Changes between Version 8 and Version 9 of FeddGettingStarted

Timestamp:

Mar 29, 2012 9:01:41 PM (12 years ago)

Author:

faber

Comment:

--

FeddGettingStarted

@@ -190 +190 @@
 == Configuring the Access Controller ==
 
-The access controller needs a similar set of files configured, but there are a couple key differences.  The configuration file looks like:
+The access controller needs a similar set of files configured, but there are a couple key differences. For exposition, call the configuration file {{{/usr/local/etc/fedd/access/access.conf}}}.
+
+The configuration file looks like:
 
 {{{
@@ -257 +259 @@
 
 }}}
+
+A copy is [attachnemnt:access.conf attached].
+
+An X.509 identity and ssh identity are required, and should be protected using proper file system protections.
+
+Again, we configure the ABAC credentials in 2 steps from the existing DETER database.  The system will map from an ABAC attribute to a user and project in which to create the federated experiment.  The access controller makes allocations as a user through two mechanisms
+
+ * The XMLRPC actions to manipulate DETER experiments are taken with a copy of the DETER user's SSL certificate issued by DETER
+   * Copies of these certificates are placed under the access controller's home directory, protected by the file system
+ * Additional software and data is moved into federated experiments using the access controller's ssh identity to log in as the user in question.
+
+The analogue {{{to exp_access.db.py}}} for DETER access controllers is {{{deter_exp_access_db.py}}}.  It takes the same selection praameters as {{{to exp_access.db.py}}} and two others:
+
+ * --testbed takes the X.509 certificate of this access controller.  This is used to get the fedid of the access controller.
+ * --cert-dir is the pathname under the access controller's home in which copies of users' X.509 identities will be stored.
+
+This script is run on boss, so copy the access controller's certificate to boss and run something like:
+
+{{{
+deter_exp_access_db.py --testbed cert.pem --cert-dir deter_certs
+}}}
+
+and capture it to a file named {{{deter_access}}}.
+
+Now we need to gather the users' X.509 identities.  The following is puts them all in deter_certs in the current directory:
+
+{{{
+db_to_certs.py --cert-dir deter_certs
+}}}
+
+Make a tar archive of that directory and copy it back to users.  The certificate copies are all read-only and only accessible to the user who ran the script.  If the access controller will be running as another user, you will have to change their owners when you install them on users.
+
+Untar the certificates into {{{/usr/local/etc/fedd/access/deter_certs}}} and set permissions appropriately.
+
+Now to convert all this to ABAC, run the following in {{{/usr/local/etc/fedd/access}}}:
+
+{{{
+access_to_abac.py --cert=fedd.pem --dir=/usr/local/etc/fedd/access/abac --type=emulab --mapfile=deter_abac_map deter_access
+}}}
+
+Note that the parameter to {{{--mapfile}}} must be the filename given as {{{access_db:}}} in the {{{access.conf}}} file.
+
+At this point the access controller can be run as:
+
+{{{fedd.py --config=/usr/local/etc/fedd/access/access.conf --debug}}}
+
+It will also take the {{{--logfile}}} parameter.