Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "Dteam vo"

From EGIWiki
Jump to navigation Jump to search
(Created page with ' Sync dteam Greece with dteam CERN. Advise sites to add the new VOMS server to their configuration. (*) They need to be told new site-info.def definitions to replace these: …')
 
 
(127 intermediate revisions by 12 users not shown)
Line 1: Line 1:
{{Template:Op menubar}}
{{Template:Doc_menubar}}
{{TOC_right}}


Sync dteam Greece with dteam CERN.
[[Category:Catch All Grid Core Services]]


= General Information  =


The DTEAM VO is an infrastructure VO that MUST be enabled by all EGI Resource Centres that support the VO concept for user authentication, as stated in the [https://documents.egi.eu/document/31 Resource Centre Operational Level Agreement]. It is meant for testing and troubleshooting of capabilities across EGI Resource Centres. Usage of the DTEAM VO is subject to the EGI [[SPG:Documents|Security Policies]].


Advise sites to add the new VOMS server to their configuration. (*)
* DTEAM AUP: Find on the VO page in the Operation Portal: https://operations-portal.egi.eu/vo/view/voname/dteam
*'''Get support''': in order to get support about the DTEAM VO please [http://helpdesk.egi.eu/ open a ticket], select type ''Operations'', and set ''concerned VO'' to ''dteam''. If you have privileges, assign it to the Support Unit ''VOsupport unit''.


They need to be told new site-info.def definitions to replace these:
= Become a member =


----------------------------------------------------------------------
Open the following link
VO_DTEAM_VOMS_SERVERS='vomss://voms.cern.ch:8443/voms/dteam?/dteam/'
VO_DTEAM_VOMSES="\
'dteam lcg-voms.cern.ch 15004 \
/DC=ch/DC=cern/OU=computers/CN=lcg-voms.cern.ch dteam 24' \
'dteam voms.cern.ch 15004 \
/DC=ch/DC=cern/OU=computers/CN=voms.cern.ch dteam 24' \
"
----------------------------------------------------------------------


*[https://voms2.hellasgrid.gr:8443/voms/dteam DTEAM VOMS-Admin]


They also need an rpm containing the host cert(s) of the new VOMS server(s)
fill in the requested information and after reading the dteam AUP confirm that you abide to this policy and press the submit button.  
at least for the WMS, while it still requires the certs of supported VOs.


We could add those certs to lcg-vomscerts to smoothen the transition,
In order to verify your email address an email will be sent to you (if you cannot find the verification email in your inbox please make sure to also check your spam folder). By following the link given within the verification email you will have to select the appropriate NGI/Group manager who will handle your request and press the "Continue" button at the bottom of the page. The NGI/Group Manager you selected will be notified of your request and should handle it.
but it may be better for EGI to control its own rpm.


== What users filling the '''dteam''' VO Registration form should do  ==


Select the appropriate '''Group Manager''' (depending on NGI origin) for themselves. The Manager corresponding to their NGI/region is offered in a bullet-list menu.


'''Example:'''
<blockquote style="background-color: lightgrey; border: solid thin grey; padding: 5px;">dteam users from Greece should select Kostas Koumantaros as their Group Manager</blockquote>


1 month sounds reasonable.
Everybody is automatically registered under the root group /dteam. Nobody can de-assign them from this "root group" unless they get "Denied", in the first place or, later on, "Suspended", by the VO-Admin, in which case they can't run any Grid jobs and they get deleted from the VOMS database.  


Close registrations at CERN. (Not sure how to technically do that
Users may select additional Groups, SubGroups and Roles within their NGI Group from their [https://voms2.hellasgrid.gr:8443/voms/dteam/user/home.action VO Home page].
but anyway)


service stop vomrs should do.
'''Examples:'''
<blockquote style="background-color: lightgrey; border: solid thin grey; padding: 5px;">dteam users from Greece should select to be added to /dteam/NGI_GRNET Group</blockquote>
<blockquote style="background-color: lightgrey; border: solid thin grey; padding: 5px;">dteam users from Greece who want Production Role should request the/dteam/NGI_GRNET/Role=production role</blockquote>


4) Sync dteam Greace with dteam CERN.
= Recipes for VO/ROC/NGI/Group/Site managers  =
5) Advise new users to register with Greece.
 
6) Remove CERN dteam.
== What the VO-Admin can do ==
7) Advise sites to drop CERN dteam configuration.
 
Everything including VO member suspension/removal and ACLs configuration that nobody else can do!
 
== What the NGI/Group Manager can do  ==
 
* Approve Candidates during the initial registration.  
 
<blockquote style="background-color: white; border: solid thin grey; padding: 5px; color: red;">
NOTE: Once an NGI/Group Manager approves a user request he/she should make sure to add this person to the corresponding group he/she manages, plus any other subgroups as applicable.  
</blockquote>
 
* Add/remove members to specific NGI/Group he/she is in charge of.

Latest revision as of 15:15, 13 March 2018

Main EGI.eu operations services Support Documentation Tools Activities Performance Technology Catch-all Services Resource Allocation Security


Documentation menu: Home Manuals Procedures Training Other Contact For: VO managers Administrators


General Information

The DTEAM VO is an infrastructure VO that MUST be enabled by all EGI Resource Centres that support the VO concept for user authentication, as stated in the Resource Centre Operational Level Agreement. It is meant for testing and troubleshooting of capabilities across EGI Resource Centres. Usage of the DTEAM VO is subject to the EGI Security Policies.

Become a member

Open the following link

fill in the requested information and after reading the dteam AUP confirm that you abide to this policy and press the submit button.

In order to verify your email address an email will be sent to you (if you cannot find the verification email in your inbox please make sure to also check your spam folder). By following the link given within the verification email you will have to select the appropriate NGI/Group manager who will handle your request and press the "Continue" button at the bottom of the page. The NGI/Group Manager you selected will be notified of your request and should handle it.

What users filling the dteam VO Registration form should do

Select the appropriate Group Manager (depending on NGI origin) for themselves. The Manager corresponding to their NGI/region is offered in a bullet-list menu.

Example:

dteam users from Greece should select Kostas Koumantaros as their Group Manager

Everybody is automatically registered under the root group /dteam. Nobody can de-assign them from this "root group" unless they get "Denied", in the first place or, later on, "Suspended", by the VO-Admin, in which case they can't run any Grid jobs and they get deleted from the VOMS database.

Users may select additional Groups, SubGroups and Roles within their NGI Group from their VO Home page.

Examples:

dteam users from Greece should select to be added to /dteam/NGI_GRNET Group

dteam users from Greece who want Production Role should request the/dteam/NGI_GRNET/Role=production role

Recipes for VO/ROC/NGI/Group/Site managers

What the VO-Admin can do

Everything including VO member suspension/removal and ACLs configuration that nobody else can do!

What the NGI/Group Manager can do

  • Approve Candidates during the initial registration.

NOTE: Once an NGI/Group Manager approves a user request he/she should make sure to add this person to the corresponding group he/she manages, plus any other subgroups as applicable.

  • Add/remove members to specific NGI/Group he/she is in charge of.