Technical Board Meeting, CNAF, 14 Feb. 2004 Production VOMS experience D. Cesini - INFN-CNAF, V.Venturi-INFN-CNAF, A. Paolini – INFN-CNAF www.eu-egee.org EGEE is a project funded by the European Union under contract IST-2003-508833

Summary Gridit managed VOs (LDAP and VOMS) overview Some simple Production Server Statistics VOMS encountered problems (based on our experience) Server Version 1.2.18 Admin Interface Version 0.7.1 – 0.7.5 Client /Users side Server side Admin Interface side

Virtual Organizationions in GRIDIT 7 VOs LDAP managed 4 VO VOMS managed - only 2 submitted jobs to the Grid 4 voms-server are running on the same host 155 User in VOs managed by voms 93 user in VOs managed by ldap The same user can be in different VOs

Statistics for testbed008 (1/2) Jul. 15 2004 – Feb. 13 2005 for INFNGRID Sep. 07 2004 – Feb. 13 2005 for CDF 1174 Certificates for INFNGRID 310 Certificates for CDF Less than 50 certificates /day

Statistics for testbed008 (2/2) Jul. 15 2004 – Feb. 13 2005 for INFNGRID Sep. 07 2004 – Feb. 13 2005 for CDF Less than 300 certificates /month

Encountered Problems Client/User side (1/3) The right command is voms-proxy-init --voms vo-name and not voms-proxy-init (equivalent to grid-proxy-init)  No explicit warning, job submission will probably fail

Encountered Problems Client/User side (2/3) UI and VOMS server clocks must be synchronized or proxy creation will fail giving strange error messages. This is becoming frequent with the introduction of User Interfaces not managed by the lcfg server.

Encountered Problems Client/User side (3/3) – The only serious one MyProxy cannot be used with VOMS proxy certificates  Should be fixed into the next deployed release Server side – Good news: very few problems The Certification Revocation List did not update automatically. Patched with a cron job. VOMS server restart was needed only twice for the cdf VO – voms-proxy-init hangs forever. This should be fixed into the next deployed release.

Encountered Problems Admin Interface side Even if a web based interface exists, it is not very user friendly and some features are not working (i.e. – the user search utility) Version 0.7.1 Removing the administrator role to a user means delete completely the user from the VO The max VO name length is 6 characters (we already have 2 VOs with longer names and the walk around is not easy to implement) voms-httpd unstable No VO Usage Rules Agreement button present Upgrade to Version 0.7.5 VO Databases changed (db ownership) but configuration files were left unmodified. Missed mailer configuration. Neither the user, nor the administrator received notification after the submission of a join request. VO Usage Rules Agreement button is present, but it is not possible to add a link to the Rules.

Encountered Problems

Conclusions 4 VOMS server are currently running (on the same host) in the production grid, but only two VOs had already used it The load was not heavy during the production period Apart from MyProxy incompatibility no serious problems were encountered in the client and server middleware The admin interface should be improved