|
Bugzilla – Full Text Bug Listing |
| Summary: | grid-mapfile location should be in global security descriptor | ||
|---|---|---|---|
| Product: | Java WS Security | Reporter: | Mats Rynge <rynge@isi.edu> |
| Component: | Authentication | Assignee: | Rachana Ananthakrishnan <ranantha@mcs.anl.gov> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | bester@mcs.anl.gov, gawor@mcs.anl.gov, lane@mcs.anl.gov, meder@mcs.anl.gov, millerjj@us.ibm.com, paxhia@us.ibm.com, seelbach@us.ibm.com, slang@mcs.anl.gov, smartin@mcs.anl.gov, tboehm@de.ibm.com |
| Priority: | P3 | ||
| Version: | unspecified | ||
| Target Milestone: | 4.0 | ||
| Hardware: | All | ||
| OS: | All | ||
This is a high priority for gram automated testing. There should be a setup package that can be called to change the location of the grid-mapfile programatically. e.g. ./setup-globus-core --grid-mapfile /home/user/grid-mapfile
Seems high overhead to create a setup package for what is essentially cat <globus sec desc>|sed 's!/etc/grid-security/grid-mapfile!<your location here>!' /Sam
> This is a high priority for gram automated testing. There should be a setup
> package that can be called
> to change the location of the grid-mapfile programatically.
>
> e.g. ./setup-globus-core --grid-mapfile /home/user/grid-mapfile
I'd argue that we don't need that. From the GRAM standpoint, if the services did
not explicitly name the grid-mapfile, I could easily use a different container
security description file on the command line to use a custom gridmap.
joe
Ok - sounds good to me. no setup package required.
Changes have been committed to trunk.
For our Java services, the grid-mapfile location should be specified in the global security descriptor to provide a good default and not in the services. If I want to use an alternate grid-mapfile today, I have to set GRIDMAP for my C tools and change the following services security configs: [rynge@devrandom etc]$ grep -R /etc/grid-security/grid-mapfile * 2>/dev/null globus_delegation_service/service-security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> globus_delegation_service/factory-security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> globus_wsrf_mds_index/factory-security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> globus_wsrf_mds_index/index-security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> globus_wsrf_replicator/security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> globus_wsrf_rft/security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> globus_wsrf_rft/factory-security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> gram-service/managed-job-factory-security-config.xml: <gridmap value="/etc/grid-security/grid-mapfile"/> This should be fixed by 1. adding <gridmap value="/etc/grid-security/grid-mapfile"/> to globus security descriptor 2. remove it for all the services The idea is to have one place to edit if you want to change it, and if you want a certain service to use a specific one, add a <gridmap> entry to only that service.