EDG-MKGRIDMAP.CONF(5)

💖 EDG-MKGRIDMAP.CONF(5) 💖

okay bestie, we're looking at edg-mkgridmap.conf — the manual page, section 5, and it's giving "the config file that runs the whole grid-mapfile situation." let's get into it 🫶

---

✨ NAME ✨

edg-mkgridmap.conf — the configuration file for edg-mkgridmap. that's it, that's the name, no notes 💅

---

🌸 DESCRIPTION 🌸

so the edg-mkgridmap.conf file is where all the configuration info for edg-mkgridmap lives. like, everything it needs to know? it's in here.

the default location is /etc/edg-mkgridmap.conf. that's home base, periodt.

now the tea on the file format ☕ — edg-mkgridmap.conf is a free-form ASCII text file. it gets parsed by the descent parser that's built right into edg-mkgridmap. so like, you can throw in extra tabs and white spaces just for formatting purposes, it literally doesn't care, it's unbothered. 👑

keywords in the file are case-insensitive — uppercase, lowercase, whatever vibe you're on, it works. comments can go anywhere in the file (except inside quotes, bestie, don't do that) and they start with the # character and run all the way to the end of the line.

the file is basically a list of directives, and each directive is made of a keyword plus one or more arguments. optional arguments go in square brackets []. iconic structure, honestly.

here's the whole lineup of directives:

• group URI [lcluser]
• default_lcluser default_lcluser
• auth URI
• allow⎪deny pattern_to_match
• gmf_local grid-mapfile-local

---

🎀 EXAMPLE 🎀

no cap, here's what it actually looks like in the wild:

#### GROUP: group URI [lcluser]
group ldaps://grid-vo.infn.it/ou=testbed1,o=infn,c=it .infngrid
group ldaps://grid-vo.infn.it/ou=testbed2,o=infn,c=it
group ldaps://grid-vo.infn.it/ou=testbed3,o=infn,c=it AUTO
group https://grid-vo.infn.it/infngrid/testbed1 .infngrid
group https://grid-vo.infn.it/infngrid/testbed2
group https://grid-vo.infn.it/infngrid/testbed3 AUTO
group vomss://voms.hellasgrid.gr:8443/voms/dteam?/dteam/Role=lcgadmin dteamsgm
group vomss://voms.hellasgrid.gr:8443/voms/dteam?/dteam .dteam

#### DEFAULT_LCLUSER: default_lcluser lcluser
default_lcluser .infngrid

#### AUTH: auth URI
auth ldaps://grid-auth.infn.it/ou=People,o=infn,c=it

#### ALLOW and DENY: deny⎪allow pattern_to_match
deny *L=Parma*
allow *INFN*

#### GMF_LOCAL: gmf_local grid-mapfile-local
gmf_local /etc/grid-mapfile-local1
gmf_local /etc/grid-mapfile-local2
gmf_local /etc/grid-mapfile-local3

---

🦋 REFERENCE: GROUP 🦋

the group directive

group URI [lcluser]

a group directive defines a group of people who are members of a VO. if you specify lcluser, that's the local user name that gets associated with each member of the group. if you don't specify lcluser, then the default local user is implicitly used, no announcement needed. and if someone belongs to more than one group? the first match is the one that's used. first come, first served, bestie. 💅

the URI can be one of these types:

ldap[s]://<host>[:<port>]/<group>[??<scope>?<filter>]

http[s]://<host>[:<port>]/<group>

voms[s]://<host>[:<port>]/edg-voms-admin/<vo>[?<group>[/Role=<role>]]

for an ldap URI, the default scope is base and the default filter is (objectClass=*).

for a voms/vomss URI, the default port is the same as for an http/https URI. noted. 📝

now — specify AUTO as lcluser or default_lcluser and you unlock automatic generation of local usernames. in that case, the executable local-subject2user gets used. local-subject2user is called with the user certificate subject as its argument, and it writes the local username associated with that user certificate subject to the standard output. this is the moment where local sites get to customize the output of edg-mkgridmap. slay, honestly. ✨

and if you specify . or .[PREFIX] (for example .cms) as lcluser or default_lcluser, you enable dynamic allocation of local usernames — that's the Andrew McNab's gridmapdir patch, iykyk. 🔥

---

💜 REFERENCE: DEFAULT_LCLUSER 💜

the default_lcluser directive

default_lcluser default_lcluser

the default_lcluser directive defines the default local user. short, sweet, essential. 💖

---

🌈 REFERENCE: AUTH 🌈

the auth directive

auth URI

the auth directive specifies a group of people who are authorized to access the local resources. here's the important bit: if the certificate subject of a member of an ldap/ldaps group is not present in this authorized group, it will not be inserted in the grid-mapfile. so yeah, gatekeeping, but make it security. 🚪

if auth is omitted, this feature is disabled.

the URI can be this type:

ldap[s]://<host>[:<port>]/<group>[??<scope>?<filter>]

the default scope is one and the default filter is (description=subject=*). 🌟

---

⭐ REFERENCE: ALLOW and DENY ⭐

the allow⎪deny directive

allow⎪deny pattern_to_match

allow and deny directives define the access control list. the pattern to match may contain wildcards, and the test is done on the user certificate subject. parsing stops at the first match — no second chances, no appeals. 👑

if there is at least one allow, there's an implicit deny * at the end. otherwise there's an implicit allow *. parsing is not case sensitive. that's the whole rule, fr fr.

---

🍓 REFERENCE: GMF_LOCAL 🍓

the gmf_local directive

gmf_local grid-mapfile-local

the gmf_local directive specifies a local grid-mapfile that's useful for adding static entries into the grid-mapfile. cute little extra, love that for you. 🎀

---

🧚 FILES 🧚

• /etc/edg-mkgridmap.conf

---

💫 SEE ALSO 💫

• edg-mkgridmap(8)

---

👑 AUTHORS 👑

EU DataGrid Authorization Working Group, EGEE Middleware Security Group, Maarten Litmaath (CERN/WLCG). absolute legends, respect. 🙌

---

and that's the whole page, bestie — this version dropped on 2011-04-03, it's EDG-MKGRIDMAP.CONF(5) from the EDG-MKGRIDMAP.CONF(5) manual section, and now you know it inside and out. go configure something iconic 💖✨🦋