User certificate renewal

[hmiyake]

Hello,

When a user wants to renew grid certificate, sometimes simple replacement brings trouble in several DIRAC sub systems.
For example, if the user has Waiting jobs, these jobs cannot start on grid since they fail to download proxy.
Or recently we faced severe trouble in JobCleaningAgent, by repeated attempts to register RMS request (but never succeeded due to "invalid" OwnerDN in JobDB).

So probably we better to keep both old and new certificates for a while, but usually user job cleanup happens some time later, then that old cert might be expired. Furthermore I heard IAM does not allow multiple certificates for user...

So I wonder what is better way to manage certificate replacement.

For Waiting jobs, is it safe to replace OwnerDN with new one, in JobDB?
As more extreme case, if that user already left the collaboration, we may use "admin" DN instead...I would know if it is allowed treatment, too.

Anyways, these operations require direct DB manipulation...perhaps do we already have such command or API?

Best Regards,
Hideki

[IgorPelevanyuk]

Hello, Hideki,

Why DN changes after receiving new certificate? I ask because, my DN has the following form: /C=RU/O=RDIG/OU=users/OU=jinr.ru/CN=Igor Pelevanyuk and it is the same for almost 8 years.

Kind regards,
Igor Pelevanyuk

[hmiyake]

There are several cases to change DN.

• An organization changes CA
• CA changes format (e.g. add/remove OU)
• Append random? numerical ID per renewal

Here is recent our Italian colleague case:
/DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare - INFN/CN=XXX
/DC=org/DC=terena/DC=tcs/C=IT/O=Istituto Nazionale di Fisica Nucleare/CN=XXX

[fstagni]

We have already seen this: #5355
I have also started a PR (#6566) that would sort out this issue once for all, but it is targeting version v8.1 and until that point the only way out is a manual intervention in the DB.

[hmiyake]

Thanks a lot!
Good to know, then we will survive by manual intervention till v8.1 migration.

Given links are also helpful for us.

Cheers,
Hideki