New User Setup in PRAGMA testbed

Overview

The reason for setting up a standard new user info files and a sample setup script is to help all testbed site administrators to automate the new user setup process. This should also enable us to integrate with GAMA in the future. GAMA development team is working on the next version which should provide the functionalities we need to manage certificates and user accounts.

Because the system environment and requirements may differ at each site, it's the site administrator's responsibility to implement an user setup process which will work well on his/her cluters. But we need a standardize interface for the user information input among all testbed site. For clarity and to provide site administrators with an sample input file for testing, we made available of a sample user input tar.gz file and a sample user setup script for your reference. Below are some detail explainations about the input sample file and the sample script.

The input file

When a new user is approved to run an application in PRAGMA testbed, the testbed coordinator will get the following info from the user:

full name [can be used for an UNIX account creation]
affiliation [can be used for an UNIX account creation]
address [can be used for an UNIX account creation]
country [can be used for an UNIX account creation]
phone [can be used for an UNIX account creation]
fax [can be used for an UNIX account creation]
email [can be used for an UNIX account creation]
purpose of using testbed [can be used for an UNIX account creation]
contribution to PRAGMA [can be used for an UNIX account creation]
prefered username 1 [can be used for an UNIX account creation]
prefered username 2 [can be used for an UNIX account creation]
prefered username 3 [can be used for an UNIX account creation]
prefered shell [can be used for an UNIX account creation]
dn [required for globus authentication]
host name(s) [required for opening firewall]
host ip(s) [required for opening firewall]
url for site certificate files [required for globus authentication]
url for signing_policy file [required for globus authentication]
url for crl file [can be used for globus authentication]
ssh public key [required for ssh login]

Then all the info and files are packaged into a stardard tar.gz file which will be made available for download at https://pragma-goc.rocksclusters.org/secure. The input tar.gz file includes 4 or 5 files and they are organized as

{prefered1}/authorized_keys
{prefered1}/{certfilename}.0
{prefered1}/{certfilename}.signing_policy
{prefered1}/{certfilename}.r0 [May or may not present]
{prefered1}/user.txt

The {prefered1} is the most prefered username specified by the new user.

The format of user.txt file looks something like this

fullname=Cindy Test
affiliation=PRAGMA
address=UCSD/SDSC La Jolla, CA 92093-0505
country=USA
phone=858-534-5000
fax=858-534-5001
email=cindytest@sdsc.edu
purpose=routine-basis experiments
contribution=work
prefered1=cindytest
prefered2=cindytest1
prefered3=NONE
shell=bash
dn="/C=US/O=NPACI/OU=SDSC/CN=Cindy Zheng/USERID=zhengc"
hostname=rocks-52.sdsc.edu
hostip=198.202.88.52
urlcert=https://pragma-goc.rocksclusters.org/secure/certificates/b89793e4.0
urlcrl=NONE
urlsign=https://pragma-goc.rocksclusters.org/secure/certificates/b89793e4.signing_policy

The sample script

The sample script is written in Perl. Please read it in full to understand all the assumptions it's based on, before attempt a trial run. You may use the sample script anyway you like, but at your own risk.

To run the script, make it executable (chmod +x) and make sure that you have all the required priviledges to create user accounts, install ssh key and certificate files. If the input file cindytest.tar.gz is in the same directory of this script, you can run the script with a command like this

# pragma_setuser cindytest.tar.gz