Task Force (TF) for LHC Experiment VO integration with CERN HR database

 

Transition plan between stable software version and service deployment:
First written after the 2005-03-22 TF meeting
Updated on 2005-04-12
Updated on 2005-05-31
Updated on 2005-06-07
Updated on 2005-06-22
Updated on 2005-06-28
Updated on 2005-06-30
Updated on 2005-08-05
Last update on 2005-08-11 --- We are in Action# 18

CERN HR database == ORGDB

Action# What Who When Status on date of last update
      1 Compare lcg-registrar entries for all 4 LHC VOs with ORGDB content. Karoly Now Lists were ready on 2005-04-08
      2 Decide what to do if Action 1 gives huge discrepancies. Contact VO mgrs? Exp. secretariats? TF a.s.a.p. Maria sent results to TF on 2005-12-12.

VO members missing or expired from ORGDB:
LHCb: 7 out of 48 people, 15%
ALICE: 17 out of 40 people, 43%
CMS: 55 out of 259 people, 21%
ATLAS: 83 out of 312 records, 27% (includes 29 people of the USATLAS subgroup)

Suggestion:VO managers should be prompted to:
1. check if the discrepancies are due to different spelling.
2. if not, check if the users are still eligible to stay in the VO.
2.1 if not, delete them from the present LDAP VODB.
2.2 if yes, seek registration in ORGDB of these users by contacting the users
their Team Leaders and
their experiment secretariats.
      3 Install VOMRS on CERN SL3 host (pre-supposes Tanya will be happy with all tests). Maria April 11 I. Bird announced in the Grid Deployment Group Meeting pf April 8, that we should install the gLite VOMS a.s.a.p.
This was completed on lcg-voms.cern.ch on April 25.
Installation method of fixes still remains unclear!
Tanya prepare VOMRS rpms with glite-voms hooks and installed on lcg-voms.cern.ch.
Action completed on May 12.
      4 Ask all 4 VO managers to use VOMRS. Maria April 14 Action completed on May 20 for vomrs Test VO.
      5 Call TF and the 4 VO managers to an information meeting. Maria April28? Action completed on May 26 with vomrs LHCb VO demo.
      6 The 4 VO managers publish their individual AUPs based on the template in http://edms.cern.ch/document/573348 VOmgrs May Not applicable. The common global Grid Usage Rules still apply as long as this document remains draft. No action.
     7 Stop synchronisation LDAP-to-VOMS on lcg-voms.cern.ch to allow registration via VOMRS with ORGDB matching and VOMRS-to-VOMS synchronisation. Maria May 27 Done.
     8 Send Tanya text changes for the notification templates. Maria June Maria entered savannah tasks on VOMRS notification templates. Tanya is working on VOMRS 1.1.2 incorporating these improvements.
      9 Configure ALICE, ATLAS and CMS VOMRS on lcg-voms.cern.ch.
Configure http://lcg-registrar.cern.ch Welcome page for LHC Experiment VO members prompting them to get their ORGDB entry in order first.
Configure warning on the glite voms-admin web interface, e.g.
https://lcg-voms.cern.ch:8443/voms/lhcb/ re-directing users to the VOMRS one, e.g.
https://lcg-voms.cern.ch:8443/vo/lhcb/vomrs
Maria June Configuration of ALICE, ATLAS and CMS VOMRS on lcg-voms.cern.ch completed on June 30th.
     10 Arrange lcg-voms.cern.ch and voms.cern.ch monitoring and backup of files and data in the database. Maria June-August Monitoring is done at present via CNSURE. Backup was discussed on June 3. When all on Oracle, the Physics Database Group will take care of the database data.
      11 Publish in the LCG2 Release of June the edg-mkgridmap.conf file with lines in the following (strict) sequence:
group vomss://lcg-voms.cern.ch:8443 ...
group vomss://voms.cern.ch:8443...
auth ldap://lcg-registrar.cern.ch...
group ldap://grid-vo.nikhef.nl/...
Depl. Team June Done. The edg-mkgridmap.conf with vomss lines is prepared for 6 VOs. Not sure what is the edg-mkgridmap version available in glite R1.1/R1.2.(savannah ticket 8799)
      12 Make available edg-mkgridmap v.2.4.2 (published April 28) in the next LCG2 Release (early July). Depl. Team June M.Litmaath re-wrote the edg-mkgridmap.pl (now v. 2.5.0) to fix script exiting if one of the VO servers was not contactable (grid-map file is not re-built).
      13 voms-proxy-init doesn't work on the CERN afs UI Depl. Team June We need to re-decide what voms-client we make available with the LCG2 release of July 1st. Done and documented in http://cern.ch/dimou/lcg/voms/voms-lcg2-2_6_0.html
     14 Ask a small number of "pilot" LHC exp. VO members to re-register via VOMRS on lcg-voms.cern.ch to collect feedback. VOmgrs June Meeting TF+VOmgrs scheduled for June 28. CANCELLED due to changes on lcg-voms.cern.ch including: java, ORGDB index.
     15 Implement suggested VOMRS changes and bug fixes requested by the VOmgrs. Tanya July Tanya upgraded vomrs on Aug. 4th with PEM and GEM email support and improved indexed ORGDB view.
      16 Make available vomrs, voms-admin and voms-core on Oracle. Make sure Oracle voms-admin is available on the glite packages repository. The db will move to another machine. This migration will be transparent for the users. Karoly, then Tanya July Glite R1.2 release_notes:
The new VOMS server has now support for Oracle backends. Support for
Oracle in the web based admin tools will be added in a future release.


From the integration team meeting of Aug.2:
> Eli was asking if VOMS is included.
> Joachim: VOMS came late, so QF or R1.4.
> Erwin: are there any showstoppers?
> Akos: Oracle installation?!
> Erwin: then it stays for R1.4
> Alessandro: is VOMS in R1.2 compatible with R1.1?
> Joachim: he is aware of a bug, which is not in R1.1, but in R1.2!
> [TODO] Eli: will ask Vincenzo on the upgrade.

      17 Check-point meeting on ORGDB link performance, VOMRS, voms-admin and voms installations. TF August Meeting TF+VOmgrs scheduled for August 9th, pending VO mgrs' confirmation.
      18 Install all Oracle components on lcg-voms.cern.ch Maria August On Aug. 6th this is not possible due to lack of voms-admin on Oracle in the glite distribution. Not available before gLite R1.4 planned for end of August.
      19 The 4 VO managers ask their community to re-register via VOMRS. Allow a period, at least, until the end of 2005. VOmgrs September  
      20

During this 6-months' period the grid-map file will contain vomss:// and (auth+ldap://) lines in *this* order.As the first entry is always the one taken, the new entry will be used for users who are in VOMS and LDAP.

VOmembers 2nd Half 2005  
      21 Remove the ldap:// lines from the edg-mkgridmap.conf file for the 4 LHC exp. VOs Depl.Team Jan2006  
     22 Tell NIKHEF they can switch off their LDAP server for these VOs. Maria Feb2006  

 

Maria Dimou, IT/GD, Grid Infrastructure Services