1. VO Management on the US-ATLAS/CMS Test Grids Rick Cavanaugh University of Florida DataTAG/WP4 Meeting 23 May, 2002

2. 23.05.2002VO Management2 VO management scripts l US-projects are just beginning work on VO management: would like to benefit from the excellent VO work in the EDG. l INFN scripts for VO management (from Roberto Cecchini) Adopted by PPDG Adapted by Conrad Steenberg cleaned up, re-written in Python provides a simple GUI l Allows a “manager” to simply: connect to a remote LDAP server add/delete a “group” (VO) add/delete a “user” from a VO

3. 23.05.2002VO Management3 Current Status on the US-ATLAS/CMS Test Grids l Currently no VO management on the Test Grids Account management is fully decentralized Local account policy/management varies widely from site to site Some sites do not allow group accounts ! Decentralized situation is starting to become un-wieldy… l VO Scripts are currently deployed across two US-CMS Test Grid sites: Florida Caltech l Testing phase only

4. 23.05.2002VO Management4 Current Issues l Group (or pooled) accounts vs. individual accounts Current VO management scripts only work well if group accounts are allowed at every site Not every site allows group accounts (for very good reasons) ! The interaction between local and grid-wide account management needs to be understood Will sites be willing (or even able) to delegate account management to a trusted CA or RA? Integrate mkgridmap so that the grid-mapfile can be automatically generated at (or for) a particular site l Need a centralized LDAP server where information for all iVDGL VO’s is kept E.g. ESnet CA site. Need for administrative domains when accessing server?