Skip to content

Commit

Permalink
Revocation entries are defunct since gplazma-1 is discontinued
Browse files Browse the repository at this point in the history
  • Loading branch information
XMol committed Mar 30, 2023
1 parent ac9976d commit 06e7cf6
Showing 1 changed file with 1 addition and 11 deletions.
12 changes: 1 addition & 11 deletions docs/TheBook/src/main/markdown/config-gplazma.md
Expand Up @@ -1246,7 +1246,7 @@ Example:

"*" "/desy/Role=production/" desyprod

In that case, any DN with the corresponding role will match. It should be noted that a match is first attempted with the explicit DN. Therefore if both DN and `"*"` matches can be made, the DN match will take precedence. This is true for the revocation matches as well (see below).
In that case, any DN with the corresponding role will match. It should be noted that a match is first attempted with the explicit DN. Therefore if both DN and `"*"` matches can be made, the DN match will take precedence.

Thus a user with subject `/C=DE/O=GermanGrid/OU=DESY/CN=John Doe` and
role `/desy/Role=production` will be mapped to username `desyprod` via
Expand All @@ -1257,16 +1257,6 @@ there is also a line such as

in which case the username will be `desyprod2`.

#### Revocation Entries

To create a revocation entry, add a line with a dash (`-`) as the username, such as

"/C=DE/O=GermanGrid/OU=DESY/CN=John Doe" "/desy/production" -

or modify the username of the entry if it already exists. The behaviour is undefined if there are two entries which differ only by username.

Since DN is matched first, if a user would be authorized by his VO membership through a `"*"` entry, but is matched according to his DN to a revocation entry, authorization would be denied. Likewise if a whole VO were denied in a revocation entry, but some user in that VO could be mapped to a username through his DN, then authorization would be granted.

#### More Examples

Suppose that there are users in production roles that are expected to
Expand Down

0 comments on commit 06e7cf6

Please sign in to comment.