FusionGrid GridID

Before you can use the services provided by the FusionGrid you need to get a GridId and register it with the services that you want to use.

Because the underlying Grid communication protocols are based on the Transport Layer Security (TLS), the FusionGrid uses an X.509 public key certificate as a GridId. (Learn more about X.509 public key certificates). You can either store and manage the credential yourself (see Self managed credentials) or have the FusionGrid Credential Manager do it for you. We recommend that new users create and store their credentials on the credential manager and use a login name and password to do a Grid signon.

Getting a GridId

To get a certificate issued go the FusionGrid Credential Manager and fill in the form that is presented. It will take 1-2 working days to verify your request with your sponsor and install a credential in the manager. When it is complete you will be notified by email.

Getting Access to FusionGrid Resources

When your FusionGrid certificate is issued it is also registered with ROAM, the FusionGrid authorization service. Once you have been notified that your certificate is available for use, you should connect to the ROAM server using the same user name and password that you gave to the credential manager. You will be presented with a list of the resources that you can currently use and a link to request access to other resources.

Using your GridId to access resources

When you want to connect to a Grid service, you must first signon to the FusionGrid with the fglogin.sh command.

Establish the Globus environment:

set the $GLOBUS_LOCATION environment variable

Get a proxy certificate:

fglogin.sh [ -l <user name> ] [ -t <hours> ]
-l  <user name> - the username that you gave when you requested your long
term certifiate. It is optional if it is the same as your current login id.

-t   <hours> - the lifetime in hours of the proxy certificate. Its 
default value is 12 hours. The maximum allowed time is 336 (2 weeks). 

fglogin calls myproxy-get-delegation which will prompt for the password that you gave to the credential manager.

A proxy credential that is derived from your long-term user credential is created. This credential has an unencrypted private key, so that it can be used repeatedly without requiring a passphrase to be input at each use. Since the private key of the proxy is unencrypted you should only choose longer lifetimes when they are absolutley necessary, e.g for multi-day TRANSP runs. The proxy is created by myproxy-get-delegation and signed by the credential manager with your long-term private key. The proxy is stored in a well known location (/tmp/x509up_NNNN).

---

about the fusion grid | fusiongrid research
Last modified 10/26/04 Comments? webmaster