VOMS

VOMS is a system to classify users that are part of a Virtual Organization (VO) on the base of a set of attributes that will be granted to them upon request and to include that information inside Globus-compatible proxy certificates.

VOMS consists of two main components:

• VOMS - includes the VOMS server and the VOMS client tools (e.g. voms-proxy-init)
• VOMS Admin - a Java server application (and UI servlet) used to manage users and their privileges for a VO

They interact in the following way:
VOMS and VOMS Admin are distinct applications written by two different EDG collaborators. The relevant websites for these two projects are:

• VOMS
• VOMS Admin

VOMS in VDT

VOMS and VOMS Admin are included in VDT 1.3.0 (in the $VDT_LOCATION/voms directory). They come with all the required supporting software (e.g. MySQL, Tomcat, Java/Perl libraries).

VOMS Client

If you are already part of a VO, you can use voms-proxy-init to create a GSI proxy with special permissions that your VO entitles you to. The proxy is fully compatible with the standard Globus proxy format, but it has additional VO-related attributes in it. Grid services that you will subsequently authenticate with may be configured to read these attributes from your proxy and perform decisions based on their values.

When you run voms-proxy-init, it contacts your VO's VOMS server, authenticates to it using your "normal" proxy, receives the VO-specific attributes, and creates a new proxy with these attributes. To specify the name of the VO to contact you use the --voms optin, e.g.:

voms-proxy-init --voms MyProject

voms-proxy-init finds the address of the server for the given VO (i.e. MyProject) by looking through a series of configuration directories, namely:

• /etc/vomses
• $X509_VOMS_DIR evnironment variable
• ~/.edg/vomses

Each of these directories may have files of the following format:

NAME SERVER_HOST SERVER_PORT SERVER_DN DESCRIPTION

For example:

"MyProject" "south.cs.wisc.edu" "12121" "/DC=org/DC=doegrids/OU=Services/CN=south.cs.wisc.edu" "MyProject VO"

The administrator(s) of your VO(s) should give you the exact settings.
Note: VOMS has fairly strict permissions/ownership requirements on these data files, in particular:

• $X509_VOMS_DIR must be owned by exactly root:root
• /etc/vomses, ~/.edg/vomses, or the directory pointed by $X509_VOMS_DIR must have permissions exactly 0755
• The actual data files must have permissions exactly 0644

Otherwise VOMS tools might refuse to read these files, and you will get the following error:

VOMS Server for MyProject not known!

VOMS Server

VOMS is a new VDT component and we're working hard to make the server configuration as simple as possible. Since this is changing rapidly, please see the appropriate per-release documentation for information on setting up a VOMS server.