EUgridPMA CA certificates and fetch-crl¶

You must have EUgridPMA certificates installed on its standard location (/etc/grid-security/certificates) and the fetch-crl package properly working so as have the CRLs up to date.

$ wget -q -O - https://dist.eugridpma.info/distribution/igtf/current/GPG-KEY-EUGridPMA-RPM-3 | apt-key add -
$ echo "deb http://repository.egi.eu/sw/production/cas/1/current egi-igtf core" \
  | tee --append /etc/apt/sources.list.d/egi-cas.list
$ apt-get update
$ apt-get install ca-policy-egi-core fetch-crl
$ fetch-crl

$ curl -L http://repository.egi.eu/sw/production/cas/1/current/repo-files/EGI-trustanchors.repo | sudo tee /etc/yum.repos.d/EGI-trustanchors.repo
$ sudo yum install ca-policy-egi-core fetch-crl

VOMS libraries¶

You must install the VOMS libraries. Please install the libvomsapi1 package in Debian/Ubuntu or voms package in RedHat/Fedora/ScientificLinux/etc:

$ apt-get install libvomsapi1

Apache Installation and Configuration¶

You need Keystone working under Apache WSGI with mod_ssl enabled. The standard installation starting on Liberty, guides through this setup, so during thise guide we will only set up the SSL part. To do so, enable the relevant module.

Ubuntu:

$ a2enmod ssl

CentOS:

$ yum install mod_ssl

Then add to your Apache Keystone WSGI configuration the SSL options as shown below. We assume that you have the CA certificates installed in the default location, otherwise you should adapt it to your needs, also check that the paths of the wsgi script are correct for your installation. The location of the configuration file for the keystone service under Apache depends on your distribution (e.g. in Ubuntu is /etc/apache2/sites-available/wsgi-keystone.conf, in CentOS 7 is /etc/httpd/conf.d/wsgi-keystone.conf). Note that you need a valid certificate for the http server (SSLCertificateFile and SSLCertificateKeyFile):

Listen 5000
WSGIDaemonProcess keystone user=keystone group=nogroup processes=8 threads=1
<VirtualHost _default_:5000>
    LogLevel     warn
    ErrorLog    ${APACHE_LOG_DIR}/error.log
    CustomLog   ${APACHE_LOG_DIR}/ssl_access.log combined

    SSLEngine               on
    SSLCertificateFile      /etc/ssl/certs/hostcert.pem
    SSLCertificateKeyFile   /etc/ssl/private/hostkey.pem
    SSLCACertificatePath    /etc/grid-security/certificates
    SSLCARevocationPath     /etc/grid-security/certificates
    SSLVerifyClient         optional
    SSLVerifyDepth          10
    SSLProtocol             all -SSLv2
    SSLCipherSuite          ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
    SSLOptions              +StdEnvVars +ExportCertData

    WSGIScriptAlias     /  /usr/bin/keystone-wsgi-public
    WSGIProcessGroup    keystone
</VirtualHost>

Listen 35357
WSGIDaemonProcess   keystoneapi user=keystone group=nogroup processes=8 threads=1
<VirtualHost _default_:35357>
    LogLevel    warn
    ErrorLog    ${APACHE_LOG_DIR}/error.log
    CustomLog   ${APACHE_LOG_DIR}/ssl_access.log combined

    SSLEngine               on
    SSLCertificateFile      /etc/ssl/certs/hostcert.pem
    SSLCertificateKeyFile   /etc/ssl/private/hostkey.pem
    SSLCACertificatePath    /etc/grid-security/certificates
    SSLCARevocationPath     /etc/grid-security/certificates
    SSLVerifyClient         optional
    SSLVerifyDepth          10
    SSLProtocol             all -SSLv2
    SSLCipherSuite          ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
    SSLOptions              +StdEnvVars +ExportCertData

    WSGIScriptAlias     / /usr/bin/keystone-wsgi-admin
    WSGIProcessGroup    keystoneapi
</VirtualHost>

As you can see, the SSLVerifyClient is set to optional, so that people without a VOMS proxy can authenticate using their Keystone credentials.

Next, set the variable OPENSSL_ALLOW_PROXY_CERTS to 1 in your Apache environment configuration file (/etc/apache2/envvars in Debian/Ubuntu, /etc/sysconfig/httpd in CentOS) so that X.509 proxy certificates are accepted by OpenSSL. This is an important thing, so please double check that you have really enabled it.

Ubuntu:

$ echo "export OPENSSL_ALLOW_PROXY_CERTS=1" >> /etc/apache2/envvars

CentOS:

$ echo "OPENSSL_ALLOW_PROXY_CERTS=1" >> /etc/sysconfig/httpd

With the above configuration, and assuming that the Keystone host is keystone.example.org the endpoints will be as follow:

• https://keystone.example.org:5000/ will be public and private endpoints, thus the Keystone URL will be https://keystone.example.org:5000/v2.0
• https://keystone.example.org:35357/ will be administration endpoint, thus the Keystone URL will be https://keystone.example.org:35357/v2.0

Catalog¶

If you did not have Keystone running behind https your have to adjust your Keystone catalog so that the identity backend points to to the correct URLS as explained above. With the above configuration, these URLs will be:

• public URL: https://keystone.example.org:5000/v2.0
• admin URL: https://keystone.example.org:35357/v2.0
• internal URL: https://keystone.example.org:5000/v2.0

Note that the rest of the OpenStack configuration should be adjusted.

Upgrading to 2014.2 (Juno)¶

If you are upgrading from any prior version to the 2014.2 (juno) version, the VOMS filter in the API paste file (/etc/keystone/keystone-paste.ini) has changed from:

[filter:voms]
paste.filter_factory = keystone_voms:VomsAuthNMiddleware.factory

to:

[filter:voms]
paste.filter_factory = keystone_voms.core:VomsAuthNMiddleware.factory

Install the Keystone VOMS module¶

$ pip uninstall python-keystone-voms keystone-voms

$ pip install 'keystone-voms>=9.0.0,<10.0.0'

$ pip uninstall python-keystone-voms

$ git clone git://github.com/IFCA/keystone-voms.git -b stable/mitaka
$ cd keystone-voms
$ pip install .

Enable the Keystone VOMS module¶

The authentication module is a WSGI middleware that performs the authentication and passes the authenticated user down to keystone. Add the VOMS filter to your paste configuration file (/etc/keystone/keystone-paste.ini is the default one) First, add the VOMS filter as follows:

[filter:voms]
paste.filter_factory = keystone_voms.core:VomsAuthNMiddleware.factory

Then add this filter to the public_api pipeline for the version V2 of your API. Probably, you should add it before the debug, ec2_extension, user_crud_extension and public_service components:

[pipeline:public_api]
(...)
pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body_v2 json_body ec2_extension voms user_crud_extension public_service

Note that you may have a different pipeline. You don’t need to replace your pipeline with the above, but just add the voms filter in the correct place.

VOMS configuration options¶

There are several new options in /etc/keystone/keystone.conf that are used to configure the VOMS identity behaviour. The default values should be OK for most installations, except the autocreate_users option. These optiones are under the [voms] section:

[voms]
vomsdir_path = /etc/grid-security/vomsdir
ca_path = /etc/grid-security/certificates
voms_policy = /etc/keystone/voms.json
vomsapi_lib = libvomsapi.so.1
autocreate_users = False
add_roles = False
user_roles = _member_

• vomsdir_path: Path storing the .lsc files.
• ca_path: Path where the CAs and CRLs are stored.
• voms_policy: JSON file containing the VO/tenant/role mapping.
• vomsapi_lib: Path to the voms library to use.
• autocreate_users: Whether a user should be autocreated if it does not exist.
• add_roles: Whether roles should be added to users or not.
• user_roles: list of role names to add to the users (if add_roles is True).

Allowed VOs¶

For each allowed VO, you need a subdirectory in /etc/grid-security/vomsdir/ that contains the .lsc files of all truted VOMS servers for the given VO. The LSC files must be named as the fully qualified host name of the VOMS server with an .lsc extension, and they contain:

• First line: subject DN of the VOMS server host certificate.
• Second line: subject DN of the CA that issued the VOMS server host certificate.

So, for example, for the dteam VO the first should be:

$ cat /etc/grid-security/vomsdir/dteam/voms.hellasgrid.gr.lsc
/C=GR/O=HellasGrid/OU=hellasgrid.gr/CN=voms.hellasgrid.gr
/C=GR/O=HellasGrid/OU=Certification Authorities/CN=HellasGrid CA 2006

The dteam VO has two VOMS servers (see link above) so another file for the second server needs to be present as well:

$ cat /etc/grid-security/vomsdir/dteam/voms2.hellasgrid.gr.lsc
/C=GR/O=HellasGrid/OU=hellasgrid.gr/CN=voms2.hellasgrid.gr
/C=GR/O=HellasGrid/OU=Certification Authorities/CN=HellasGrid CA 2006

For more details, please check the following page How to configure VOMS LSC files. Note that you do not need to install the .pem certificate, just the .lsc file.

{
    "voname": {
        "tenant": "local_tenant"
    }
}

{
    "dteam": {
        "tenant": "dteam"
    },
    "/dteam/NGI_IBERGRID": {
        "tenant": "dteam_ibergrid"
    }
}

{
    "auth": {
        "voms": "true",
        "tenantNane": "/dteam/NGI_IBERGRID",
    }
}

{
    "dteam": {
        "tenant": "dteam"
    }
}

Apache complains about issuer of certificate¶

You get something like:

Certificate Verification: Error (20): unable to get local issuer certificate

You probably missed to set the OPENSSL_ALLOW_PROXY_CERTS variable on the Apache environment

Error 14: Signature error¶

You have to double check that the vomsdir_path and ca_path configuration options (that default to /etc/grid-security/vomsdir and /etc/grid-security/certificates respectively) point to the correct path. Also ensure that the .lsc files have the right contents and that the CLRs are up to date.