Changes between Version 32 and Version 33 of FeddCommands

Timestamp:

Jun 12, 2014 1:18:06 PM (10 years ago)

Author:

faber

Comment:

--

FeddCommands

@@ -2 +2 @@
 
 These are the various user level programs that the fedd package installs, including fedd itself.
+
+[[TOC()]]]
 
 == Fedd ==
@@ -19 +21 @@
   Redirect log output to ''filename'' rather than the default standard output
 
+== Configuration Utilities ==
+
+There are several utilities used in the process of setting up a new controller on a DETER-style testbed.  These generate [FeddDatabases federation databases] from the main testbed database.
+
+=== access_exp_access_db.py ===
+
+The `access_exp_access_db.py` command is a helper to generate [FeddDatabases#AccessComponentAccessDB access controler component access databases].  It can be used to export access to a subset of testbed users.
+
+It can be run on a DETER testbed's `boss` to print datathat can be redirected into a file for use as a database.  With no options it converts the entire users table of the testbed database into an access controller access database with an entry for each local project of which the user is a member.  The [FeddAuthorizationArchitecture#GlobalIdentifiers:Fedids fedid] of the experiment controller that will assert the attributes is required.
+
+That behavior can be constrained using the following options.
+
+ '''--user='''''username'''::
+  Extract the information for ''username''.  Once '''--user''' is given once, only the users selected will be output.  The option may be specified more than once.
+ '''--project='''''projectname''::
+  Extract information only for the given project.  The option may be specified multiple times.
+ '''--cert_dir='''''dir''::
+   Use ''dir'' as the directory containing user certificates.  The `fedd` expects this to be a full pathname.  It is just an output parameter; the directory does not need to exist.
+ '''--experiment_controller='''''cert''::
+   The certificate of the experiment controller that will be asserting these credentials.  Required.
+
+Multiple user constraints are or-ed with each other as are multiple project constraints.  Then the resulting or clauses are and-ed together.  For example, the invocation
+{{{
+$ access_exp_accessdb.py --user faber --project Deter --project Virtual --experiment_controller ./fedd.pem --cert_dir /usr/local/etc/fedd/access/certs
+}}}
+
+produces output like
+
+{{{
+# users faber
+# projects Deter,Virtual
+(fedid:e630047380b1060ce03d19e373b8047bb785031a,Deter,faber)-> access, (Deter,faber,/usr/local/etc/fedd/access/certs/faber.pem)
+(fedid:e630047380b1060ce03d19e373b8047bb785031a,Virtual,faber)-> access, (Virtual,faber,/usr/local/etc/fedd/access/certs/faber.pem)
+}}}
+
+If the users are in other projects, those lines are suppressed; if the projects contain other users, those lines are suppressed.  The comment lines before each cluster of output help administrators understand which data corresponds to a given user.
+
+As with other commands in the fedd package, it is installed in `/usr/local/bin` by default.
+
+=== db_to_certs.py ===
+
 
 === exp_access_db.py ===
 
-The `exp_access_db.py` command is a helper to generate [FeddDatabases#ExperimentControlComponentAccessDB experiment control component access databases].  It can be run on `boss` to print data in that database's format that can be redirected into a file for use as a database.  With no options it converts the entire users table of the database into an experiment control access database with an entry for each local project of which the user is a member.  The [FeddAbout#GlobalIdentifiers:Fedids fedid's] are generated from the user's SSL certificates as they appear in the Emulab database.
+The `exp_access_db.py` command is a helper to generate [FeddDatabases#ExperimentControlComponentAccessDB experiment control component access databases].  That is, it makes the file of attributes that an experiment controller exports.
+
+It can be run on a DETER testbed's `boss` to print data in that database's format that can be redirected into a file for use as a database.  With no options it converts the entire users table of the database into an experiment control access database with an entry for each local project of which the user is a member.  The [FeddAbout#GlobalIdentifiers:Fedids fedid's] are generated from the user's SSL certificates as they appear in the Emulab database.
 
 That behavior can be constrained using the following options.