Difference: SWGuideLcgAccess (1 vs. 46)

Revision 462019-08-25 - KarriFolanDiPetrillo

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 9 to 9
  Three things are needed to have access to WLCG:
Changed:
<
<
  1. an account on a User Interface (any machine with the WLCG commands installed).
  2. a personal certificate, used to authenticate with the Grid;
  3. having your personal certificate registered in the CMS Virtual Organisation;
>
>
  1. an account on a User Interface (any machine with the WLCG commands installed).
  2. a personal certificate, used to authenticate with the Grid;
  3. having your personal certificate registered in the CMS Virtual Organisation;
  These steps are here explained in detail.
Line: 28 to 28
 

Getting an account on a User Interface

A machine with the WLCG commands installed is, by definition, a User Interface (UI). Many institutes have local UIs; at CERN the needed commands are installed as part of the operating system on LXPLUS6, if you use an SL5 machine at CERN you can source the one of these script (pick according to your login shell):

Changed:
<
<
/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.csh   (tcsh)

>
>
/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.csh   (tcsh)

 /afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.sh (bash)
Line: 39 to 37
  A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options, ordered from most preferred to least preferred:
Changed:
<
<
  1. request a certificate from the CERN CA if you have a CERN NICE/lxplus account (instructions here);
  2. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
  3. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE/lxplus account.
>
>
  1. request a certificate from the CERN CA if you have a CERN NICE/lxplus account ( instructions here);
  2. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
  3. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE/lxplus account.
 Special note for German collaborators: If you are a member of a German CMS institution, they require you to use a certificate from the German CA. You can contact your local institution for more details.
Deleted:
<
<
 

How to register in the CMS VO

Changed:
<
<
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources.
>
>
When in possession of a personal certificate, a CMS user has to register his or her certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources.
  Needed steps are:
  1. Make sure you are registered at CERN as a CMS member (VOMS will check it) in CERN's Human Rescource Data Base.
Line: 129 to 124
 

CERN Human Resources registration

To check if you are already registered, follow these steps:

Changed:
<
<
  1. go to http://graybook.cern.ch/ExperimentSearch.html;
  2. select CMS as experiment, enter your family name and click search;
  3. if you find yourself, then you are already registered; otherwise, you need to register;
  4. if the generic e-mail and the physical e-mail are all none, please write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be added to the Graybook and to the CERN phonebook; The registration to the CMS VO cannot proceed until this is done.
>
>
  1. go to http://graybook.cern.ch/ExperimentSearch.html;
  2. select CMS as experiment, enter your family name and click search;
  3. if you find yourself, then you are already registered; otherwise, you need to register;
  4. if the generic e-mail and the physical e-mail are all none, please write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be added to the Graybook and to the CERN phonebook; The registration to the CMS VO cannot proceed until this is done.
  To register in the CERN HR database:
Changed:
<
<
  1. complete this web pre-registration form;
  2. you will then be contacted by the CMS secretariat (cms.people at cern.ch) to fill in the CMS registration form.
>
>
  1. complete this web pre-registration form;
  2. you will then be contacted by the CMS secretariat (cms.people at cern.ch) to fill in the CMS registration form.
  You will be contacted by the CMS secretariat to confirm your registration.
Line: 150 to 144
 If you try that and get an error message that you do not understand, and if you are sure that you have properly followed the VOMS registration procedure, the following are possible reasons:

If you are getting an authorisation error when using WLCG commands, the cause can be one among many:

Changed:
<
<
  1. your proxy certificate has expired;
  2. your personal certificate has expired;
  3. you have renewed your certificate but you are still using your OLD private key;
  4. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
>
>
  1. your proxy certificate has expired;
  2. your personal certificate has expired;
  3. you have renewed your certificate but you are still using your OLD private key;
  4. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
  You should be able to easily detect and solve those. If there is any problem with your data in the CERN HR database, contact CERN User Office.

Revision 452018-09-14 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 85 to 85
 
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  3. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instructions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
Changed:
<
<
  1. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following *Note that registration service was moved to a new one in March 2015 - Some functionality is different from the past.
>
>
  1. go to the CMS VOMS-admin server, and follow the instructions
 
  1. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
Added:
>
>
  1. if you have problems contacting the VOMS registration web server with your browser, you can find hints and solution to common problems in https://twiki.cern.ch/twiki/bin/view/CMSPublic/SWGuideVomsFAQ
 

Revision 442016-12-12 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 51 to 51
 When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources.

Needed steps are:

Changed:
<
<
  1. Make sure you are registered at CERN as a CMS member (VOMS will check it) by verifying that you appear in CERN's phonebook and that CMS is indicated as your experiment in there
>
>
  1. Make sure you are registered at CERN as a CMS member (VOMS will check it) in CERN's Human Rescource Data Base.
    • Most users can simply verify that they appear in CERN's phonebook and that CMS is indicated as main experiment in there. But there are a few cases in which CERN will not list you in the phonebook even if everything is OK, in this case you want to be sure that both CMS Secreatariat and CERN User's Office have acknowledged your registration.
 
  1. Make sure your web browser is ready and your personal certificate is in it (best it to make sure that it is the only personal certificate).
    • Remember that if you change browser (or computer) it is up to you to import your certificate from one browser to another
    • Registration can only done using your web browser. All major modern browsers should work, but if possible we recommend using Firefox as it is the most tested one.

Revision 432016-11-05 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 53 to 53
 Needed steps are:
  1. Make sure you are registered at CERN as a CMS member (VOMS will check it) by verifying that you appear in CERN's phonebook and that CMS is indicated as your experiment in there
  2. Make sure your web browser is ready and your personal certificate is in it (best it to make sure that it is the only personal certificate).
Added:
>
>
    • Remember that if you change browser (or computer) it is up to you to import your certificate from one browser to another
 
    • Registration can only done using your web browser. All major modern browsers should work, but if possible we recommend using Firefox as it is the most tested one.
    • Most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of previous steps, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your national CA if needed) and then load it into your browser (instructions are different for each browser and can be found e.g. via google).
  1. Click here to reach the VOMSAdmin server and submit the registration form

Revision 422016-10-23 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 149 to 149
 If you are getting an authorisation error when using WLCG commands, the cause can be one among many:
  1. your proxy certificate has expired;
  2. your personal certificate has expired;
Changed:
<
<
  1. the certificate of your CA has expired;
  2. the Certificate Revocation List of your CA has expired;
  3. you have renewed your certificate but you are still using your OLD private key;
  4. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.

You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support (GGUS).

>
>
  1. you have renewed your certificate but you are still using your OLD private key;
  2. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
 
Added:
>
>
You should be able to easily detect and solve those.
 If there is any problem with your data in the CERN HR database, contact CERN User Office.
Changed:
<
<
For problems, contact the CMS Computing Support (CMS.Computing@cernNOSPAMPLEASE.ch).
>
>
If you really have a problem that you can not solve yourself, contact the CMS Computing Support (hn-cms-computing-tools@cernNOSPAMPLEASE.ch)
 
Added:
>
>

StefanoBelforte - 2016-10-23 - streamline Troubleshooting section and point to HN for help
 
StefanoBelforte - 2015-12-18 - simplify VO registration part and point to new VOMSAdmin host
StefanoBelforte - 2015-11-10 - point to CERN User Office for Human Resource DB problems
AndreasPfeiffer - 2015-03-03 - updated links to new VOMS service

Revision 412016-04-21 - FabioMartinelli

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 90 to 90
 
  1. Most CMS user should not select any group nor role, but some national organization have specific rules (below), user can contact directly their institution for doubts:
User from should select group and role
Added:
>
>
Switzerland /cms/chcms None
 
US-CMS /cms/uscms None
Germany /cms/dcms None
Italy /cms/itcms None

Revision 402015-12-22 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 55 to 55
 
  1. Make sure your web browser is ready and your personal certificate is in it (best it to make sure that it is the only personal certificate).
    • Registration can only done using your web browser. All major modern browsers should work, but if possible we recommend using Firefox as it is the most tested one.
    • Most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of previous steps, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your national CA if needed) and then load it into your browser (instructions are different for each browser and can be found e.g. via google).
Changed:
<
<
  1. Click here and submit the registration form
>
>
  1. Click here to reach the VOMSAdmin server and submit the registration form
    • Documentation on the VOMSAdmin web page(s) is available here
 
  1. After submitting the form, you will get a confirmation email that contains a link that you need to click to confirm your registration. Find the link and click it.
  2. Now, you need to wait for final confirmation that will be done by the VO administrators, wait up to a day especially on weekends
  3. When they confirm your registration request, you will get a notification email
Line: 70 to 71
 
  1. When they confirm your registration request, you will get a notification email
  2. Finally, you can sign up the AUP. Please click here to see the page
Changed:
<
<

If you never registered to the CMS VO

>
>
#---+++ If you never registered to the CMS VO
  First of all, make sure that you are registered in the CERN Human Resources database with an e-mail address.
Line: 96 to 97
 
Belgium /cms/becms None
Taiwan /cms/twcms None
Changed:
<
<

If you are already registered in the CMS VO with a different certificate

>
>
#---+++ If you are already registered in the CMS VO with a different certificate
  If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
Changed:
<
<

Note for users of CERN CA

>
>
#---+++ Note for users of CERN CA
 
You should make sure you use a certificate from the new (in 2014) CERN Grid CA. In some cases you may have problems due to conflict with a possible pre-existing certificate of your from old CERN CA, in that case read : CERNGridCertificateIssues

-->

Revision 392015-12-18 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 17 to 17
  Note: BEFORE you do any of the following steps, it is necessary to load the root CA certificate and any intermediate CA certificates into the trust store used by your browser so that it will know about the certificates used to secure the hosts and services -- for example, VOM(R)S -- in the remaining steps. DO NOT PROCEED without doing this for the CAs that apply to your region and to the service.
Changed:
<
<
The easiest way to load these CA certificates is to visit the Terena Academic Certificate Authorities Repository at https://www.tacar.org/ and click on the link labeled "Certificates" and then download and install the CA certificates for (at minimum) the CERN Root and Intermediate CAs, and also those of the CA that will be issuing your personal certificate as described below. Note that some CAs require both root and intermediate CA files to be downloaded, and in some cases these are not named in an obvious way. For example, to use DOEGrids as a CA, you also have to download and install the ESNet Root CA file.
>
>
The easiest way to load these CA certificates is to visit the Terena Academic Certificate Authorities Repository at https://www.tacar.org/ and click on the link labeled "Certificates" and then download and install the CA certificates for (at minimum) the CERN Root and Intermediate CAs, and also those of the CA that will be issuing your personal certificate as described below. Note that some CAs require both root and intermediate CA files to be downloaded, and in some cases these are not named in an obvious way.
  In most browsers, this can be handled by just clicking on the "Install" link and following the instructions to grant trust in these files. Alternatively, you can use the check-boxes to select several and then download them as a bundle using the pull-down menu at the bottom or the page to select your preferred format.
Line: 42 to 42
 
  1. request a certificate from the CERN CA if you have a CERN NICE/lxplus account (instructions here);
  2. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
  3. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE/lxplus account.
Added:
>
>
Special note for German collaborators: If you are a member of a German CMS institution, they require you to use a certificate from the German CA. You can contact your local institution for more details.
 
Deleted:
<
<
When a personal certificate is renewed, normally the certificate subject is identical to the old one: in that case, nothing has to be done to update the VO registration.
 

How to register in the CMS VO

Changed:
<
<
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not. You need to check whether or not your AUP (VO Acceptable Usage Policy) status is active. Please click here and check it. If your status is not active, please follow these steps:
>
>
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources.

Needed steps are:

  1. Make sure you are registered at CERN as a CMS member (VOMS will check it) by verifying that you appear in CERN's phonebook and that CMS is indicated as your experiment in there
  2. Make sure your web browser is ready and your personal certificate is in it (best it to make sure that it is the only personal certificate).
    • Registration can only done using your web browser. All major modern browsers should work, but if possible we recommend using Firefox as it is the most tested one.
    • Most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of previous steps, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your national CA if needed) and then load it into your browser (instructions are different for each browser and can be found e.g. via google).
  3. Click here and submit the registration form
  4. After submitting the form, you will get a confirmation email that contains a link that you need to click to confirm your registration. Find the link and click it.
  5. Now, you need to wait for final confirmation that will be done by the VO administrators, wait up to a day especially on weekends
  6. When they confirm your registration request, you will get a notification email
  7. Finally, you can sign up the AUP using the link in that mail, or go directly to here
<!--

The procedure is different depending if you are already registered in the CMS VO or not. You need to check whether or not your AUP (VO Acceptable Usage Policy) status is active. Please click here and check it. If your status is not active, please follow these steps:

 
  1. Click here (or find the registration form) and submit it
Added:
>
>
  1. Go
 
  1. After submitting the form, you should get a confirmation email that contains a link that you need to click to confirm your registration. Find the link and click it
  2. Now, you need to wait for final confirmation that will be done by the VO administrators
  3. When they confirm your registration request, you will get a notification email
  4. Finally, you can sign up the AUP. Please click here to see the page
Deleted:
<
<
If you think these steps are not consistent, please contact us.
 

If you never registered to the CMS VO

Line: 86 to 104
 

Note for users of CERN CA

You should make sure you use a certificate from the new (in 2014) CERN Grid CA. In some cases you may have problems due to conflict with a possible pre-existing certificate of your from old CERN CA, in that case read : CERNGridCertificateIssues
Added:
>
>
-->
  1. pick your VOMS groups and roles if needed
    • Most CMS user should not select any group nor role, but some national organization have specific rules (below), user can contact directly their institution for doubts:
User from should select group and role
US-CMS /cms/uscms None
Germany /cms/dcms None
Italy /cms/itcms None
Spain /cms/escms None
Belgium /cms/becms None
Taiwan /cms/twcms None
 

Special instructions for US-CMS users

Line: 130 to 158
  For problems, contact the CMS Computing Support (CMS.Computing@cernNOSPAMPLEASE.ch).
Added:
>
>

StefanoBelforte - 2015-12-18 - simplify VO registration part and point to new VOMSAdmin host
 
StefanoBelforte - 2015-11-10 - point to CERN User Office for Human Resource DB problems
AndreasPfeiffer - 2015-03-03 - updated links to new VOMS service

Revision 382015-11-10 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 126 to 126
  You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support (GGUS).
Changed:
<
<
If there is any problem with your data in the CERN HR database, go to this page.
>
>
If there is any problem with your data in the CERN HR database, contact CERN User Office.
  For problems, contact the CMS Computing Support (CMS.Computing@cernNOSPAMPLEASE.ch).
Changed:
<
<
>
>

StefanoBelforte - 2015-11-10 - point to CERN User Office for Human Resource DB problems
 
AndreasPfeiffer - 2015-03-03 - updated links to new VOMS service \ No newline at end of file

Revision 372015-09-08 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 64 to 64
  Follow these steps:
Changed:
<
<
  1. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  2. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instructions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
  3. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following Note that registration service was moved to a new one in March 2015 - Some functionality might not be there in the geginning, e.g. selection of a country representative:
  4. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
>
>
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  3. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instructions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
  4. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following *Note that registration service was moved to a new one in March 2015 - Some functionality is different from the past.
 
  1. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
Changed:
<
<
  1. if you are an US-CMS member, select Anthony Tiradani as Representative and follow these additional steps;
  2. if you are a German CMS member, select Thomas Kress as Representative;
  3. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  4. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
  5. otherwise, select Andreas Pfeiffer as Representative;
  6. Most CMS user should not select any group nor role, but some national organization have specific rules (below), user can contact directly their institution for doubts:
>
>
  1. Most CMS user should not select any group nor role, but some national organization have specific rules (below), user can contact directly their institution for doubts:
 
User from should select group and role
US-CMS /cms/uscms None
Germany /cms/dcms None

Revision 362015-05-21 - IsidroGonzalezCaballero

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 129 to 129
 
  1. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
Changed:
<
<
You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.
>
>
You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support (GGUS).
  If there is any problem with your data in the CERN HR database, go to this page.

Revision 352015-05-14 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 76 to 76
 
  1. otherwise, select Andreas Pfeiffer as Representative;
  2. Most CMS user should not select any group nor role, but some national organization have specific rules (below), user can contact directly their institution for doubts:
User from should select group and role
Changed:
<
<
US-CMS /cms/uscms cmsuser
>
>
US-CMS /cms/uscms None
 
Germany /cms/dcms None
Italy /cms/itcms None
Spain /cms/escms None
Line: 94 to 94
 

Special instructions for US-CMS users

Changed:
<
<
All members should sign up for the /cms/uscms group. Further, you can select your role in the group from cmsfrontier, cmsphedex, cmsprod, cmssoft, cmst2admin and cmsuser. If you do not know your role, then your default role should be cmsuser. For any question, contact Patrick Gartung (gartung AT fnal.gov) or Anthony Tiradani (tiradani AT fnal.gov).
>
>
All members should sign up for the /cms/uscms group. Further, you can select your role in the group. If you do not know any reason to pick a specific role, do not select any. For any question, contact Anthony Tiradani (tiradani AT fnal.gov).
 

CERN Human Resources registration

Revision 342015-04-02 - ChristophWissing

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 47 to 47
 

How to register in the CMS VO

Changed:
<
<
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not. You need to check whether or not your AUP (VO Acceptable Usage Policy) status is active. Please click here and check it. If your status is not active, please follow these steps:
  1. Click here (or find the registration form) and submit it
>
>
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not. You need to check whether or not your AUP (VO Acceptable Usage Policy) status is active. Please click here and check it. If your status is not active, please follow these steps:
  1. Click here (or find the registration form) and submit it
 
  1. After submitting the form, you should get a confirmation email that contains a link that you need to click to confirm your registration. Find the link and click it
  2. Now, you need to wait for final confirmation that will be done by the VO administrators
  3. When they confirm your registration request, you will get a notification email
Line: 126 to 126
 
  1. the certificate of your CA has expired;
  2. the Certificate Revocation List of your CA has expired;
  3. you have renewed your certificate but you are still using your OLD private key;
Changed:
<
<
  1. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
>
>
  1. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
 

You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.

Revision 332015-03-18 - AliMehmetAltundag

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 47 to 47
 

How to register in the CMS VO

Changed:
<
<
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not.
>
>
When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not. You need to check whether or not your AUP (VO Acceptable Usage Policy) status is active. Please click here and check it. If your status is not active, please follow these steps:
  1. Click here (or find the registration form) and submit it
  2. After submitting the form, you should get a confirmation email that contains a link that you need to click to confirm your registration. Find the link and click it
  3. Now, you need to wait for final confirmation that will be done by the VO administrators
  4. When they confirm your registration request, you will get a notification email
  5. Finally, you can sign up the AUP. Please click here to see the page
If you think these steps are not consistent, please contact us.
 

If you never registered to the CMS VO

Revision 322015-03-06 - AndreasPfeiffer

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 60 to 60
 
  1. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  2. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instructions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
Changed:
<
<
  1. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following Note that registration service was moved to a new one in March 2015 - Some functionality might not be there in the geginning, e.g. selection of a country representative:
>
>
  1. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following Note that registration service was moved to a new one in March 2015 - Some functionality might not be there in the geginning, e.g. selection of a country representative:
 
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
  3. if you are an US-CMS member, select Anthony Tiradani as Representative and follow these additional steps;

Revision 312015-03-04 - ChristophWissing

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 59 to 59
 Follow these steps:

  1. obtain a personal certificate, if you have not done so, using the procedure indicated above;
Changed:
<
<
  1. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instuctions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
  2. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following;
>
>
  1. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instructions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
  2. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following Note that registration service was moved to a new one in March 2015 - Some functionality might not be there in the geginning, e.g. selection of a country representative:
 
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
  3. if you are an US-CMS member, select Anthony Tiradani as Representative and follow these additional steps;

Revision 302015-03-03 - ChristophWissing

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 53 to 53
  First of all, make sure that you are registered in the CERN Human Resources database with an e-mail address.
Changed:
<
<
Please do NOT use Safari to connect to the CMS VOMRS server below, use a recent version of Firefox or Chrome instead.
>
>
Please do NOT use Safari to connect to the CMS VOMS-admin server below, use a recent version of Firefox or Chrome instead.
 Safari will just give you an error page - the problem is known to Apple since a long time, but so far not resolved.

Follow these steps:

  1. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  2. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instuctions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
Changed:
<
<
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
>
>
  1. go to the CMS VOMS-admin server, and follow the instructions, taking into account the following;
 
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
  3. if you are an US-CMS member, select Anthony Tiradani as Representative and follow these additional steps;

Revision 292015-03-03 - AndreasPfeiffer

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 60 to 60
 
  1. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  2. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instuctions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
Changed:
<
<
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
>
>
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
 
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
  3. if you are an US-CMS member, select Anthony Tiradani as Representative and follow these additional steps;
Line: 120 to 120
 
  1. the certificate of your CA has expired;
  2. the Certificate Revocation List of your CA has expired;
  3. you have renewed your certificate but you are still using your OLD private key;
Changed:
<
<
  1. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
>
>
  1. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
 

You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.

Line: 128 to 128
 If there is any problem with your data in the CERN HR database, go to this page.

For problems, contact the CMS Computing Support (CMS.Computing@cernNOSPAMPLEASE.ch). \ No newline at end of file

Added:
>
>


AndreasPfeiffer - 2015-03-03 - updated links to new VOMS service

Revision 282014-09-29 - AndreasPfeiffer

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 81 to 81
  If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
Deleted:
<
<

Solutions to common problems

You can find in this page tips and hints for common problems when trying to obtain or renew your CMS VO membership

 

Note for users of CERN CA

You should make sure you use a certificate from the new (in 2014) CERN Grid CA. In some cases you may have problems due to conflict with a possible pre-existing certificate of your from old CERN CA, in that case read : CERNGridCertificateIssues
Line: 110 to 106
 You will be contacted by the CMS secretariat to confirm your registration.
Added:
>
>

Troubleshooting -- Solutions to common problems

 
Changed:
<
<

Troubleshooting

See also SWGuideLcgAccess#Solutions_to_common_problems above in this page

>
>
You can find in this page tips and hints for common problems when trying to obtain or renew your CMS VO membership
  You can find here hints on how to verify that your grid certificate is working.

Revision 272014-09-20 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 77 to 77
 
Belgium /cms/becms None
Taiwan /cms/twcms None
Changed:
<
<

If are already registered in the CMS VO with a different certificate

>
>

If you are already registered in the CMS VO with a different certificate

  If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
Added:
>
>

Solutions to common problems

You can find in this page tips and hints for common problems when trying to obtain or renew your CMS VO membership

 

Note for users of CERN CA

Changed:
<
<
You should make sure you use a certificate from the new (in 2014) CERN [[][Grid CA]]. In some cases you may have problems due to conflict with a possible pre-existing certificate of your from old CERN CA, in that case read : CERNGridCertificateIssues
>
>
You should make sure you use a certificate from the new (in 2014) CERN Grid CA. In some cases you may have problems due to conflict with a possible pre-existing certificate of your from old CERN CA, in that case read : CERNGridCertificateIssues
 

Special instructions for US-CMS users

Line: 108 to 113
 

Troubleshooting

Added:
>
>
See also SWGuideLcgAccess#Solutions_to_common_problems above in this page

You can find here hints on how to verify that your grid certificate is working.

If you try that and get an error message that you do not understand, and if you are sure that you have properly followed the VOMS registration procedure, the following are possible reasons:

 If you are getting an authorisation error when using WLCG commands, the cause can be one among many:
  1. your proxy certificate has expired;
  2. your personal certificate has expired;
Line: 116 to 127
 
  1. you have renewed your certificate but you are still using your OLD private key;
  2. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
Changed:
<
<
You are not supposed to be able to recognize the nature of the problem (apart from the first two cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.
>
>
You are not supposed to be able to recognize the nature of the problem (apart from the first two and the last cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.
  If there is any problem with your data in the CERN HR database, go to this page.

Revision 262014-09-20 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 27 to 27
 

Getting an account on a User Interface

Changed:
<
<
A machine with the WLCG commands installed is, by definition, a User Interface (UI). Many institutes have local UIs; at CERN you can login to LXPLUS and source the script
>
>
A machine with the WLCG commands installed is, by definition, a User Interface (UI). Many institutes have local UIs; at CERN the needed commands are installed as part of the operating system on LXPLUS6, if you use an SL5 machine at CERN you can source the one of these script (pick according to your login shell):
 
/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.csh (tcsh)

Deleted:
<
<
or

 /afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.sh (bash)
Line: 108 to 105
 You will be contacted by the CMS secretariat to confirm your registration.
Deleted:
<
<

Technical stuff

This is information useful for experts and administrators. Users should not read, nor try to use or follow any of the links in this section, unless they know exactly what they are doing and why.

The URL of the CMS VOMS server is https://voms.cern.ch:8443/voms/cms/.

The latest LCMAPS configuration in LCG is here.

 

Troubleshooting

Revision 252014-09-19 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 70 to 70
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
Changed:
<
<
  1. otherwise, select Stefano Belforte or Andreas Pfeiffer as Representative;
  2. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.

Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Spanish CMS members Taiwanese CMS members
/cms no role All CMS users Y Y Y Y Y Y
cmsuser Normal user in OSG Y Y Y Y Y Y
lcgadmin To install CMS software on WLCG N N N N N N
production MC production in WLCG N N N N N N
/cms/production no role For testing only (obsolete) N N N N N N
high_prio For high priority productions N N N N N N
/cms/analysis no role For testing only (obsolete) N N N N N N
/cms/CMS.HeavyIons no role For Heavy Ions studies N N N N N N
/cms/Higgs no role For Higgs studies N N N N N N
/cms/StandardModel no role For SM studies N N N N N N
/cms/Susy no role For SUSY studies N N N N N N
/cms/uscms no role OSG CMS users N Y N N N N
cmsfrontier Frontier ops N N N N N N
cmsphedex PhEDEx ops in OSG N N N N N N
cmsprod MC production in OSG N N N N N N
cmssoft To install CMS software on OSG N N N N N N
cmsuser Normal user in OSG N Y N N N N
/cms/dcms no role German user N N Y N N N
/cms/itcms no role Italian user N N N Y N N
/cms/escms no role Spanish user N N N N Y N
/cms/twcms no role Taiwanese user N N N N N Y
>
>
  1. otherwise, select Andreas Pfeiffer as Representative;
  2. Most CMS user should not select any group nor role, but some national organization have specific rules (below), user can contact directly their institution for doubts:
User from should select group and role
US-CMS /cms/uscms cmsuser
Germany /cms/dcms None
Italy /cms/itcms None
Spain /cms/escms None
Belgium /cms/becms None
Taiwan /cms/twcms None
 

If are already registered in the CMS VO with a different certificate

Revision 242014-08-20 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 36 to 36
 /afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.sh (bash)
Changed:
<
<
To learn how to use the WLCG commands, you should by all means read the gLite 3 User Guide: it explains all the basic concepts, all the commands and it is full of examples. Here it is simply said that to send WLCG commands you must first create a "proxy certificate", valid for 12 hours by default, with the command grid-proxy-init: think of it as a sort of "Grid token", much in the same way you need an AFS token for LXPLUS. For comments or problems with the gLite 3 User Guide, write to support-eis@cernNOSPAMPLEASE.ch.
>
>
 

Getting a personal certificate

Line: 79 to 78
 
cmsuser Normal user in OSG Y Y Y Y Y Y
lcgadmin To install CMS software on WLCG N N N N N N
production MC production in WLCG N N N N N N
Deleted:
<
<
cmst0admin CMS T0 admins N N N N N N
cmst1admin CMS T1 admins N N N N N N
cmst2admin CMS T2 admins N N N N N N
 
/cms/production no role For testing only (obsolete) N N N N N N
high_prio For high priority productions N N N N N N
/cms/analysis no role For testing only (obsolete) N N N N N N
Line: 94 to 90
 
cmsphedex PhEDEx ops in OSG N N N N N N
cmsprod MC production in OSG N N N N N N
cmssoft To install CMS software on OSG N N N N N N
Deleted:
<
<
cmst1admin CMS T1 admins N N N N N N
cmst2admin CMS T2 admins N N N N N N
 
cmsuser Normal user in OSG N Y N N N N
/cms/dcms no role German user N N Y N N N
/cms/itcms no role Italian user N N N Y N N
Line: 106 to 100
  If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
Added:
>
>

Note for users of CERN CA

You should make sure you use a certificate from the new (in 2014) CERN [[][Grid CA]]. In some cases you may have problems due to conflict with a possible pre-existing certificate of your from old CERN CA, in that case read : CERNGridCertificateIssues
 

Special instructions for US-CMS users

Revision 232014-06-25 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 62 to 62
  Follow these steps:
Changed:
<
<
  1. obtain a personal certificate, if you have not done so;
  2. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
>
>
  1. obtain a personal certificate, if you have not done so, using the procedure indicated above;
  2. most CA's give users certificates via web pages, so the certificate is already imported in your browser as part of the previous step, in particular this is the case with CERN certificates. If instead you got your certificate as a file, you need to make sure it is P12 format (contact your natciona CA if needed) and load it into your browser (instuctions are different for each browser and can be found e.g. via google). Make sure you use the very same browser used to request the certificate.
 
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  2. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  3. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;

Revision 222014-06-25 - AndreasPfeiffer

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 57 to 57
  First of all, make sure that you are registered in the CERN Human Resources database with an e-mail address.
Added:
>
>
Please do NOT use Safari to connect to the CMS VOMRS server below, use a recent version of Firefox or Chrome instead. Safari will just give you an error page - the problem is known to Apple since a long time, but so far not resolved.
 Follow these steps:

  1. obtain a personal certificate, if you have not done so;

Revision 212014-04-11 - MarttiPimia

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 64 to 64
 
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  2. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  3. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
Changed:
<
<
  1. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
>
>
  1. if you are an US-CMS member, select Anthony Tiradani as Representative and follow these additional steps;
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;

Revision 202014-04-11 - AndreasPfeiffer

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 68 to 68
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
Changed:
<
<
  1. otherwise, select Martti Pimia as Representative;
>
>
  1. otherwise, select Stefano Belforte or Andreas Pfeiffer as Representative;
 
  1. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.

Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Spanish CMS members Taiwanese CMS members

Revision 192014-02-19 - FabioMartinelli

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 64 to 64
 
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  2. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  3. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
Changed:
<
<
  1. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
  2. if you are a German CMS member, select Thomas Kress as Representative;
  3. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  4. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
  5. otherwise, select Martti Pimia as Representative;
>
>
  1. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
  2. if you are a German CMS member, select Thomas Kress as Representative;
  3. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  4. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
  5. otherwise, select Martti Pimia as Representative;
 
  1. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.

Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Spanish CMS members Taiwanese CMS members

Revision 182013-02-21 - RobSnihur

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 9 to 9
  Three things are needed to have access to WLCG:
Changed:
<
<
  1. a personal certificate, used to authenticate with the Grid;
  2. having your personal certificate registered in the CMS Virtual Organisation;
  3. an account on a User Interface (any machine with the WLCG commands installed).
>
>
  1. an account on a User Interface (any machine with the WLCG commands installed).
  2. a personal certificate, used to authenticate with the Grid;
  3. having your personal certificate registered in the CMS Virtual Organisation;
  These steps are here explained in detail.
Line: 25 to 25
  Note that the proper procedure, regardless of which browser you are using, is NOT just to grant exceptions for each and every site you visit on a case-by-case basis, but instead it is important to use the certificate authority files as described above to set up the proper trust anchor paths for your browser and operating system.
Added:
>
>

Getting an account on a User Interface

A machine with the WLCG commands installed is, by definition, a User Interface (UI). Many institutes have local UIs; at CERN you can login to LXPLUS and source the script

/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.csh (tcsh)
or
/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.sh (bash)

To learn how to use the WLCG commands, you should by all means read the gLite 3 User Guide: it explains all the basic concepts, all the commands and it is full of examples. Here it is simply said that to send WLCG commands you must first create a "proxy certificate", valid for 12 hours by default, with the command grid-proxy-init: think of it as a sort of "Grid token", much in the same way you need an AFS token for LXPLUS. For comments or problems with the gLite 3 User Guide, write to support-eis@cernNOSPAMPLEASE.ch.

 

Getting a personal certificate

A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options, ordered from most preferred to least preferred:

Line: 87 to 101
 

If are already registered in the CMS VO with a different certificate

Changed:
<
<
If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read also these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
>
>
If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
 

Special instructions for US-CMS users

Line: 110 to 124
 You will be contacted by the CMS secretariat to confirm your registration.
Deleted:
<
<

Getting an account on a User Interface

A machine with the WLCG commands installed is, by definition, a User Interface (UI). Many institutes have local UIs; at CERN you can login to LXPLUS and source the script

/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.csh (tcsh)
or
/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.sh (bash)

To learn how to use the WLCG commands, you should by all means read the gLite 3 User Guide: it explains all the basic concepts, all the commands and it is full of examples. Here it is simply said that to send WLCG commands you must first create a "proxy certificate", valid for 12 hours by default, with the command grid-proxy-init: think of it as a sort of "Grid token", much in the same way you need an AFS token for LXPLUS. For comments or problems with the gLite 3 User Guide, write to support-eis@cernNOSPAMPLEASE.ch.

 

Technical stuff

This is information useful for experts and administrators.

Revision 172013-02-20 - RobSnihur

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 27 to 27
 

Getting a personal certificate

Changed:
<
<
A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options:
>
>
A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options, ordered from most preferred to least preferred:
 
Changed:
<
<
  1. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
  2. request a certificate from the CERN CA if you have a CERN NICE/lxplus account (here);
>
>
  1. request a certificate from the CERN CA if you have a CERN NICE/lxplus account (instructions here);
  2. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
 
  1. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE/lxplus account.

When a personal certificate is renewed, normally the certificate subject is identical to the old one: in that case, nothing has to be done to update the VO registration.

Deleted:
<
<

How to get or renew a certificate from the CERN CA

The CERN CA will issue certificates only to people with a CERN NICE/lxplus account and who are registered as CERN users.

The steps to follow to make a request are explained in the CA website. The instructions to convert the certificate in a format appropriate for use in the Grid are here. If you have problems, write to the Helpdesk: Helpdesk@cernNOSPAMPLEASE.ch. The procedure to renew a certificate is identical to the procedure to get a certificate for the first time.

Make sure that the certificate and the private key are installed in $HOME/.globus with the following permissions:

-rw-r--r-- 1 doe zh 4541 Feb 23 17:44 usercert.pem
-r-------- 1 doe zh 963 Feb 22 11:52 userkey.pem

Notice that the private key must be readable only by you, otherwise the certificate will not work (and your private key could be stolen).

 

How to register in the CMS VO

When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not.

Revision 162012-03-16 - MarttiPimia

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 65 to 65
 
  1. obtain a personal certificate, if you have not done so;
  2. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
  3. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
Changed:
<
<
  1. when asked, and if you have an account at CERN, provide the e-mail address which matches exactly the E-mail field in the CERN phonebook; if not, then give the Generic E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
  2. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
  3. if you are a German CMS member, select Thomas Kress as Representative;
  4. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  5. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
  6. otherwise, select Martti Pimia as Representative;
  7. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.
>
>
  1. you should find yourself in the CERN graybook as a CMS member. If not, contact the CMS secretariat (cms.people at cern.ch);
  2. when asked, and if you have an account at CERN, provide your e-mail address to match exactly the E-mail field in the CERN phonebook; if not, then give the E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
  3. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
  4. if you are a German CMS member, select Thomas Kress as Representative;
  5. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  6. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
  7. otherwise, select Martti Pimia as Representative;
  8. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.
 
Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Spanish CMS members Taiwanese CMS members
/cms no role All CMS users Y Y Y Y Y Y
Line: 117 to 118
 
  1. go to http://graybook.cern.ch/ExperimentSearch.html;
  2. select CMS as experiment, enter your family name and click search;
  3. if you find yourself, then you are already registered; otherwise, you need to register;
Changed:
<
<
  1. if the generic e-mail and the physical e-mail are all none, please follow the advice on this page or write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be defined as physical e-mail address. The registration to the CMS VO cannot proceed until this is done.
>
>
  1. if the generic e-mail and the physical e-mail are all none, please write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be added to the Graybook and to the CERN phonebook; The registration to the CMS VO cannot proceed until this is done.
  To register in the CERN HR database:
  1. complete this web pre-registration form;
Changed:
<
<
  1. you will then be contacted by the CMS secretariat (cmspeople@cmsdocNOSPAMPLEASE.cern.ch) to fill in the CMS registration form.
>
>
  1. you will then be contacted by the CMS secretariat (cms.people at cern.ch) to fill in the CMS registration form.
  You will be contacted by the CMS secretariat to confirm your registration.

Revision 152012-03-16 - MarttiPimia

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 65 to 65
 
  1. obtain a personal certificate, if you have not done so;
  2. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
  3. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
Changed:
<
<
  1. when asked, provide an e-mail address which matches the Generic E-mail of the Preferred E-mail fields in the CERN HR database; if you have an account at CERN, choose your CERN e-mail address;
>
>
  1. when asked, and if you have an account at CERN, provide the e-mail address which matches exactly the E-mail field in the CERN phonebook; if not, then give the Generic E-Mail in the CERN graybook; Note that the address you give now will later be used for the communication from the CMS-VO system to you;
 
  1. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
  2. if you are a German CMS member, select Thomas Kress as Representative;
  3. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
Line: 157 to 157
 
  1. your personal certificate has expired;
  2. the certificate of your CA has expired;
  3. the Certificate Revocation List of your CA has expired;
Changed:
<
<
  1. you have renewed your certificate but you are still using your OLD private key.
>
>
  1. you have renewed your certificate but you are still using your OLD private key;
  2. your membership in the CMS-VO has expired, or you have not re-signed the grid usage rules.
  You are not supposed to be able to recognize the nature of the problem (apart from the first two cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.

Revision 142012-03-16 - MarttiPimia

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 30 to 30
 A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options:

  1. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
Changed:
<
<
  1. request a certificate from the CERN CA if you have a CERN NICE account (here);
  2. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE account.
>
>
  1. request a certificate from the CERN CA if you have a CERN NICE/lxplus account (here);
  2. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE/lxplus account.
  When a personal certificate is renewed, normally the certificate subject is identical to the old one: in that case, nothing has to be done to update the VO registration.

How to get or renew a certificate from the CERN CA

Changed:
<
<
The CERN CA will issue certificates only to people with a CERN NICE account.
>
>
The CERN CA will issue certificates only to people with a CERN NICE/lxplus account and who are registered as CERN users.
  The steps to follow to make a request are explained in the CA website. The instructions to convert the certificate in a format appropriate for use in the Grid are here. If you have problems, write to the Helpdesk: Helpdesk@cernNOSPAMPLEASE.ch. The procedure to renew a certificate is identical to the procedure to get a certificate for the first time.

Revision 132012-02-09 - StefanoBelforte

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 142 to 142
 

Technical stuff

Added:
>
>
This is information useful for experts and administrators. Users should not read, nor try to use or follow any of the links in this section, unless they know exactly what they are doing and why.
 The URL of the CMS VOMS server is https://voms.cern.ch:8443/voms/cms/.

The latest LCMAPS configuration in LCG is here.

Revision 122011-11-16 - BurtHolzman

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 66 to 66
 
  1. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
  2. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  3. when asked, provide an e-mail address which matches the Generic E-mail of the Preferred E-mail fields in the CERN HR database; if you have an account at CERN, choose your CERN e-mail address;
Changed:
<
<
  1. if you are an US-CMS member, select Anthony Tiradani or Burt Holzman as Representative and follow these additional steps;
>
>
  1. if you are an US-CMS member, select Anthony Tiradani or Patrick Gartung as Representative and follow these additional steps;
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;

Revision 112011-11-03 - KatiLassilaPerini

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 103 to 103
 

If are already registered in the CMS VO with a different certificate

Changed:
<
<
If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read also these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
>
>
If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read also these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.
 

Special instructions for US-CMS users

Revision 102011-10-12 - AnthonyTiradani

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 108 to 108
 

Special instructions for US-CMS users

Changed:
<
<
All members should sign up for the /cms/uscms group. Further, you can select your role in the group from cmsfrontier, cmsphedex, cmsprod, cmssoft, cmst2admin and cmsuser. If you do not know your role, then your default role should be cmsuser. For any question, contact Anthony Tiradani (tiradani AT fnal.gov) or Burt Holzman (burt AT fnal.gov).
>
>
All members should sign up for the /cms/uscms group. Further, you can select your role in the group from cmsfrontier, cmsphedex, cmsprod, cmssoft, cmst2admin and cmsuser. If you do not know your role, then your default role should be cmsuser. For any question, contact Patrick Gartung (gartung AT fnal.gov) or Anthony Tiradani (tiradani AT fnal.gov).
 

CERN Human Resources registration

Revision 92011-08-30 - WellsWulsin

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 66 to 66
 
  1. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
  2. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  3. when asked, provide an e-mail address which matches the Generic E-mail of the Preferred E-mail fields in the CERN HR database; if you have an account at CERN, choose your CERN e-mail address;
Changed:
<
<
  1. if you are an US-CMS member, select Anthony Tiradani or Burt Holzman as Representative and follow these additional steps;
>
>
  1. if you are an US-CMS member, select Anthony Tiradani or Burt Holzman as Representative and follow these additional steps;
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;

Revision 82011-03-28 - AlanSill

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 15 to 15
  These steps are here explained in detail.
Changed:
<
<
TO BE NOTICED: you must not use Safari browser. Even if you are able to install the certificate, with Safari the voms server refuse it (because of security issues). You can install another browser e.g. Firefox
>
>
Note: BEFORE you do any of the following steps, it is necessary to load the root CA certificate and any intermediate CA certificates into the trust store used by your browser so that it will know about the certificates used to secure the hosts and services -- for example, VOM(R)S -- in the remaining steps. DO NOT PROCEED without doing this for the CAs that apply to your region and to the service.
 
Added:
>
>
The easiest way to load these CA certificates is to visit the Terena Academic Certificate Authorities Repository at https://www.tacar.org/ and click on the link labeled "Certificates" and then download and install the CA certificates for (at minimum) the CERN Root and Intermediate CAs, and also those of the CA that will be issuing your personal certificate as described below. Note that some CAs require both root and intermediate CA files to be downloaded, and in some cases these are not named in an obvious way. For example, to use DOEGrids as a CA, you also have to download and install the ESNet Root CA file.

In most browsers, this can be handled by just clicking on the "Install" link and following the instructions to grant trust in these files. Alternatively, you can use the check-boxes to select several and then download them as a bundle using the pull-down menu at the bottom or the page to select your preferred format.

For Safari on Mac OS X, the best procedure is to download the needed files, then rename them with the proper certificate extension (for example, 51.pem instead of just 51) and then double-click on them to install them into your Mac OS X keychain. Your personal certificate should also be installed into your keychain, as that is what is used to store certificates in OS X. Once you install these files, the rest of the procedures should work as described below in Safari also.

Note that the proper procedure, regardless of which browser you are using, is NOT just to grant exceptions for each and every site you visit on a case-by-case basis, but instead it is important to use the certificate authority files as described above to set up the proper trust anchor paths for your browser and operating system.

 

Getting a personal certificate

A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options:

Changed:
<
<
  1. find out from the list of recognized Certification Authorities the one relative to your country and request a certificate from them following the procedures published on their web site;
>
>
  1. find out from the list of recognized International Grid Trust Federation Certification Authorities the one that provides service to your country and request a certificate from that CA following the procedures published on their web site;
 
  1. request a certificate from the CERN CA if you have a CERN NICE account (here);
  2. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE account.
Changed:
<
<
When a personal certificate is renewed, normally the certificate subject is identical to the old one: in that case, nothing has to be done about the VO registration.
>
>
When a personal certificate is renewed, normally the certificate subject is identical to the old one: in that case, nothing has to be done to update the VO registration.
 

How to get or renew a certificate from the CERN CA

Line: 77 to 84
 
/cms/production no role For testing only (obsolete) N N N N N N
high_prio For high priority productions N N N N N N
/cms/analysis no role For testing only (obsolete) N N N N N N
Changed:
<
<
/cms/HeavyIons no role For Heavy Ions studies N N N N N N
>
>
/cms/CMS.HeavyIons no role For Heavy Ions studies N N N N N N
 
/cms/Higgs no role For Higgs studies N N N N N N
/cms/StandardModel no role For SM studies N N N N N N
/cms/Susy no role For SUSY studies N N N N N N
/cms/uscms no role OSG CMS users N Y N N N N
cmsfrontier Frontier ops N N N N N N
Changed:
<
<
cmsphedex PhEDEx ops in OSG N N N N N N
>
>
cmsphedex PhEDEx ops in OSG N N N N N N
 
cmsprod MC production in OSG N N N N N N
cmssoft To install CMS software on OSG N N N N N N
cmst1admin CMS T1 admins N N N N N N

Revision 72010-05-31 - IsidroGonzalezCaballero

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 66 to 66
 
  1. otherwise, select Martti Pimia as Representative;
  2. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.

Changed:
<
<
Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Taiwanese CMS members
/cms no role All CMS users Y Y Y Y Y
cmsuser Normal user in OSG Y Y Y Y Y
lcgadmin To install CMS software on WLCG N N N N N
production MC production in WLCG N N N N N
cmst0admin CMS T0 admins N N N N N
cmst1admin CMS T1 admins N N N N N
cmst2admin CMS T2 admins N N N N N
/cms/production no role For testing only (obsolete) N N N N N
high_prio For high priority productions N N N N N
/cms/analysis no role For testing only (obsolete) N N N N N
/cms/HeavyIons no role For Heavy Ions studies N N N N N
/cms/Higgs no role For Higgs studies N N N N N
/cms/StandardModel no role For SM studies N N N N N
/cms/Susy no role For SUSY studies N N N N N
/cms/uscms no role OSG CMS users N Y N N N
cmsfrontier Frontier ops N N N N N
cmsphedex PhEDEx ops in OSG N N N N N
cmsprod MC production in OSG N N N N N
cmssoft To install CMS software on OSG N N N N N
cmst1admin CMS T1 admins N N N N N
cmst2admin CMS T2 admins N N N N N
cmsuser Normal user in OSG N Y N N N
/cms/dcms no role German user N N Y N N
/cms/itcms no role Italian user N N N Y N
/cms/twcms no role Taiwanese user N N N N Y
>
>
Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Spanish CMS members Taiwanese CMS members
/cms no role All CMS users Y Y Y Y Y Y
cmsuser Normal user in OSG Y Y Y Y Y Y
lcgadmin To install CMS software on WLCG N N N N N N
production MC production in WLCG N N N N N N
cmst0admin CMS T0 admins N N N N N N
cmst1admin CMS T1 admins N N N N N N
cmst2admin CMS T2 admins N N N N N N
/cms/production no role For testing only (obsolete) N N N N N N
high_prio For high priority productions N N N N N N
/cms/analysis no role For testing only (obsolete) N N N N N N
/cms/HeavyIons no role For Heavy Ions studies N N N N N N
/cms/Higgs no role For Higgs studies N N N N N N
/cms/StandardModel no role For SM studies N N N N N N
/cms/Susy no role For SUSY studies N N N N N N
/cms/uscms no role OSG CMS users N Y N N N N
cmsfrontier Frontier ops N N N N N N
cmsphedex PhEDEx ops in OSG N N N N N N
cmsprod MC production in OSG N N N N N N
cmssoft To install CMS software on OSG N N N N N N
cmst1admin CMS T1 admins N N N N N N
cmst2admin CMS T2 admins N N N N N N
cmsuser Normal user in OSG N Y N N N N
/cms/dcms no role German user N N Y N N N
/cms/itcms no role Italian user N N N Y N N
/cms/escms no role Spanish user N N N N Y N
/cms/twcms no role Taiwanese user N N N N N Y
 

If are already registered in the CMS VO with a different certificate

Revision 62010-04-29 - BurtHolzman

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 59 to 59
 
  1. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
  2. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  3. when asked, provide an e-mail address which matches the Generic E-mail of the Preferred E-mail fields in the CERN HR database; if you have an account at CERN, choose your CERN e-mail address;
Changed:
<
<
  1. if you are an US-CMS member, select Vijay Sekhri as Representative and follow these additional steps;
>
>
  1. if you are an US-CMS member, select Anthony Tiradani or Burt Holzman as Representative and follow these additional steps;
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
Line: 100 to 100
 

Special instructions for US-CMS users

Changed:
<
<
All members should sign up for the /cms/uscms group. Further, you can select your role in the group from cmsfrontier, cmsphedex, cmsprod, cmssoft, cmst2admin and cmsuser. If you do not know your role, then your default role should be cmsuser. For any question, contact Vijay Sekhri (sekhri@fnalNOSPAMPLEASE.gov).
>
>
All members should sign up for the /cms/uscms group. Further, you can select your role in the group from cmsfrontier, cmsphedex, cmsprod, cmssoft, cmst2admin and cmsuser. If you do not know your role, then your default role should be cmsuser. For any question, contact Anthony Tiradani (tiradani AT fnal.gov) or Burt Holzman (burt AT fnal.gov).
 

CERN Human Resources registration

Revision 52009-12-09 - MarcoCalloni

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 109 to 109
 
  1. go to http://graybook.cern.ch/ExperimentSearch.html;
  2. select CMS as experiment, enter your family name and click search;
  3. if you find yourself, then you are already registered; otherwise, you need to register;
Changed:
<
<
  1. if the generic e-mail and the physical e-mail are all , please follow the advice on this page or write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be defined as physical e-mail address. The registration to the CMS VO cannot proceed until this is done.
>
>
  1. if the generic e-mail and the physical e-mail are all none, please follow the advice on this page or write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be defined as physical e-mail address. The registration to the CMS VO cannot proceed until this is done.
  To register in the CERN HR database:
  1. complete this web pre-registration form;

Revision 42009-10-13 - MarcoCalloni

Line: 1 to 1
 
META TOPICPARENT name="SWGuideCrab"
<!-- PDFSTART -->

How to get access to WLCG

Line: 15 to 15
  These steps are here explained in detail.
Added:
>
>
TO BE NOTICED: you must not use Safari browser. Even if you are able to install the certificate, with Safari the voms server refuse it (because of security issues). You can install another browser e.g. Firefox
 

Getting a personal certificate

Line: 55 to 57
 
  1. obtain a personal certificate, if you have not done so;
  2. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
Changed:
<
<
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
>
>
  1. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
 
  1. when asked, provide an e-mail address which matches the Generic E-mail of the Preferred E-mail fields in the CERN HR database; if you have an account at CERN, choose your CERN e-mail address;
  2. if you are an US-CMS member, select Vijay Sekhri as Representative and follow these additional steps;
  3. if you are a German CMS member, select Thomas Kress as Representative;

Revision 32009-06-22 - KatiLassilaPerini

Line: 1 to 1
Added:
>
>
META TOPICPARENT name="SWGuideCrab"
 
<!-- PDFSTART -->

How to get access to WLCG

Line: 149 to 150
  If there is any problem with your data in the CERN HR database, go to this page.
Changed:
<
<
For problems, contact the CMS User Support (CMS-User.support@NO-SPAMNOSPAMPLEASE.cern.ch).
>
>
For problems, contact the CMS Computing Support (CMS.Computing@cernNOSPAMPLEASE.ch).

Revision 22009-05-11 - MarcoCalloni

Line: 1 to 1
 
<!-- PDFSTART -->

How to get access to WLCG

Line: 60 to 60
 
  1. if you are a German CMS member, select Thomas Kress as Representative;
  2. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  3. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
Changed:
<
<
  1. otherwise, select Andrea Sciabà as Representative;
>
>
  1. otherwise, select Martti Pimia as Representative;
 
  1. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.

Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Taiwanese CMS members

Revision 12009-04-23 - MarcoCalloni

Line: 1 to 1
Added:
>
>
<!-- PDFSTART -->

How to get access to WLCG

Summary

Three things are needed to have access to WLCG:

  1. a personal certificate, used to authenticate with the Grid;
  2. having your personal certificate registered in the CMS Virtual Organisation;
  3. an account on a User Interface (any machine with the WLCG commands installed).

These steps are here explained in detail.

Getting a personal certificate

A personal certificate consists of a pair of files, the private key (userkey.pem) and the certificate itself, containing the public key (usercert.pem). To obtain a certificate, a request has to be made to a Certification Authority recognized by WLCG. You have three options:

  1. find out from the list of recognized Certification Authorities the one relative to your country and request a certificate from them following the procedures published on their web site;
  2. request a certificate from the CERN CA if you have a CERN NICE account (here);
  3. request a certificate from the WLCG catch-all CA if no CA exists for your country and you do not have a CERN NICE account.

When a personal certificate is renewed, normally the certificate subject is identical to the old one: in that case, nothing has to be done about the VO registration.

How to get or renew a certificate from the CERN CA

The CERN CA will issue certificates only to people with a CERN NICE account.

The steps to follow to make a request are explained in the CA website. The instructions to convert the certificate in a format appropriate for use in the Grid are here. If you have problems, write to the Helpdesk: Helpdesk@cernNOSPAMPLEASE.ch. The procedure to renew a certificate is identical to the procedure to get a certificate for the first time.

Make sure that the certificate and the private key are installed in $HOME/.globus with the following permissions:

-rw-r--r-- 1 doe zh 4541 Feb 23 17:44 usercert.pem
-r-------- 1 doe zh 963 Feb 22 11:52 userkey.pem

Notice that the private key must be readable only by you, otherwise the certificate will not work (and your private key could be stolen).

How to register in the CMS VO

When in possession of a personal certificate, a CMS user has to register his certificate in the CMS Virtual Organisation in order to be authorized to use WLCG resources. The procedure is different depending if you are already registered in the CMS VO or not.

If you never registered to the CMS VO

First of all, make sure that you are registered in the CERN Human Resources database with an e-mail address.

Follow these steps:

  1. obtain a personal certificate, if you have not done so;
  2. convert your certificate in P12 format and load it into your browser (instuctions here); however this is not necessary if you have obtained a CERN certificate, because it is already in the browser (use the very same browser used to request the certificate);
  3. go to the CMS VOMRS server, and follow the instructions, taking into account the following;
  4. when asked, provide an e-mail address which matches the Generic E-mail of the Preferred E-mail fields in the CERN HR database; if you have an account at CERN, choose your CERN e-mail address;
  5. if you are an US-CMS member, select Vijay Sekhri as Representative and follow these additional steps;
  6. if you are a German CMS member, select Thomas Kress as Representative;
  7. if you are an Italian CMS member, select Giuseppe Bagliesi as Representative;
  8. if you are a Taiwanese CMS member, select Chia-Ming Kuo as Representative;
  9. otherwise, select Andrea Sciabà as Representative;
  10. select which groups and roles to join following the indications of the following table. The average CMS user should only select the combination /cms/Role=cmsuser.

Group Group Roles Description Non-US-CMS member US-CMS member German CMS members Italian CMS members Taiwanese CMS members
/cms no role All CMS users Y Y Y Y Y
cmsuser Normal user in OSG Y Y Y Y Y
lcgadmin To install CMS software on WLCG N N N N N
production MC production in WLCG N N N N N
cmst0admin CMS T0 admins N N N N N
cmst1admin CMS T1 admins N N N N N
cmst2admin CMS T2 admins N N N N N
/cms/production no role For testing only (obsolete) N N N N N
high_prio For high priority productions N N N N N
/cms/analysis no role For testing only (obsolete) N N N N N
/cms/HeavyIons no role For Heavy Ions studies N N N N N
/cms/Higgs no role For Higgs studies N N N N N
/cms/StandardModel no role For SM studies N N N N N
/cms/Susy no role For SUSY studies N N N N N
/cms/uscms no role OSG CMS users N Y N N N
cmsfrontier Frontier ops N N N N N
cmsphedex PhEDEx ops in OSG N N N N N
cmsprod MC production in OSG N N N N N
cmssoft To install CMS software on OSG N N N N N
cmst1admin CMS T1 admins N N N N N
cmst2admin CMS T2 admins N N N N N
cmsuser Normal user in OSG N Y N N N
/cms/dcms no role German user N N Y N N
/cms/itcms no role Italian user N N N Y N
/cms/twcms no role Taiwanese user N N N N Y

If are already registered in the CMS VO with a different certificate

If you have recently obtained a new certificate but you were already registered in the CMS VO with an old certificate, please read also these instructions. This is the case, for example, if you got a new CERN certificate from the new CERN CA but you had already a certificate from the old CERN CA. Basically, what you have to do in this case is to add a new certificate to your entry in the CMS VO.

Special instructions for US-CMS users

All members should sign up for the /cms/uscms group. Further, you can select your role in the group from cmsfrontier, cmsphedex, cmsprod, cmssoft, cmst2admin and cmsuser. If you do not know your role, then your default role should be cmsuser. For any question, contact Vijay Sekhri (sekhri@fnalNOSPAMPLEASE.gov).

CERN Human Resources registration

To check if you are already registered, follow these steps:

  1. go to http://graybook.cern.ch/ExperimentSearch.html;
  2. select CMS as experiment, enter your family name and click search;
  3. if you find yourself, then you are already registered; otherwise, you need to register;
  4. if the generic e-mail and the physical e-mail are all , please follow the advice on this page or write to Cms.People@cernNOSPAMPLEASE.ch and ask your preferred e-mail address to be defined as physical e-mail address. The registration to the CMS VO cannot proceed until this is done.

To register in the CERN HR database:

  1. complete this web pre-registration form;
  2. you will then be contacted by the CMS secretariat (cmspeople@cmsdocNOSPAMPLEASE.cern.ch) to fill in the CMS registration form.

You will be contacted by the CMS secretariat to confirm your registration.

Getting an account on a User Interface

A machine with the WLCG commands installed is, by definition, a User Interface (UI). Many institutes have local UIs; at CERN you can login to LXPLUS and source the script

/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.csh (tcsh)
or
/afs/cern.ch/cms/LCG/LCG-2/UI/cms_ui_env.sh (bash)

To learn how to use the WLCG commands, you should by all means read the gLite 3 User Guide: it explains all the basic concepts, all the commands and it is full of examples. Here it is simply said that to send WLCG commands you must first create a "proxy certificate", valid for 12 hours by default, with the command grid-proxy-init: think of it as a sort of "Grid token", much in the same way you need an AFS token for LXPLUS. For comments or problems with the gLite 3 User Guide, write to support-eis@cernNOSPAMPLEASE.ch.

Technical stuff

The URL of the CMS VOMS server is https://voms.cern.ch:8443/voms/cms/.

The latest LCMAPS configuration in LCG is here.

Troubleshooting

If you are getting an authorisation error when using WLCG commands, the cause can be one among many:

  1. your proxy certificate has expired;
  2. your personal certificate has expired;
  3. the certificate of your CA has expired;
  4. the Certificate Revocation List of your CA has expired;
  5. you have renewed your certificate but you are still using your OLD private key.

You are not supposed to be able to recognize the nature of the problem (apart from the first two cases, which are trivial), so in case you need help, send a ticket to the Global Grid User Support.

If there is any problem with your data in the CERN HR database, go to this page.

For problems, contact the CMS User Support (CMS-User.support@NO-SPAMNOSPAMPLEASE.cern.ch).

 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright &© 2008-2019 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback