==Introducció==
Per treballar amb l'OpenID Connect és necessari tenir localment un oidc-agent configurat per a que pugui demanar/generar un token amb el que accedir a la door o l'endpoint que sigui.

A continuació es mostrarà com a exemple la configuració d'un ubuntu i algunes proves realitzades.

==Instal·lació agent==
La instal·lació es pot fer a partir d'un paquet rpm (si tenim CentOS7), a podem compilar el paquet des del codi font en altres casos.

En la documentació següent del oidc-agent, hi ha els passos per a configurar els diferents clients (Linux i MacOS):

[https://indigo-dc.gitbook.io/oidc-agent/installation https://indigo-dc.gitbook.io/oidc-agent/installation]

Per a la instal·lació de clients Linux el link a seguir és:

[https://indigo-dc.gitbook.io/oidc-agent/installation/install https://indigo-dc.gitbook.io/oidc-agent/installation/install]

=== Repositoris ===
Del següent repositoris ens podem descarregar el paquets, o el source:

==== CentOS7 ====
[https://github.com/indigo-dc/oidc-agent/releases https://github.com/indigo-dc/oidc-agent/releases]

==== Debian / Ubuntu ====
[http://repo.data.kit.edu/ http://repo.data.kit.edu/]

==== Source ====
Es pot descarregar el codi per compilar per dues vies. Però caldrà instal·lar també una sèrie de dependències per poder-ho compilar.

* Utilitzant git
git clone https://github.com/indigo-dc/oidc-agent
cd oidc-agent

* Utilitzant curl
curl -L https://github.com/indigo-dc/oidc-agent/archive/master.tar.gz -o /tmp/oidc-agent-master.tar.gz
tar xzf /tmp/oidc-agent-master.tar.gz
cd oidc-agent

=== [[Exemple instal.lació oidc-agent a Ubuntu]] ===

Config oidc-agent

2020-07-27T13:24:12Z

Eplanas: Created page with "En aquest apartat indicarem els paràmetres i canvis que cal definir per a permetre l'utilització de l'oidc a dCache. Posem com a exemple l'entorn de dev. Per a realitzar la..."

En aquest apartat indicarem els paràmetres i canvis que cal definir per a permetre l'utilització de l'oidc a dCache. Posem com a exemple l'entorn de dev.

Per a realitzar la configuració s'ha seguit la presentació que es va fer en un mini-workshop sobre dCache i OIDC, concretament el document '''dCache_OIDC_setup.pdf'''

== Canvis a gPlazma.conf ==

Autenticació: Afegir la línia
auth optional oidc

Maping: afegir els fitxers multimap.

map optional multimap gplazma.multimap.file=/etc/dcache/multimap-id-to-group+gid.conf
map optional multimap gplazma.multimap.file=/etc/dcache/multimap-id-to-username.conf
map sufficient multimap gplazma.multimap.file=/etc/dcache/multimap-username-to-uid+gid.conf
map sufficient multimap gplazma.multimap.file=/etc/dcache/multimap-groupname-to-username+uid.conf

NOTA: En la presentació del mini workshop dèien d'esborrar el grid-vorolemap, però nosaltres no l'hem esborrat i així segueixen funcionant els mapejos anteriors.

== Creació fitxers mapeig ==
=== multimap-id-to-group+gid.conf ===
fqan:/escape group:escape gid:50023
oidcgrp:/escape group:escape gid:50023
fqan:/dteam group:dteam gid:46003
oidcgrp:/dteam group:dteam gid:46003

=== multimap-id-to-username.conf ===
"dn:/DC=org/DC=terena/DC=tcs/C=ES/O=Port dInformacio Cientifica/CN=Elena Planas eplanas@pic.es" username:dteam001
#oidc:<oidc toquen?> username:dteam001
oidc:73e5b674-c15f-4fdd-b0d8-e14efdb6c4b1 username:dteam001

=== multimap-username-to-uid+gid.conf ===
username:eplanas uid:63196 gid:50041,true gid:57064 gid:57063
username:eplanas@pic.es uid:31601 gid:46003,true

=== multimap-groupname-to-username+uid.conf ===
group:escape username:escape001 uid:53001
group:atlas username:atlas001 uid:31051
group:deam username:dteam001 uid:31601

== storage-authzdb ==
Cal garantir que estigui autoritzat l'usuari per llegir i escriure.

authorize escape001 read-write 53001 50023 / / /

== Fitxers de layout ==
=== gPlazma ===
Cal configurar el plugin oidc
############################################
# Domain: gplazma-dccore01-devDomain
[gplazma-${host.name}Domain]
dcache.java.memory.heap=256m
# Cell: gplazma
[gplazma-${host.name}Domain/gplazma]
gplazma.authzdb.uid=uid,login,group,user
'''gplazma.oidc.provider!escape=https://iam-escape.cloud.cnaf.infn.it/'''
gplazma.roles.admin-gid=90000
## End gplazma-dccore01-devDomain
############################################

=== Webdav door ===
############################################
# Domain: webdav-dteam-https-dcdoor01-devDomain
[webdav-dteam-https-${host.name}Domain]
dcache.java.memory.heap=512m
webdav.mover.queue=webdav
webdav.net.port=8448
# Cell: webdav
[webdav-dteam-https-${host.name}Domain/webdav]
webdav.authn.protocol=https
#webdav.authz.anonymous-operations=READONLY
webdav.authz.allowed-paths=/pnfs/pic.es/data/
webdav.authz.readonly=false
webdav.cell.name=WebDAV-DTEAM-${host.name}
webdav.root=/pnfs/pic.es/data/
## End webdav-dteam-https-dcdoor01-devDomain
############################################

=== Frontend ===
Si volem utilitzar oidc amb el dCacheView. En aquest cas caldrà registra el servei com un client a l'IAM d'ESCAPE

############################################
# Domain: frontend-dccore05-devDomain
[frontend-${host.name}Domain]
dcache.java.memory.heap=512m
# Cell: frontend
[frontend-${host.name}Domain/frontend]
frontend.authn.accept-client-cert=false
frontend.authn.basic=true
frontend.authn.protocol=https
frontend.authz.anonymous-operations=READONLY
frontend.authz.unlimited-operation-visibility=true
frontend.static!dcache-view.org-name=pic.es
frontend.static!dcache-view.oidc-authz-endpoint-list=https://iamescape.cloud.cnaf.infn.it/authorize
#frontend.static!dcache-view.oidc-client-id-list=
frontend.static!dcache-view.oidc-provider-name-list=escape
## End frontend-dccore05-devDomain
############################################

Config dCache OpenID Connect

2020-07-27T13:23:39Z

DCache OpenID Connect

2020-07-27T13:23:18Z

Eplanas: Created page with "Documentació per integrar l'OpenID connect amb dCache. Inicialment per al projecte ESCAPE. Es separarà en dos apartats, per una banda la configuracio de dCache i per una al..."

Documentació per integrar l'OpenID connect amb dCache. Inicialment per al projecte ESCAPE.

Es separarà en dos apartats, per una banda la configuracio de dCache i per una altra la configuració del client per poder generar els tokens per treballar amb l'OpenID.

===[[Config dCache OpenID Connect]]===

===[[Config oidc-agent]]===

=== Links d'interès ===

* Mini workshop d'OIDC sobre dCachhe. Hi ha presentacions interessants.
[https://indico.in2p3.fr/event/20331/timetable/#20200113 https://indico.in2p3.fr/event/20331/timetable/#20200113]

* Documentació projecte ESCAPE
[https://wiki.escape2020.de/index.php/Main_Page#dCache_Services https://wiki.escape2020.de/index.php/Main_Page#dCache_Services]

* Rclone sobre WebDAV amb OpenID
[https://rclone.org/webdav/ https://rclone.org/webdav/ ]

DCache.org

2020-07-27T13:22:30Z

Eplanas:

= Become a dCache Administrator at PIC =
* [[HowTo: dCache Management - GIT + Puppet]]
== Management tools ==
* [[HowTo: Accessing to the dCache Admin Console]]
* [[HowTo: Installing & Configuring PCells to Administrate dCache]]
== Instances ==

=== Test instance ===
* '''''Version''''': this can be higher than the ''production'' instance.
* '''''Needed for''''': test newer dCache releases.
* '''''When to upgrade''''':
:# Whenever you want, whenever you need.
:# Recommended to test with Enstore before upgrading the Development instance
:# Recommended to backup DBs for rolling back upgrades.
* '''''Upgrade requirements''''':
:# No requirements.

=== Development instance ===
* '''''Version''''': should be always the same as the ''production'' instance
* '''''Needed for''''': this instance is used in order to test Enstore with the dCache version running in production.
* '''''When to upgrade''''':
:# Always upgrade before upgrading the dCache production instance.
:# Upgrade only as the last validation for the dCache upgrade procedure, just before upgrading the production instance.
:# Only upgrade when no Enstore interventions / changes are expected until the production instance is upgraded.
* '''''Upgrade requirements''''':
:# Always ask to the Enstore admin if upgrades can be performed in the the Development instance.
:# Ensure that there are always DB backups before upgrading the instance.

=== Production instance ===
* '''''Version''''': Any Golden or Production release.
* '''''Needed for''''': production services.
* '''''When to upgrade''''':
:# Always upgrade after upgrading and validating the upgrade for the dCache development instance.
:# Upgrade always ensuring that Enstore client and service was already tested in the test and development instances.
* '''''Upgrade requirements''''':
:# Always ask to the Enstore admin if upgrade can be performed in the the Production instance.
:# Ensure that there are always DB backups before upgrading the instance.

=== CMS MWR (MiddleWare Readiness) instance ===
* '''''Version''''': Latest dCache version.
* '''''Needed for''''': CMS MRW tests (Debug)
* '''''When to upgrade''''':
:# Whenever a new release is available is recommended to upgrade. However, there is no a strict requirement and you can wait few days / weeks before upgrading.
* '''''Upgrade requirements''''':
:# For major release upgrades, always inform the CMS Contact and CMS MWR team.
:# Ensure that there are always DB backups before upgrading the instance.

= Service Administration =

== gPlazma ==
* [[HowTo: Configuring gPlazma]]

== Pools Management ==
* Data Migration:
:* [[HowTo: Migrate dCache Pool]]
:* [[HowTo: Permanent Migration to dCache Read Only Pools]]
* [[HowTo: srm22 - Generating poolmanager.conf & LinkGroupAuthorization.conf]]
:* [[HowTo:_srm22_-_Generating_poolmanager.conf_%26_LinkGroupAuthorization.conf#Adding_.2F_Moving_.2F_Removing_pools_from_poolgroups|HowTo: Adding/Removing pools to a VO]]

== dCacheAdmin ==
* [[HowTo: Configure SSH2 access to the Admin Console]]

== SRM ==
* [[HowTo: Managing Space Reservation (Tokens)]]

== Billing ==
* [[HowTo: Reset Billing PostgreSQL]]
* [[HowTo: Clean old Billing PostgreSQL records]]

== Info Provider ==
* [[HowTo: Publishing dCache Information]]

== Alarms ==

== dCache + Enstore Administration ==
* [[HowTo: Managing Tape File Families in dCache]]

== Doors ==
=== NFSv3/NFSv41 Service in dCache ===
[[HowTo: Exporting a new dCache NFS directory]]
=== WebDAV ===
* [[HowTo: WebDAV properties]]:
:* [[HowTo:_WebDAV_properties#Example:_File_Checksum_via_WebDAV | File Checksum check via WebDAV]]
=== CMS XRootD ===
* [[HowTo: CMS XRootD configuration]]

== dCache Advanced Administration ==
* [[dCache Metadata Commands]]
* [[dCache Administration Console Commands]]
* [[Monitoring dCache with ELK]]

== Alarms ==
* [[DCACHE_CHECK_POOL_BTREE_MEMORY]]
* [[DCACHE_CHECK_POOL_METADATA]]

= Others =
* [[dCache OpenID Connect]]