Description

glite-VOMS_mysql, glite-VOMS_oracle, glite-UI, glite-VOBOX

New version of VOMS Admin and Clients:

New VOMS Admin features:

The VOMS SAML codebase developed during the OMII project has been integrated into the codebase. Now VOMS Admin exposes a service, called VOMSSaml that can be used to obtain a SAML assertion containing signed VOMS attributes.

Since the VOMS SAML Attribute authority (AA) needs to sign the issued assertions, when configuring the service you should define which X509 certificate and private key will be used for signing.

New VOMS Admin service properties:

• voms.aa.certificate
• voms.aa.key

The validity of issued attribute assertions can be limited with the voms.saml.max_assertion_lifetime service property.

The voms-admin-configure script has been extended to support flags to set these properties at configuration time.

Type voms-admin-configure --help for more information.

Updated dependencies:

VOMS SAML makes extensive use of the OpenSAML library, which requires a recent version of java xml parsing tools installed in your Java Runtime Environment.

The VOMS Admin distribution provides the jars you need to make your tomcat installation OpenSAML compliant. You just need to issue the following command:

cp $GLITE_LOCATION/share/voms-admin/endorsed/*.jar $CATALINA_HOME/common/endorsed

or change the tomcat startup script to include the following system property:

-Djava.endorsed.dirs=$GLITE_LOCATION/share/voms-admin/endorsed

VOMS Admin Server SAML attribute authority configuration handling.

Optional advanced parameters added:

1. voms.admin.configure.endorsed

Type: boolean
Context: server level

Adds $GLITE_LOCATION/share/voms-admin/endorsed to JAVA_ENDORSED_DIRS in Tomcat. The default value is "true".

2. voms.saml.aaCertificate

Type: string
Context: server level/VO level

The location of the certificate to be used by the VOMS SAML attribute authority. By default the tomcat SSL certificate is used.

3. voms.saml.aaPrivateKey

Type: string
Context: server level/VO level

The location of the certificate to be used by the VOMS SAML attribute authority. By default the tomcat SSL private key is used.

4. voms.admin.membershipRequest.timeout

Type: integer
Default value: 86400
Context: server level/VO level

Sets the timeout in seconds before voms-admin removes unconfirmed registration requests from the VO database.

5. voms.saml.max_assertion_lifetime

Type: integer
Default value: 720
Context: server level/VO level

Sets the lifetime, in seconds, of issued SAML assertions

6. voms.admin.membershipRequest.emailOnExpire

Type: boolean
Default value: true
Context: server level/VO level

Configures voms-admin to send a warning email to the user when his/her unconfirmed request is removed from the database.

This release introduces also automatic configuration of read-only access for anyone with a valid certificate (needed for the gridmap file generation on the relevant grid hosts). Applies only to newly created VOs.

glite-CREAM, glite-FTA_oracle, glite-FTS_oracle, glite-LFC_mysql, glite-LFC_oracle, glite-PX, glite-SE_dpm_disk, glite-SE_dpm_mysql, glite-UI, glite-VOBOX, glite-VOMS_mysql, glite-VOMS_oracle, glite-WMS, glite-WN, lcg-CE

New version of lcg-vomscerts:

lcg-vomscerts-5.6.0 adds new cert for voms.fnal.gov and removes old certs for voms.fnal.gov, voms.cern.ch and voms-pilot.cern.ch

Please also have a look at the list of known issues.

This update fixes various bugs. For the full list of bugs, please see list below.

Fixed bugs

Updated rpms

The RPMs can be updated using yum via

• via apt: yum update
• or via a download from:
  
  http://glitesoft.cern.ch/EGEE/gLite/R3.1/glite-VOMS_oracle/sl4/i386/RPMS.updates/

Service reconfiguration after update

Service must be reconfigured.

Service restart after update

Service must be restarted.

How to apply the fix

1. Update the RPMs (see above)
2. Update configuration (see above)
3. Restart the service if necessary (see above)