LCG A few slides for the discussion on VOMS Kors Bos, NIKHEF, Amsterdam GDB Oct.4, 2006

LCG 2 VOMS Reminder Reminder to re-register using VOMS/VOMSRS sent to all registered VO users that have not re-registered “As of October 16th 2006 (stoppage of voms.cern.ch), you will no longer be able to use voms-proxy-init to obtain credentials from voms.cern.ch. After this date only lcg-voms.cern.ch will provide this function.” “As of December 11th 2006 (stoppage of lcg- registrar.cern.ch), you will no longer be able to use a grid-proxy, unless you have re-registered at lcg- voms.cern.ch.” Can we switch off the LDAP service on Dec.31? Is there still any LDAP dependance in our software?

LCG 3 VOMS Groups and Roles the way I had understood it.. GroupsRoles MonteCarloVO-Admin ReProcessinglcgadmin Analysisproduction USGrouproot SoftwAdmin VO For Accounting Storage quota For Special privileges Job Priorities Production management By default

LCG 4 VOMS Groups and Roles GroupsRoles Lcg1 ?VO-Admin productionlcgadmin Software ?production usatlasroot software GroupsRoles uscmsVO-Admin Susylcgadmin analysisproduction root HeavyIonscmssoft Higgscmsfrontier StandardModelcmsphedex dcmscmsprod cmst1admin cmst2admin Cmsuser ATLAS CMS Some sites may not be able to implement them all

LCG 5 The n x m explosion (group, role)  Unix uid 8 groups x 11 roles  88 Unix uid combinations 500(?) CMS users  44,000 pool accounts Many sites may not be able to implement that May not be a problem if –Use LDAP Unix User Directories –Collapse several groups and roles into one Unix group –Not all combinations are needed What happens if you run out of pool accounts ? How many pool accounts do sites set up ?

LCG 6 ATLAS Roles: –Grid software administrators (who install software and manage the resources) –Production managers for official productions –Normal users Groups: –Physics groups –Combined performance groups –Detectors & trigger –Computing & central productions

LCG 7 ATLAS Group list –phys-beauty phys-top phys-sm –phys-higgs phys-susy phys-exotics –phys-hi phys-gener phys-lumin –perf-egamma perf-jets perf-flavtag –perf-muons perf-tau trig-pesa –det-indet det-larg det-tile –det-muon soft-test soft-valid –soft-prod soft-admingen-user It is foreseen that initially only group production managers would belong to most of those groups –All Collaboration members would be, at least initially, in “gen-user” –Software installers would be in soft-admin The matrix would therefore be diagonal –Only ~25 group/role combinations would be populated

LCG 8 CMS Simulation and Reconstruction –CMS expects to implement prioritization of simulation activity at the level of the submitter, so one simulation group and one reconstruction group is probably sufficient Analysis Groups –Of order 10 Physics Groups 2 to 3 roles for each of the groups Not all Groups need to be supported at all sites CMS will need to summarize computing usage by individuals by institution or funding source, for accounting purposes –The accounting system will need have the ability to identify the institution or region of the user –VOMS groups are a possibility to implement the functionality by making an extended proxy with the identifying information

LCG 9 VOMS Groups and Roles GroupsRoles lcg1VO-Admin lcgadmin production root GroupsRoles pilotphysicsVO-Admin lcgprodlcgadmin Administrators?production sgmroot user LHCb ALICE ?

LCG 10 ALICE & VOMS © Disney All Rights Reserved ALICE is interested and ready to test VOMS features as soon as they will be deployed USE –WE CAN USE VOMS TO: –PERFORM PRIORITY MANAGEMENTS AMONG DIFFERENT GROUPS/ROLES –PERFORM DISK SPACE pre-ALLOCATION –TAKE ACCOUNTING INFORMATION FOR MONITORING TASKS REQUIREMENTS –10 GROUPS –3 ROLES (admin, prod manager, user) ISSUES –MAPPING OF GROUP PRIVILEGES ON LOCAL JOB MANAGEMENT SYSTEMS

LCG 11 LHCb I only had their slides in pdf format so I could not copy But it sounds much the same as the other expts.

LCG 12 VOMS Issues to be discussed Can we now switch off LDAP servers ? –Nowhere else used in the software? …Ian ? When do the expts implement their groups/roles ? When/how used for Job priorities ?... Jeff ? GPBox, How does it work ? Do we need it ? When ? –What is the plan ? …Ian ? VOMS in Storage ? How done at sites ? –See agenda VOMS and job accounting ? By what ? Groups ? How ? With pilot jobs, no user-level accounting ? VOMS and storage accounting ? By what ? Groups ? How ? –DCAS and/or APEL? …. John?