Skip to content

Commit 40a3556

Browse files
chaenchaen
authored
Merge pull request #539 from chrisburr/add-more-docs
Add more docs
2 parents ff81680 + 76bfad0 commit 40a3556

37 files changed

+738
-306
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ repos:
5353
- id: mdformat
5454
args: ["--number"]
5555
additional_dependencies:
56+
- mdformat-mkdocs
5657
- mdformat-gfm
5758
- mdformat-black
5859

‎docs/SECURITY.md‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎docs/admin/how-to/register-a-vo.md‎

Lines changed: 48 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -11,65 +11,63 @@
1111

1212
1. Log in to your VO’s IdP instance.
1313
2. Create a new OIDC client with:
14-
- **Client secret**: _none_
15-
- **Redirect URIs**:
16-
```
17-
https://<your‑diracx‑url>/api/auth/authorize/complete
18-
```
19-
- **Grant type**: `authorization_code`
20-
- **Scope**: at minimum `openid`, `profile` and `email`
14+
- **Client secret**: _none_
15+
- **Redirect URIs**:
16+
```
17+
https://<your‑diracx‑url>/api/auth/authorize/complete
18+
```
19+
- **Grant type**: `authorization_code`
20+
- **Scope**: at minimum `openid`, `profile` and `email`
2121
2222
### 2. Configure DiracX
2323
2424
1. In your DIRAC CS, add under `DiracX > CsSync > VOs > <VO> > IdP`:
2525
26-
```yaml
27-
DiracX
28-
{
29-
CsSync
30-
{
31-
VOs
32-
{
33-
<VO>
34-
{
35-
IdP
36-
{
37-
ClientID = "<OIDC‑client‑ID>"
38-
URL = "https://<your‑idp‑instance>/"
39-
}
40-
}
41-
}
42-
}
43-
}
44-
```
26+
```yaml
27+
DiracX
28+
{
29+
CsSync
30+
{
31+
VOs
32+
{
33+
<VO>
34+
{
35+
IdP
36+
{
37+
ClientID = "<OIDC‑client‑ID>"
38+
URL = "https://<your‑idp‑instance>/"
39+
}
40+
}
41+
}
42+
}
43+
}
44+
```
4545
4646
2. To add specific users, list their subject‑IDs under `UserSubjects`:
4747
48-
```yaml
49-
DiracX
50-
{
51-
CsSync
52-
{
53-
VOs
54-
{
55-
<VO>
56-
{
57-
UserSubjects
58-
{
59-
<username from dirac> = <user id from the IdP instance>
60-
...
61-
}
62-
}
63-
}
64-
}
65-
}
66-
```
67-
68-
!!! note
69-
70-
```
48+
```yaml
49+
DiracX
50+
{
51+
CsSync
52+
{
53+
VOs
54+
{
55+
<VO>
56+
{
57+
UserSubjects
58+
{
59+
<username from dirac> = <user id from the IdP instance>
60+
...
61+
}
62+
}
63+
}
64+
}
65+
}
66+
```
67+
68+
!!! note
69+
7170
User IDs are associated to the usernames that are defined in the `Registry > Users` section. This allows DiracX to retrieve the groups they belong to and their properties.
72-
```
7371
7472
After saving, you should sync the configuration with DiracX. Dirac Groups and properties should then be associated to users defined in the `DiracX` section.
7573
See [Convert CS](./convert-cs.md) for next steps.

‎docs/admin/how-to/register-the-admin-vo.md‎

Lines changed: 68 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -12,85 +12,85 @@ We currently support [Indigo IAM](https://indigo-iam.github.io/) and [dex](https
1212

1313
1. Log in to your VO’s IdP instance (e.g. Indigo IAM).
1414
2. Create a new OIDC client with:
15-
- **Client secret**: _none_
16-
- **Redirect URIs**:
17-
```
18-
https://<your‑diracx‑url>/api/auth/authorize/complete
19-
```
20-
- **Grant type**: `authorization_code`
21-
- **Scope**: at minimum `openid`, `profile` and `email`
15+
- **Client secret**: _none_
16+
- **Redirect URIs**:
17+
```
18+
https://<your‑diracx‑url>/api/auth/authorize/complete
19+
```
20+
- **Grant type**: `authorization_code`
21+
- **Scope**: at minimum `openid`, `profile` and `email`
2222
2323
## 2. Configure DiracX
2424
2525
1. In your DIRAC CS, add under `DiracX > CsSync > VOs > <VO> > IdP`:
2626
27-
```yaml
28-
DiracX
29-
{
30-
CsSync
31-
{
32-
VOs
33-
{
34-
diracx_admin
35-
{
36-
IdP
37-
{
38-
ClientID = "<OIDC‑client‑ID>"
39-
URL = "https://<your‑idp‑instance>/"
40-
}
41-
}
42-
}
43-
}
44-
}
45-
```
27+
```yaml
28+
DiracX
29+
{
30+
CsSync
31+
{
32+
VOs
33+
{
34+
diracx_admin
35+
{
36+
IdP
37+
{
38+
ClientID = "<OIDC‑client‑ID>"
39+
URL = "https://<your‑idp‑instance>/"
40+
}
41+
}
42+
}
43+
}
44+
}
45+
```
4646
4747
2. Add an admin group to the `Registry`:
4848
49-
```yaml
50-
Registry
51-
{
52-
Groups
53-
{
54-
diracx_admin
55-
{
56-
Users = <username from dirac>
57-
VO = diracx_admin
58-
Properties = Operator
59-
Properties += FullDelegation
60-
Properties += ProxyManagement
61-
Properties += ServiceAdministrator
62-
Properties += JobAdministrator
63-
Properties += CSAdministrator
64-
Properties += AlarmsManagement
65-
Properties += FileCatalogManagement
66-
Properties += SiteManager
67-
}
68-
}
69-
}
70-
```
49+
```yaml
50+
Registry
51+
{
52+
Groups
53+
{
54+
diracx_admin
55+
{
56+
Users = <username from dirac>
57+
VO = diracx_admin
58+
Properties = Operator
59+
Properties += FullDelegation
60+
Properties += ProxyManagement
61+
Properties += ServiceAdministrator
62+
Properties += JobAdministrator
63+
Properties += CSAdministrator
64+
Properties += AlarmsManagement
65+
Properties += FileCatalogManagement
66+
Properties += SiteManager
67+
}
68+
}
69+
}
70+
```
7171
7272
3. To add specific users, list their subject‑IDs under `UserSubjects`:
7373
74-
```yaml
75-
DiracX
76-
{
77-
CsSync
78-
{
79-
VOs
80-
{
81-
diracx_admin
82-
{
83-
UserSubjects
84-
{
85-
<username from dirac> = <user id from the IdP instance>
86-
...
87-
}
88-
DefaultGroup = diracx_admin
89-
}
90-
}
91-
}
92-
}
93-
```
74+
```yaml
75+
DiracX
76+
{
77+
CsSync
78+
{
79+
VOs
80+
{
81+
diracx_admin
82+
{
83+
UserSubjects
84+
{
85+
<username from dirac> = <user id from the IdP instance>
86+
...
87+
}
88+
DefaultGroup = diracx_admin
89+
}
90+
}
91+
}
92+
}
93+
```
9494
9595
After saving, you should sync the configuration with DiracX.
9696
See [Convert CS](./convert-cs.md) for next steps.

‎docs/admin/index.md‎

Whitespace-only changes.

‎docs/admin/reference/security_model.md‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -6,39 +6,39 @@ Version: v0.9.0
66

77
1. [Introduction](#introduction)
88

9-
- [Terms and Definitions](#terms-and-definitions)
9+
- [Terms and Definitions](#terms-and-definitions)
1010

1111
2. [DiracX Authorisation and Authentication](#diracx-authorisation-and-authentication)
1212

13-
- [User and Group Management](#user-and-group-management)
14-
- [Lifetime](#lifetime)
15-
- [Token Profile](#token-profile)
16-
- [Signature Verification](#signature-verification)
17-
- [Issuance](#issuance)
18-
- [Supported Authorisation Flows](#supported-authorisation-flows)
19-
- [Pilot Jobs](#pilot-jobs)
20-
- [Installation Administrators](#installation-administrators)
13+
- [User and Group Management](#user-and-group-management)
14+
- [Lifetime](#lifetime)
15+
- [Token Profile](#token-profile)
16+
- [Signature Verification](#signature-verification)
17+
- [Issuance](#issuance)
18+
- [Supported Authorisation Flows](#supported-authorisation-flows)
19+
- [Pilot Jobs](#pilot-jobs)
20+
- [Installation Administrators](#installation-administrators)
2121

2222
3. [External Authorization and Authentication](#external-authorization-and-authentication)
2323

24-
- [Storage Access](#storage-access)
25-
- [Computing Resources](#computing-resources)
24+
- [Storage Access](#storage-access)
25+
- [Computing Resources](#computing-resources)
2626

2727
4. [Network Communication](#network-communication)
2828

29-
- [Certificate Signing](#certificate-signing)
29+
- [Certificate Signing](#certificate-signing)
3030

3131
5. [Threat Analysis](#threat-analysis)
3232

33-
- [Compromised External IdP](#compromised-external-idp)
34-
- [Compromised Batch Submission System](#compromised-batch-submission-system)
35-
- [Compromised Worker Node](#compromised-worker-node)
36-
- [Compromised Refresh Token](#compromised-refresh-token)
37-
- [Compromised User Identity](#compromised-user-identity)
38-
- [Compromised JWK](#compromised-jwk)
39-
- [Compromised DB](#compromised-db)
40-
- [Compromised Hosts](#compromised-hosts)
41-
- [Malicious Legitimate User](#malicious-legitimate-user)
33+
- [Compromised External IdP](#compromised-external-idp)
34+
- [Compromised Batch Submission System](#compromised-batch-submission-system)
35+
- [Compromised Worker Node](#compromised-worker-node)
36+
- [Compromised Refresh Token](#compromised-refresh-token)
37+
- [Compromised User Identity](#compromised-user-identity)
38+
- [Compromised JWK](#compromised-jwk)
39+
- [Compromised DB](#compromised-db)
40+
- [Compromised Hosts](#compromised-hosts)
41+
- [Malicious Legitimate User](#malicious-legitimate-user)
4242

4343
6. [Legacy Compatibility and Migration](#legacy-compatibility-and-migration)
4444

@@ -275,14 +275,14 @@ In the event of malicious activity, refer to existing procedures in addition to
275275
- v0.1.0 (2023-06-07): Initial draft for internal review.
276276
- v0.2.0 (2023-06-12): Add glossary of common terms.
277277
- v0.3.0 (2023-06-27):
278-
- Define Identity
279-
- Specify token issuer
280-
- Change property to capability
281-
- Add diagram of the role of the external IdP, DiracX and the user
278+
- Define Identity
279+
- Specify token issuer
280+
- Change property to capability
281+
- Add diagram of the role of the external IdP, DiracX and the user
282282
- v0.9.0 (2023-10-11):
283-
- Specify traceability consideration
284-
- Specify reference of the registered claim
285-
- `vo` field in the token may change if it becomes a standard
286-
- Better description of alternative mechanism to issue a token
287-
- Explicit the reason for not needing to issue `id_token`
288-
- Recommend to contact VO admins in case of compromission
283+
- Specify traceability consideration
284+
- Specify reference of the registered claim
285+
- `vo` field in the token may change if it becomes a standard
286+
- Better description of alternative mechanism to issue a token
287+
- Explicit the reason for not needing to issue `id_token`
288+
- Recommend to contact VO admins in case of compromission

0 commit comments

Comments
 (0)