{"id":22733812,"url":"https://github.com/angelogalav/voms4noa","last_synced_at":"2025-03-30T02:11:28.521Z","repository":{"id":189128796,"uuid":"488644583","full_name":"AngeloGalav/VOMS4NOA","owner":"AngeloGalav","description":"Voms support for the OpenResty-OPA-Authz infrastructure","archived":false,"fork":false,"pushed_at":"2023-03-15T15:45:04.000Z","size":112,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-02-05T04:32:16.488Z","etag":null,"topics":["nginx-proxy","openpolicyagent","openresty","voms","voms-clients"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AngeloGalav.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-05-04T15:31:31.000Z","updated_at":"2023-08-18T09:43:34.000Z","dependencies_parsed_at":"2023-08-18T12:20:50.770Z","dependency_job_id":null,"html_url":"https://github.com/AngeloGalav/VOMS4NOA","commit_stats":null,"previous_names":["angelogalav/voms4noa"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FVOMS4NOA","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FVOMS4NOA/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FVOMS4NOA/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FVOMS4NOA/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AngeloGalav","download_url":"https://codeload.github.com/AngeloGalav/VOMS4NOA/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246266245,"owners_count":20749754,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nginx-proxy","openpolicyagent","openresty","voms","voms-clients"],"created_at":"2024-12-10T20:16:18.655Z","updated_at":"2025-03-30T02:11:28.494Z","avatar_url":"https://github.com/AngeloGalav.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VOMS4NOA\n\nProxy VOMS Integration for the OpenResty-OPA reverse proxy infrstructure, thus enabling usage, testing and validation of VOMS Certificates. \n\nYou can find the base NGINX-OPA-Authz (NOA) system [here](https://github.com/AngeloGalav/NGINX-OPA-Authz).\n\nDevelopment is still in progress.\n\n## Usage\n\nFirst of all, you'll need to generate a Proxy VOMS using `voms-proxy-init`. To do that, you'll need to enter the `.devcontainer`, which provides easy use to the VOMS services. You can use the `.devcontainer` inside Visual Studio Code by clicking on the icon in the bottom left with the two angled brackets and selecting \"Reopen Folder in Container\".\n\n\u003e :warning: **In order to access the `voms-proxy-init` service**, you need to place your user certificate \n\u003e in `/home/{$USER}/.globus` folder, and an `/home/{$USER}/.config/oidc-agent` folder (a full installation of the service is recommended).\n\nAfter entering the container, you'll need to create said Proxy VOMS:\n```bash\nvoms-proxy-init -pwstdin -voms test.vo \u003c\u003c\u003c pass\n```\n\n(You can also create a VOMS proxy using the voms-client container. You can find more info about the voms-client below, but I suggest to stick with the devcontainer).\n\n\nYou'll then need to add the `servicecnaf.test.example` host into `/etc/hosts` of your PC: \n```\n127.0.0.1  localhost servicecnaf.test.example\n``` \n\nSubsequently, the NGINX-OPA-Authz infrastructure must be booted using another terminal:\n```bash\ndocker-compose up\n```\n\nThis final steps will allow you to actually test the infrastructure we just built (keep in mind that you mustn't exit the `.devcontainer`):\n```bash\n./debug_requester/voms_curl_test.sh [role] [operation]\n```\nIf the `debug_tester` is not working, you can still use the `curl` to try and test this system. Here are some examples:\n- Using a VOMS Proxy (this command must be executed inside the devcontainer in order to use the VOMS Proxy). \n```\ncurl --cert \"/tmp/x509up_u1000\"  --capath \"/etc/grid-security/certificates\"  --cacert \"nginx_docker_revproxy/certificates_for_https/user.cert.pem\" \"https://servicecnaf.test.example:8081/operation/\" -H \"X-Operation: retrieve\" -H \"X-EnableJWT: false\" \n```\n\n- Using simple authentication information \n```\ncurl  --capath \"/etc/grid-security/certificates\"  \"https://servicecnaf.test.example:8081/operation/\" -H \"X-Role: moderator\" -H \"X-Operation: report\" -H \"X-EnableJWT: false\"\n```\n\n\u003c!-- Aggiungere parte dei metodi di accesso disponibili, aka JWT e VOMS, e come usarli in modo interchangeable --\u003e\n\n## IN-\u0026-OUTS of a VOMS Proxy\n\nA VOMS Proxy is a certificate used by the The Virtual Organization Membership Service, which enables Virtual Organization access control in distributed services. \nYou can find more information about VOMS [here](https://italiangrid.github.io/voms/).\n\nThe VOMS Proxy is made of 2 parts:\n- The user certificate, which is a standard x509 certificate.\n- The VOMS AC (Attribute Certificate), which is a x509 certificate representing the VO. \n\nBoth parts are standard X509 certificates and can be used for SSL connections.\n\nThe server validating the VOMS Proxy will need to check both the user certificate and the VOMS AC. It will also need the standard X509 user certificate, in order to fill the Certificate Chain.  \n\n## Milestones \u0026 Todos\nThrough the [NGINX-OPA-Authz](https://github.com/AngeloGalav/NGINX-OPA-Authz) repository:\n- [x] Understading OPA\n- [x] Making a simple RBAC in OPA\n- [x] Adding support for JWT\n- [x] Developing a RevProxy using NGINX and Docker-compose\n- [x] Integrating the RevProxy with OPA\n- [x] Ditching the sidecar in favour of NJS for authorization information parsing\n- [x] Developing a way to interact with this system\n- [x] Adding support for X509 certificates\n\nThrough this repository:\n- [x] Understanding VOMS Proxies and how they work\n- [x] Adding VOMS support to the OpenResty revproxy\n- [x] Easing the VOMS creation process (.devcontainer integration)\n- [x] Adding VOMS support in OPA\n- [x] Fix known issues\n- [x] Interfacing with storm-tape.\n- [x] Enhancing bash scripts for interactions/debugging\n\n# Storm-Tape API\nYou can find an example of the integration of this system with a real API by visiting the [storm-tape branch](https://github.com/AngeloGalav/VOMS4NOA/tree/storm-tape-integration).\n\n## Notes\nThe service server graphical UI also is not supported anymore. It is suggested to use `debug_requester` for further testing and interacting with the system.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelogalav%2Fvoms4noa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fangelogalav%2Fvoms4noa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelogalav%2Fvoms4noa/lists"}