View source for User Interface (UI) to support approved VOs

== Introduction ==

The basic way for users to submit jobs to the grid is via a User Interface (UI) system. This document describes an efficent way to set up a UI in the first place,
using a tool called instantUI.sh. It is distributed with VomsSnooper, which is described here:  https://www.gridpp.ac.uk/wiki/VomsSnooper_Tools . 

Notes: 
* Some brief instructions follow. For more details, see the VomsSnooper documentation.
* Mark Slater wrote a manual procedure, [[Installing a UI for Grid Submission]], which this document is based on.
* A good overview of the grid account set up process is avaliable in: https://edms.cern.ch/file/722398/1.4/gLite-3-UserGuide.pdf‎
* Tom Whyntie has written a guide to using instantUI on a CERN SLC6 VM [[Using instantUI on a CERN SLC6 VM|here]].
* This procedure assumes use of the root account except where noted.

In brief, to host a User Interface (UI), you need to set up a standard Linux system using SL6 or a similar (such as RHEL6). Each grid user needs to have a user account on the system, and each grid user must be a member of at least one Virtual
Organisation (VO). Prior to joining any VO, a user needs a grid certificate. Here's the run down.

=== User setup ===
* Create the Linux user (adduser johndoe)

* Get a grid certificate for the user

::See the [https://edms.cern.ch/file/722398/1.4/gLite-3-UserGuide.pdf‎ user guide]. Additional advice on acquiring a UK grid certificate is given here:  https://ca.grid-support.ac.uk

* Install the user's certificate

::See the user guide. Once a grid certificate is received for the user, install it as per the instructions here:  https://twiki.cern.ch/twiki/bin/view/LHCb/FAQ/Certificate
::The end result should be a certificate and key in pem format in the user's $HOME/.globus directory.
<pre>
ls -l $HOME/.globus
total 13
-r--r--r-- 1 doe xy 4541 Aug 23 2010 usercert.pem
-r-------- 1 doe xy 963 Aug 23 2010 userkey.pem

ls -ld $HOME/.globus
drwxr-xr-x 6 doe xy 4096 Dec 19 10:18 /home/doe/.globus

</pre>


* Use the grid certificate to join a VO

::Once users have a grid certificate, they can join a VO. Advice on joining an example VO, dteam, is given here: https://wiki.egi.eu/wiki/Dteam_vo . However, each VO will have its own membership process. Home pages for most of the Approved VOs is available here: [[GridPP_approved_VOs]].

== RPM Install with root Access ==

* Make sure the current EPEL, EMI and trust-anchor repos are installed. The example below shows specific releases, but these may/will change over time. You may find newer versions by browsing the directories.

<pre>
cd /tmp
wget http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum localinstall epel-release-6-8.noarch.rpm

wget http://emisoft.web.cern.ch/emisoft/dist/EMI/3/sl6/x86_64/base/emi-release-3.0.0-2.el6.noarch.rpm
yum localinstall emi-release-3.0.0-2.el6.noarch.rpm

wget http://repository.egi.eu/sw/production/cas/1/current/repo-files/EGI-trustanchors.repo
mv EGI-trustanchors.repo /etc/yum.repos.d/

yum clean all
</pre>



* Install some required packages:
<pre>
yum update lcg-CA 
  <or>
yum install lcg-CA 
</pre>

<pre>
yum install yum-priorities yum-protectbase
</pre>

* Install the EMI UI package

<pre>
yum install emi-ui
</pre>

* Setup for and install the VomsSnooper package

Make a new file called /etc/yum.repos.d/sysadmin.hep.ac.uk.repo

<pre>
vi /etc/yum.repos.d/sysadmin.hep.ac.uk.repo
</pre>

and add this content:

<pre>
[sysadmin.hep.ac.uk]
name=sysadmin.hep.ac.uk
baseurl=http://www.sysadmin.hep.ac.uk/rpms/fabric-management/RPMS.vomstools/
enabled=1
gpgcheck=0
priority=100
</pre>

Install VomsSnooper:

<pre>
yum install VomsSnooper
</pre>

== Configure the UI ==

As root,
<pre>
# cd /opt/GridDevel/vomssnooper/usecases/instantUI/
</pre>


Run the ./instantUI.sh script.
<pre>
# ./instantUI.sh
</pre>

If you give it no options, it sets up the UI to use all the VOs that are approved for use at the time of writing. You can also give specific VOs as options, e.g.

<pre>
# ./installUI.sh zeus t2k.org
</pre>

In this case, the UI will only support zeus and t2k.org.

Note: Any VO must be present in the Operations Portal:  http://operations-portal.egi.eu/

=== Test Steps ===

A brief test is provided. Follow these steps to use it. The test assume you are a member of dteam.

Switch user from root to the grid user, e.g.
<pre>
# su - sjones
</pre>

Make a test directory
<pre>
# mkdir tmptest; cd tmptest
</pre>

Make a proxy
<pre>
voms-proxy-init --voms dteam
</pre>

Edit a file called hello.jdl with this content.

<pre>
VirtualOrganisation = "dteam";
MyProxyServer = "myproxy.cern.ch";
DataAccessProtocol = {
"gsiftp"
};
ShallowRetryCount = 3;
AllowZippedISB = false;
RetryCount = 0;

JobType = "NORMAL";

Executable = "/bin/echo";
Arguments = "HELLO";
StdOutput = "hello.out";
StdError = "hello.err";
##InputSandbox = {""};
OutputSandbox = {"hello.out","hello.err"};
</pre>

Now you can run and check your job.
<pre>
glite-wms-job-submit -a hello.jdl 
glite-wms-job-status https://....
</pre>

== Ongoing maintenance ==

The VOMS records within the Operations Portal are occasionally edited by VO managers. It's
therefore necessary to keep abreast of changes to VOs that concern you and to amend the
configuration as necessary.

To reconfigure the UI, it is necessary to re-run the instantUI.sh script. As root:
<pre>
# cd /opt/GridDevel/vomssnooper/usecases/instantUI/
</pre>

Run the ./installUI.sh script.
<pre>
# ./installUI.sh
</pre>



'''For more info, please contact Steve Jones (sjones@NONONESPAMnoneATALL.hep.ph.liv.ac.uk)'''

END OF DOCUMENT