A valid certificate is needed in order to access the grid. Certificates are used to identify users. In addition to a valid certificate any user is required to be also a member of a virtual organisation (VO). Which resources are available for the user, is authorised based on the VO membership.
Look up the instructions from here.
Once you have your certificate, the next step is to log in to a grid UI. This is a computer which is pre-configured with grid middleware client tools. The grid middleware is what allows the different resources to talk to each other and makes it possible for user to submit jobs. To login from IPPP desktop machines, use:
ssh -Y username@gridui1.dur.scotgrid.ac.uk
Your username and password for the gridui is not necessarily identical to your credentials on the main IPPP system.
After you have got your certificate application approved, export the certificate as a PKCS12 file and copy this .p12 file to the grid UI (these steps are covered at the tutorial on obtaining certificates). In order to use the certificate for grid submissions, it needs to be converted to a public - private key pair. First, create a directory under your home directory in the grid UI
mkdir .globus
and run the following commands (replace gridcert.p12 with the name or your PKCS12 file.)
openssl pkcs12 -nocerts -in gridcert.p12 -out .globus/userkey.pem
openssl pkcs12 -clcerts -nokeys -in gridcert.p12 -out .globus/usercert.pem
The last step is to set the permissions right
chmod 444 .globus/usercert.pem
chmod 400 .globus/userkey.pem
Your private key is encrypted and can be only accessed with a passphrase. Once you submit your job, communication between different grid resources is needed, each communication requiring authentication. To reduce the number of times you need to enter your passphrase, grid security infrastructure supports proxy certificates (delegation). A proxy contains a modified version of your public and private keys, and this private key is not encrypted. The slightly lower level of security is acceptable here because proxies have a finite lifetime.
The next step is to create a proxy, which also tests that your certificate is valid and properly installed. The proxy generation is done using the VOMS (Virtual Organisation Management Service) client tools. The proxy validity can be set to 7 days:
arcproxy -S pheno -N -c validityPeriod=7d -c vomsACvalidityPeriod=7d
where pheno is the name of your virtual organisation. It will prompt you to enter your passphrase and after that it will tell you if the proxy generation succeeded or not. If successful, you should see output similar to this:
11:33am gridui1 1102 > arcproxy -S pheno -N -c validityPeriod=7d -c vomsACvalidityPeriod=7d Enter pass phrase for private key: Your identity: /C=UK/O=eScience/OU=Durham/L=eScience/CN=jeppe rosenkrantz andersen Contacting VOMS server (named pheno): voms.gridpp.ac.uk on port: 15011 Proxy generation succeeded Your proxy is valid until: 2026-09-10 11:45:49You can test if you have a valid proxy, and how much time is left, with
arcproxy --info
which should give an output like:11:45am gridui1 1103 > arcproxy --info Subject: /C=UK/O=eScience/OU=Durham/L=eScience/CN=jeppe rosenkrantz andersen/CN=1656893590 Issuer: /C=UK/O=eScience/OU=Durham/L=eScience/CN=jeppe rosenkrantz andersen Identity: /C=UK/O=eScience/OU=Durham/L=eScience/CN=jeppe rosenkrantz andersen Time left for proxy: 167 hours 59 minutes 42 seconds Proxy path: /tmp/x509up_u1101 Proxy type: X.509 Proxy Certificate Profile RFC compliant impersonation proxy - RFC inheritAll proxy Proxy key length: 2048 Proxy signature: sha256 ====== AC extension information for VO pheno ====== VO : pheno subject : /C=UK/O=eScience/OU=Durham/L=eScience/CN=jeppe rosenkrantz andersen issuer : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=voms.gridpp.ac.uk uri : voms.gridpp.ac.uk:15011 attribute : /pheno Time left for AC: 167 hours 59 minutes 44 secondsThis contains information both on the validity of the certificate, and its association with the VO (Pheno in this case).