indigo-iam / voms-importer

A VOMS import script for INDIGO IAM

VOMS importer

This is a python script that can be used to import data from a VOMS Admin VO into an IAM organization.

Devcontainer support

For those who use VSCode, there is support for a remote Devcontainer, which comes preconfigured with the test VOMS at meteora.cloud.cnaf.infn.it.

Note (and beware) that $HOME/.globus and $HOME/.config/oidc-agent are mounted from the host.

To run the vomsimporter script, you first need to obtain an admin VOMS proxy with voms-proxy-init and an admin access token with oidc-token.

Running the importer

This is an example to import users from the test.vo hosted in meteora, into iam-dev.

Pre-requisites

• being an admin of meteora
• being an admin of iam-dev
• the X.509 certificate linked to the VOMS admin has to be the same as for the IAM admin
• having a local oidc-configuration (generated with Centos7) whith at least the following scopes allowed: openid iam:admin.read iam:admin.write scim:read scim:write proxy:generate

Define the following environment variables:

OIDC_AGENT_ALIAS=<your-client-alias>
OIDC_AGENT_SECRET=<your-client-secret>
IAM_ENDPOINT=https://iam-dev.cloud.cnaf.infn.it
IAM_HOST=iam-dev.cloud.cnaf.infn.it
VOMS_HOST=meteora.cloud.cnaf.infn.it
VOMS_VO=test.vo
X509_USER_PROXY=/tmp/x509up_u1000

Initialize your admin credentials with

$ ./docker/init-credentials.sh

Run the importer with

python vomsimporter.py --vo ${VOMS_VO} --voms-host ${VOMS_HOST} --iam-host ${IAM_HOST} --skip-duplicate-accounts-checks --username-attr nickname --debug --voms-port 8443

voms-importer's Issues

AUP synchronization

IAM 1.8.1 started to validate AUP for refresh tokens and X.509, but this tool doesn't synchronize AUP signature time. Users that logged in IAM year ago now have account with expired AUP and they can't get new token (I did not really checked X.509).

I was not also able to find API that would allow me to update aupSignatureTime

Cleanup of linked certificates

New certificates are added with link_certificate, but for full synchronization it is also necessary to remove DNs that no longer exists in the source VOMS. We are just aggregating in IAM bad / incorrect DNs that were cleanup long time ago from VOMS and to be able to use IAM SCIM as account source for other services (e.g. Rucio) we should get rid of these problematic entries that sometimes even don't have correct encoding for DN.

Certificates with same subject and different issuer

It seems to me that certificates with same subject but different issuer are not imported.

Fails for VOMS with a single group

E.g. LHCb only has one group (lhcb) so the script fails at

voms-importer/vomsimporter.py

Line 93 in 07618c3

groups = self._proxy.call_method("list-sub-groups", root_group)

Use CERN username instead of user.<vomsid> for setting IAM account username for LHC VOs

voms-importer/vomsimporter.py

Lines 289 to 301 in 0a55ce2

	def build_username(self, voms_user):
	user_id = "user.%d" % voms_user['id']
	if self._username_attr is not None:
	for attr in voms_user['attributes']:
	if attr['name'] == self._username_attr:
	return attr['value']
	logging.error("Attribute %s not found for user %s. Will fall back to default username %s",
	self._username_attr, voms_user['id'], user_id)
	return user_id
	else:
	return user_id

Use programmatic ldap call instead of subprocess to resolve cern login

voms-importer/vomsimporter.py

Line 573 in 0a55ce2

def resolve_cern_login_from_ldap(self, voms_user):

Failing to import a user should not stop the whole script run

Sometimes import_voms_user fails, for example when a new user needs to be created and the creation fails, raising an exception and terminating the whole run.
A more sensible behavior is to catch the exception and continue with the next user.

VOMS importer needs option for importing suspended users as well

At least ALICE and LHCb also need users who are suspended in VOMS-Admin to be imported into IAM.

A workaround would be to restore them all, let the VOMS importer do its job, and then let them get suspended again, independently on the VOMS-Admin side and in IAM...