LCMAPS_VOMS_POOLGROUP.MOD(8)

✨ NAME ✨

okay so bestie, meet lcmaps_voms_poolgroup.mod 💖 — it's an LCMAPS plugin (yes, section 8 of the manual, the big-girl admin stuff 👑) that switches up your user identity based on VOMS credentials, but specifically by pool groups. cute, right? let's get into it 🦋

---

🎀 SYNOPSIS 🎀

lcmaps_voms_poolgroup.mod [-groupmapfile group-mapfile] [-groupmapdir groupmapdir] [--map-to-secondary-groups] [-override_inconsistency] [-mapall] [-mapmin number of minimal mappings] [-strict_poolprefix_match {yes|no}]

---

🌸 DESCRIPTION 🌸

so the VOMS poolgroup acquisition plugin is a 'VOMS-aware' plugin, basically the sibling of lcmaps_voms_poolaccount.mod.8 except it's for groups instead of accounts. same energy, different department 💅

what it does: it tries to find local groups (more specifically GroupIDs) based on the VOMS information that LCMAPS hands it, and the star of that show is the Fully Qualified Attribute Names (FQANs). the actual groups get acquired from a group pool. then that resulting list of groups gets looked up in the /etc/groups and/or LDAP directories so the plugin can figure out which Group IDs should be added as a mapping result. periodt.

first thing it does is try to find an FQAN → pool name mapping in the group-mapfile, where the pool name starts with a dot . instead of an alphanumeric character. that mapping is what hands it a list of local groups. the group-mapfile is, like, the same vibe as a grid-mapfile, fr fr.

the groupmapdir directory is the persistent and open mapping database 🌈. a pool is defined as being a set of groups following a particular pattern in their naming — think pool001 or atlas001, iconic naming tbh. inside that directory the plug-in makes a new filename consisting of the lowercase URL-encoded VOMS FQAN.

for example (bestie, this is the good part): if the FQAN is mapped to .atlas in the group-mapfile, it will be mapped to the pool groups atlas001, atlas002, etc., and the names of those can be found in the groupmapdir. slay.

if there's no pool group assigned to the FQAN yet, the plugin will try to find a free pool group — i.e. one for which the link count is 1 — and make a new hardlink to it, with the URL-encoded FQAN as the name. not me making hardlinks like it's nothing 😭

and when a user comes back to the site, the plugin looks for that user's FQAN (URL encoded) in this directory. if it finds it, the corresponding pool group gets reassigned. welcome back babe 🫶

example showing the output of ls -li:

1836080 -rw-r--r-- 2 root root %2fdteam%2f
1836080 -rw-r--r-- 2 root root dteam001

see how the filename is hardlinked to the mapped group name? the way that creating this hardlink is designed to be an atomic operation and verified to work on large installations serving multiple services from one NFS-share... obsessed. 💖

---

💅 OPTIONS 💅

• -groupmapfile group-mapfile — this file has to contain the FQAN → pool group name mappings, same idea as the grid-mapfile, and the same formatting rules of the grid-mapfile apply to the group-mapfile too. it is strongly advised to set it to an absolute path so you don't accidentally use the wrong file (or the wrong filepath). in a (setuid-)root application, relative paths are taken with respect to /etc/grid-security/. and it is important to not mix the grid-mapfile and group-mapfile. do not do it. no cap. 🚫
• -groupmapdir groupmapdir — a directory used for the group mapping database, similar to the gridmapdir. if this option is unset, the plugin will try to obtain the value from the environment variable GROUPMAPDIR (go peek at ENVIRONMENT). in a (setuid-)root application, relative paths are taken with respect to /etc/grid-security/. and again: it is important to not mix the gridmapdir and groupmapdir directories 🙈
• --map-to-secondary-groups — when enabled, the plug-in will map also the first FQAN of the user to secondary Group IDs, which means there will be no primary Group ID set by this plug-in while it's enabled. and note that also if the first FQAN does not give a mapping, there will be no primary Group ID set by this plug-in. so like. no primary. at all. 💀
• -override_inconsistency — moving a user from one pool to another (because of a VO change, we've all been there) should normally only be done by changing the group-mapfile to indicate the new pool for that user. if the resulting URL-encoded lease (that's the hardlink) already exists but points to a different pool group than what running this plugin would produce, the plugin would normally fail. this option instructs the plugin to remap to the new pool group instead. glow-up, but for leases ✨
• -mapall — when enabled, a failure will be triggered if not all of the FQANs were successfully mapped to primary or secondary Group IDs. all of them. every single one. no leftovers bestie 😤
• -mapmin minimum number of mappings — this option sets a minimum amount of FQANs that have to be mapped for the plugin to succeed. default is '0'. note: if the minimum is unset or set to 0, the plugin will succeed (if no other errors occur) even if no pool groups were found. so like, zero is a valid vibe here 💅
• -strict_poolprefix_match {yes|no} — if this is set to 'yes', a line in the group-mapfile like <FQAN> .poolgr will result in mapping pool groups matching only the regexp poolgr[0-9]+. otherwise it will be allowed to match the wider range of poolgr.* — that's the legacy behaviour, iykyk.

---

🌈 RETURN VALUES 🌈

• LCMAPS_MOD_SUCCESS — success! we ate. 👑
• LCMAPS_MOD_FAIL — failure. it's giving tragedy. 😭

---

🦋 ENVIRONMENT 🦋

• GROUPMAPDIR — when no groupmapdir is specified as an option to the plugin, it will try to obtain the file location from this environment variable. she's resourceful like that 💜

---

💀 BUGS 💀

please report any errors to the Nikhef Grid Middleware Security Team <grid-mw-security-support@nikhef.nl>. they want to hear from you, fr fr 🫶

---

⭐ SEE ALSO ⭐

lcmaps.db(5), lcmaps(3).

---

🎀 AUTHORS 🎀

LCMAPS and the LCMAPS plug-ins were written by the Grid Middleware Security Team <grid-mw-security@nikhef.nl>. absolute legends, no notes. 💖

---

Stichting FOM/Nikhef · February 6, 2015 · LCMAPS_VOMS_POOLGROUP.MOD(8)

okay that's the whole page bestie, mwah 💋 go map some pool groups responsibly 🌸✨