Federated AAI Configuration

From EGIWiki
Jump to: navigation, search

This page lists various AAI configurations for individual Cloud technologies.

OpenNebula

The full OpenNebula configuration including AAI settings: OpenNebula Configuration

OpenStack

Keystone

The generic documentation about how to enable VOMS support for Keystone can be found here[1].

When it comes to configuration, you will need the following files as a member of EGI FCTF.

/etc/keystone/voms.json

{
    "fedcloud.egi.eu": {
        "tenant": "EGI_FCTF"
    },
    "ops": {
        "tenant": "EGI_ops"
    }
}

Of course, the Keystone tenants EGI_FCTF and EGI_ops need to exist prior to using this mapping for the first time.

In order to accept VOMS proxy certificates for VOs fedcloud.egi.eu and ops, the following files need to be created.

/etc/grid-security/vomsdir/
├── fedcloud.egi.eu
│   ├── voms1.grid.cesnet.cz.lsc
│   └── voms2.grid.cesnet.cz.lsc
└── ops
    ├── lcg-voms2.cern.ch.lsc
    └── voms2.cern.ch.lsc

They have to contain the following:

/etc/grid-security/vomsdir/fedcloud.egi.eu/voms1.grid.cesnet.cz.lsc:

/DC=org/DC=terena/DC=tcs/C=CZ/ST=Hlavni mesto Praha/L=Praha 6/O=CESNET/CN=voms1.grid.cesnet.cz
/C=NL/ST=Noord-Holland/L=Amsterdam/O=TERENA/CN=TERENA eScience SSL CA 3

/etc/grid-security/vomsdir/fedcloud.egi.eu/voms2.grid.cesnet.cz.lsc:

/DC=cz/DC=cesnet-ca/O=CESNET/CN=voms2.grid.cesnet.cz
/DC=cz/DC=cesnet-ca/O=CESNET CA/CN=CESNET CA 3

/etc/grid-security/vomsdir/ops/lcg-voms2.cern.ch.lsc:

/DC=ch/DC=cern/OU=computers/CN=lcg-voms2.cern.ch
/DC=ch/DC=cern/CN=CERN Grid Certification Authority

/etc/grid-security/vomsdir/ops/voms2.cern.ch.lsc:

/DC=ch/DC=cern/OU=computers/CN=voms2.cern.ch
/DC=ch/DC=cern/CN=CERN Grid Certification Authority

References