Skip to content

Commit

Permalink
Corrected documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
vrbanecd committed Sep 9, 2024
1 parent 29fe8b2 commit 56c981e
Show file tree
Hide file tree
Showing 3 changed files with 44 additions and 40 deletions.
69 changes: 36 additions & 33 deletions CONFIGURATION.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,14 @@
## Certificates

Both Teapot and StoRM WebDAV servers require `SSL` certificates. Teapot requires
a certificate/key pair for the machine's DNS name to be added to `/var/lib/teapot/webdav`,
the certificate should also be added to the system's trust store. To generate self-signed
certificates for StoRM WebDAV and add them to the trust store, run
`sudo self-signed-cert-gen.sh`.
a certificate/key pair for the machine's DNS name to be added to
`/var/lib/teapot/webdav`. The certificate should also be added to the system's
trust store. To generate self-signed certificates for StoRM WebDAV and add them
to the trust store, run `sudo /usr/share/teapot/self-signed-cert-gen.sh`.

In `teapot.py` line 945, uvicorn hostname needs to be replaced with the machine DNS name,
and paths to the certificate/key pair for that DNS name should be added here.
In `teapot.py` line 945, uvicorn hostname needs to be replaced with the machine
DNS name, and paths to the certificate/key pair for that DNS name should be
added here.

## Storm-webdav configuration

Expand All @@ -20,24 +21,25 @@ Two main pieces of information are required to configure StoRM-WebDAV:

### Storage areas (SA)

Storage areas that are automatically assigned to each user should be defined in the
`storage-areas` file. `storage-areas` file should be manually added to `/etc/teapot/`.
It should contain a list of storage areas and their root paths. The information for
each storage area should be on a single line, separated by a single space. It is used
to automatically create configuration files for users. Here is an example of
`storage-areas` file content:
```
Storage areas that are automatically assigned to each user should be defined in
the `storage-areas` file. `storage-areas` file should be manually added to
`/etc/teapot/`. It should contain a list of storage areas and their root paths.
The information for each storage area should be on a single line, separated by a
single space. It is used to automatically create configuration files for users.
Here is an example of `storage-areas` file content:

```text
default $HOME/interTwin
extra $HOME/interTwin_extra
```

For user-specific storage areas, configuration files must be created manually and
added to `/var/lib/teapot/user-$USER/sa/$SA_NAME.properties`.
Template for this can be found under `/templates/storage_element.properties` in
the repository or `/usr/share/teapot/storage_element.properties` upon installation,
For user-specific storage areas, configuration files must be created manually
and added to `/var/lib/teapot/user-$USER/sa/$SA_NAME.properties`. Template for
this can be found under `/templates/storage_element.properties` in the
repository or `/usr/share/teapot/storage_element.properties` upon installation,
where the information defined in `storage-areas` must be added manually, or you
can follow the principles of the .properties files that are automatically generated
for SA in the `storage-areas` file.
can follow the principles of the .properties files that are automatically
generated for SA in the `storage-areas` file.

For information on how to configure storage-areas, please refer to the
[StoRM WebDAV Guidelines](https://github.com/italiangrid/storm-webdav/blob/master/doc/storage-area-configuration.md).
Expand All @@ -51,33 +53,34 @@ details on authentication to the storage areas, refer to the

To configure the OIDC provider information, make the following changes:

1. Modify the OIDC provider in `/etc/teapot/issuers` by changing the `name`
and `issuer` information.
1. Modify the OIDC provider in `/etc/teapot/issuers` by changing the `name` and
`issuer` information.
2. Modify the OIDC provider in `/usr/share/teapot/storage_authorizations` by
modifying the `iss` information which stands for issuer.
3. Modify the OIDC providers that have access to the storage area by modifying
the `org` information in `/usr/share/teapot/storage_element.properties`.
4. Modify the OIDC provider list in `teapot.py` under `flaat.set_trusted_OP_list`.
4. Modify the OIDC provider list in `teapot.py` under
`flaat.set_trusted_OP_list`.

If no other way for mapping user's local and global identities is provided, the
rudementary way is defined as explained next. The `user-mapping.csv` file is to
be manually added to `/etc/teapot`. It should contain information for mapping local
users' identities to their global identities as provided by the OIDC provider in form
of the subject (`sub`) claim. For each user, the local username and the user's sub
claim from the OIDC provider should be on a single line, separated by a single space.
E.g.:
be manually added to `/etc/teapot`. It should contain information for mapping
local users' identities to their global identities as provided by the OIDC
provider in form of the subject (`sub`) claim. For each user, the local username
and the user's sub claim from the OIDC provider should be on a single line,
separated by a single space. E.g.:

```
```text
user1 subclaim1
user2 subclaim2
```

## System certificates

To run Teapot, OpenSSL certificates may need to be adjusted. To do this please do the
following: In `OPENSSLDIR`, which can be found with `openssl version -d`, create a
symbolic link to the system ca-trust-source by typing
`sudo ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem cert.pem`.
The letsencrypt and geant/sectigo ca-certs may need to be added to the system
To run Teapot, OpenSSL certificates may need to be adjusted. To do this please
do the following: In `OPENSSLDIR`, which can be found with `openssl version -d`,
create a symbolic link to the system ca-trust-source by typing
`sudo ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem cert.pem`. The
letsencrypt and geant/sectigo ca-certs may need to be added to the system
ca-trust-store `/etc/pki/ca-trust/source/anchors`, which is then updated using
`sudo update-ca-trust`.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ Functional tests can be found in `/robot`. To execute them, run `robot teapot-te

## Version

The current version of Teapot is 0.6.0.
The current version of Teapot is 0..0.

## Authors

Expand Down
13 changes: 7 additions & 6 deletions Service_Reference_Card.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,16 @@ start another StoRM-WebDAV server for that user in the same way.

## List of configuration files

All templates for configuration files are located in `/templates`. All
configuration files for each user are automatically generated in
All templates for configuration files are located in `/templates`. Teapot
configuration file can be found in `/etc/teapot/`. All configuration files for
StoRM-WebdDAV for each user are automatically generated in
`/var/lib/teapot/user-$USER/` when user sends its first request. To provide the
necessary information for configuration files and for more details on
configuration files, please refer to [CONFIGURATION.md](https://github.com/interTwin-eu/teapot/blob/main/CONFIGURATION.md).

`teapot.py` must be run as the `teapot` user, with the Python modules listed in
`requirements.txt` and the sudoers permissions defined in the `templates/teapot` file.
Teapot is started by systemd using `teapot.service` file.
Teapot is started by systemd using the `teapot.service` file.

## Log files

Expand All @@ -33,6 +34,6 @@ Teapot listens on port 8081.

## List of cron jobs

If you plan to run the `self-signed-cert-gen.sh` script to generate the self-signed
certificates for StoRM-WebDAV, the script will trigger a cron job to automatically renew
the certificate once a year.
If you run the `self-signed-cert-gen.sh` script to generate the self-signed
certificates for StoRM-WebDAV, the script will trigger a cron job to automatically
renew the certificate once a year.

1 comment on commit 56c981e

@vrbanecd
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Robot Results

✅ Passed ❌ Failed ⏭️ Skipped Total Pass % ⏱️ Duration
32 0 0 32 100 19.120671s

Passed Tests

Name ⏱️ Duration Suite
GET USER1 9.652 s Teapot-Tests
GET USER2 8.531 s Teapot-Tests
GET NO TOKEN 0.010 s Teapot-Tests
GET INVALID TOKEN 0.039 s Teapot-Tests
PUT REQUEST INVALID TOKEN 0.012 s Teapot-Tests
PUT REQUEST NO TOKEN 0.013 s Teapot-Tests
PUT REQUEST USER1 0.127 s Teapot-Tests
PUT REQUEST USER2 0.079 s Teapot-Tests
GET FILE USER1 0.073 s Teapot-Tests
GET FILE USER2 0.060 s Teapot-Tests
GET FILE NO TOKEN 0.009 s Teapot-Tests
GET FILE INVALID TOKEN 0.009 s Teapot-Tests
DELETE REQUEST USER1 0.037 s Teapot-Tests
DELETE REQUEST USER2 0.039 s Teapot-Tests
DELETE REQUEST INVALID TOKEN 0.009 s Teapot-Tests
DELETE REQUEST NO TOKEN 0.009 s Teapot-Tests
GET USER1 EXTRA_AREA 0.039 s Teapot-Tests
GET USER2 EXTRA_AREA 0.040 s Teapot-Tests
GET NO TOKEN EXTRA_AREA 0.011 s Teapot-Tests
GET INVALID TOKEN EXTRA_AREA 0.010 s Teapot-Tests
PUT REQUEST INVALID TOKEN EXTRA_AREA 0.009 s Teapot-Tests
PUT REQUEST NO TOKEN EXTRA_AREA 0.009 s Teapot-Tests
PUT REQUEST USER1 EXTRA_AREA 0.039 s Teapot-Tests
PUT REQUEST USER2 EXTRA_AREA 0.036 s Teapot-Tests
GET FILE USER1 EXTRA_AREA 0.054 s Teapot-Tests
GET FILE USER2 EXTRA_AREA 0.055 s Teapot-Tests
GET FILE NO TOKEN EXTRA_AREA 0.010 s Teapot-Tests
GET FILE INVALID TOKEN EXTRA_AREA 0.009 s Teapot-Tests
DELETE REQUEST USER1 EXTRA_AREA 0.036 s Teapot-Tests
DELETE REQUEST USER2 EXTRA_AREA 0.039 s Teapot-Tests
DELETE REQUEST INVALID TOKEN EXTRA_AREA 0.010 s Teapot-Tests
DELETE REQUEST NO TOKEN EXTRA_AREA 0.009 s Teapot-Tests

Please sign in to comment.