GLOBUS-GATEKEEPER(8)

✨ NAME ✨

globus-gatekeeper — authorize and execute a grid service on behalf of a user. That's it, that's the whole job description, and she does it flawlessly. 💅

🦋 SYNOPSIS 🦋

globus-gatekeeper [-help]

globus-gatekeeper -conf PARAMETER_FILE [-test] [-d | -debug] [-inetd |
-f] [-p PORT | -port PORT] [-l LOGFILE | -logfile LOGFILE] [-lf
LOG_FACILITY] [-acctfile ACCTFILE] [-e LIBEXECDIR] [-launch_method {
fork_and_exit | fork_and_wait | dont_fork }] [-grid_services SERVICEDIR]
[-globusid GLOBUSID] [-gridmap GRIDMAP] [-x509_cert_dir
TRUSTED_CERT_DIR] [-x509_cert_file TRUSTED_CERT_FILE] [-x509_user_cert
CERT_PATH] [-x509_user_key KEY_PATH] [-x509_user_proxy PROXY_PATH] [-k]
[-globuskmap KMAP] [-pidfile PIDFILE]

🌸 DESCRIPTION 🌸

okay so bestie, listen. globus-gatekeeper is a meta-server — think inetd or xinetd, same energy, but make it grid. What she does is authenticate a TCP connection using GSSAPI, map the client's credential onto a local account, and then start other services for them. Auth first, vibes after. ✨

Her most iconic, most common use is starting up instances of the globus-job-manager(8) service. And here's the slay: one single globus-gatekeeper deployment can handle multiple different service configurations at once, just by having entries in the /etc/grid-services/ directory. One gatekeeper, many services, zero drama. 👑

Typically, users don't even talk to her directly — they come through client applications like globusrun(1), globus-job-submit(1), or tools like CoG jglobus or Condor-G. She's the backstage icon making it all work. 🎀

💅 The full set of command-line options to globus-gatekeeper consists of 💅

• -help — Display a help message to standard error and exit. Short and sweet.
• -conf PARAMETER_FILE — Load configuration parameters from PARAMETER_FILE. The parameters in that file get treated as additional command-line options, so it's basically the same conversation, just written down. 📝
• -test — Parse the configuration file and print out the POSIX user id of the globus-gatekeeper process, the service home directory, the service execution directory, and the X.509 subject name — then she exits. A little peek behind the curtain. 👀
• -d, -debug — Run the globus-gatekeeper process in the foreground.
• -inetd — Flag to indicate that the globus-gatekeeper process was started via inetd or a similar super-server. Heads up though: if this flag is set and the globus-gatekeeper was not actually started via inetd, a warning will be printed in the gatekeeper log. 🙈
• -f — Flag to indicate that the globus-gatekeeper process should run in the foreground. This flag has no effect when the globus-gatekeeper is started via inetd.
• -p PORT, -port PORT — Listen for connections on the TCP/IP port PORT. This option has no effect if the globus-gatekeeper is started via inetd or a similar service. If not specified and the gatekeeper is running as root, the default of 2119 is used. Otherwise, the gatekeeper defaults to an ephemeral port.
• -home PATH — Sets the gatekeeper deployment directory to PATH. This is used to interpret relative paths for accounting files, libexecdir, certificate paths, and also to set the GLOBUS_LOCATION environment variable in the service environment. If not specified, the gatekeeper looks for service executables in /usr/sbin, configuration in /etc, and writes logs and accounting files to /var/log.
• -l LOGFILE, -logfile LOGFILE — Write log entries to LOGFILE. If LOGFILE is equal to logoff or LOGOFF, then logging will be disabled, both to file and to syslog. Silence era. 🤫
• -lf LOG_FACILITY — Open syslog using the LOG_FACILITY. If not specified, LOG_DAEMON will be used as the default when using syslog.
• -acctfile ACCTFILE — Set the path to write accounting records to ACCTFILE. If not set, records will be written to the log file.
• -e LIBEXECDIR — Look for service executables in LIBEXECDIR. If not specified, the sbin subdirectory of the parameter to -home is used, or /usr/sbin if that is not set.
• -launch_method fork_and_exit | fork_and_wait | dont_fork — Determine how to launch services. The method may be either:
  • fork_and_exit — the service runs completely independently of the gatekeeper, which exits after creating the new service process. She drops you off and leaves. 🚗💨
  • fork_and_wait — the service is run in a separate process from the gatekeeper, but the gatekeeper does not exit until the service terminates. She's waiting in the parking lot, no cap.
  • dont_fork — where the gatekeeper process becomes the service process via the exec() system call. Full main character transformation. 🦋
• -grid_services SERVICEDIR — Look for service descriptions in SERVICEDIR.
• -globusid GLOBUSID — Sets the GLOBUSID environment variable to GLOBUSID. This variable is used to construct the gatekeeper contact string if it can not be parsed from the service credential.
• -gridmap GRIDMAP — Use the file at GRIDMAP to map GSSAPI names to POSIX user names.
• -x509_cert_dir TRUSTED_CERT_DIR — Use the directory TRUSTED_CERT_DIR to locate trusted CA X.509 certificates. The gatekeeper sets the environment variable X509_CERT_DIR to this value.
• -x509_user_cert CERT_PATH — Read the service X.509 certificate from CERT_PATH. The gatekeeper sets the X509_USER_CERT environment variable to this value.
• -x509_user_key KEY_PATH — Read the private key for the service from KEY_PATH. The gatekeeper sets the X509_USER_KEY environment variable to this value.
• -x509_user_proxy PROXY_PATH — Read the X.509 proxy certificate from PROXY_PATH. The gatekeeper sets the X509_USER_PROXY environment variable to this value.
• -k — Use the globus-k5 command to acquire Kerberos 5 credentials before starting the service.
• -globuskmap KMAP — Use KMAP as the path to the Grid credential to kerberos initialization mapping file.
• -pidfile PIDFILE — Write the process id of the globus-gatekeeper to the file named by PIDFILE.

ngl bestie, -x509_cert_file TRUSTED_CERT_FILE shows up in the SYNOPSIS up there but the option list doesn't give it its own description paragraph, and I am not about to invent one for you. The facts are the facts. 💀

🌈 ENVIRONMENT 🌈

The following environment variables affect the execution of globus-gatekeeper:

• X509_CERT_DIR — Directory containing X.509 trust anchors and signing policy files.
• X509_USER_PROXY — Path to file containing an X.509 proxy.
• X509_USER_CERT — Path to file containing an X.509 user certificate.
• X509_USER_KEY — Path to file containing an X.509 user key.
• GLOBUS_LOCATION — Default path to gatekeeper service files.

🎀 FILES 🎀

The following files affect the execution of globus-gatekeeper:

• /etc/grid-services/SERVICENAME — Service configuration for SERVICENAME.
• /etc/grid-security/grid-mapfile — Default file mapping Grid identities to POSIX identities.
• /etc/globuskmap — Default file mapping Grid identities to Kerberos 5 principals.
• /etc/globus-nologin — File to disable the globus-gatekeeper program.
• /var/log/globus-gatekeeper.log — Default gatekeeper log.

🔥 SEE ALSO 🔥

globus-k5(8), globusrun(1), globus-job-manager(8)

👑 AUTHOR 👑

Copyright © 1999-2016 University of Chicago

and that's the whole page, bestie!! this is Grid Community Toolkit 6, dated 03/31/2018, and honestly she ate. go authenticate something, you've got this 💖✨🦋