FWWG

Friday 12 May 2006, 14:00 → 16:00 Europe/Zurich

104/R-A10

Slides FWWG_FSMAccessControl.pdf Slides

Participants: Fernando, André, Francisca, Stefan, Olly, Lennart, Jim, Clara, Bobby, Wayne, Piotr, Giacinto, Sascha, Frank, Sorina 12th May 2006 1) Use of FW Installation Tool in distributed systems - Bobby Bobby presented the current CMS ideas for the use of the FW Installation tool in a distributed environment together with a short demo. Essentially the approach being adopted is as follows: - Install OS, PVSS and other standard applications with CMF (standard) - Install a modified FW installer together with other specific SW and PVSS projects via CMF (CMS specific) - All FW components will be installed in a central file server - A configuration database (not the JCOP FW one) will hold the definition of which versions of which components should be installed on each machine - CMF will be used to schedule and initiate the installation of missing components on each machine - A panel will be available for defining what components are required on any particular machine and this will write the appropriate information to the configuration database The following issues were raised/discussed: - What about Linux machines? Fernando suggested that the installation of the FW components could initiated directly on the machines without the need for CMF. Bobby noted that as the FW Installation functions were being used then this would of course be possible. - There was also the question raised whether this could be done without the need for the configuration database. The response from Bobby above applies here too. - The was the question of whether the modified version of the FW Installation tool, assuming Bobby's changes would eb incorporated and supported, could replace the existing version completely. It was agreed that this could not be the case as external users would still need to be able to install FW components without the infrastructure available at CERN. There was a general agreement that the functionality shown by Bobby was of general interest and he and Fernando will work together to estimate the work required to modify the JCOP Installation tool to provide the necessary functionality. A decision will then be made as to whether to go ahead or not. 2) Integration of access control in FSM - Clara Clara gave a brief presentation and then a demo of her implementation of access control integrated with the FSM component. This allows different access rights to be assigned to any CU, i.e. CU1 requires expert level of domain x while CU2 requires only operator level but in domain y. The attached slides illustrate this. The general approach was accepted and Clara agreed to release the new version by 17th May with a few minor changes including the incorporation of the login widget into the main panel. 3) A.o.B Piotr raised a couple of issues that should be discussed at the next FWWG meeting. - Access control synchronisation across distributed system, central repository of accounts and privileges and the use of common authentication mechanism. The experiments were requested to think about these issues and whether anything is already defined for their experiment. - Recipes based on FSM hierarchy. Piotr asked whether the experiments were interested in such functionality and whether they would then accept a delay in the release of the official 3.1 version of the Configuration DB component by 4 weeks or so to implement this. It was agreed to go ahead. Giacinto asked whether experiments were interested in having a common panel navigation mechanism. There was little interest in this. Frank asked whether a hook could be provided to integrate any standard authentication mechanism with the FW Access Control component. Piotr replied that is was not easy to provide this and that it certainly could not be done in the short-term.