Skip to content
Snippets Groups Projects
Commit 2baccc4a authored by lcappelli's avatar lcappelli
Browse files

Improve the main README

parent 44911b88
No related branches found
No related tags found
1 merge request!23Use nginx with njs instead of openresty with lua
Pipeline #92167 passed
# ngx_http_voms_module
# `ngx_http_voms_module`
[![pipeline status](https://baltig.infn.it/storm2/ngx_http_voms_module/badges/master/pipeline.svg)](https://baltig.infn.it/storm2/ngx_http_voms_module/commits/master)
## Description
*ngx_http_voms_module* is a module for the [Nginx web server](https://www.nginx.org/) that enables client-side authentication based on X.509 proxy certificates augmented with VOMS Attribute Certificates, typically obtained from a [Virtual Organization Membership Service](https://italiangrid.github.io/voms/) (VOMS) server.
`ngx_http_voms_module` is a module for the [Nginx web server](https://www.nginx.org/) that enables client-side authentication based on X.509 proxy certificates augmented with VOMS Attribute Certificates, typically obtained from a [Virtual Organization Membership Service](https://italiangrid.github.io/voms/) (VOMS) server.
The module defines a set of [*embedded* variables](#embedded-variables), whose values are extracted from the first Attribute Certificate found in the certificate chain.
The module defines a set of [*embedded* variables](###embedded-variables), whose values are extracted from the first Attribute Certificate found in the certificate chain.
## Installation
The generic installation instructions are:
```shell
$ cd nginx-x.y.z
$ ./configure --add-module=/path/to/ngx_http_voms_module
$ make && make install
```
The module is written in C++, using features from C++14 that are supported by gcc v. 4.8.5 (the version available in CentOS 7) enabling the option `-std=c++1y` (see [`config.make`](config.make)).
A Docker image is available for use in the context of the StoRM2 project, where the OpenResty distribution is used:
```shell
$ docker run --rm -it -v /path/to/ngx_http_voms_module:/home/build/ngx_http_voms_module storm2/ngx-voms-build
$ cd openresty-x.y.z
$ ./configure ${RESTY_CONFIG_OPTIONS} --add-module=../ngx_http_voms_module
$ make && make install
```
## Embedded Variables
### Embedded Variables
The module makes the following embedded variables available for use in an Nginx configuration file:
### voms_user
#### voms_user
The Subject of the End-Entity certificate, used to sign the proxy.
_Example_: ``/C=IT/O=IGI/CN=test0``
### ssl_client_ee_s_dn
#### ssl_client_ee_s_dn
Like `voms_user`, the Subject of the End-Entity certificate. Unlike `voms_user`, it is available even for non-VOMS proxies and is formatted according to RFC 2253.
_Example_: `CN=test0,O=IGI,C=IT`
### voms_user_ca
#### voms_user_ca
The Issuer (Certificate Authority) of the End-Entity certificate.
_Example_: `/C=IT/O=IGI/CN=Test CA`
### ssl_client_ee_i_dn
#### ssl_client_ee_i_dn
Like `voms_user_ca`, the Issuer of the End-Entity certificate. Unlike `voms_user_ca`, it is available even for non-VOMS proxies and is formatted according to RFC 2253.
_Example_: `CN=Test CA,O=IGI,C=IT`
### voms_fqans
#### voms_fqans
A comma-separated list of Fully Qualified Attribute Names. See [The VOMS Attribute Certificate Format](http://ogf.org/documents/GFD.182.pdf) for more details.
_Example_: `/test.vo/exp1,/test.vo/exp2,/test.vo/exp3/Role=PIPPO`
### voms_server
#### voms_server
The Subject of the VOMS server certificate, used to sign the Attribute Certificate.
_Example_: `/C=IT/O=IGI/CN=voms.example`
### voms_server_ca
#### voms_server_ca
The Issuer (Certificate Authority) of the VOMS server certificate.
_Example_: `/C=IT/O=IGI/CN=Test CA`
### voms_vo
#### voms_vo
The name of the Virtual Organization (VO) to which the End Entity belongs.
_Example_: `test.vo`
### voms_server_uri
#### voms_server_uri
The hostname and port of the VOMS network service that issued the Attribute Certificate, in the form _hostname_ :_port_.
_Example_: `voms.example:15000`
### voms_not_before
#### voms_not_before
The date before which the Attribute Certificate is not yet valid, in the form _YYYYMMDDhhmmss_ `Z`.
_Example_: `20180101000000Z`
### voms_not_after
#### voms_not_after
The date after which the Attribute Certificate is not valid anymore, in the form _YYYYMMDDhhmmss_ `Z`.
_Example_: `20180101120000Z`
### voms_generic_attributes
#### voms_generic_attributes
A comma-separated list of attributes, each defined by three properties and formatted as `n=`_name_ `v=`_value_ `q=`_qualifier_. The qualifier typically coincides with the name of the VO.
_Example_: `n=nickname v=newland q=test.vo,n=nickname v=giaco q=test.vo`
### voms_serial
#### voms_serial
The serial number of the Attribute Certificate in hexadecimal format.
_Example_: `7B`
## Installation
### prerequisites
The module is written in C++, using features from C++14 that are supported by gcc v. 4.8.5 (the version available in CentOS 7) enabling the option `-std=c++1y` (see [`config.make`](config.make)).
The software dependecies are listed in the [provide-deps](docker/library-scripts/provide-deps.sh) script in the `docker` directory.
The nginx source files are also needed. To download them in ```/tmp/nginx-x.y.z``` you can execute:
```
$ ngxVersion=<version>
$ wget -O /tmp/nginx-$ngxVersion.tar.gz https://nginx.org/download/nginx-$ngxVersion.tar.gz
$ cd /tmp && tar -xzvf /tmp/nginx-$ngxVersion.tar.gz && cd -
```
### Generic installation
The generic installation instructions are:
```shell
$ cd /tmp/nginx-x.y.z
$ ./configure --add-module=/path/to/ngx_http_voms_module
$ make && make install
```
### Docker container
A Docker image with nginx and the `ngx_http_voms_module` is available, you can find it [here](https://hub.docker.com/r/storm2/openresty-voms).
### For the developers
A [.devcontainer](.devcontainer) is provided for the developers with all the instructions on how to use it, how to build the rpm module and how to install it.
## Testing
Setup and files to test the *ngx_http_voms_module* are contained in the [`t`](t) folder.
Setup and files to test the `ngx_http_voms_module` are contained in the [`t`](t) folder.
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment