Changes between Version 6 and Version 7 of FeddDatabases

Timestamp:

Jun 29, 2010 3:26:18 AM (14 years ago)

Author:

faber

Comment:

--

FeddDatabases

@@ -49 +49 @@
 === Access Component AccessDB ===
 
-This is the most complex of the accessDBs.  Its purpose is to configure how an access control component maps a [FeddAbout#GlobalIdentifiers:Three-levelNames three level name] to a local testbed user and project, as well as the rights the project must possess (the node types it can access).  It also includes information about which kinds of nodes are restricted and allows a testbed owner to supply additional attributes used in accessing the testbed.
+This is the most complex of the accessDBs.  Its purpose is to configure how an access control component maps a [FeddAbout#GlobalIdentifiers:Three-levelNames three level name] to a authorization attribute and local access control information.  Usually the authorization attribute information is 'access' implying the ability to create new experiments.  Other plug-ins are free to create and interpret other attributes.
+
+In addition to that, a mapping can have local values, interpreted by the plug-in.  By convention the attribute is unadorned and the optional plug-in dependent information is separated by a comman and enclosed in parentheses.
+
+The general format looks like:
+{{{
+(testbed, project, user) -> attribute
+}}}
+
+With testbed dependent information:
+
+{{{
+(testbed, project, user) -> attribute, (some, testbed, stuff)
+}}}
+
 
 ==== Emulab Mappings ====
@@ -56 +70 @@
 
 {{{
-(testbed, project, user) -> (local_project[:node_type[,node_type]], local_creation_user, local_service_user)
+(testbed, project, user) -> attribute, (local_project, local_creation_user, local_service_user)
 }}}
 
@@ -66 +80 @@
 
 {{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, faber) -> (fed, foo, bar)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, faber) -> access, (fed, foo, bar)
 }}}
 
@@ -74 +88 @@
 
 {{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <any>, bill) -> (fed, foo, bar)
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <none>, faber) -> (fed, baz, quux)
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <any>, <none>) -> (fed, foo, fred)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <any>, bill) -> access, (fed, foo, bar)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <none>, faber) -> access, (fed, baz, quux)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <any>, <none>) -> access, (fed, foo, fred)
 }}}
 
@@ -86 +100 @@
 
 {{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, <any>) -> (fed, foo, <same>)
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <none>, faber) -> (<dynamic>, <dynamic>, <dynamic>)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, <any>) -> access, (fed, foo, <same>)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <none>, faber) -> access, (<dynamic>, <dynamic>, <dynamic>)
 }}}
 
@@ -95 +109 @@
 
 {{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, <any>) -> (foo, <same>, <same>)
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <any>, faber) -> (bar, <same>, <same>)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, <any>) -> access, (foo, <same>, <same>)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, <any>, faber) -> access, (bar, <same>, <same>)
 }}}
 
 the outcome is determined by the setting of the '''project_priority''' option in the [FeddConfig#AccessOptions access section] of the global configuration file.  If it is true, the user will map to local project `foo`, otherwise to `bar`.
 
-Other than the access rules, two types of line can appear in the acesss accessdb.  A line of the form:
-
-{{{
-restricted: node_type
-}}}
-
-indicates that the use of `node_type` is not open to all users.  If a requester asks for access to a restricted node type and is mapped to a project that does not include access to that type, the `fedd` will deny the request.  To specify multiple such types, include multiple such lines.
-
-For example if `node_type` is restricted and `(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea,emulab-ops, faber)` makes an access request, that user will succeed if he or she matches:
-
-{{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea,emulab-ops, faber) -> (emulab-ops:node_type, <same>, <same>)
-}}}
-
-but fail if the matching line is:
-
-{{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea,emulab-ops, faber) -> (emulab-ops:pc3000, <same>, <same>)
-}}}
 
 ==== DRAGON Mappings ====
@@ -126 +121 @@
 
 {{{
-(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea,emulab-ops, faber) -> (/usr/local/OSCARS/local_repo)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea,emulab-ops, faber) -> access, (/usr/local/OSCARS/local_repo)
 }}}
 
 Maps the given three-level name to the keys stored in /usr/local/OSCARS/local_repo.  That directory should be protected appropriately.
 
-==== Attributes ====
-
-A line of the form:
-
-{{{
-attribute: connectorImage value: FBSD7-TVF
-}}}
-
-specifies an attribute to be passed back to the requester.  In this case the attribute specifies that nodes used to connect this testbed to another federant should use local Emulab image FBSD7-TVF.  Attribute values start with the first non-whitespace character after '''value:''' and continue until the end of the line.
-
-Currently `fedd`'s experiment system understands the following attributes:
-
- '''!ConnectorImage'''::
-  The local image to load on federation connectors
- '''!ConnectorType'''::
-  The Emulab node type to request for federation connectors.  For example, this type may have access to the wide area Internet when others do not.
- '''!MasterConnectorStartCmd'''::
-  When this testbed is a master, run the given command on starting a federation connector node.
- '''!MasterNodeStartCmd'''::
-  When this testbed is a master, run the given command on starting an experimental node.
- '''!SlaveConnectorStartCmd'''::
-  When this testbed is a slave, run the given command on starting a federation connector node.
- '''!SlaveNodeStartCmd'''::
-  When this testbed is a slave, run the given command on starting an experimental node.
- '''SMBShare'''::
-  The name of the machine that the SMB file system is exported from.  Defaults to USERS which is usually correct.  If not, swap in a windows experiment and see where your testbed exports from.
- '''dragon'''::
-  The endpoint designator of this testbed to DRAGON.  This indicates that the testbed is DRAGON-connected.
- '''vlans'''::
-  The acceptable vlan numbers to allocate from DRAGON, if any.  Ranges and comma separated lists (and lists of ranges) are acceptable.
-
-Generally the '''!StartCmd''' attributes do not need to be modified.
 
 === Experiment Control Component AccessDB ===