Two Currently, two technologies are involved in Authentication (AuthN for short) and Authorization (AuthZ) for in the computing grid:
- Virtual Organization Membership Service (VOMS), based on the X.509 standard for SSL certificates;
- JSON Web Token (JWT), based on openid-connect and OAuth2.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
[ashtimmerman@ui-tier1 ~]$ voms-proxy-init --voms juno
Enter GRID pass phrase for this identity:
Created proxy in /tmp/x509up_u10171.
Your proxy is valid until Wed Jun 18 07:04:04 CEST 2025 |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
[ashtimmerman@ui-tier1 ~]$ voms-proxy-info --all subject : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it/CN=1171514709 issuer : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it identity : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it type : RFC3820 compliant impersonation proxy strength : 2048 path : /tmp/x509up_u10171 timeleft : 11:58:42 key usage : Digital Signature, Key Encipherment === VO juno extension information === VO : juno subject : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it issuer : /DC=org/DC=terena/DC=tcs/C=IT/ST=Roma/O=Istituto Nazionale di Fisica Nucleare/CN=voms-juno.cloud.cnaf.infn.it attribute : /juno/Role=NULL/Capability=NULL timeleft : 11:58:42 uri : voms-juno.cloud.cnaf.infn.it:15008 |
For displaying Often for debugging purposes, is useful to display the entire certificate chain, including intermediate and root certificates used to validate the proxy:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[ashtimmermanus@ui-tier1 ~]$ voms-proxy-info --all --chain === Proxy Chain Information === X.509 v3 certificate Subject: CN=1479623907,CN=Aksieniia Shtimmerman ashtimmerman@infn.it,O=Istituto Nazionale di Fisica Nucleare,C=IT,DC=tcs,DC=terena,DC=org Issuer: CN=Aksieniia Shtimmerman ashtimmerman@infn.it,O=Istituto Nazionale di Fisica Nucleare,C=IT,DC=tcs,DC=terena,DC=org Valid from: Tue Jun 17 19:04:04 CEST 2025 Valid to: Wed Jun 18 07:04:04 CEST 2025 CA: false Signature alg: SHA384WITHRSA Public key type: RSA 2048bit Allowed usage: digitalSignature keyEncipherment Serial number: 1479623907 VOMS extensions: no. X.509 v3 certificate Subject: CN=Aksieniia Shtimmerman ashtimmerman@infn.it,O=Istituto Nazionale di Fisica Nucleare,C=IT,DC=tcs,DC=terena,DC=org Issuer: CN=GEANT TCS Authentication RSA CA 4B,O=GEANT Vereniging,C=NL Valid from: Fri Nov 22 09:08:54 CET 2024 Valid to: Mon Dec 22 09:08:54 CET 2025 Subject alternative names: email: aksieniia.shtimmerman@cnaf.infn.it CA: false Signature alg: SHA384WITHRSA Public key type: RSA 2048bit Allowed usage: digitalSignature keyEncipherment Allowed extended usage: clientAuth emailProtection Serial number: 101113208650839486715316733014861942537 === Proxy Information === subject : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it/CN=1479623907 issuer : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it identity : /DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=Aksieniia Shtimmerman ashtimmerman@infn.it type : RFC3820 compliant impersonation proxy strength : 2048 path : /tmp/x509up_u10171 timeleft : 11:42:28 key usage : Digital Signature, Key Encipherment |
Whereas, for For removing the current VOMS proxy certificate:
...
Once registered within the token inssuer issuer (e.g. IAM), an access token can be retrieved using OIDC-agent, which is available in ui-tier1. A full set of commands follows below.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
eval "$(oidc-agent-service use)" |
to the .bashrc file. and apply load the changes with: source ~/.bashrc.
Then, one needs to register his its own client (this has to be done just the first time to create a new local IAM client):
| Code Block | ||||
|---|---|---|---|---|
| ||||
$ oidc-gen -w device <device name> |
following the steps required by the application, and namely:
...