VomsTestsP3407 < EgeeJra1It

Tags: , view all tags
---+ *Certification report patch [[https://savannah.cern.ch/patch/?func=detailitem&item_id=3407][3407]]*

Author: Elisabetta Molinari elisabetta.molinari@mi.infn.it

Outcome: %GREEN% Certified%ENDCOLOR%

%TOC%
---++ Automatic tests
   * tests on voms core were run automatically as a result of a build in etics, see [[http://etics-repository.cern.ch/repository/reports/id/f3c69f90-80aa-41a5-bebf-c789d1eea2f8/sl5_x86_64_gcc412/-/reports/index-custom-Testsuite.html][here]]
   * voms-admin automatic testing---> run the voms-cli tests from the testsuite [[http://glite.cvs.cern.ch/cgi-bin/glite.cgi/org.glite.testsuites.ctb/VOMS/][here]], after adjustying the error messages to the new ones:
      * here's a result of the command './myCheck-VOMS -n voms-rd02-21.cnaf.infn.it -l test-sequence.lst.voms-admin'<verbatim>Test VOMS-addMember	- OK
Test VOMS-assignRole	- OK
Test VOMS-crAttribute	- OK
Test VOMS-crGroup	- OK
Test VOMS-crRole	- OK
Test VOMS-crUser	- OK
Test VOMS-crUserNocert	- OK
Test VOMS-delAttribute	- OK
Test VOMS-delGroup	- OK
Test VOMS-delGroupAttribute	- OK
Test VOMS-delRole	- OK
Test VOMS-delRoleAttribute	- OK
Test VOMS-delUser	- OK
Test VOMS-delUserAttribute	- OK
Test VOMS-dismissRole	- OK
Test VOMS-listAttributes	- OK
Test VOMS-listGroupAttributes	- OK
Test VOMS-listGroups	- OK
Test VOMS-listMembers	- OK
Test VOMS-listRoleAttributes	- OK
Test VOMS-listRoles	- OK
Test VOMS-listSubGroups	- OK
Test VOMS-listUserAttributes	- OK
Test VOMS-listUserGroups	- OK
Test VOMS-listUserRoles	- OK
Test VOMS-listUsers	- OK
Test VOMS-listUsrWithRol	- OK
Test VOMS-removeMember	- OK
Test VOMS-setGroupAttribute	- OK
Test VOMS-setRoleAttribute	- OK
</verbatim> here's the full result [[https://twiki.cnaf.infn.it/twiki/bin/viewfile/EgeeJra1It/VomsTestsP3407?rev=1;filename=full_result.html.gz][report]] 
   * voms-core automatic testing, run the voms-core tests from the testsuite [[http://glite.cvs.cern.ch/cgi-bin/glite.cgi/org.glite.testsuites.ctb/VOMS/][here]]:
      * here's a result of the command './myCheck-VOMS -n voms-rd02-21.cnaf.infn.it -l test-sequence.lst.voms-core':<verbatim>Test VOMS-pr-attr	- OK
Test VOMS-pr-bits	- OK
Test VOMS-pr-cert	- OK
Test VOMS-pr-conf	- OK
Test VOMS-pr-dbg	- OK
Test VOMS-pr-genattr	- OK
Test VOMS-pr-hlp	- OK
Test VOMS-pr-hours	- OK
Test VOMS-pr-ign	- OK
Test VOMS-pr-key	- OK
Test VOMS-pr-limit	- OK
Test VOMS-pr-list	- OK
Test VOMS-pr-noreg	- OK
Test VOMS-pr-order	- OK
Test VOMS-pr-out	- OK
Test VOMS-pr-pver	- OK
Test VOMS-pr-pwst	- OK
Test VOMS-pr-quiet	- OK
Test VOMS-pr-RoleOrder	- OK
Test VOMS-pr-usg	- OK
Test VOMS-pr-valid	- OK
Test VOMS-pr-verify	- OK
Test VOMS-pr-vers	- OK
Test VOMS-pr-vlf	- OK
Test VOMS-pr-vomses	- OK
Test VOMS-pr-warn	- OK</verbatim>here's the full result [[https://twiki.cnaf.infn.it/twiki/bin/viewfile/EgeeJra1It/VomsTestsP3407?rev=1;filename=full_result_vomscore.html.gz][report]]

---++ Clean installation
   * installation steps:<verbatim> wget http://etics-repository.cern.ch:8080/repository/pm/volatile/repomd/id/fa01c264-37cc-4539-a3b3-da59486a13dd/sl5_x86_64_gcc412/etics-volatile-build-by-id.repo
yum install glite-VOMS_mysql
yum install lcg-CA</verbatim> here's the yum install [[https://twiki.cnaf.infn.it/twiki/bin/viewfile/EgeeJra1It/VomsTestsP3407?rev=1;filename=yum_install_3407][log]]
here's the updated yum install [[https://twiki.cnaf.infn.it/twiki/pub/EgeeJra1It/VomsTestsP3407/yum_install_3407_1304][log]]
   * configuration steps:<verbatim>copy siteinfo.def and services/glite-voms_mysql from '/opt/glite/yaim/examples/siteinfo' into your favourite dir. Rename glite-voms_mysql as glite-voms
Set yaim variables as specified here https://twiki.cern.ch/twiki/bin/view/LCG/Site-info_configuration_variables
Launch  '/opt/glite/yaim/bin/yaim -c -s site-info.def -n VOMS'
</verbatim>
   * yaim configuration [[https://twiki.cnaf.infn.it/twiki/bin/viewfile/EgeeJra1It/VomsTestsP3407?rev=1;filename=yaimlog][log]]
   * yaim configuration files used:<verbatim>cat ~/siteinfo/site-info.def
# Uncomment this variable if you are installing a mysql server
# It is the MySQL admin password. 
MYSQL_PASSWORD="admin"


# Human-readable name of your site
SITE_NAME=voms-sa3-italia

##############################
# VO configuration variables #
##############################
# If you are configuring a DNS-like VO, please check
# the following URL: https://twiki.cern.ch/twiki/bin/view/LCG/YaimGuide400#vo_d_directory

# Space separated list of VOs supported by your site
VOS="sa3test vomstest"
-----------------------------------------------------------------

cat ~/siteinfo/services/glite-voms
# VOMS server hostname
VOMS_HOST=localhost

# Hostname of the database server. Put 'localhost'
# if you run the database on the same machine.
# This parameter can be specified per VO in the following way:
# VO_<vo_name>_VOMS_ADMIN_DB_HOST
VOMS_ADMIN_DB_HOST='localhost'

VO_SA3TEST_VOMS_DB_HOST="voms-rd02-21.cnaf.infn.it"
VO_SA3TEST_VOMS_DB_TYPE="mysql"
VO_SA3TEST_VOMS_DB_USER="sa3test_user"
VO_SA3TEST_VOMS_DB_PASS="pwd"
VO_SA3TEST_VOMS_DB_NAME="db_sa3test"
VO_SA3TEST_VOMS_PORT="15001"

VO_VOMSTEST_VOMS_DB_HOST="voms-rd02-21.cnaf.infn.it"
VO_VOMSTEST_VOMS_DB_TYPE="mysql"
VO_VOMSTEST_VOMS_DB_USER="vomstest_user"
VO_VOMSTEST_VOMS_DB_PASS="pwd1"
VO_VOMSTEST_VOMS_DB_NAME="db_vomstest"
VO_VOMSTEST_VOMS_PORT="15002"

VOMS_ADMIN_SMTP_HOST="localhost"
VOMS_ADMIN_MAIL="elisabetta.molinari@mi.infn.it"
VOMS_DB_DEPLOY="true"
-----------------------------------------------
</verbatim>


---++ Upgrade from production
   * Since this is the first release of VOMS for  SL5, only the upgrade of the mysql backend has been tested. Following the basic steps of a sample upgrade:<verbatim>- dump the old database  on the old VOMS server and transfer the file to the new node: mysqldump -h <OLD_HOSTNAME> -u <USER> -p --databases <DB_NAME> > <DUMP_FILE>
- mysql -u root -p < dbsa3test; mysql -u root -p < dbvomstest;
- grant all on *.* to 'root'@'voms-rd02-21.cnaf.infn.it' identified by 'admin';
- grant all on db_sa3test.* to 'sa3test_user'@'voms-rd02-21.cnaf.infn.it' identified by 'admin';
- grant all on db_sa3test.* to 'sa3test_user'@'localhost' identified by 'admin';
- grant all on db_vomstest.* to 'vomstest_user'@'voms-rd02-21.cnaf.infn.it' identified by 'admin';
- grant all on db_vomstest.* to 'vomstest_user'@'localhost' identified by 'admin';
- synchronize yaim conf files from the old machine with the new one, i.e. make sure username and password for the VO databases are the same 
- launch yaim configuration after setting yaim variable  VOMS_DB_DEPLOY to 'false' in the siteinfo.def or the services/glite-voms file
- re-start tomcat
- launch upgrade VO, for each VO as in the following: /opt/glite/sbin/voms-admin-configure upgrade --vo=sa3test
- re-start voms server and voms-admin
- register the VOMS host identity as a default admin  -->/opt/glite/sbin/voms-db-deploy.py add-admin --vo sa3test --cert /etc/grid-security/hostcert.pem</verbatim>
here's an upgrade [[https://twiki.cnaf.infn.it/twiki/bin/viewfile/EgeeJra1It/VomsTestsP3407?rev=1;filename=upgrade_log.gz][log]]

---++ Check Bugs:

---+++ Voms Admin 2.5-cli

   * BUG [[https://savannah.cern.ch/bugs/?38150][#38150]]: "Extend member status in voms-admin" %GREEN%FIXED%ENDCOLOR%
      * checked that active and suspend status are present in the voms-admin webapp.
   * BUG [[https://savannah.cern.ch/bugs/?38151][#38151]]: "Implement member institutional expiration in voms-admin" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?43127][#43127]]: "implement in voms-admin VO membership expiration bound to AUP version" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?43129][#43129]]: "implement in voms-admin an authorisation-aware web UI" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?43130][#43130]]: "multiple certificate support" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?43189][#43189]]: "allow user to request his/her inclusion in a Group/Role in voms-admin" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?43264][#43264]]: "voms-admin to keep user Registration Data in the VOMS database" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?60328][#60328]]: "remove-certificate does not work" %GREEN%FIXED%ENDCOLOR%
      * tried with a non-existent pair DN/CA as in the following: <verbatim> voms-admin --vo sa3test --nousercert remove-certificate '/C=IT/O=INFN/OU=Personal Certificate/L=CNAF/CN=Elisabet' '/C=IT/O=INFN/CN=INFN'
org.glite.security.voms.admin.database.NoSuchCertificateException: No certificate found matching subject '/C=IT/O=INFN/OU=Personal Certificate/L=CNAF/CN=Elisabet, /C=IT/O=INFN/CN=INFN'.</verbatim>
   * BUG [[https://savannah.cern.ch/bugs/?60329][#60329]]: "Not possible to restore a certificate from the command line" %GREEN%FIXED%ENDCOLOR%
      * launch <verbatim>voms-admin --vo sa3test suspend-certificate .globus/usercert.pem 'security incident'</verbatim>
      * launch <verbatim>voms-admin --vo sa3test restore-certificate .globus/usercert.pem</verbatim>
   * BUG [[https://savannah.cern.ch/bugs/?60337][#60337]]: "Locks held on access denied when processing membership requests" %GREEN%FIXED%ENDCOLOR%  
      * Actually this, and all the other bugs regarding locks not being well manages, were due to an improper management of the hibernate session when exceptions were raised. This is fixed in the code now.
   * BUG [[https://savannah.cern.ch/bugs/?60483][#60483]]: "Unhandled exception when deleting groups containing subgroups & locks held" %GREEN%FIXED%ENDCOLOR%
      * create a group as for ex: <verbatim>voms-admin --vo sa3test create-group testgroup</verbatim>
      * create a subgroup as for ex: <verbatim>voms-admin --vo sa3test create-group testgroup/testsubgroup</verbatim>
      * try to delete the parent group 'testgroup' from the webadmin
      * no exception is returned but an error message as the following: "The group testgroup cannot be deleted since it contains subgroups"
   * BUG [[https://savannah.cern.ch/bugs/?51657][#51657]]: "delete-user does not treat Email= and emailAddress= as equivalent" %GREEN%FIXED%ENDCOLOR%
      * given the following usercert: <verbatim>openssl x509 -in cas/ca2/certs/08.pem -text -noout | more
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8 (0x8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=CH, DC=CERN, OU=EMAILCA, CN=emailca.cern.ch/emailAddress=emailca@cern.ch
        Validity
            Not Before: Mar  8 20:32:58 2010 GMT
            Not After : Mar  8 20:32:58 2011 GMT
        Subject: DC=CH, DC=CERN, OU=EMAILCA, CN=Test user 3/emailAddress=test_user_3@emailca.cern.ch
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption</verbatim>
      * created a new user from the voms cli as in the following: <verbatim>voms-admin --vo sa3test create-user cas/ca2/certs/08.pem
 voms-admin --vo sa3test list-users
..........
/DC=CH/DC=CERN/OU=EMAILCA/CN=Test user 3/Email=test_user_3@emailca.cern.ch, /DC=CH/DC=CERN/OU=EMAILCA/CN=emailca.cern.ch/Email=emailca@cern.ch - test_user_3@emailca.cern.ch</verbatim>
      * tried to delete the user: <verbatim> voms-admin --vo sa3test delete-user cas/ca2/certs/08.pem
org.glite.security.voms.admin.persistence.error.NoSuchUserException: User '/DC=CH/DC=CERN/OU=EMAILCA/CN=Test user 3/Email=test_user_3@emailca.cern.ch,/DC=CH/DC=CERN/OU=EMAILCA/CN=emailca.cern.ch/emailAddress=emailca@cern.ch' not found in org.glite.security.voms.admin.persistence.error!
voms-rd02-21</verbatim>
   * BUG [[https://savannah.cern.ch/bugs/?54613][#54613]]: "voms-admin-configure ignores --dbhost option when configuring mysql VO" %GREEN%FIXED%ENDCOLOR%
      * launched the following: <verbatim>voms-admin-configure install --vo adminDeploy --createdb --deploy-database --dbtype mysql --dbhost cert-10.cnaf.infn.it --port 15002 --dbusername 'admin_Deploy' --dbpassword 'pwd' --mail-from elisabetta.molinari@mi.infn.it --verbose --smtp-host smtp.cnaf.infn.it --dbapwd 'admin'</verbatim>
   * BUG [[https://savannah.cern.ch/bugs/?54614][#54614]]: "voms-admin-configure should not try to create an administrator if the --skip-database option is set" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?56065][#56065]]: "voms-admin email notification behaviour should be configurable" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?58656][#58656]]: "Unique GAs handling exception" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?60517][#60517]]: "Unhandled exception when adding ACL entry" %GREEN%FIXED%ENDCOLOR%
      * add a new ACL entry for a non VO member
      * add another ACL entry for a non VO member setting the same subject as for the member above and a different CA
      * the following error message is returned: <verbatim>
An administrator with the given subject already exists. Choose a different subject!
Certificate subject: </verbatim>
   * BUG [[https://savannah.cern.ch/bugs/?60600][#60600]]: "Problems with groups and roles having special characters in the name" %GREEN%FIXED%ENDCOLOR%
      * It does not allow to create group and roles with special characters in the name
   * BUG [[https://savannah.cern.ch/bugs/?60604][#60604]]: "Error adding a default ACL for a group" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?61292][#61292]]: "VOMS Admin 2.0.7 Client fails with some (non-ASCII?) characters" %GREEN%FIXED%ENDCOLOR% 
   * BUG [[https://savannah.cern.ch/bugs/?59918][#59918]]: "NullPointerException during group creation with slash in the name" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?59919][#59919]]: "No warning when creating a group in a read-only context" %GREEN%FIXED%ENDCOLOR%
      * set the user to read only under '/sa3test/test'
      * tried to create a group under '/sa3test/test' and the following is returned: <verbatim>Insufficient privileges to execute 'CreateGroupOperation'.</verbatim>
   * BUG [[https://savannah.cern.ch/bugs/?59933][#59933]]: "Problem removing config backup" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?59985][#59985]]: "'ALL' permission resolution" %GREEN%FIXED%ENDCOLOR%
      * set an ACL permission for a member to ALL
      * check in the voms admin webadmin the field for 'suspend' is set to yes
   * BUG [[https://savannah.cern.ch/bugs/?60256][#60256]]: "Unhandled 'UserAlreadyExists' Exception" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?60264][#60264]]: "Uncought 'IllegalArgumentException' on request confirm" %GREEN%FIXED%ENDCOLOR%
      * tried to click on the confirmation link twice
   * BUG [[https://savannah.cern.ch/bugs/?60265][#60265]]: "Other VOs list not complete" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?60296][#60296]]: "Database session problems when wrong request confirmation parameters are submitted" %GREEN%FIXED%ENDCOLOR%
      * Actually this, and all the other bugs regarding locks not being well manages, were due to an improper management of the hibernate session when exceptions were raised. This is fixed in the code now. 
   * BUG [[https://savannah.cern.ch/bugs/?60308][#60308]]: "It is not possible to remove an AUP which has acceptance records" %GREEN%FIXED%ENDCOLOR%
   * BUG [[https://savannah.cern.ch/bugs/?60313][#60313]]: "Trigger reacceptance work only for the predefined AUP" %GREEN%FIXED%ENDCOLOR%
      * defined a new AUP with a new version
      * triggered re-acceptance to the existing members
   * BUG [[https://savannah.cern.ch/bugs/?60314][#60314]]: "Links in user AUP acceptance history displaying same AUP" %GREEN%FIXED%ENDCOLOR%

---+++ Voms core 
   * see tests performed for patch [[https://twiki.cnaf.infn.it/twiki/bin/view/EgeeJra1It/VomsTestsP3142][#3142]]
 
-- Main.ElisabettaMolinari - 2010-02-17

   * [[%ATTACHURL%/full_result][full_result]]: voms-cli full result report

   * [[%ATTACHURL%/yaimlog1][yaimlog1]]: yaim configuration log

   * [[%ATTACHURL%/full_result_vomscore.html][full_result_vomscore.html]]: full result voms core report

   * [[%ATTACHURL%/full_result.html][full_result.html]]: full result voms admin report

   * [[%ATTACHURL%/full_result.html.gz][full_result.html.gz]]: full result voms admin report

   * [[%ATTACHURL%/full_result_vomscore.html.gz][full_result_vomscore.html.gz]]: full result voms core report

   * [[%ATTACHURL%/yum_install_log.gz][yum_install_log.gz]]: yum install log

   * [[%ATTACHURL%/yaimlog][yaimlog]]: yaim configuration log

   * [[%ATTACHURL%/upgrade_log.gz][upgrade_log.gz]]: upgrade log

   * [[%ATTACHURL%/yum_install_3407_1304][yum_install_3407_1304]]: yum_install_3407_1304
Attachments
Topic attachments
I	Attachment	Action	Size	Date	Who	Comment
gz	full_result.html.gz	manage	2.2 K	2010-03-18 - 08:36	UnknownUser	full result voms admin report
gz	full_result_vomscore.html.gz	manage	3.9 K	2010-03-18 - 08:39	UnknownUser	full result voms core report
gz	upgrade_log.gz	manage	2.1 K	2010-03-23 - 09:29	UnknownUser	upgrade log
EXT	yaimlog	manage	33.3 K	2010-03-18 - 15:09	UnknownUser	yaim configuration log
EXT	yum_install_3407	manage	16.5 K	2010-04-13 - 07:28	UnknownUser	yum install 3407
EXT	yum_install_3407_1304	manage	7.6 K	2010-04-20 - 09:52	UnknownUser
gz	yum_install_log.gz	manage	2.4 K	2010-03-18 - 14:24	UnknownUser	yum install log
Topic revision: r34 - 2010-04-20 - ElisabettaMolinari
Account
- Log In
Edit
Attach