The Stage Configuration File will contain a white list. Each line of the white list may contain one or two regular expressions enclosed in double quotes. The first regular expression matches the DN, and the second matches the FQAN :
Lines starting with a hash symbol
# are discarded as comments.
The regular expression syntax follows the syntax defined for the Java Pattern class .
Here are some examples of the White List Records for the 1.9.5 series:
".*" "/atlas/Role=production" "/C=DE/O=DESY/CN=Kermit the frog" "/C=DE/O=DESY/CN=Beaker" "/desy" "/O=GermanGrid/.*" "/desy/Role=.*"
This example authorizes a number of different groups of users:
Any user with the FQAN
The user with the DN
/C=DE/O=DESY/CN=Kermit the frog, irrespective of which VOMS groups he belongs to.
The user with the DN
/C=DE/O=DESY/CN=Beakerbut only if he is also identified as a member of VO
Any user with DN and FQAN that match
With the plain
dCap protocol the DN and FQAN are not known for any users.
Therefore, there is a special case for
dCap users in 1.9.5. In order to allow all
to stage files the white list should contain the following record:
If this line is commented or not present in the white list,
dCap users will be disallowed to stage files.
In 1.9.5-20 release, an optional storage group parameter can be specified. Each line of the white list may contain up to three regular expressions enclosed in double quotes. The regular expressions match the DN, FQAN, and Storage Group written in the following format:
"<DN>" ["<FQAN>" ["<StorageGroup>"] ]
If a storage group is specified all three parameters must be provided.
The regular expression
".*" may be used to authorize any DN
or any FQAN. Consider the following example:
".*" "/atlas/Role=production" "h1:raw@osm" "/C=DE/O=DESY/CN=Scooter" ".*" "sql:chimera@osm"
In the example above:
Any user with FQAN
/atlas/Role=productionis allowed to stage files located in the storage group
/C=DE/O=DESY/CN=Scooter, irrespective of which VOMS groups he belongs to, is allowed to stage files located in the storage group
In the following example, all
dCap users are allowed to stage files located
in the storage group
"Unknown" "nobody" "h1:raw@osm"