Merge pull request #66 from efajardo/SOFTWARE-3774.cms-xcache-auth

Adding authorization pieces to CMS Xcache

Author: brianhlin

configs/cms-xcache/config.d/50-cms-xcache-authz.cfg

@@ -6,8 +6,24 @@
 # **********************************************************************
 #
 # This file is part of the CMS XCache Daemon
+xrd.allow host * 
 
-# Allow connections from all hosts
-xrd.allow host *
-sec.protocol  host
-sec.protbind  * none
+# Enable the gsi authentication using lcmaps
+
+sec.protocol /usr/lib64 gsi \
+  -certdir:/etc/grid-security/certificates \
+  -cert:/etc/grid-security/xrd/xrdcert.pem \
+  -key:/etc/grid-security/xrd/xrdkey.pem \
+  -crl:1 -authzfun:libXrdLcmaps.so \
+  -authzfunparms:--lcmapscfg=/etc/xrootd/lcmaps.cfg,\
+  --loglevel=1 \
+  -gmapopt:10 -gmapto:0
+
+# The Authorization file for which users can do which actions:
+# https://opensciencegrid.org/docs/data/xrootd/xrootd-authorization/
+acc.authdb /etc/xrootd/Authfile-cms-xcache
+
+sec.protbind * gsi
+ofs.authorize 1
+acc.audit deny grant
+xrootd.seclib /usr/lib64/libXrdSec.so

configs/cms-xcache/xrootd/Authfile-cms-xcache

@@ -0,0 +1 @@
+g /cms /store rl

rpm/xcache.spec

@@ -1,7 +1,7 @@
 Name:      xcache
 Summary:   XCache scripts and configurations
-Version:   1.0.5
-Release:   1%{?dist}
+Version:   1.1.0
+Release:   0.1%{?dist}
 License:   Apache 2.0
 Group:     Grid
 URL:       https://opensciencegrid.org/docs/
@@ -103,10 +103,9 @@ Summary: The CMS data federation cache server
 
 Requires: %{name} = %{version}
 Requires: wget
-
+Requires: xrootd-lcmaps >= 1.5.1
 %description -n cms-xcache
 %{summary}
-
 %post -n cms-xcache
 %systemd_post xrootd@cms-xcache.service cmsd@cms-xcache.service
 %preun -n cms-xcache
@@ -192,6 +191,7 @@ mkdir -p %{buildroot}%{_sysconfdir}/grid-security/xrd
 
 %files -n cms-xcache
 %config %{_sysconfdir}/xrootd/xrootd-cms-xcache.cfg
+%config %{_sysconfdir}/xrootd/Authfile-cms-xcache
 %{_unitdir}/xrootd@cms-xcache.service.d/10-cms-xcache-overrides.conf
 %{_unitdir}/cmsd@cms-xcache.service.d/10-cms-xcache-overrides.conf
 %config %{_sysconfdir}/xrootd/config.d/40-cms-xcache-plugin.cfg
@@ -202,6 +202,9 @@ mkdir -p %{buildroot}%{_sysconfdir}/grid-security/xrd
 %config(noreplace) %{_sysconfdir}/xrootd/config.d/95-cms-xcache-logging.cfg
 
 %changelog
+* Wed Jul 31 2019 Edgar Fajardo <emfajard@ucsd.edu> - 1.1.0-0.1
+- Add ATLAS and CMS XCache (SOFTWARE-3583, SOFTWARE-3584)
+
 * Wed May 01 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.0.5-1
 - Start services after network is up (SOFTWARE-3681)