For example, the file /etc/grid-security/vomsdir/dteam/voms.cern.ch.lsc contains :

/DC=ch/DC=cern/OU=computers/CN=voms.cern.ch
/DC=ch/DC=cern/CN=CERN Trusted Certification Authority

/DC=ch/DC=cern/OU=computers/CN=lcg-voms.cern.ch
/DC=ch/DC=cern/CN=CERN Trusted Certification Authority

The VOMS servers' certificates in /etc/grid-security/vomsdir can be removed. You don't need to install lcg-vomscerts anymore. If the name of the host in the DN is different from the primary hostname, a change has to be done by the VOMS server manager, which will be included in the fix of bug #22973

Extend proxy timeout for a given VO:

This might not survive an upgrade. Opened savannah ticket https://savannah.cern.ch/bugs/?func=detailitem&item_id=17247

1. add line
--timeout=345600
in /opt/glite/etc/voms/VO_Name/voms.conf

2. restart voms for VO_Name via /opt/glite/etc/init.d/voms restart VO_Name

3. test (if VO_Name member) with command: voms-proxy-init -valid 1000:0 -voms VO_Name

Example:

Your identity: /C=CH/O=CERN/OU=GRID/CN=Maria Dimou 7577
Enter GRID pass phrase:
Creating temporary proxy
.......................................................................
Done
Contacting  lcg-voms.cern.ch:15002
[/C=CH/O=CERN/OU=GRID/CN=host/lcg-voms.cern.ch] "cms"
Warning: voms102.cern.ch:15002: validity shortened to 345600 seconds! Done
Creating proxy .............................................. Done
Your proxy is valid until Mon May 22 20:17:18 2006

List VO members with their email (for use by site managers)

The command to list the members of a VO by contacting the voms server is

voms-admin [options] list-users

You need to wget and install the latest rpm glite-security-voms-admin-client from the 'glitesoft.cern.ch' repository.

It should be at least version: http://glitesoft.cern.ch/EGEE/gLite/APT/R3.0/rhel30/RPMS.Release3.0/glite-security-voms-admin-client-1.2.13-1.noarch.rpm

Then type:
/opt/glite/bin/voms-admin --host [VOMS_Server] --vo [VOName] list-users
Example:
/opt/glite/bin/voms-admin --host lcg-voms.cern.ch --vo lhcb list-users

User Unknown to this VO

http://goc.grid.sinica.edu.tw/gocwiki/Error%3A_voname%3A_User_unknown_to_this_VO

voms core stopped logging

   Here it is the recipe to follow to get me the informations I need.

   Between '' I put commands you should execute, into the shell or into gdb.

1) do 'ps aux | grep edg-voms'

2) you will see two processes for each voms.  From here on, I will only consider the process with the lower PID.

3) for each of them (10 in total) do:
   3.a) gdb attach <pid>
   3.b) 'cont'


4) Then, when one VOMS stops logging, go to its respective gdb.

5) Did gdb return control to you?
  5.a) yes:
  5.a.1) record the output you see.
  5.a.2) 'bt'. record the output.
  5.a.3) 'info locals' record the output.
  5.a.4) Send me the output.

  5.b) no:
  5.b.1) Ctrl-c
  5.b.2) 'up' until you are in the bread function
  5.b.3) 'p fd' record the output
  5.b.4) 'cont'
  5.a.4) Send me the output.

6) Done. You may kill all gdbs and restart the vomses. 

List VO users for gridmap file with voms-admin-2

Question: I have some problems updating the grid-mapfile. If I run edg-mkgridmap script I get an error like:

************
voms
search(https://voms.cern.ch:8443/voms/cms/services/VOMSCompatibility?method=getGridmapUsers&container=%2Fcms):
SSL negotiation failed: error:1406D0CB:SSL
routines:GET_SERVER_HELLO:peer error no cipher

Answer: if you use this version edg-mkgridmap-2.9.0-1.noarch or higher, the problem goes away.

Reason: Since 2007-12-10 the VOMS servers at CERN are running voms-admin 2.0.x, with a different interface and with ACLs preventing easy browsing.

The URL to get the VO users (e.g. for Atlas) now is as follows:

https://voms.cern.ch:8443/voms/atlas/services/VOMSCompatibility?method=getGridmapUsers&container=%2Fatlas

We had to adjust edg-mkgridmap to be able to deal with both the old and the new formats. The voms2gacl utility may need to imitate those changes:

http://jra1mw.cvs.cern.ch:8180/cgi-bin/jra1mw.cgi/Auth/edg-mkgridmap/sbin/

This information is kindly provided by Maarten Litmaath

Allowing mkgridmap to download a list of members.

Answer: Edit the ACLs in the following way.

voms-admin --vo <VO> add-ACL-entry /<VO> ANYONE VOMS_CA CONTAINER_READ,MEMBERSHIP_READ true

VOMS-Admin 2.0.x normal and default ACLs differences

In VOMS-Admin 2.0.x, there are 2 sorts of ACLs:

• "normal" ACLs: Apply to the current group, and can be propagated to all children during the creation. They also apply to children created at a later time, if there are no default ACLs defined.
• default ACLs: Apply to the children of the current group. Defining at least one default ACL will prevent normal parent ACLs to be applied to a newly-created child. In that case, the child ACLs will only be the default ones.

So, in most of the cases, there is no need to define default ACLs (all groups have the same ACLs). In other words, default ACLs are useful only when you want children to have different ACLs from their parents.

voms-admin command to list users with GAs

The voms-admin client in production should be 1.2.16, in order to be inter-operable with voms-admin 2.0.8 which provides GA support.

voms-admin --vo lhcb list-user-attributes certificate.pem

It's also possible to give the use as DN, CA, ... with the following syntax:

voms-admin --nousercert --vo lhcb list-user-attributes 'DN' 'CA' 'CN' 'EMAIL'

voms-admin --nousercert --vo lhcb list-user-attributes 'DN' 'CA' '' ''