| 148 | | In addition to define [#VODefaultParams default values] for VO parameters, it is possible to override default VO parameters, as specified in templates located in [source:trunk/grid/glite-3.2/vo/params vo/params], with site-specific values. This is possible to do it on a per-VO basis or for all VOs configured on a machine. This is done using the same variable (nlist) as for [#VODefaultParams default parameters], `VOS_SITE_PARAMS`. To override default parameters for one specific VO, the key must be the VO name, as used in `VOS` variable. To override default parameters for all configured VOs, use special entry `LOCAL`. |
| 149 | | |
| 150 | | ''Note: if a template `vo/site/VONAME` can be located, it'll be loaded even though there is no explicit entry for the VO into variable `VOS_SITE_PARAMS`.'' |
| | 148 | In addition to define [#VODefaultParams default values] for VO parameters, it is possible to override default VO parameters, as specified in templates located in [source:trunk/grid/glite-3.2/vo/params vo/params], with site-specific values. This can be done on a per-VO basis or for all VOs configured on a machine, using the [#VODefaultParams previously described] variable (nlist), `VOS_SITE_PARAMS`: |
| | 149 | * To override default parameters for one specific VO, the key must be the VO name, as used in `VOS` variable. |
| | 150 | * To override default parameters for all configured VOs, use special entry `LOCAL`. |
| | 151 | |
| | 152 | The value can be either a nlist defining the site-specific parameters or a string referring to a template. When the entry for a VO is a nlist or is not defined, if a template `vo/site/`''voname'' can be located, it'll be loaded before applying parameters specified in `VOS_SITE_PARAMS`.'' |
| 154 | | ''Note: some properties are invalid in the context of the `LOCAL` entry (as with `DEFAULT`), in particular: `account_prefix`, `base_uid`, `gid`, `name`, `voms_servers`, `voms_roles`.'' |
| 155 | | |
| 156 | | For example, to define a site-specific WMS for VO Alice, create a template `vo/site/alice.tpl` in your site directory like : |
| | 156 | ''Note: some properties are invalid in the context of the `LOCAL` entry (as with `DEFAULT`), in particular: `account_prefix`, `base_uid`, `gid`, `name`, `voms_servers`, `voms_mappings`.'' |
| | 157 | |
| | 158 | The site-specific parameters are merged with default ones for each VO. They never replace default parameters. In particular, for `voms_servers` and `voms_mappings`, attributes specified into site-specific parameters are merged with attributes specified in the standard parameters for the same VOMS server or VOMS mapping. Site parameters need only to specify non default attributes, not the whole list of servers or roles with all their attributes. |
| | 159 | |
| | 160 | For `voms_servers`, if the entry in site-specific parameters has the attribute `host` defined and if there is not matching entry in standard parameters, a new VOMS server is added. If the entry in site parameters has no `host` attribute defined but the `name` attribute is present, the site parameters are taken into account only if there is a matching entry in standard parameters. |
| | 161 | |
| | 162 | For example, to define a site-specific WMS for VO Alice, the recommended solution is to create a template `vo/site/alice.tpl` in your site directory like : |
| 188 | | A particular site may wish to define its own parameters for a particular VOMS role. This can be done with nlist variable VOMS_ROLE_CONFIG_SITE. In this variable the key is a VO name and the value a nlist where the key is the role. The value of this second nlist has the same format as `VOS_SITE_PARAMS`. |
| 189 | | |
| 190 | | In this example, the Atlas role `production` is configured to use pool accounts: |
| 191 | | {{{ |
| 192 | | variable |
| 193 | | VOMS_ROLE_CONFIG_SITE = |
| 194 | | nlist("atlas", # VO |
| 195 | | nlist(escape("/atlas/Role=production"), # role FQAN |
| 196 | | nlist("pool_size", 20, |
| 197 | | "suffix", "prd") )); |
| 198 | | }}} |
| 199 | | |
| 200 | | To use pool accounts with all the specific FQANs declared in VO parameters, using the same number of accounts in the pool for each FQAN, it is possible to define propery `fqan_pool_size` in the [#VOSpecificParams VO-specific] entry or in the [#VODefaultParams DEFAULT] entry of `VOS_SITE_PARAMS` variable. For example, to use pool accounts for each specific FQAN of each VO, creating 10 accounts per FQAN, except for Atlas where 20 accounts per FQAN are created: |
| | 194 | A particular site may wish to define its own parameters for a particular VOMS role. This can be done easily defining the attribute `voms_mappings` in VO site-specific parameters. If the entry in site-specific parameters has the attribute `fqan` defined and if there is not matching entry in standard parameters, a new VOMS mapping is added at the end of the list of standard mappings. If the entry in site parameters has no `fqan` attribute defined but the `description` attribute is present, the site parameters are taken into account only if there is a matching entry in standard parameters. |
| | 195 | |
| | 196 | ''Note: in previous versions of the QWG templates, there used to be a variable VOMS_ROLE_CONFIG_SITE to do the site-specific configuration of VOMS mappings. This variable is now ignored and must be replaced by `voms_mappings` definition into VO site-specific parameters, as explained above.'' |
| | 197 | |
| | 198 | For each mapping, in addition to the standard attributes (`description`, `fqan`, `suffix`, `suffix2`), the following attributes can be used: |
| | 199 | * `enabled`. When defined to `false`, the matching mapping in standard templates is ignored. |
| | 200 | * `pool_size`: if greater than 1, the number of pool accounts to create for this mapping. If 1, disable the use of pool accounts for this mapping. |
| | 201 | |
| | 202 | For example, to configure the CMS role `production` to use pool accounts (with 20 accounts) and disable the role `t1production`, you may add the following to your `vo/site/cms.tpl` (or directly in `VOS_SITE_PARAMS` variable): |
| | 203 | {{{ |
| | 204 | 'voms_mappings' = list( |
| | 205 | nlist('description', 'production', |
| | 206 | 'pool_size', 20, |
| | 207 | ), |
| | 208 | nlist('fqan', '/cms/Role=t1production', |
| | 209 | 'enabled', false, |
| | 210 | ), |
| | 211 | ); |
| | 212 | }}} |
| | 213 | |
| | 214 | To use pool accounts with all the specific FQANs declared in VO parameters, using the same number of accounts in the pool for each FQAN, it is possible to define propery `fqan_pool_size` in the [#VOSpecificParams VO-specific] entry or in the [#VODefaultParams DEFAULT] entry of `VOS_SITE_PARAMS` variable. In addition, it is possible to exclude the use of pool accounts for the software manager (as it has implications on software area permissions), even if pool accounts are enabled for other FQANs, by defining VO attribute `swmgr_pool_accounts_disabled` to `true`, either in a [#VOSpecificParams VO-specific] entry or in the [#VODefaultParams DEFAULT] entry. |
| | 215 | |
| | 216 | For example, to use pool accounts for each specific FQAN (except software manager) of each VO, creating 10 accounts per FQAN, except for Atlas where 20 accounts per FQAN are created: |
