Ah, I'll play with that then. Is the procedure for that documented on the Engage VO site? And what does it mean if it's not added into Swift, that I won't be able to run on sites that require it? Or does it operate like grid-proxy-init in that once I apply it to a site, I'm good to go?<br>
<br>Arjun<br><br><div class="gmail_quote">On Thu, Jun 17, 2010 at 10:38 AM, Michael Wilde <span dir="ltr"><<a href="mailto:wilde@mcs.anl.gov">wilde@mcs.anl.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Arjun, this may be the reason that your access to many OSG sites is failing.<br>
<br>
Find a site that fails using grid-proxy-init from say teraport.<br>
Then try that same site, using voms-proxy-init (sp?) on engage-login.<br>
<br>
We'll both need to dig into the full meaning of a "VOMS" proxy, but basically it appends extra "role" information to the proxy to indicate that you are activing as a member of a specific VO (in your case, the "engage" VO).<br>
<br>
I dont recall if we added that to Swift yet (I think not). Mihael, do you recal?<br>
<br>
If not, you'll need to do more of the initial testing from engage-login until we instal; OSG clients.<br>
<br>
- Mike<br>
<br>
----- Forwarded Message -----<br>
From: "Brian Bockelman" <<a href="mailto:bbockelm@cse.unl.edu">bbockelm@cse.unl.edu</a>><br>
To: "Robert Engel" <<a href="mailto:engel_r@ligo.caltech.edu">engel_r@ligo.caltech.edu</a>><br>
Cc: "Keith Chadwick" <<a href="mailto:chadwick@fnal.gov">chadwick@fnal.gov</a>>, "Iwona Sakrejda" <<a href="mailto:isakrejda@lbl.gov">isakrejda@lbl.gov</a>>, <a href="mailto:OSG-int@opensciencegrid.org">OSG-int@opensciencegrid.org</a>, <a href="mailto:OSG-VO-FORUM@opensciencegrid.org">OSG-VO-FORUM@opensciencegrid.org</a>, "Arvind Gopu" <<a href="mailto:agopu@indiana.edu">agopu@indiana.edu</a>>, "Rob Quick" <<a href="mailto:rquick@iupui.edu">rquick@iupui.edu</a>><br>
Sent: Thursday, June 17, 2010 2:44:16 AM GMT -06:00 US/Canada Central<br>
Subject: Re: How to know if a site requires a VOMS Proxy or a Grid Proxy for authentication?<br>
<br>
<br>
On Jun 17, 2010, at 12:39 AM, Robert Engel wrote:<br>
<br>
> Keith,<br>
><br>
> thanks for the link. But that is what I meant by manually knocking on each door. As an OSG user I want a simple way to find out what proxy to use on each of the potential 50+ resources there are.<br>
><br>
<br>
Use a VOMS proxy. Didn't we just determine they are a superset of grid proxies? Reading through the thread, I didn't see any site saying "I accept grid proxies but not VOMS proxies."<br>
<br>
Ultimately, there are a million things that can go wrong in distributed computing (cosmic rays hitting fiber cables at FNAL). Why concentrate on this one? I'm not against having better probes or tests - but we have extremely limited effort. I'd rather identify the areas where we need this the most.<br>
<br>
The only way to know if a site accepts your jobs are to submit jobs. Why should we add central complexity instead of using auto-discovery (esp since the central view, whether MyOSG, BDII, etc, is always going to be wrong as they don't use your proxy)?<br>
<br>
We are a decentralized, distributed computing facility. You can't have centralized information that's "correct" if you have a decentralized computing system.<br>
<br>
Brian<br>
<br>
> I am thinking that myOSG could provide the required proxy information for each of the resources. Perhaps Arvind and Rob can comment on that.<br>
><br>
> Robert<br>
><br>
><br>
><br>
> Keith Chadwick wrote:<br>
>> At 3:17 PM -0700 6/16/10, Robert Engel wrote:<br>
>>> Hey Iwona,<br>
>>><br>
>>> currently I recommend in the documentation to always check with the membership VO if they support VOMS and provide a VOMS server. Just as you said, the VOMS proxy in the end is just a 'fancy' grid proxy and can be used as such. I recommend using the VOMS Proxy under this circumstances.<br>
>>><br>
>>> On the other hand I would like users who can't generate a VOMS Proxy with extended attributes to know if a certain site requires such without having to 'knock on every door' manually? Like for instance at Fermilab where this is required. I only know it is required because I talked to Burt. Otherwise I would have no idea.<br>
>><br>
>> The requirement for voms proxies is explicitly published in the<br>
>> FermiGrid policy document:<br>
>><br>
>> <a href="http://fermigrid.fnal.gov/policy.html" target="_blank">http://fermigrid.fnal.gov/policy.html</a><br>
>><br>
>> Direct quote from the above document:<br>
>><br>
>> VOs and VO members that desire to Fermilab grid resources must initialize<br>
>> their credentials using:<br>
>><br>
>> * $VDT_LOCATION/voms/bin/voms-proxy-init<br>
>><br>
>> Those VOs and VO members that fail to use voms-proxy-init may be blocked<br>
>> from accessing Fermilab grid resources.<br>
>><br>
>> -Keith.<br>
>><br>
>>> Thanks,<br>
>>> Robert<br>
>>><br>
>>> Iwona Sakrejda wrote:<br>
>>>> But even not all the sites that run GUMS servers requirer VOMS proxy.<br>
>>>><br>
>>>> So I'd say - if a proxy is rejected by a site, is the error message clear? I never tried....<br>
>>>><br>
>>>> Also the user should check with the VO. If a vo is utilizing functionality that comes with<br>
>>>> a VOMS proxy, it will be presumably educating its users about available roles and such, no?<br>
>>>><br>
>>>> Always asking for a VOMS proxy is safer. If no VOMS server available - it will be reduced to<br>
>>>> a regular proxy. If a site is using map files, the extra stuff will be ignored and the proxy will<br>
>>>> work anyway.<br>
>>>><br>
>>>> Isn't it so?<br>
>>>><br>
>>>> Iwona<br>
>>>><br>
>>>> On Wed, Jun 16, 2010 at 2:57 PM, Robert Engel <<a href="mailto:engel_r@ligo.caltech.edu">engel_r@ligo.caltech.edu</a> <mailto:<a href="mailto:engel_r@ligo.caltech.edu">engel_r@ligo.caltech.edu</a>>> wrote:<br>
>>>><br>
>>>> Steven,<br>
>>>><br>
>>>> ? Do you know how a user could find out what RSV probes are<br>
>>>> running on any given site? I tried to find this in myOSG, but<br>
>>>> nothing turned up.<br>
>>>><br>
>>>> Thanks,<br>
>>>> Robert<br>
>>>><br>
>>>><br>
>>>> Steven Timm wrote:<br>
>>>><br>
>>>> The answer is not always a clear yes or no. ?If a site copies<br>
>>>> the OSG GUMS template and runs GUMS then they will end up<br>
>>>> requiring voms proxies for about half of the VO's and not<br>
>>>> for the other half.<br>
>>>> You could indirectly find out by which RSV probes any given site<br>
>>>> is running, GUMS sites run different RSV probes than grid-mapfile<br>
>>>> sites do. ?by default all grid-mapfile sites do not require<br>
>>>> any VOMS proxy.<br>
>>>><br>
>>>> FermiGrid is the only site I know of that requires VOMS proxy for<br>
>>>> everyone and even we have a way to make exceptions if necessary.<br>
>>>><br>
>>>> Steve<br>
>>>><br>
>>>><br>
>>>> On Wed, 16 Jun 2010, Robert Engel wrote:<br>
>>>><br>
>>>> Hello,<br>
>>>><br>
>>>> ?I am writing documentation for end users. I would like to<br>
>>>> write how a user can find out if a site accepts a Grid<br>
>>>> Proxy or requires a VOMS Proxy. Can that information be<br>
>>>> found in myOSG?<br>
>>>><br>
>>>> Thanks,<br>
>>>> Robert<br>
>>>><br>
>>>><br>
>>><br>
>>><br>
>>><br>
>>> Attachment converted: Macintosh HD:engel_r 18.vcf (TEXT/ttxt) (0040AFA0)<br>
>><br>
>><br>
> <engel_r.vcf><br>
<font color="#888888"><br>
<br>
--<br>
Michael Wilde<br>
Computation Institute, University of Chicago<br>
Mathematics and Computer Science Division<br>
Argonne National Laboratory<br>
<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Arjun Comar, Rose-Hulman '12<br>