Configuration of the C++ and Java command line clients

Configuration of the C++ command line client

The AMGA C++ command line clients as well as all other executables using the MDClient class of the C++ client package need to read an mdclient.config file for their configuration. This configuration file is searched first in the current directory, then as $HOME/.mdclient.config and finally as /usr/etc/mdclient.config. Only the port and server of the configuration file can be overridden on the command line of the clients:

  $ mdclient [-p port] [hostname]

The following is an example configuration file:

  $ cat mdclient.config
  # Connection options
  Host = localhost
  Port = 8822
  
  # User settings
  Login = koblitz
  PermissionMask = rwx
  GroupMask = r-x
  Home = /

  # Security options
  UseSSL = yes 
  # AuthenticateWithCertificate = 1
  # CertFile=/home/koblitz/.globus/usercert.pem
  # KeyFile=/home/koblitz/.globus/userkey.pem
  # UseGridProxy = 1
  # Password = secret
  # VerifyServerCert = 1
  # IgnoreCertificateNameMismatch = 0

  # If server certificates are verified, local certificates need to be loaded:
  # TrustedCertDir = /etc/grid-security/certificates

The following options are supported:

• Host: The name of the host to connect to. This option can be overridden on the command line of mdclient. (Default: localhost)
• Port: Port of the mdserver to connect to. Can be overridden on the command line of mdclient using the -p option. (Default: 8822)
• Login: The login name of the user on the AMGA server. All entries created in the catalogue will have this owner. This is also the user which you need to authentiate to the AMGA server if authentication is enabled. (Default: NULL which gives the default role when authenticating with a VO certificate)
• PermissionMask: A 3 character string giving the owner permissions of newly created entries in the metadata catalogue.
• GroupMask: A 3 character string giving the group permissions of newly created entries in the metadata catalogue.
• Home: The home-directory. The default is "/".
• Name: Can be used to give a full name to the server, comparable to the comment in an /etc/passwd file. Currently only used for information in the server.
• UseSSL: Possible values are no, try, require (synonyme is yes). Default is no. Needed for any authentication using certificates (also proxy certificate). You want this if you intend to use passwords which are not sent in plain text. If you use SSL the entire session will be encrypted. Some servers may require you to use SSL to connect. If you want to be sure that SSL is allways used you need to set this to require or yes.
• AuthenticateWithCertificate: Set this to 1 to enable certificate based authentication, also grid-proxy certificates. You will need to either enable normal certificates via a CertFile, KeyFile option pair, or use a grid proxy certificate via the UseGridProxy option. If you specify both, then the grid proxy gets precendence. This option does not work if you have not enabled SSL via UseSSL! In fact you will try to authenticate as the user named in Login, so you need to have this field set as well. However, the Password field is ignored unless certificate based authentication fails in which case the password is tried.
• CertFile: Path to your x509 certificate in .pem format. For this option to have any effect, you need also options UseSSL and AuthenticateWithCertificate enabled and UseGridProxy disabled!
• KeyFile: Path to your x509 private key in .pem format. If the key is encrypted you will be asked for the passphrase on client startup. For this option to have any effect, you need also options UseSSL and AuthenticateWithCertificate enabled and UseGridProxy disabled!
• UseGridProxy: Tries to use the a grid proxy certificate in /tmp/x509up_u[user-id].
• Password: If a password is given, password based authentication will be tried. You should want to use an SSL connection with this. This is _not_ the password for your private key. For that you will allways be promted on the command line. For a discussion on how to escape special characters (#\) see Configuring the AMGA Server and the Replicatin Daemon .
• VerifyServerCert: Verifies the server certificate against CA certifiates in TrustedCertDir, default is 1: yes.
• IgnoreCertificateNameMismatch: Do not try to match the DN in the server certificate to the canonical name of the server. Useful for services that have an alias or are multi-homed. Default is off.
• TrustedCertDir: A directory with certificate authority certificates to verify the server certificate.

Configuration of the Java command line client

The Java client also reads its configuration from a file, called by default mdjavaclient.config. This file is searched in the same places as the C++ API looks for the mdclient.config, that is, first in the current directory, then in $HOME/.mdclient.config and finally on /usr/etc/mdjavaclient.config. Like the C++ client, only the port and server of the configuration file can be overridden on the command line of the clients:

  $ mdjavaclient.sh [-p port] [hostname]

Next are the properties recognized on the mdjavaclient.config file. The following have the same sintax as in the C++ configuration.

• Host
• Port
• Login
• PermissionMask
• GroupMask
• Name:

The following exist only on the the Java configuration file or else have a slightly different syntax:

• AuthMode: Possible values are GridProxy, Certificate, Password, None. Default is None.
• Password: The user password. Only used when the AuthMode is set to Password. If not provided here, it must be provided at runtime by the user.
• UseSSL: Possible values are 1 for enable, 0 for disable. Default is 0. Needed for any authentication using certificates and grid proxies. If you use SSL the entire session will be encrypted. Some servers may require you to use SSL to connect.
• CertFile: Path to your x509 certificate in .pem format. For this option to have any effect, you need also options UseSSL and the AuthMode set to Certificate.
• KeyFile: Path to your x509 private key in .pem format. If the key is encrypted you will be asked for the passphrase on client startup. For this option to have any effect, you need also options UseSSL and the AuthMode set to Certificate.
• PrivateKeyPassword: Password for private key. If not defined, the password must be provided at runtime.
• VerifyServerCert: Verifies the server certificate against CA certifiates in TrustedCertDir.
• TrustedCertDir: A directory with certificate authority certificates to verify the server certificate.

---