /DC=org/DC=cilogon/C=US/O=Google/CN=Jeanne Ohren A1700
     292Enter GRID pass phrase for this identity:
     293Creating proxy ..............................++++++++++++
     294......++++++++++++
     295 Done
     296Proxy Verify OK
     297Your proxy is valid until: Fri Nov 30 19:27:15 2012
     298}}}
     299
     3006.  Unset X509_USER_CERT and X509_USER_KEY so it uses the proxy certificate:
     301{{{
     302unset X509_USER_CERT
     303unset X509_USER_KEY
     304}}}
     305
     3067.  Go back to the '''iRODS server''' and add the user authentication id.
     307    Identity is the one specified in the output of grid-proxy-init above.
     308{{{
     309   iadmin aua alice '/DC=org/DC=cilogon/C=US/O=Google/CN=Jeanne Ohren A1700'
     310}}}
     311
     3128.  Now you should be able to run ils.
     313{{{
     314johren@pc:/tmp$ ils
     315/tempZone/home/alice:
     316}}}
     317
     318==== GCF w/ grid-proxy-init ====
     319
     320I downloaded the GCF code () to generate GENI certificates from my own clearing house.
     321
     322
     3231.  Ran src/gen-certs.py to generate certificates for both host and client.
     324{{{
     325   ./src/gen-certs.py
     326   ./src/gen-certs.py --notAll --exp -u host
     327   ./src/gen-certs.py --notAll --exp -u alice
     328}}}
     329
     3302.  Configure the root CA certificates.  These can be found in the trusted_roots directory generated above.
     331     However, a hash link and signing_policy need to be created for each cert.
     332
     3332a.  Move the trusted_roots directory to /home/johren/.globus/certificates.
     334
     3352b.  Determine the hash for the certificate and create the link
     336{{{
     337}}}
     338
     3392c.  Create the signing_policy file and create a hash link for this.
     340{{{
     341}}}
     342
     343You should end up with the following:
     344  * A cert/key pair for the iRODS client
     345  * A cert/key pair for the iRODS server (must be named hostcert.pem and hostkey.pem)
     346  * The CA certificate directory
     347
     348===== Server =====
     349
     3501.  Place the hostkey.pem and hostcert.pem files (generated above) in /home/globus/.globus
     351{{{
     352    mv /tmp/hostkey.pem /home/globus/.globus
     353    mv /tmp/hostcert.pem /home/globus/.globus
     354}}}
     355
     3562.  Change the permissions of the hostkey.pem to 0600
     357{{{
     358    chmod 600 /home/globus/.globus/hostkey.pem
     359}}}
     360
     3613.  Copy the CA certificates created above to /home/globus/.globus/certificates
     362
     363
     364===== Client =====
     365
     366
     3671.  Place the alicekey.pem and alicecert.pem files in /home/johren/.globus
     368{{{
     369    mv /tmp/alicekey.pem /home/johren/.globus
     370    mv /tmp/alicecert.pem /home/johren/.globus
     371}}}
     372
     3733.  Change the permissions of the alicekey.pem to 0600
     374{{{
     375    chmod 600 /home/johren/.globus/alicekey.pem
     376}}}
     377
     3783.  Copy the CA certificates created above to /home/johren/.globus/certificates
     379
     3804. Set the environment
     381{{{
     382    export X509_CERT_DIR=/home/johren/.globus/certificates
     383    export X509_USER_CERT=/home/johren/.globus/alicecert.pem
     384    export X509_USER_KEY=/home/johren/.globus/alicekey.pem
     385}}}
     386
     3874.  Create the proxy certificate
     388{{{
     389    cd /home/johren/.globus
     390    /usr/local/johren/bin/grid-proxy-init -debug
     391}}}
     392
     393Output should look something like this:
     394{{{
     395
     396User Cert File: /users/johren/.globus/alice-cert.pem
     397User Key File: /users/johren/.globus/alice-key.pem
     398
     399Trusted CA Cert Dir: (null)
     400
     401Output File: /tmp/x509up_u20001
     402Your identity: /CN=geni//gpo//gcf.user.alice
     403Creating proxy .......................................++++++++++++
     404.........++++++++++++
     405 Done
     406Your proxy is valid until: Fri Nov 30 19:57:41 2012
     407}}}
     408
     4095.  Verify the proxy certificate
     410{{{
     411    /usr/local/johren/bin/grid-proxy-init -debug -verify
     412}}}
     413
     414Output should look something like this:
     415{{{
     416User Cert File: /users/johren/.globus/alice-cert.pem
     417User Key File: /users/johren/.globus/alice-key.pem
     418
     419Trusted CA Cert Dir: /users/johren/.globus/certificates/
     420
     421Output File: /tmp/x509up_u20001
     422Your identity: /CN=geni//gpo//gcf.user.alice
     423Creating proxy .++++++++++++
     424.....++++++++++++
     425 Done
     426Proxy Verify OK
     427Your proxy is valid until: Fri Nov 30 19:57:56 2012
     428}}}
     429
     4306.  Unset X509_USER_CERT and X509_USER_KEY so it uses the proxy certificate:
     431{{{
     432unset X509_USER_CERT
     433unset X509_USER_KEY
     434}}}
     435
     4367.  Go back to the '''iRODS server''' and add the user authentication id.
     437    Identity is the one specified in the output of grid-proxy-init above.
     438{{{
     439   iadmin aua alice '/CN=geni//gpo//gcf.user.alice'
     440}}}
     441
     4428.  Now you should be able to run ils.
     443{{{
     444johren@pc:/tmp$ ils
     445/tempZone/home/alice:
     446}}}
     447
     448==== GCF w/ openssl proxy cert ====
     449
     450===== Server =====
     451
     452Same as GCF w/ grid-proxy-init.
     453
     454===== Client =====
     455
     456Steps 1-3 are the same as GCF w/ grid-proxy-init.
     457
     4584.  Get the identity from the GCF cert.
     459
     4605.  Create the CSR.
     461{{{
     462}}}
     463
     4646.  Create the proxy certificate.
     465
     4667.  Concatenate the new proxy cert, new private key, and original certificate to a file named x509up_uXXXXX where XXXXX is the same as the proxy cert generated by grid-proxy-init.
     467
     4688.  Copy the concatenated certificate to /tmp.
     469
     4709.  Run grid-proxy-info to get the identity of the proxy certificate.
     471
     47210.  Go back to the '''iRODS server''' and add the user authentication id.
     473{{{
     474   iadmin aua alice '/CN=geni//gpo//gcf.user.alice'
     475}}}
     476
     4778.  Now you should be able to run ils.
     478{{{
     479johren@pc:/tmp$ ils
     480/tempZone/home/alice:
     481}}}
    230482
    231483=== References ===
     484https://code.renci.org/gf/project/jargon/tracker/?action=TrackerItemEdit&tracker_item_id=132
     485http://www.nordugrid.org/documents/certificate_howto.html
     486https://cilogon.org/
     487https://www.irods.org/index.php/Grid_Security_Infrastructure