libXrdVoms(1)

💖 libXrdVoms(1) — the XRootD plug-in that pulls VOMS attributes out of your proxy 🎀

okay bestie, sit down, hydrate, and let me tell you about libXrdVoms — it's a plug-in for XRootD (you know, the manual page situation, libXrdVoms(1)) and it's genuinely one of those little guys that does a very specific job extremely well. No cap. ✨

---

🌸 NAME 🌸

libXrdVoms — an XRootD plug-in to extract VOMS attributes 💅

---

✨ SYNOPSIS ✨

sec.protparm gsi -vomsfun:libXrdVoms.so
sec.protparm gsi -vomsfunparms:options

---

🦋 DESCRIPTION 🦋

So the tea is: the libXrdVoms plug-in is basically an implementation of these two functions 👇

int XrdSecgsiVOMSFun(XrdSecEntity &ent)
int XrdSecgsiVOMSInit(const char *cfg)

and the way it does it is by using the official VOMS API libraries to validate and extract the VOMS attributes from a VOMS proxy. That's the whole vibe. Reliable. Iconic. Doing its little job. 🫶

---

👑 OPTIONS 👑

here's the full lineup, bestie, no skipping, we're reading every single one like the good students we are 📚✨

• certfmt={raw,pem,x509} — picks the certificate format. raw is for using it with XrdCrypto tools; pem is that PEM base64 format (the one you see in cert files, you know the one); and x509 gives you a STACK_OF(X509). The default? raw. 🎀
• grpopt=opt — tells it how to use the group names info. And opt is literally sel * 10 + which — math girlies rise 🙈 — where sel is either 0 (consider all the groups chillin' in the VOMS extension) or 1 (select among those groups specified by the grps option; peep below), and which can be 0 (take the first one), 1 (take the last), or 2 (take all of them, comma separated, and create a vertically sliced tuple — more on that in NOTES, don't worry). 💅
• grps=grp1[,grp2,...] — the group(s) whose info gets extracted. And heads up: if you specify this, the grpopt sel gets set to 1 regardless of what you set it to. Rude? Maybe. But that's the rule. See NOTES. 👇
• vos=vo1[,vo2,...] — the VOs to be considered; the first match is the one that's taken. See NOTES. 🌀
• grpfmt=fmtstring, rolefmt=fmtstring, vofmt=fmtstring — format strings for the content of XrdSecEntity::grps, XrdSecEntity::role, and XrdSecEntity::vorg, respectively. These are optional and by default they're just empty, no drama. ✨

And the place holders it recognizes in those format strings are:

• <r>: role
• <g>: group
• <vo>: VO
• <an>: Full Qualified Attribute Name

For example, rolefmt=<g>|grpfmt=<r>|vofmt="<vo> <an>" will invert the group and the role, and will add a space plus the FQAN in the vorg field of XrdSecEntity. Cute, right? 🎀

• dbg — forces verbose mode. It's giving "tell me everything, I want the lore". 🔍
• Multiple options can be specified separated by '|'. (Yes, the pipe. Our beloved.) 🌈

---

💜 NOTES 💜

If you specify the grps or vos options, it forces a failure if the requested group and/or VO isn't found. 😭 So yeah — in that regard, this plug-in can act as a sort of authorization filter. Lowkey powerful. But also note: the most refined authorization based on VOMS information can be achieved using the libXrdSecgsiAuthzVO plug-in distributed with XRootD. iykyk. 🫶

Option 'all' for the group selection (which=2) will generate a vertically sliced tuple including VO, group, and role fields. So like, for example, these VOMS attributes right here 👇

attribute : /atlas/de/Role=production/Capability=NULL
attribute : /atlas/de/Role=NULL/Capability=NULL
attribute : /atlas/Role=NULL/Capability=NULL

would result in this content in the XrdSecEntity fields 👇

vorg: atlas atlas atlas
grps: /atlas/de /atlas/de /atlas
role: producton NULL NULL

And the default XrdAcc will take its decision by checking, in turn, the triplets you get from slicing this tuple vertically. Slay. 🔥

---

🔥 EXAMPLES 🔥

This example shows you how to configure the plug-in to select VO=cms, select the first group, use the PEM format for the proxy, and switch on debugging. It also shows how to specify multiple options — either on the same line or spread across multiple lines. Both valid, both iconic. 💅

sec.protparm gsi -vomsfun:libXrdVoms.so
sec.protparm gsi -vomsfunparms:grpopt=0|vos=cms|certfmt=pem
sec.protparm gsi -vomsfunparms:dbg

---

🎀 FILES 🎀

The plug-in files are

lib64/libXrdVoms-4.so (or lib/libXrdVoms-4.so)
include/xrootd/private/XrdVoms/XrdVoms.hh

and they're typically available under /usr. 🗂️✨

---

🌈 ENVIRONMENT 🌈

The environment variable X509_VOMS_DIR must be set to a valid directory. Typically it's /etc/grid-security/vomsdir. So like, don't forget it, bestie, or the whole thing is gonna be mad at you. 😤

---

🧚 DIAGNOSTICS 🧚

The libXrdVoms plug-in requires libvomsapi.so and the openssl libraries. And if you hit a load failure, it may be useful to check with ldd whether all the required dependencies are correctly resolved. Classic move, always works. 🔧

---

⭐ LICENSE ⭐

LGPL; see http://www.gnu.org/licenses/.

---

👑 AUTHOR AND SUPPORT 👑

The libXrdVoms plug-in has been implemented by Gerardo Ganis (Gerardo.Ganis@cern.ch). If you need support, any request should be addressed via the project main web site

https://github.com/gganis/vomsxrd

or via the XRootD support site

https://github.com/xrootd/xrootd

---

and that's the whole page, bestie 💖 this was v6.2.0 of the libXrdVoms(1) manual, and honestly? she ate. go forth and extract those VOMS attributes. periodt. 🎀✨🦋🌸💅