LCMAPS_LOCALACCOUNT.MOD(8)

💖 LCMAPS_LOCALACCOUNT.MOD(8) — the site access control girlie 💖

okay bestie, sit down, hydrate, and let me tell you about lcmaps_localaccount.mod, a section 8 (system administration) manual page from Site Access Control. she's a plugin. she's an acquisition icon. and she's about to hand your LCMAPS system some Local Account credentials. let's go 🫶

---

✨ NAME ✨

lcmaps_localaccount.mod — an LCMAPS plugin that switches user identity. yes literally. that's her whole thing. 💅

---

🎀 SYNOPSIS 🎀

lcmaps_localaccount.mod [-gridmapfile grid-mapfile]

---

🌸 DESCRIPTION 🌸

so. this plugin is an acquisition plugin, meaning her job is to go get info and bring it back to the LCMAPS system — specifically Local Account credential information. she's a provider. a giver. we love that for her.

what she does is try to find a local account — and when we say local account we mean, more specifically, a UserID — based on the Distinguished Name (DN) of the user's end-entity certificate. like, she looks at who the cert says you are, and she's like "okay and who are you locally? 👀"

she'll try to find that DN → local account name mapping inside the grid-mapfile. and then, once she's found the mapped local (system) account username, she resolves the UID, the GID, and all the secondary GIDs. all of them. not just the first one. the whole friend group. 💜

---

💅 OPTIONS 💅

• -gridmapfile grid-mapfile — this file has to contain the DNs → (local) user account name mappings. fr fr, it is strongly advised that you set this option, and that you set it to an absolute path, so you don't accidentally use the wrong file or the wrong file path. lowkey important.
  • when it's unset, the plugin will try to grab the value from one of the environment variables (scroll down to ENVIRONMENT, bestie).
  • when those are unset too, the default depends on whether the plugin is running inside a (setuid-)root application:
    • in the (setuid-)root case, the default is /etc/grid-security/grid-mapfile
    • in the non-(setuid-)root case, the default is <homedir>/.gridmap
  • and if that latter default doesn't exist? the plugin returns the account information of the calling user. surprise bestie, it's you. 🙈
  • also, in a (setuid-)root application, relative paths are taken with respect to /etc/grid-security/.

---

👑 RETURN VALUES 👑

• LCMAPS_MOD_SUCCESS — success. she ate. ✨
• LCMAPS_MOD_FAIL — failure. she did not eat. 😭

---

🌈 ENVIRONMENT 🌈

• GRIDMAP | GLOBUSMAP | globusmap | GlobusMap — when no grid-mapfile is specified as an option to the plugin, she'll try to obtain the file location from one of these environment variables. yes, all four spellings. she's flexible like that. 🦋

---

⭐ NOTES ⭐

since version 1.6.0, the localaccount plugin supports grid-mapfile entries with multiple usernames, separated by a comma — and no whitespace, okay? comma, then name, no spaces, we're not animals.

this can be used together with specifying a requested username (like via gsissh) to pick any of these accounts. when no requested username is specified, the first one is used. and heads up: this requires LCMAPS version 1.6.0 or newer. no cap. 🎀

---

💀 BUGS 💀

please report any errors to the Nikhef Grid Middleware Security Team <grid-mw-security-support@nikhef.nl>. they're lovely, they'll help, just tell them what broke. 🫶

---

🔥 SEE ALSO 🔥

• lcmaps.db(5)
• lcmaps(3)

iykyk. go read them, bestie, they're right there. 📚

---

🌸 AUTHORS 🌸

LCMAPS and the LCMAPS plug-ins were written by the Grid Middleware Security Team <grid-mw-security@nikhef.nl>. absolute icons, every single one of them. 👑

---

and that's the whole page, no skips, no summaries, every flag and default accounted for 💖

this little love letter to local accounts was brought to you by Stichting FOM/Nikhef, dated February 6, 2015 — yeah she's a 2015 baby and she's still serving. periodt. 🎀✨