This page is not up-to-date, please see https://wiki.metacentrum.cz/wiki/Facility_managers%27s_manual

Perun server

The installation of the Perun server is described in detail at https://github.com/CESNET/perun-ansible/blob/master/README.md

Slave scripts

Gen script creates file .tar.gz with data for end services and for files VERSION and SERVICE.

File VERSION contains version of gen scripts checked by slave script. File SERVICE contains service's name. According to this name end machine selects service slave script.

End machine runs script/opt/perun/bin/perun. This script decide which script should be run (depending on content file SERVICE).
As a transport layer SSH is used. Using SSH key, only /opt/perun/bin/perun is set to run at the end machine.

Debian package repository

Adding MetaCentrum Repository to a Debian host

If the file /etc/apt/sources.list.d/meta_repo.list is not already created, put there the following:

deb https://repo.metacentrum.cz/ all main pilot

deb-src https://repo.metacentrum.cz/ all main pilot

Following key (PGP PUBLIC KEY BLOCK) must be put into a file and added into the list of trusted keys by the following command:

apt-key add /tmp/key

PGP key: A385CDB0

LDAP

Information about groups are exported into LDAP.
Data are pushed via LDAPc component into LDAP which use Auditer. Delay in communication takes a couple of seconds.

Inner structure schema:

            dc=perun,dc=cesnet,dc=cz
                       |
              -------------------
              |                  |
        perunVoId=voId        ou=People
              |                  |
     perunGroupId=groupId perunUserId=userId ...

LDAP - related schemas

Following schemas are required:

 inetUser.schema
 tenOperEntry.schema
 perun.schema

Current perun.schema
- perun-schema.ldif – https://github.com/CESNET/perun/blob/production/perun-utils/ldapc-scripts/schemas/perun-schema.ldif
- inetuser-schema.ldif – https://github.com/CESNET/perun/blob/production/perun-utils/ldapc-scripts/schemas/inetUser-schema.ldif
- tenOperEntry-schema.ldif – https://github.com/CESNET/perun/blob/production/perun-utils/ldapc-scripts/schemas/tenOperEntry-schema.ldif

LDAP - entities and attributes description

PerunPerson or PerunUser - for user image in LDAP (taken from Perun)

 perunId - main user ID in form of number
 mail - user email taken from his profile, not necessary preffered one 
 preferredMail - preffered email 
 entryStatus - not ised at the moment, user is active in all cases or does not exist in LDAP
 sn - user's surname
 givenName - user's name
 cn - name and surname (without middleName) 
 o - user's organisation
 uidNumber;x-ns-* - user's UID in particular namespace (marked as *). For example cesnet, metacentrum etc.
 login;x-ns-* - user login in particular namespace (marked as *). For example cesnet, metacentrum etc.
 userCertificateSubject - subject of one user certificate (can be multivalue)  
 eduPersonalPrincipalNames - external logins of all IDP users external identities (can be multivalue) 
 memberOf - defines membership in particular group 
 isServiceUser - being service user value is 1, otherwise value is 0
 memberOfPerunVo - defines ID of Vo where user is member (active one)
 libraryIDs - IDs in library

PerunVo, defines image of VO in LDAP

 perunVoId - main VO ID 
 o - VO short name
 description - VO long name
 uniqueMember - defines relationship between user and the vo (members group)

PerunGroup, image of group under particular VO in LDAP

 cn - group name
 perunUniqueGroupName - group name with all parent group and also with Vo name in notation (VoName:parentGroupName:groupName)
 description - group description
 perunGroupId - main group ID 
 perunParentGroup - main parent group ID (if exist) 
 assignedToResourceId - resource ID where group is assigned to 
 uniqueMember - defines relationship between user and the group in the direction of "user is member in the group"
 owner - group owner (if exists)

PerunResource, image of resource under particular VO in LDAP

 perunResourceId - id of resource in perun
 perunVoId - id of vo where this resource exists
 perunFacilityId - id of facility where this resource is assigned to
 assignedGroupId - ids of assigned groups to this resource

LDAP - entity searching

Searching by command in CLI:

 ldapsearch -x -H ldap://localhost:389/ -b "dc=perun,dc=cesnet,dc=cz" "(perunUserId=13889)"
 - where ldap://localhost:389/ is necessary to replace by server address for remote access 
 - "(perunUserId=13889)" is searching condition (could be changed to perunVoId=, perunGroupId= etc.)
 - filter can be added at the end, for example ldapsearch -x -H ldap://localhost:389/ -b "dc=perun,dc=cesnet,dc=cz" "(perunUserId=13889)" sn cn givenName 
 (return sn, cn and givenName)

Instalace Peruna

Obsah

This page is not up-to-date, please see https://wiki.metacentrum.cz/wiki/Facility_managers%27s_manual

Perun server

Slave scripts

Debian package repository

Adding MetaCentrum Repository to a Debian host

LDAP

LDAP - related schemas

LDAP - entities and attributes description

LDAP - entity searching

Navigační menu

Instalace Peruna

This page is not up-to-date, please see https://wiki.metacentrum.cz/wiki/Facility_managers%27s_manual

Perun server

Slave scripts

Debian package repository

Adding MetaCentrum Repository to a Debian host

LDAP

LDAP - related schemas

LDAP - entities and attributes description

LDAP - entity searching

Navigační menu

Hledat