GLOBUS-K5(8)

💅 GLOBUS-K5(8) — globus-k5

okay bestie, so this is a page from the Grid Community Toolkit Manual, and it's all about a little program called globus-k5. grab a snack, we're doing Kerberos today ✨

---

🌸 NAME 🌸

globus-k5 — Acquire Kerberos Credentials for use with Grid Services

like, it goes and gets you Kerberos credentials so your Grid Services can actually do their thing. no credentials, no service. periodt. 💅

---

🎀 SYNOPSIS 🎀

globus-k5 SERVICE-COMMAND SERVICE-ARGS...

---

🦋 DESCRIPTION 🦋

so the globus-k5 program is an authorization module — it's used by the globus-gatekeeper program to acquire Kerberos 5 Credentials before it runs a Grid Service. like, it's the little pre-game ritual. 💖

and there's a few ways it can do that whole "acquire the credentials" thing:

• running kinit with a password stored in the globuskmap file
• using the NCSA krb525 command
• using the sslk5 command to use the X509 user proxy

now, the arguments you pass to globus-k5? it literally does not use them itself. it just passes them along to the job manager. so don't stress. the first parameter must be the path to the Grid Service though — that part matters fr fr.

it's also expecting your environment to already have the variables GLOBUSID and USER in it — those are your Grid identity and your local POSIX user identity. this program is normally run as root, and it will call seteuid() before it executes the Grid Service. main character energy honestly 👑

and where does it find the parameters to use and the mapping from globus to K5 user? the globuskmap file, obviously. 💁

✨ Format of the globuskmap file ✨

the globuskmap file is line-oriented — every line has a command to run that acquires Kerberos 5 credentials for a Grid identity.

each line is made of:

• an optionally-quoted GLOBUSID value
• followed by a command-line for running a process to acquire a Kerberos credential

for example:

"/O=Example/OU=Grid/CN=Joe User" /usr/afsws/bin/klog -principal juser -password mypasswd -cell infn.it

see? quoted identity, then the command. iconic. 🍓

---

🌈 ENVIRONMENT 🌈

these are the variables that affect how globus-k5 runs, bestie:

• GLOBUSKMAP — Path to the globuskmap file.
• USER — POSIX username that the service will run as.
• KRB5CCNAME — Path to a Kerberos credential cache.
• GLOBUS_ID — Grid identity to generate Kerberos credentials for.

---

💜 FILES 💜

and these files affect how globus-k5 runs too:

• /etc/globuskmap — Default file mapping Grid identities to Kerberos 5 principals.

---

🔥 SEE ALSO 🔥

• globus-k5(8)
• globus-job-manager(8)

---

👑 AUTHOR 👑

Copyright © 1999-2016 University of Chicago

---

okay that's the whole page, you ate it, go get those credentials 💖

this was the Grid Community Toolkit 6 version, dated 03/31/2018. mwah, bye bestie 🫶✨