LCMAPS_VOMS...ACCOUNT.MOD(8)

💖 LCMAPS_VOMS_LOCALACCOUNT.MOD 💖

okay bestie, we're doing lcmaps_voms_localaccount.mod from section 8 of the Site Access Control manual, and honestly? she's that girl. let's get into it 🫶

---

✨ NAME ✨

lcmaps_voms_localaccount.mod — an LCMAPS plugin that switches user identity based on VOMS credentials, using local accounts. 💅

---

🌸 SYNOPSIS 🌸

lcmaps_voms_localaccount.mod [-gridmapfile grid-mapfile] [--do-not-add-primary-gid-from-mapped-account] [--add-primary-gid-from-mapped-account] [--add-primary-gid-as-secondary-gid-from-mapped-account] [--do-not-add-secondary-gids-from-mapped-account] [--add-secondary-gids-from-mapped-account] [--use-voms-gid|--use_voms_gid|-use_voms_gid] [--use-account-gid]

---

🦋 DESCRIPTION 🦋

so. this VOMS localaccount acquisition plugin is literally a 'VOMS-aware' glow-up of the lcmaps_localaccount.mod.8 plugin. same energy, but now she actually knows about VOMS. 🧚

what she does: she tries to find a local account (more specifically a UserID) based on the VOMS info that's available from LCMAPS — and in particular, the Fully Qualified Attribute Names (FQANs).

she'll go looking for an FQAN-to-local-account-name mapping in the gridmapfile. and once she's found your account? she resolves the UID, the GID, and all the secondary GIDs of the mapped local (system) account username. not me being thorough 😭👑

---

💅 OPTIONS 💅

• -gridmapfile grid-mapfile — this file has to contain FQANs → (local) user account name mappings. strongly advised to set this one, and to set it to an absolute path, so you don't accidentally use the wrong file (or the wrong path to the right file, which is somehow worse 💀). if you leave it unset, the plugin will try to grab the value from one of the environment variables (peep ENVIRONMENT below). and if those are unset too, the default depends on whether the plugin is running inside a (setuid-)root application:
  • in the (setuid-)root case, the default is /etc/grid-security/grid-mapfile
  • in the non-(setuid-)root case, the default is <homedir>/.gridmap
  • and in a (setuid-)root application, relative paths are taken with respect to /etc/grid-security/
• --do-not-add-primary-gid-from-mapped-account — once the account is mapped, do NOT add the primary Group ID from the passwd-file/LDAP of the mapped account as part of the mapping result. the default is to add the primary Group ID, unless --use-voms-gid is specified. see also --add-primary-gid-from-mapped-account, --add-primary-gid-as-secondary-gid-from-mapped-account and --use-voms-gid. 🙈
• --add-primary-gid-from-mapped-account — once the account is mapped, add the primary Group ID from the passwd-file/LDAP of the mapped account as part of the mapping result. the default is to add the primary Group ID, unless --use-voms-gid is specified. see also --do-not-add-primary-gid-from-mapped-account, --add-primary-gid-as-secondary-gid-from-mapped-account and --use-voms-gid. ✨
• --add-primary-gid-as-secondary-gid-from-mapped-account — once the account is mapped, add the primary Group ID from the passwd-file/LDAP of the mapped account as a secondary Group ID as part of the mapping result (possibly in addition to adding it as a primary Group ID, she contains multitudes 💖). the default is to add it only as primary Group ID. see also --do-not-add-primary-gid-from-mapped-account, --add-primary-gid-from-mapped-account and --use-voms-gid.
• --do-not-add-secondary-gids-from-mapped-account — once the account is mapped, do NOT add the secondary Group ID(s) from the groups-file/LDAP of the mapped account as secondary Group ID(s) as part of the mapping result. the default is to add the sGIDs, unless --use-voms-gid is specified. see also --add-secondary-gids-from-mapped-account and --use-voms-gid.
• --add-secondary-gids-from-mapped-account — once the account is mapped, add the secondary Group ID(s) from the groups-file/LDAP of the mapped account as secondary Group ID(s) as part of the mapping result. the default is to add the secondary Group ID(s), unless --use-voms-gid is specified. see also --do-not-add-secondary-gids-from-mapped-account and --use-voms-gid.
• --use-voms-gid, --use_voms_gid, -use_voms_gid — by default this plugin adds the primary and secondary Group ID(s) from the passwd-file/groups-file/LDAP of the mapped account as part of the mapping result. specifying this option overrides that default. part or all of the group info can still be added by using the --add-* flags. we advise switching this option on by default. 👑 see also --use-account-gid.
• --use-account-gid — this one does the exact opposite of --use-voms-gid, telling the plugin to add the mapped account group information to the mapping result. it's currently already the default, which means this option has no effect. no cap. see also --use-voms-gid.

---

⭐ RETURN VALUES ⭐

• LCMAPS_MOD_SUCCESS — success! slay. 🎀
• LCMAPS_MOD_FAIL — failure. it's giving sad girl hours. 😭

---

🌈 ENVIRONMENT 🌈

• GRIDMAP | GLOBUSMAP | globusmap | GlobusMap — when no grid-mapfile is specified as an option to the plugin, she'll try to obtain the file location from one of these environment variables. four whole names, pick your fave. 🦋

---

💜 NOTES 💜

since version 1.6.0, the voms_localaccount plugin supports grid-mapfile entries with multiple usernames, separated by a comma without whitespace. this can be used in combination with specifying a requested username (such as by gsissh), to pick any of these accounts. when no requested username is specified, the first one is used. 🫶

heads up bestie: this requires LCMAPS version 1.6.0 or newer.

---

🍓 BUGS 🍓

please report any errors to the Nikhef Grid Middleware Security Team <grid-mw-security-support@nikhef.nl>. they're lovely, they'll handle it. 💖

---

🌸 SEE ALSO 🌸

lcmaps.db(5), lcmaps(3).

---

🧚 AUTHORS 🧚

LCMAPS and the LCMAPS plug-ins were written by the Grid Middleware Security Team <grid-mw-security@nikhef.nl>. icons, honestly. 💅

---

and that's the whole page, bestie!! this one's brought to you by Stichting FOM/Nikhef, dated February 6, 2015 — vintage but still serving, iykyk. stay mapped, stay slaying. ✨👑💖