Skip to content

Commit a2db522

Browse files
authored
adding dcache-view elease notes
1 parent eb033d5 commit a2db522

1 file changed

Lines changed: 73 additions & 0 deletions

File tree

release-notes-12.0

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,79 @@ The SRM server and SRM client are excluded from the project build and test proce
129129

130130
Respond with the `Retry-After` HTTP header when the client hits the rate limit.
131131

132+
133+
### dCache-view
134+
135+
This release adds **OIDC Authorization Code Flow** support to the dcache-view web interface.
136+
137+
Users can now log in to dcache-view using their institutional identity via for example **Keycloak (Helmholtz AAI)**.
138+
139+
---
140+
141+
142+
## Configuration Changes
143+
144+
### 1. `etc/dcache.conf` — Frontend OIDC Settings
145+
146+
Add or verify the following properties:
147+
148+
```properties
149+
# OIDC client credentials
150+
frontend.authn.oidc.client-id=1234
151+
frontend.authn.oidc.client-secret=OSwvvbbF26vioqGkeKVXy4IV7QHFbmUv
152+
frontend.authn.oidc.token-url=https://keycloak.desy.de/auth/realms/dcache-dev/protocol/openid-connect/token
153+
154+
# dcache-view UI settings
155+
frontend.static!dcache-view.endpoints.webdav=https://localhost:2881/
156+
frontend.static!dcache-view.oidc-authz-endpoint-list=https://keycloak.desy.de/auth/realms/dcache-dev/protocol/openid-connect/auth
157+
frontend.static!dcache-view.oidc-client-id-list=1234
158+
frontend.static!dcache-view.oidc-provider-name-list=Helmholtz%20AAI(Keycloak)
159+
frontend.static!dcache-view.oidc-authz-redirect-url=https://localhost:3881/api/v1/auth/callback
160+
frontend.static!dcache-view.oidc-authz-endpoint-extra=-
161+
162+
```
163+
164+
---
165+
166+
### 2. `etc/gplazma.conf` — gPlazma Authentication Stack
167+
168+
Ensure the following plugins are configured in the correct stages:
169+
170+
```
171+
# Auth stage — verify OIDC token
172+
auth optional oidc
173+
174+
# Map stage — resolve identity to local user
175+
map optional multimap gplazma.multimap.file=/pathtodcache/dcache/packages/system-test/target/dcache/etc/multimap-id-to-username.conf
176+
177+
```
178+
179+
180+
---
181+
182+
### 3. `etc/multimap-id-to-username.conf` — Identity Mappings
183+
184+
Map OIDC subject identifiers to local usernames and Unix attributes:
185+
186+
```
187+
# Keycloak identity
188+
oidc:47055fee-1@keycloak username:usernameoidc uid:1000 gid:1000,true
189+
190+
191+
---
192+
193+
### 4. `etc/grid-security/storage-authzdb` — Authorization
194+
195+
Verify the file starts with `version 2.1` and contains the following entries:
196+
197+
```
198+
version 2.1
199+
200+
authorize username:usernameoidc read-write 1000 1000 / /
201+
```
202+
203+
---
204+
132205
### Xrootd
133206

134207
### Zookeeper

0 commit comments

Comments
 (0)