From 0b67809d522e9bb38233caa9e9d554b347f02650 Mon Sep 17 00:00:00 2001
From: terranovaa Security Overview
>my_identity="frontend_identity@myfactory.example.org" ...
+ >
+ ...
<security
Security Overview
>/DC=org/DC=doegrids/OU=Services/CN=glidein/myfrontend\.example\.org " ...
- <credential type="grid_proxy"
- security_class="frontend" ...
+ <credential type="grid_proxy"
+ security_class="frontend" ...
+
Factory config (on myfactory.example.org)
<frontend
@@ -302,12 +304,18 @@ Security Overview
myfrontend.example.org and myfactory.example.org)
GSI " ^
- \/DC\=org\/DC\=doegrids\/OU\=Services\/CN\=glidein\/myfactory\.example\.org$ "
+ \/DC\=org\/DC\=doegrids\/OU\=Services\/CN\=glidein\/myfactory\.example\.org$ "
factory_identity
- \/DC\=org\/DC\=doegrids\/OU\=Services\/CN\=glidein\/myfrontend\.example\.org$ "
+ \/DC\=org\/DC\=doegrids\/OU\=Services\/CN\=glidein\/myfrontend\.example\.org$ "
frontend_identity
-
+
For a visual representation of the JWT configuration that must match,
see the below:
From 65f885da782f64ef76377f1b8c753d5eb7b97724 Mon Sep 17 00:00:00 2001
From: terranovaa
executable
+type
- True if the file is a script (executable, see example below), - default is False + Keyword identifying the file type. Can have qualifiers depending + on the type after a colon (":"). - regular - nocache - + executable/exec/run (:s/:singularity modifier to run in + singularity) - untar (if a qualifier is present, it will be the + name of the directory where the tarball will be unpacked, the + name of the tarball will be used otherwise) - wrapper - source - + library (:shell in case of a shell library)
wrapper
+const
- True if the file is a user wrapper (see example below), default - is False + If False the file is not constant (i.e. changes may happen + without a reconfiguration of the Factory and the file cannot be + checksummed), default is True
untar
+relfname
- True if the file is a tarball that needs to be expanded (see - example below), default is False + Path to save the file, relative to the glidein main directory
type
+time
- File type, must be one of the valid types (regular, run, source, - wrapper, untar). Can have qualifiers depending on the type after - a colon (":"). Valid qualifier for run is "singularity" - causes setup scripts to run in Singularity. Currently - type is ignored for non executables and the only values - used are "run" or "run:singularity". Default is empty + Phase of the lifecycle when to execute/source the scripts: - + startup - pre_job - after_job - cleanup - periodic (:period will + specify the period in seconds, 60 by default) - milestone (:code + will specify the milestone code) - failure (:exit_code will + specify the failure code) Time will be ignored for files when + type is different than exec or source. A combination of time + phases can be used.
const
+prefix
- If False the file is not constant (i.e. changes may happen
- without a reconfiguration of the Factory and the file cannot be
- checksummed), default is True
+ STARTD_CRON prefix, it is prepended to all HTCondor variables
+ generated by the script (see documentation). This is ignored
+ from anything different from a periodic executable script. The
+ default value is
relfname
+priority
- Path to save the file, relative to the glidein main directory + priority - priority in the order of execution inside a time + phase [0-99]. Relevant only for executable, source and library + files. Order String code representation Associated integer code + (internal representation) Factory pre_entry e-[g-] 10 Frontend + pre_entry pre_group e-g- 20 Frontend pre_entry group e-g= 30 + Frontend pre_entry after_group e-g+ 40 entry e=[g-,g+,g=] 50 + Frontend after_entry pre_group e+g- 60 Frontend after_entry + group e+g= 70 Frontend after_entry after_group e+g+ 80 Factory + after_entry e+[g+] 90 A custom value inside the range [0-99] can + be specified in order to alter the order of execution. (see + the custom scripts document + for more details).
period
+comment
+Arbitrary comment string
after_entry
- If period>0 is the period (in seconds) of the executable . - Default is 0 (non periodic script). This is ignored for non - executable scripts. (see + If True, the script is executed after the entry scripts. Default + is False for the Factory, default is True for the Frontend. (see the custom scripts document for more)
@@ -2743,50 +2770,60 @@prefix
+cond_download
- STARTD_CRON prefix, it is prepended to all HTCondor variables
- generated by the script (see documentation). This is ignored
- from anything different from a periodic executable script. The
- default value is
comment
+tar_source
++ Name of the tarball containing the file, if the file is + contained in a tarball, NULL otherwise (default) +
Arbitrary comment string
after_entry
+config_out
+has a special value of FALSE
+cond_attr
- If True, the script is executed after the entry scripts. Default - is False for the Factory, default is True for the Frontend. (see - the custom scripts document - for more) + cond_attr - Name of a configuration switch. (like "ENABLE_KRB5") + The operation requested on the file will be performed only if + that parameter will be set to 1. If not set (set to NULL), the + result will be considered as TRUE (i.e. download) As result, a + file will be downloaded if cond_download == TRUE OR $cond_attr + == TRUE
after_group
+absdir_outattr
- If True, the Frontend script is executed after the group - scripts. Default is False. Not considered in the Factory. (see - the custom scripts document - for more) + Name of a variable name. (like "KRB5_SUBSYS_DIR") The variable + will be set to the absolute path of the file if the file is not + a tarball or the directory where the tarball was unpacked in + case it is a tarball, this last thing if and only if the + unpacking actually happened (else it will not be defined.)
@@ -2818,7 +2855,7 @@
Path to the wrapper custom script. The script will be copied in @@ -2836,7 +2873,7 @@
@@ -2859,10 +2896,10 @@
Sometimes it is useful to transfer a whole set of files, or even @@ -2885,8 +2922,9 @@
executable="True"+
type="executable"
By default the files listed are non executable, so an administrator needs explicitly list the executable ones. @@ -152,7 +152,7 @@
period="3600"+
time="periodic:period"
Periodic script can know if they are run at setup or later by looking at the GLIDEIN_PERIODIC_SCRIPT environment variable, which is set only @@ -533,7 +533,10 @@
executable
+type
- True if the file is a script (executable, see example below), - default is False + Keyword identifying the file type. Can have qualifiers depending + on the type after a colon (":"). - regular - nocache - + executable/exec/run (:s/:singularity modifier to run in + singularity) - untar (if a qualifier is present, it will be the + name of the directory where the tarball will be unpacked, the + name of the tarball will be used otherwise) - wrapper - source - + library (:shell in case of a shell library)
wrapper
+const
- True if the file is a user wrapper (see example below), default - is False + If False the file is not constant (i.e. changes may happen + without a reconfiguration of the Factory and the file cannot be + checksummed), default is True
untar
+relfname
- True if the file is a tarball that needs to be expanded (see - example below), default is False + Path to save the file, relative to the glidein main directory
type
+time
- File type, must be one of the valid types (regular, run, source, - wrapper, untar). Can have qualifiers depending on the type after - a colon (":"). Valid qualifier for run is "singularity" - causes setup scripts to run in Singularity. Currently - type is ignored for non executables and the only values - used are "run" or "run:singularity". Default is empty + Phase of the lifecycle when to execute/source the scripts: - + startup - pre_job - after_job - cleanup - periodic (:period will + specify the period in seconds, 60 by default) - milestone (:code + will specify the milestone code) - failure (:exit_code will + specify the failure code) Time will be ignored for files when + type is different than exec or source. A combination of time + phases can be used.
const
+prefix
- If False the file is not constant (i.e. changes may happen
- without a reconfiguration of the Factory and the file cannot be
- checksummed), default is True
+ STARTD_CRON prefix, it is prepended to all HTCondor variables
+ generated by the script (see documentation). This is ignored
+ from anything different from a periodic executable script. The
+ default value is
relfname
+priority
- Path to save the file, relative to the glidein main directory + priority - priority in the order of execution inside a time + phase [0-99]. Relevant only for executable, source and library + files. Order String code representation Associated integer code + (internal representation) Factory pre_entry e-[g-] 10 Frontend + pre_entry pre_group e-g- 20 Frontend pre_entry group e-g= 30 + Frontend pre_entry after_group e-g+ 40 entry e=[g-,g+,g=] 50 + Frontend after_entry pre_group e+g- 60 Frontend after_entry + group e+g= 70 Frontend after_entry after_group e+g+ 80 Factory + after_entry e+[g+] 90 A custom value inside the range [0-99] can + be specified in order to alter the order of execution. (see + the custom scripts document + for more details).
period
+comment
+Arbitrary comment string
after_entry
- If period>0 is the period (in seconds) of the executable . - Default is 0 (non periodic script). This is ignored for non - executable scripts. (see + If True, the script is executed after the entry scripts. Default + is False for the Factory, default is True for the Frontend. (see the custom scripts document for more)
@@ -2743,50 +2770,60 @@prefix
+cond_download
- STARTD_CRON prefix, it is prepended to all HTCondor variables
- generated by the script (see documentation). This is ignored
- from anything different from a periodic executable script. The
- default value is
comment
+tar_source
++ Name of the tarball containing the file, if the file is + contained in a tarball, NULL otherwise (default) +
Arbitrary comment string
after_entry
+config_out
+has a special value of FALSE
+cond_attr
- If True, the script is executed after the entry scripts. Default - is False for the Factory, default is True for the Frontend. (see - the custom scripts document - for more) + cond_attr - Name of a configuration switch. (like "ENABLE_KRB5") + The operation requested on the file will be performed only if + that parameter will be set to 1. If not set (set to NULL), the + result will be considered as TRUE (i.e. download) As result, a + file will be downloaded if cond_download == TRUE OR $cond_attr + == TRUE
after_group
+absdir_outattr
- If True, the Frontend script is executed after the group - scripts. Default is False. Not considered in the Factory. (see - the custom scripts document - for more) + Name of a variable name. (like "KRB5_SUBSYS_DIR") The variable + will be set to the absolute path of the file if the file is not + a tarball or the directory where the tarball was unpacked in + case it is a tarball, this last thing if and only if the + unpacking actually happened (else it will not be defined.)
@@ -2818,7 +2855,7 @@
Path to the wrapper custom script. The script will be copied in @@ -2836,7 +2873,7 @@
@@ -2859,10 +2896,10 @@
Sometimes it is useful to transfer a whole set of files, or even @@ -2885,8 +2922,9 @@
executable="True"+
type="executable"
By default the files listed are non executable, so an administrator needs explicitly list the executable ones. @@ -152,7 +152,7 @@
period="3600"+
time="periodic:period"
Periodic script can know if they are run at setup or later by looking at the GLIDEIN_PERIODIC_SCRIPT environment variable, which is set only @@ -533,7 +533,10 @@