NAME

       arc-vomsac-check - ARC VOMS AC-based queue policy enforcing plugin

DESCRIPTION

       ARC  VOMS  AC-based  queue  policy  enforcing plugin perfors per-queue authorization based on information
       stored in VOMS AC.

SYNOPSIS

       arc-vomsac-check [-N] -P <user proxy> -L <A-REX local> [-c <configfile>] [-d <loglevel>]

OPTIONS

       -N     treat absence of VOMS AC as allowed access (deny by default)

       -P user proxy
              path to user proxy certificate file to get VOMS AC from

       -L A-REX local
              A-REX jobstatus .local file (used to determine submission queue)

       -c configfile
              plugin configuration file (/etc/arc.conf will be used by default)

       -d loglevel
              logging level from 0(ERROR) to 5(DEBUG)

GETTING A-REX TO WORK WITH PLUGIN

       You must attach plugin as handler for ACCEPTED state:

       authplugin="ACCEPTED 60 /opt/arc/libexec/arc/arc-vomsac-check -L %C/job.%I.local -P %C/job.%I.proxy"

CONFIGURATION

       Queue policies need to be written into plain text configuration file of the same format as arc.conf.  The
       plugin  expects  several  configuration  blocks  for  every  queue  identified by [queue] or [queue/name]
       section.

       The attribute value pairs identified by 'ac_policy' keyword within a queue configuration block  represent
       rules  for  allowing  or  denying  users  to  utilize  queue.  These  rules  are  processed  in  order of
       specification.

       The first rule that matches the VOMS AC presented by a user stops further processing of  remaining  rules
       in  the  block. If no one rule mathes VOMS AC, access is denied.  If no 'ac_policy' rules supplied in the
       queue block, access is granted.

       Matching rules has the following format:

        ac_policy="[+/-]VOMS: <mathing FQAN>"

       Prepending '+' indicate positive match (users with FQAN  match  are  allowed).   Prepending  '-'  or  '!'
       indicate  negative  match  (users with FQAN match are prohibited).  Without any prefix character, rule is
       treated as positive match.

       FQAN   format   can   be   specified    either    in    ARC    format    or    general    VOMS    format:
       '/VO=students/Group=physics/Role=production'   is  the  same  as  '/students/physics/Role=production'  or
       '/students/Group=physics/Role=production/Capability=NULL' or any other combinations.  Regalar expressions
       syntax can be used in FQAN specification.

EXAMPLE CONFIGURATION

        [queue/general]
        ac_policy="-VOMS: /students/Role=production"
        ac_policy="-VOMS: /students/Group=nosubmission"
        ac_policy="VOMS: /VO=students"

        [queue]
        name="production"
        ac_policy="VOMS: /students/Role=production"
        ac_policy="-VOMS: /badvo"
        ac_policy="VOMS: /.*/Role=production"

       In  the  example  configuration,  queue  "general"  can  NOT  be  used  by  VO "students" users with Role
       "production" and VO "students" "nosubmission"  Group.  It  CAN  be  used  by  any  other  members  of  VO
       "students".

       Queue  "production"  allow access to VO "students" users with Role "production", prohibit some VO "badvo"
       and allow any VO users with Role "production".  First rule may be omitted due to common regex.

AUTHOR

       Andrii Salnikov <manf at grid dot org dot ua>