VOMS services configuration reference

For VOMS 2.0.14, VOMS Admin server 3.6.0, VOMS Admin client 2.0.19

Table of contents

• VOMS server configuration
  • /etc/sysconfig/voms
  • VOMS Server VO configuration
• [VOMS Admin configuration] (#voms_admin_configuration)
  • /etc/sysconfig/voms-admin
  • Container configuration
  • VOMS Admin VO configuration
  • CERN OrgDB plugin configuration
• Troubleshooting

VOMS server configuration

/etc/sysconfig/voms

This file contains variables needed by startup scripts to properly execute the VOMS service

VOMS server VO configuration

The VOMS server configuration for a VO can be found in /etc/voms/VO_NAME and is composed of two files:

• voms.conf containing the server configuration
• voms.pass containing the password used to access the database

/etc/voms/vo/voms.conf

The server configuration file is a text file containing a series of command line options that is parsed by the VOMS daemon at startup time. Check the VOMS man page for more information, using the following command:

man voms

An example VOMS configuration file:

--x509_user_cert=/etc/grid-security/vomscert.pem
--x509_user_key=/etc/grid-security/vomskey.pem
--dbname=voms_mysql
--contactstring=localhost
--username=voms-admin
--logfile=/var/log/voms/voms.mysql
--loglevel=4
--logtype=7
--passfile=/etc/voms/mysql/voms.pass
--port=18001
--code=18001
--sqlloc=/usr/lib64/libvomsmysql.so
--vo=mysql
--uri=wilco.cnaf.infn.it:18001
--timeout=86400
--socktimeout=60
--max-reqs=50

Special configuration flags:

/etc/voms/vo/voms.pass

This is a text containing only the password used by the VOMS server to connect to the database.

VOMS Admin configuration

/etc/sysconfig/voms-admin

This file contains variables needed by startup scripts to properly execute the VOMS Admin services

Container configuration

VOMS Admin container configuration can be found in the /etc/voms-admin directory. The container configuration consists of two files:

• voms-admin-server.properties
• voms-admin-server.logback

/etc/voms-admin/voms-admin-server.properties

This is a standard Java properties file.

/etc/voms-admin/voms-admin-server.logback

This is logback configuration file, which controls the logging to the following files:

• /var/log/voms-admin/server.log (server messages)
• /var/log/voms-admin/server-authn.log (authentication-related messages)

For more information about logback configuration syntax, check the logback documentation.

To change the verbosity of the authentication-related messages, for instance to get more information about certificate-related issues, change the level for the CANLListener logger from INFO to DEBUG as follows:

<configuration>
	...
	<logger name="org.italiangrid.utils.https.impl.canl.CANLListener" level="DEBUG" additivity="false">
	       <appender-ref ref="AUTHN" />
	</logger>
	<root level="INFO">
	       <appender-ref ref="FILE" />
	</root>	
</configuration>

VO configuration

VOMS Admin configuration files can be found in /etc/voms-admin/VO_NAME for a given VO.

The following files control the configuration of a given VO:

• service.properties: the main VO configuration file
• database.properties : contains credentials and settings for accessing the database
• logback.xml : the VO logging configuration
• vo-aup.txt : the text of the default VO AUP
• vomses: this file contains the vomses configuration displayed by the VOMS Admin webapp configuration page
• lsc : this file contains the lsc configuration displayed by the VOMS Admin webapp configuration page

All the options described below can be set using the voms-configure script.

/etc/voms-admin/vo/service.properties

This is a Java properties file.

Base service options

Notification settings

Membership validation settings

Registration service options

AUP options

SAML Attribute authority options

Other options

/etc/voms-admin/vo/database.properties

Look at the Hibernate documentation for more detailed information about these properties.

Database connection pool settings

Look at the c3p0 documentation to know about connection pool tuning.

/etc/voms-admin/vo/logback.xml

This is logback configuration file. For more information about logback configuration syntax, check the logback documentation.

By default all log messages for a VO will go to /var/log/voms-admin/voms-admin-VO_NAME.log.

This file is well commented, and explains how to change log levels for separate parts of the VOMS Admin service.

An example configuration file is listed below:

<configuration>
    <!--
        This logger controls the MAIN voms admin log messages. Set the level to DEBUG 
        for maximum detail.  
     -->
    <logger name="org.glite.security.voms.admin" level="INFO" />
    <!--
         This logger controls the main validation service VOMS Admin log messages.
         Set the level to DEBUG for maximum detail.
    -->
    <logger name="org.glite.security.voms.admin.core.validation" level="DEBUG"/>
    
    <!-- 
        This logger controls the log messages produced when exceptions are raised by a call to the voms admin
        web services. Set the level to DEBUG for maximum detail.  
     -->
    <logger
        name="org.glite.security.voms.admin.service.ServiceExceptionHelper"
        level="DEBUG" />
    
    <!-- 
        The loggers below control the amount of logging produced by the main frameworks used by voms admin. Normally
        you shouldn't change the defaults listed here.
     -->
    <logger name="org.opensaml" level="ERROR" />
    
    <!-- 
        Set the level to INFO (or DEBUG) for the hibernate logging if you want to have more detailed log messages regarding
        the persistence management in voms-admin.
     -->
    <logger name="org.hibernate" level="ERROR" />
    
    <logger name="org.apache.struts2" level="WARN" />
    <logger name="com.opensymphony.xwork2" level="WARN" />
    <logger name="com.opensymphony.xwork2.config.providers.XmlConfigurationProvider" level="ERROR" />
    
    <!-- NORMALLY YOU SHOULD NOT EDIT BELOW THIS POINT  -->
    <appender name="FILE"
        class="ch.qos.logback.core.rolling.RollingFileAppender">
        <File>/var/log/voms-admin/voms-admin-${voms.vo.name}.log</File>
        <rollingPolicy
            class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <FileNamePattern>/var/log/voms-admin/voms-admin-${voms.vo.name}-%d{yyyy-MM-dd}.log</FileNamePattern>
        </rollingPolicy>

        <encoder>
            <pattern>%date{yyyy-MM-dd HH:mm:ss.SSS'Z',UTC} - %level [%logger{0}] - %msg%n</pattern>
        </encoder>
    </appender>    
    
    <root level="WARN">
        <appender-ref ref="FILE" />
    </root>
    
</configuration>

CERN OrgDB plugin configuration

The VOMS OrgDB plugin provides integration with the CERN organizational database (OrgDB).

When the OrgDB integration is active:

• registration requests are validated so that only applicants present in the OrgDB can apply for VO membership.
• VO membership expiration time is linked to OrgDB membership expiration.

A periodic background task keeps the information in VOMS in sync with the information in the OrgDB.

Enabling the OrgDB plugin

The plugin configuration is currently not supported by voms-configure.

Assuming the VO for which the OrgDB plugin must be enabled is already configured, you will need to do the following changes to the configuration:

• Edit the /etc/voms-admin/<vo-name>/service.properties file for the VO to enable the plugin.
• Create the file /etc/voms-admin/<vo-name>/orgdb.properties where the OrgDB database connection properties will be configured.

Changes to the service.properties file

Add the following lines at the bottom of the service.properties file:

## External validation plugin options
voms.external-validators = orgdb
voms.ext.orgdb.configClass = org.glite.security.voms.admin.integration.orgdb.OrgDBConfigurator
voms.ext.orgdb.experimentName = ATLAS
voms.ext.orgdb.membership_check.period = 30

The orgdb.properties configuration file

The orgdb.properties defines the configuration used to connect to the OrgDB Oracle database:

hibernate.connection.driver_class= oracle.jdbc.driver.OracleDriver
hibernate.connection.url= jdbc:oracle:oci:<the orgdb TNS alias here>
hibernate.dialect= org.hibernate.dialect.Oracle10gDialect

hibernate.connection.username= orgdb_username
hibernate.connection.password= orgdb_password

hibernate.c3p0.acquire_increment=1
hibernate.c3p0.idle_test_period=100
hibernate.c3p0.min_size=5
hibernate.c3p0.max_size=100
hibernate.c3p0.max_statements=0
hibernate.c3p0.timeout=100

Troubleshooting

Check the voms-admin log for your VO in /var/log/voms-admin-server. In case of successful configuration you will see something like:

2012-11-27 08:06:08.582Z - INFO [OrgDBConfigurator] - Connection to the OrgDB database is active.
2012-11-27 08:06:08.583Z - INFO [OrgDBConfigurator] - Setting OrgDB experiment name: ATLAS
2012-11-27 08:06:08.595Z - INFO [DefaultMembershipCheckBehaviour] - Expired users will be suspended after a grace period of 7 days.
2012-11-27 08:06:08.601Z - INFO [OrgDBConfigurator] - OrgDB request validator registered SUCCESSFULLY.
2012-11-27 08:06:08.604Z - INFO [VOMSExecutorService] - Scheduling task OrgDBMembershipSynchronizationTask with period: 30 seconds
2012-11-27 08:06:08.604Z - INFO [PluginManager] - 'orgdb' plugin configured SUCCESSFULLY.

Oracle timezone error

A bug in the Oracle jdbc driver may lead to problems in starting VOMS admin when the OrgDB is enabled. If you see an exception similar to:

Acquisition Attempt Failed!!! Clearing pending acquires. While trying to
acquire a needed new resource, we failed to succeed more than the maximum
number of allowed acquisition attempts (5). Last acquisition attempt exception:

java.sql.SQLException: ORA-00604: error occurred at recursive SQL level 1

ORA-01882: timezone region not found

then you should add the -Doracle.jdbc.timezoneAsRegion=false to the VOMS_JAVA_OPTS variable in /etc/sysconfig/voms-admin:

VOMS_JAVA_OPTS="-Doracle.jdbc.timezoneAsRegion=false ..."