Yves Kemp wrote:
> Hi Stephen,
>
>
>>The YAIM configuration should be documented in the YAIM manual ... the
>>question of how the WMS matches FQANs is a subject of debate at the
>>moment, there is not yet an answer to record!
>
>
> In this context, I wanted to ask you how the WMS matches a catch-all
> FQAN, like the ones with a * in the following groups.conf:
> "/VO=desy/GROUP=/desy/ROLE=lcgadmin":::sgm:
> "/VO=desy/GROUP=/desy/test/ROLE=lcgadmin":::sgm:
> "/VO=desy/GROUP=/desy/ROLE=production":::prd:
> "/VO=desy/GROUP=/desy/GROUP=test":desytest::test:desy
> "/VO=desy/GROUP=/desy/GROUP=test/*":desytest::test:desy
> "/VO=desy/GROUP=/desy/test":desytest::test:desy
> "/VO=desy/GROUP=/desy/test/*":desytest::test:desy
> "/VO=desy/GROUP=/desy":desy:::desy
> "/VO=desy/GROUP=/desy/*":desy:::desy
>
> Adding the catch-all lines was the only possibility to have a working
> VOMS mapping when people come with a VOMS proxy with the FQAN attribute
> like
> /VO=desy/GROUP=/desy/test/subgroup
> or
> /VO=desy/GROUP=/desy/othergroup
>
> Or did I do something wrong in the groups.conf file?
Your groups.conf looks OK. The first FQAN in a VOMS proxy _must_ have a
full match in the LCMAPS grid- and groupmapfile. Wildcards are allowed.
How to deal with explicit or implicit wildcarding in matchmaking is one
of the questions being investigated by the (very active) Job Priorities
working group involving ATLAS, CMS, middleware developers and test site
representatives.
|