GSI question

[Guy C Warner]

Hi

I am using iRODS with GSI for authentication. How do I obtain the GSI
proxy credentials for use within a microservice?

The scenario is that the microservice needs to communicate with a
(potentially) remote resource via GSI to obtain data and store
information.

Thanks in advance

Guy

--
Dr Guy Warner
E-mail: g...@cs.stir.ac.uk
Address: Room 4B58 Cottrell Building,
Department of Computing Science & Mathematics,
University of Stirling, Scotland, FK9 4LA
Phone: 01786 467433

--
Academic Excellence at the Heart of Scotland.
The University of Stirling is a charity registered in Scotland,
number SC 011159.

[schr...@diceresearch.org]

Hello,

The irods microservice, even if delayed-execution, will run as your
irods user. The server 'remembers' that you authenticated (via GSI or
whatever) and then recreates that context in the irodsReServer (for
delayed rules). Similarly, for immediate rules (in the irodsAgent), the
client context is your irods user. So the microservice will not need a
proxy credential to access remote irods resources.

If you need to access some other GSI-enabled system within a
microservice, via a proxy credential, we do not currently support that.
But one could write something to store the proxy credential in irods,
and then access it via a microservice.

- Wayne -

[Guy C Warner]

Hi

Thanks for the answer. I thought that may be the case. Is there an object
in the REI structure that I can just dump to disk (or irods) or will I
have to re-construct the proxy file format first. Any help would be much
appreciated.

Thanks

Guy

[schr...@diceresearch.org]

One way might be to store the proxy file into irods as a data-object
with a well-known name (in the user's home collection, say). Then
microservices can open that irods data-object and use the contents
directly or store it into a local file if needed (with proper
permissions to restrict access). There also might be something in the
REI structure that could be used, but I'm not sure.

[Guy C Warner]

Hi

From what you are saying iRODS only authenticates using GSI and never
creates a local proxy. It looks like my best solution is going to based
around using MyProxy and/or Shibboleth. My microservice launches a condor
job that may take a long time to run and I was trying to find a way of
not needing to leave an irodsAgent running for every job in the system -
instead reconnecting to irods when the job finished.

Thanks for your help.

Guy

[Bing Zhu]

Wayne,

I had similar idea about using GSI in this regard.
Would it be possible to verify the GSI proxy certificate
that is in the form of a byte string in iRODS server?

Bing

[schr...@diceresearch.org]

Hi Bing,

The main proxy file (from the user's grid-proxy-init command) is
verified if/when they use it to authenticate to the irods system. You
have to be careful with these, as they contain all the information
needed to authenticate on behalf of the user in a GSI system for a
period of time (12 hours typically). So it is only readable by the
user:

zuri:/users/u4/schroede % ls -l /tmp/x509up_u122
-rw------- 1 schroede sys200 3092 Apr 8 11:00 /tmp/x509up_u122
zuri:/users/u4/schroede %

I guess one could store this (a proxy like this or a proxy derived from
this) into iRODS, extract it, and verify it via some GSI commands. To
verify it within iRODS would require a fair amount of development to
integrate the GSI libraries in another manner (in addition to the
current use in client/server authentication).

[Bing Zhu]

Wayne,

That's what I mean in which we can emulate the
implementation of myProxy. I am curious if it is
possible that one does not go to the path using
GSI API calls for both client and server but something
if the server can verify the proxy as a string.