docutils.nodesdocument)}( rawsourcechildren]hsection)}(hhh](htitle)}(hDataONE Member Node Supporth]hTextDataONE Member Node Support}(hhparenthhhsourceNlineNuba attributes}(ids]classes]names]dupnames]backrefs]utagnamehhh hhh[/var/lib/jenkins/jobs/Metacat_stable/workspace/metacat/docs/user/metacat/source/dataone.rsthKubh paragraph)}(hXDataONE_ is a federation of data repositories that aims to improve interoperability among data repository software systems and advance the preservation of scientific data for future use. Metacat deployments can be configured to participate in DataONE_. This chapter describes the DataONE_ data federation, its architecture, and the way in which Metacat can be used to participate as a node in the DataONE system.h](h reference)}(hDataONE_h]hDataONE}(hhhh3ubah}(h]h!]h#]h%]h']nameDataONErefurihttp://dataone.org/uh)h1hh-resolvedKubh is a federation of data repositories that aims to improve interoperability among data repository software systems and advance the preservation of scientific data for future use. Metacat deployments can be configured to participate in }(h is a federation of data repositories that aims to improve interoperability among data repository software systems and advance the preservation of scientific data for future use. Metacat deployments can be configured to participate in hh-hhhNhNubh2)}(hDataONE_h]hDataONE}(hhhhKubah}(h]h!]h#]h%]h']nameDataONEhChDuh)h1hh-hEKubh. This chapter describes the }(h. This chapter describes the hh-hhhNhNubh2)}(hDataONE_h]hDataONE}(hhhh`ubah}(h]h!]h#]h%]h']nameDataONEhChDuh)h1hh-hEKubh} data federation, its architecture, and the way in which Metacat can be used to participate as a node in the DataONE system.}(h} data federation, its architecture, and the way in which Metacat can be used to participate as a node in the DataONE system.hh-hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhh hhubhtarget)}(h .. _DataONE: http://dataone.org/h]h}(h]dataoneah!]h#]dataoneah%]h']hChDuh)h{hK hh hhhh* referencedKubh )}(hhh](h)}(hWhat is DataONE?h]hWhat is DataONE?}(hhhhhhhNhNubah}(h]h!]h#]h%]h']uh)hhhhhhh*hK ubh,)}(hX&The DataONE_ project is a collaboration among scientists, technologists, librarians, and social scientists to build a robust, interoperable, and sustainable system for preserving and accessing Earth observational data at national and global scales. Supported by the U.S. National Science Foundation, DataONE partners focus on technological, financial, and organizational sustainability approaches to building a distributed network of data repositories that are fully interoperable, even when those repositories use divergent underlying software and support different data and metadata content standards. DataONE defines a common web-service service programming interface that allows the main software components of the DataONE system to seamlessly communicate. The components of the DataONE system include:h](hThe }(hThe hhhhhNhNubh2)}(hDataONE_h]hDataONE}(hhhhubah}(h]h!]h#]h%]h']nameDataONEhChDuh)h1hhhEKubhX project is a collaboration among scientists, technologists, librarians, and social scientists to build a robust, interoperable, and sustainable system for preserving and accessing Earth observational data at national and global scales. Supported by the U.S. National Science Foundation, DataONE partners focus on technological, financial, and organizational sustainability approaches to building a distributed network of data repositories that are fully interoperable, even when those repositories use divergent underlying software and support different data and metadata content standards. DataONE defines a common web-service service programming interface that allows the main software components of the DataONE system to seamlessly communicate. The components of the DataONE system include:}(hX project is a collaboration among scientists, technologists, librarians, and social scientists to build a robust, interoperable, and sustainable system for preserving and accessing Earth observational data at national and global scales. Supported by the U.S. National Science Foundation, DataONE partners focus on technological, financial, and organizational sustainability approaches to building a distributed network of data repositories that are fully interoperable, even when those repositories use divergent underlying software and support different data and metadata content standards. DataONE defines a common web-service service programming interface that allows the main software components of the DataONE system to seamlessly communicate. The components of the DataONE system include:hhhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhhhhubh bullet_list)}(hhh](h list_item)}(hDataONE Service Interfaceh]h,)}(hhh]hDataONE Service Interface}(hhhhubah}(h]h!]h#]h%]h']uh)h+hh*hKhhubah}(h]h!]h#]h%]h']uh)hhhhhhh*hNubh)}(h Member Nodesh]h,)}(hhh]h Member Nodes}(hhhhubah}(h]h!]h#]h%]h']uh)h+hh*hKhhubah}(h]h!]h#]h%]h']uh)hhhhhhh*hNubh)}(hCoordinating Nodesh]h,)}(hhh]hCoordinating Nodes}(hhhhubah}(h]h!]h#]h%]h']uh)h+hh*hKhhubah}(h]h!]h#]h%]h']uh)hhhhhhh*hNubh)}(hInvestigator Toolkit h]h,)}(hInvestigator Toolkith]hInvestigator Toolkit}(hjhjubah}(h]h!]h#]h%]h']uh)h+hh*hKhj ubah}(h]h!]h#]h%]h']uh)hhhhhhh*hNubeh}(h]h!]h#]h%]h']bullet*uh)hhh*hKhhhhubh,)}(hXMetacat implements the services needed to operate as a DataONE Member Node, as described below. The service interface then allows many different scientific software tools for data management, analysis, visualization and other parts of the scientific lifecycle to directly communicate with Metacat without being further specialized beyond the support needed for DataONE. This streamlines the process of writing scientific software both for servers and client tools.h]hXMetacat implements the services needed to operate as a DataONE Member Node, as described below. The service interface then allows many different scientific software tools for data management, analysis, visualization and other parts of the scientific lifecycle to directly communicate with Metacat without being further specialized beyond the support needed for DataONE. This streamlines the process of writing scientific software both for servers and client tools.}(hj-hj+hhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hKhhhhubeh}(h]what-is-dataoneah!]h#]what is dataone?ah%]h']uh)h hh hhhh*hK ubh )}(hhh](h)}(hThe DataONE Service Interfaceh]hThe DataONE Service Interface}(hjFhjDhhhNhNubah}(h]h!]h#]h%]h']uh)hhjAhhhh*hK&ubh,)}(hXlDataONE acheives interoperability by defining a lightweight but powerful set of REST_ web services that can be implemented by various data management software systems to allow those systems to effectively communicate with one another, exchange data, metadata, and other scientific objects. This `DataONE Service Interface`_ is an open standard that defines the communication protocols and technical expectations for software components that wish to participate in the DataONE federation. This service interface is divided into `four distinct tiers`_, with the intention that any given software system may implement only those tiers that are relevant to their repository; for example, a data aggregator might only implement the Tier 1 interfaces that provide anonymous access to public data sets, while a complete data management system like Metacat implements all four tiers:h](hPDataONE acheives interoperability by defining a lightweight but powerful set of }(hPDataONE acheives interoperability by defining a lightweight but powerful set of hjRhhhNhNubh2)}(hREST_h]hREST}(hhhj[ubah}(h]h!]h#]h%]h']nameRESThCAggregated logging for data access across the whole federationh]h>Aggregated logging for data access across the whole federation}(hj|hjzubah}(h]h!]h#]h%]h']uh)h+hh*hK\hjvubah}(h]h!]h#]h%]h']uh)hhjhhhh*hNubeh}(h]h!]h#]h%]h']j)j*uh)hhh*hKUhjhhubh,)}(hXThree geographically distributed Coordinating Nodes replicate these coordinating services at UC Santa Barbara, the University of New Mexico, and the Oak Ridge Campus. Coordinating Nodes are set up in a fully redundant manner, such that any of the coordinating nodes can be offline and the others will continue to provide availability of the services without interruption. The DataONE services expose their services at::h]hXThree geographically distributed Coordinating Nodes replicate these coordinating services at UC Santa Barbara, the University of New Mexico, and the Oak Ridge Campus. Coordinating Nodes are set up in a fully redundant manner, such that any of the coordinating nodes can be offline and the others will continue to provide availability of the services without interruption. The DataONE services expose their services at:}(hXThree geographically distributed Coordinating Nodes replicate these coordinating services at UC Santa Barbara, the University of New Mexico, and the Oak Ridge Campus. Coordinating Nodes are set up in a fully redundant manner, such that any of the coordinating nodes can be offline and the others will continue to provide availability of the services without interruption. The DataONE services expose their services at:hjhhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hK^hjhhubh literal_block)}(hhttps://cn.dataone.org/cnh]hhttps://cn.dataone.org/cn}(hhhjubah}(h]h!]h#]h%]h'] xml:spacepreserveuh)jhKdhjhhhh*ubh,)}(h.And the DataONE search portal is available at:h]h.And the DataONE search portal is available at:}(hjhjhhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hKfhjhhubh block_quote)}(hhh]h,)}(hhttps://search.dataone.org/h]h2)}(hjh]hhttps://search.dataone.org/}(hhhjubah}(h]h!]h#]h%]h']refurijuh)h1hjubah}(h]h!]h#]h%]h']uh)h+hh*hKhhjubah}(h]h!]h#]h%]h']uh)jhjhhhh*hNubh|)}(h#.. _CILogon: http://www.cilogon.orgh]h}(h]cilogonah!]h#]cilogonah%]h']hCj uh)h{hKjhjhhhh*hKubh|)}(h!.. _InCommon: http://incommon.orgh]h}(h]incommonah!]h#]incommonah%]h']hCj#uh)h{hKlhjhhhh*hKubeh}(h]coordinating-nodesah!]h#]coordinating nodesah%]h']uh)h hh hhhh*hKOubh )}(hhh](h)}(hInvestigator Toolkith]hInvestigator Toolkit}(hj hj hhhNhNubah}(h]h!]h#]h%]h']uh)hhjhhhh*hKoubh,)}(hXIn order to provide scientists with convenient access to the data and metadata in DataONE, the third component represents a library of software tools that have been adapted to work with DataONE via the service interface and can be used to discover, manage, analyze, and visualize data in DataONE. For example, DataONE has released metadata editors (e.g., Morpho), data search tools (e.g., Mercury), data access tools (e.g., ONEDrive), and data analysis tools (e.g., R) that all know how to interact with DataONE Member Nodes and Coordinating Nodes. Consequently, scientists will be able to access data from any DataONE Member Node, such as a Metacat node, directly from within the R environment. In addition, software tools that are written to work with one Member Node should also work with others, thereby greatly increasing the efficiency of creating an entire toolkit of software that is useful to investigators.h]hXIn order to provide scientists with convenient access to the data and metadata in DataONE, the third component represents a library of software tools that have been adapted to work with DataONE via the service interface and can be used to discover, manage, analyze, and visualize data in DataONE. For example, DataONE has released metadata editors (e.g., Morpho), data search tools (e.g., Mercury), data access tools (e.g., ONEDrive), and data analysis tools (e.g., R) that all know how to interact with DataONE Member Nodes and Coordinating Nodes. Consequently, scientists will be able to access data from any DataONE Member Node, such as a Metacat node, directly from within the R environment. In addition, software tools that are written to work with one Member Node should also work with others, thereby greatly increasing the efficiency of creating an entire toolkit of software that is useful to investigators.}(hjhjhhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hKphjhhubh,)}(hXBecause DataONE services are REST web services, software written in any programming language can be adapted to interact with DataONE. In addition, to ease the process of adapting tools to work with DataONE, libraries are provided for common programming languages such as Java (d1-libclient-java) and Python (d1_libclient-python) are provided that allow simple function calls to be used to access any DataONE service.h]hXBecause DataONE services are REST web services, software written in any programming language can be adapted to interact with DataONE. In addition, to ease the process of adapting tools to work with DataONE, libraries are provided for common programming languages such as Java (d1-libclient-java) and Python (d1_libclient-python) are provided that allow simple function calls to be used to access any DataONE service.}(hj'hj%hhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hK}hjhhubeh}(h]investigator-toolkitah!]h#]investigator toolkitah%]h']uh)h hh hhhh*hKoubh )}(hhh](h)}(h$Configuring Metacat as a Member Nodeh]h$Configuring Metacat as a Member Node}(hj@hj>hhhNhNubah}(h]h!]h#]h%]h']uh)hhj;hhhh*hKubh,)}(hConfiguring Metacat as a DataONE Member Node is accomplished with the standard Metacat Administrative configuration utility. To access the utility, visit the following URL::h]hConfiguring Metacat as a DataONE Member Node is accomplished with the standard Metacat Administrative configuration utility. To access the utility, visit the following URL:}(hConfiguring Metacat as a DataONE Member Node is accomplished with the standard Metacat Administrative configuration utility. To access the utility, visit the following URL:hjLhhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubj)}(h%http:////adminh]h%http:////admin}(hhhj[ubah}(h]h!]h#]h%]h']jjuh)jhKhj;hhhh*ubh,)}(hXwhere ```` represents the hostname of your webserver running metacat, and ```` is the name of the web context in which Metacat was installed. Once at the administrative utility, click on the DataONE configuration link, which should show the following screen:h](hwhere }(hwhere hjihhhNhNubhliteral)}(h````h]h}(hhhjtubah}(h]h!]h#]h%]h']uh)jrhjiubh@ represents the hostname of your webserver running metacat, and }(h@ represents the hostname of your webserver running metacat, and hjihhhNhNubjs)}(h ````h]h }(hhhjubah}(h]h!]h#]h%]h']uh)jrhjiubh is the name of the web context in which Metacat was installed. Once at the administrative utility, click on the DataONE configuration link, which should show the following screen:}(h is the name of the web context in which Metacat was installed. Once at the administrative utility, click on the DataONE configuration link, which should show the following screen:hjihhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubhfigure)}(hhh](himage)}(h.. figure:: images/screenshots/image068.png :align: center The configuration screen for configuring Metacat as a DataONE node. h]h}(h]h!]h#]h%]h']uriimages/screenshots/image068.png candidates}j*jsuh)jhjhh*hKubhcaption)}(hCThe configuration screen for configuring Metacat as a DataONE node.h]hCThe configuration screen for configuring Metacat as a DataONE node.}(hjhjubah}(h]h!]h#]h%]h']uh)jhh*hKhjubeh}(h]id1ah!]h#]h%]h']aligncenteruh)jhKhj;hhhh*ubh,)}(hXTo configure Metacat as a node in the DataONE network, configure the properties shown in the figure above. The Node Name should be a short name for the node that can be used in user interface displays that list the node. For example, one node in DataONE is the 'Knowledge Network for Biocomplexity'. Also provide a brief sentence or two describing the node, including its intended scope and purpose.h]hXTo configure Metacat as a node in the DataONE network, configure the properties shown in the figure above. The Node Name should be a short name for the node that can be used in user interface displays that list the node. For example, one node in DataONE is the ‘Knowledge Network for Biocomplexity’. Also provide a brief sentence or two describing the node, including its intended scope and purpose.}(hjhjhhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubh,)}(hXThe Node Identifier field is a unique identifier assigned by DataONE to identify this node even when the node changes physical locations over time. After Metacat registers with the DataONE Coordinating Nodes (when you click 'Register' at the bottom of this form), the Node Identifier should not be changed. **It is critical that you not change the Node Identifier after registration**, as that will break the connection with the DataONE network. Changing this field should only happen in the rare case in which a new Metacat instance is being established to act as the provider for an existing DataONE Member Node, in which case the field can be edited to set it to the value of a valid, existing Node Identifier.h](hX9The Node Identifier field is a unique identifier assigned by DataONE to identify this node even when the node changes physical locations over time. After Metacat registers with the DataONE Coordinating Nodes (when you click ‘Register’ at the bottom of this form), the Node Identifier should not be changed. }(hX5The Node Identifier field is a unique identifier assigned by DataONE to identify this node even when the node changes physical locations over time. After Metacat registers with the DataONE Coordinating Nodes (when you click 'Register' at the bottom of this form), the Node Identifier should not be changed. hjhhhNhNubj)}(hM**It is critical that you not change the Node Identifier after registration**h]hIIt is critical that you not change the Node Identifier after registration}(hhhjubah}(h]h!]h#]h%]h']uh)jhjubhXJ, as that will break the connection with the DataONE network. Changing this field should only happen in the rare case in which a new Metacat instance is being established to act as the provider for an existing DataONE Member Node, in which case the field can be edited to set it to the value of a valid, existing Node Identifier.}(hXJ, as that will break the connection with the DataONE network. Changing this field should only happen in the rare case in which a new Metacat instance is being established to act as the provider for an existing DataONE Member Node, in which case the field can be edited to set it to the value of a valid, existing Node Identifier.hjhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubh,)}(hX"The Node Subject and Node Certificate Path are linked fields that are critical for proper operation of the node. To act as a Member Node in DataONE, you must obtain an X.509 certificate that can be used to identify this node and allow it to securely communicate using SSL with other nodes and client applications. This certificate can be obtained from the DataONE Certificate Authority. Once you have the certificate in hand, use a tool such as ``openssl`` to determine the exact subject distinguished name in the certificate, and use that to set the Node Subject field. Set the Node Certificate Path to the location on the system in which you stored the certificate file. Be sure to protect the certificate file, as it contains the private key that is used to authenticate this node within DataONE.h](hXThe Node Subject and Node Certificate Path are linked fields that are critical for proper operation of the node. To act as a Member Node in DataONE, you must obtain an X.509 certificate that can be used to identify this node and allow it to securely communicate using SSL with other nodes and client applications. This certificate can be obtained from the DataONE Certificate Authority. Once you have the certificate in hand, use a tool such as }(hXThe Node Subject and Node Certificate Path are linked fields that are critical for proper operation of the node. To act as a Member Node in DataONE, you must obtain an X.509 certificate that can be used to identify this node and allow it to securely communicate using SSL with other nodes and client applications. This certificate can be obtained from the DataONE Certificate Authority. Once you have the certificate in hand, use a tool such as hjhhhNhNubjs)}(h ``openssl``h]hopenssl}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubhXX to determine the exact subject distinguished name in the certificate, and use that to set the Node Subject field. Set the Node Certificate Path to the location on the system in which you stored the certificate file. Be sure to protect the certificate file, as it contains the private key that is used to authenticate this node within DataONE.}(hXX to determine the exact subject distinguished name in the certificate, and use that to set the Node Subject field. Set the Node Certificate Path to the location on the system in which you stored the certificate file. Be sure to protect the certificate file, as it contains the private key that is used to authenticate this node within DataONE.hjhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubhnote)}(hFor Tier 2 deployments and above, the Metacat Member Node must have Apache configured to request client certificates. Detailed instructions are included at the end of this chapter.h]h,)}(hFor Tier 2 deployments and above, the Metacat Member Node must have Apache configured to request client certificates. Detailed instructions are included at the end of this chapter.h]hFor Tier 2 deployments and above, the Metacat Member Node must have Apache configured to request client certificates. Detailed instructions are included at the end of this chapter.}(hj(hj&ubah}(h]h!]h#]h%]h']uh)h+hh*hKhj"ubah}(h]h!]h#]h%]h']uh)j hj;hhhh*hNubh,)}(hX+The ``Enable DataONE Services`` checkbox allows the administrator to decide whether to turn on synchronization with the DataONE network. When this box is unchecked, the DataONE Coordinating Nodes will not attempt to synchronize at all, but when checked, then DataONE will periodically contact the node to synchronize all metadata content. To be part of the DataONE network, this box must be checked as that allows DataONE to receive a copy of the metadata associated with each object in the Metacat system. The switch is provided for those rare cases when a node needs to be disconnected from DataONE for maintenance or service outages. When the box is checked, DataONE contacts the node using the schedule provided in the ``Synchronization Schedule`` fields. The example in the dialog above has synchronization occurring once every third minutes at the 10 second mark of those minutes. The syntax for these schedules follows the Quartz Crontab Entry syntax, which provides for many flexible schedule configurations. If the administrator desires a less frequent schedule, such as daily, that can be configured by changing the ``*`` in the ``Hours`` field to be a concrete hour (such as ``11``) and the ``Minutes`` field to a concrete value like``15``, which would change the schedule to synchronize at 11:15 am daily.h](hThe }(hThe hj:hhhNhNubjs)}(h``Enable DataONE Services``h]hEnable DataONE Services}(hhhjCubah}(h]h!]h#]h%]h']uh)jrhj:ubhX checkbox allows the administrator to decide whether to turn on synchronization with the DataONE network. When this box is unchecked, the DataONE Coordinating Nodes will not attempt to synchronize at all, but when checked, then DataONE will periodically contact the node to synchronize all metadata content. To be part of the DataONE network, this box must be checked as that allows DataONE to receive a copy of the metadata associated with each object in the Metacat system. The switch is provided for those rare cases when a node needs to be disconnected from DataONE for maintenance or service outages. When the box is checked, DataONE contacts the node using the schedule provided in the }(hX checkbox allows the administrator to decide whether to turn on synchronization with the DataONE network. When this box is unchecked, the DataONE Coordinating Nodes will not attempt to synchronize at all, but when checked, then DataONE will periodically contact the node to synchronize all metadata content. To be part of the DataONE network, this box must be checked as that allows DataONE to receive a copy of the metadata associated with each object in the Metacat system. The switch is provided for those rare cases when a node needs to be disconnected from DataONE for maintenance or service outages. When the box is checked, DataONE contacts the node using the schedule provided in the hj:hhhNhNubjs)}(h``Synchronization Schedule``h]hSynchronization Schedule}(hhhjVubah}(h]h!]h#]h%]h']uh)jrhj:ubhXz fields. The example in the dialog above has synchronization occurring once every third minutes at the 10 second mark of those minutes. The syntax for these schedules follows the Quartz Crontab Entry syntax, which provides for many flexible schedule configurations. If the administrator desires a less frequent schedule, such as daily, that can be configured by changing the }(hXz fields. The example in the dialog above has synchronization occurring once every third minutes at the 10 second mark of those minutes. The syntax for these schedules follows the Quartz Crontab Entry syntax, which provides for many flexible schedule configurations. If the administrator desires a less frequent schedule, such as daily, that can be configured by changing the hj:hhhNhNubjs)}(h``*``h]h*}(hhhjiubah}(h]h!]h#]h%]h']uh)jrhj:ubh in the }(h in the hj:hhhNhNubjs)}(h ``Hours``h]hHours}(hhhj|ubah}(h]h!]h#]h%]h']uh)jrhj:ubh& field to be a concrete hour (such as }(h& field to be a concrete hour (such as hj:hhhNhNubjs)}(h``11``h]h11}(hhhjubah}(h]h!]h#]h%]h']uh)jrhj:ubh ) and the }(h ) and the hj:hhhNhNubjs)}(h ``Minutes``h]hMinutes}(hhhjubah}(h]h!]h#]h%]h']uh)jrhj:ubhh field to a concrete value like``15``, which would change the schedule to synchronize at 11:15 am daily.}(hh field to a concrete value like``15``, which would change the schedule to synchronize at 11:15 am daily.hj:hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubh,)}(hXNThe Replication section is used to configure replication options for the node overall and for objects stored in Metacat. The ``Accept and Store Replicas`` checkbox is used to indicate that the administrator of this node is willing to allow replica data and metadata from other Member Nodes to be stored on this node. We encourage people to allow replication to their nodes, as this increases the scalability and flexibility of the network overall. The three "Default" fields set the default values for the replication policies for data and metadata on this node that are generated when System Metadata is not available for an object (such as when it originates from a client that is not DataONE compliant). The ``Default Number of Replicas`` determines how many replica copies of the object should be stored on other Member Nodes. A value of 0 or less indicates that no replicas should be stored. In addition, you can specify a list of nodes that are either preferred for use when choosing replica nodes, or that are blocked from use as replica nodes. This allows Member Nodes to set up bidirectional agreements with partner nodes to replicate data across their sites. The values for both ``Default Preferred Nodes`` and ``Default Blocked Nodes`` is a comma-separated list of NodeReference identifiers that were assigned to the target nodes by DataONE.h](h~The Replication section is used to configure replication options for the node overall and for objects stored in Metacat. The }(h~The Replication section is used to configure replication options for the node overall and for objects stored in Metacat. The hjhhhNhNubjs)}(h``Accept and Store Replicas``h]hAccept and Store Replicas}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubhX4 checkbox is used to indicate that the administrator of this node is willing to allow replica data and metadata from other Member Nodes to be stored on this node. We encourage people to allow replication to their nodes, as this increases the scalability and flexibility of the network overall. The three “Default” fields set the default values for the replication policies for data and metadata on this node that are generated when System Metadata is not available for an object (such as when it originates from a client that is not DataONE compliant). The }(hX0 checkbox is used to indicate that the administrator of this node is willing to allow replica data and metadata from other Member Nodes to be stored on this node. We encourage people to allow replication to their nodes, as this increases the scalability and flexibility of the network overall. The three "Default" fields set the default values for the replication policies for data and metadata on this node that are generated when System Metadata is not available for an object (such as when it originates from a client that is not DataONE compliant). The hjhhhNhNubjs)}(h``Default Number of Replicas``h]hDefault Number of Replicas}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubhX determines how many replica copies of the object should be stored on other Member Nodes. A value of 0 or less indicates that no replicas should be stored. In addition, you can specify a list of nodes that are either preferred for use when choosing replica nodes, or that are blocked from use as replica nodes. This allows Member Nodes to set up bidirectional agreements with partner nodes to replicate data across their sites. The values for both }(hX determines how many replica copies of the object should be stored on other Member Nodes. A value of 0 or less indicates that no replicas should be stored. In addition, you can specify a list of nodes that are either preferred for use when choosing replica nodes, or that are blocked from use as replica nodes. This allows Member Nodes to set up bidirectional agreements with partner nodes to replicate data across their sites. The values for both hjhhhNhNubjs)}(h``Default Preferred Nodes``h]hDefault Preferred Nodes}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubh and }(h and hjhhhNhNubjs)}(h``Default Blocked Nodes``h]hDefault Blocked Nodes}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubhj is a comma-separated list of NodeReference identifiers that were assigned to the target nodes by DataONE.}(hj is a comma-separated list of NodeReference identifiers that were assigned to the target nodes by DataONE.hjhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubh,)}(hXOnce these parameters have been properly set, us the ``Register`` button to request to register with the DataONE Coordinating Node. This will generate a registration document describing this Metacat instance and send it to the Coordinating Node registration service. At that point, all that remains is to wait for the DataONE administrators to approve the node registration. Details of the approval process can be found on the `DataONE web site`_.h](h5Once these parameters have been properly set, us the }(h5Once these parameters have been properly set, us the hjhhhNhNubjs)}(h ``Register``h]hRegister}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubhXm button to request to register with the DataONE Coordinating Node. This will generate a registration document describing this Metacat instance and send it to the Coordinating Node registration service. At that point, all that remains is to wait for the DataONE administrators to approve the node registration. Details of the approval process can be found on the }(hXm button to request to register with the DataONE Coordinating Node. This will generate a registration document describing this Metacat instance and send it to the Coordinating Node registration service. At that point, all that remains is to wait for the DataONE administrators to approve the node registration. Details of the approval process can be found on the hjhhhNhNubh2)}(h`DataONE web site`_h]hDataONE web site}(hhhj2ubah}(h]h!]h#]h%]h']nameDataONE web sitehChttps://dataone.orguh)h1hjhEKubh.}(hjMhjhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhj;hhubh|)}(h).. _DataONE web site: https://dataone.orgh]h}(h]dataone-web-siteah!]h#]dataone web siteah%]h']hCjBuh)h{hKhj;hhhh*hKubeh}(h]$configuring-metacat-as-a-member-nodeah!]h#]$configuring metacat as a member nodeah%]h']uh)h hh hhhh*hKubh )}(hhh](h)}(hAccess Control Policiesh]hAccess Control Policies}(hjfhjdhhhNhNubah}(h]h!]h#]h%]h']uh)hhjahhhh*hKubh,)}(hX}Metacat has supported fine grained access control for objects in the system since its inception. DataONE has devised a simple but effective access control system that is compatible with the prior system in Metacat. For each object in the DataONE system (including data objects, scientific metadata objects, and resource maps), a SystemMetadata_ document describes the critical metadata needed to manage that object in the system. This metadata includes a ``RightsHolder`` field and an ``AuthoritativeMemberNode`` field that are used to list the people and node that have ultimate control over the disposition of the object. In addition, a separate AccessPolicy_ can be included in the ``SystemMetadata`` for the object. This ``AccessPolicy`` consists of a set of rules that grant additional permissions to other people, groups, and systems in DataONE. For example, for one data file, two users (Alice and Bob) may be able make changes to the object, and the general public may be allowed to read the object. In the absence of explicit rules extending these permissions, Metacat enforces the rule that only the ``RightsHolder`` and ``AuthoritativeMemberNode`` have rights to the object, and that the Coordinating Node can manage ``SystemMetadata`` for the object. An example AccessPolicy that might be submitted with a dataset (giving Alice and Bob permission to read and write the object) follows:h](hXKMetacat has supported fine grained access control for objects in the system since its inception. DataONE has devised a simple but effective access control system that is compatible with the prior system in Metacat. For each object in the DataONE system (including data objects, scientific metadata objects, and resource maps), a }(hXKMetacat has supported fine grained access control for objects in the system since its inception. DataONE has devised a simple but effective access control system that is compatible with the prior system in Metacat. For each object in the DataONE system (including data objects, scientific metadata objects, and resource maps), a hjrhhhNhNubh2)}(hSystemMetadata_h]hSystemMetadata}(hhhj{ubah}(h]h!]h#]h%]h']nameSystemMetadatahC[http://releases.dataone.org/online/d1-architecture-1.0.0/apis/Types.html#Types.AccessPolicyuh)h1hjrhEKubhp document describes the critical metadata needed to manage that object in the system. This metadata includes a }(hp document describes the critical metadata needed to manage that object in the system. This metadata includes a hjrhhhNhNubjs)}(h``RightsHolder``h]h RightsHolder}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubh field and an }(h field and an hjrhhhNhNubjs)}(h``AuthoritativeMemberNode``h]hAuthoritativeMemberNode}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubh field that are used to list the people and node that have ultimate control over the disposition of the object. In addition, a separate }(h field that are used to list the people and node that have ultimate control over the disposition of the object. In addition, a separate hjrhhhNhNubh2)}(h AccessPolicy_h]h AccessPolicy}(hhhjubah}(h]h!]h#]h%]h']name AccessPolicyhC[http://releases.dataone.org/online/d1-architecture-1.0.0/apis/Types.html#Types.AccessPolicyuh)h1hjrhEKubh can be included in the }(h can be included in the hjrhhhNhNubjs)}(h``SystemMetadata``h]hSystemMetadata}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubh for the object. This }(h for the object. This hjrhhhNhNubjs)}(h``AccessPolicy``h]h AccessPolicy}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubhXs consists of a set of rules that grant additional permissions to other people, groups, and systems in DataONE. For example, for one data file, two users (Alice and Bob) may be able make changes to the object, and the general public may be allowed to read the object. In the absence of explicit rules extending these permissions, Metacat enforces the rule that only the }(hXs consists of a set of rules that grant additional permissions to other people, groups, and systems in DataONE. For example, for one data file, two users (Alice and Bob) may be able make changes to the object, and the general public may be allowed to read the object. In the absence of explicit rules extending these permissions, Metacat enforces the rule that only the hjrhhhNhNubjs)}(h``RightsHolder``h]h RightsHolder}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubh and }(h and hjrhhhNhNubjs)}(h``AuthoritativeMemberNode``h]hAuthoritativeMemberNode}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubhF have rights to the object, and that the Coordinating Node can manage }(hF have rights to the object, and that the Coordinating Node can manage hjrhhhNhNubjs)}(h``SystemMetadata``h]hSystemMetadata}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjrubh for the object. An example AccessPolicy that might be submitted with a dataset (giving Alice and Bob permission to read and write the object) follows:}(h for the object. An example AccessPolicy that might be submitted with a dataset (giving Alice and Bob permission to read and write the object) follows:hjrhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hKhjahhubj)}(h... /C=US/O=SomeIdP/CN=Alice /C=US/O=SomeIdP/CN=Bob read write ...h]h... /C=US/O=SomeIdP/CN=Alice /C=US/O=SomeIdP/CN=Bob read write ...}(hhhj2ubah}(h]h!]h#]h%]h']jjuh)jhKhjahhhh*ubh,)}(hThese AccessPolicies can be embedded inside of the ``SystemMetadata`` that accompany submission of an object through the `MNStorage.create`_ and `MNStorage.update`_ services, or can be set using the `CNAuthorization.setAccessPolicy`_ service.h](h3These AccessPolicies can be embedded inside of the }(h3These AccessPolicies can be embedded inside of the hj@hhhNhNubjs)}(h``SystemMetadata``h]hSystemMetadata}(hhhjIubah}(h]h!]h#]h%]h']uh)jrhj@ubh4 that accompany submission of an object through the }(h4 that accompany submission of an object through the hj@hhhNhNubh2)}(h`MNStorage.create`_h]hMNStorage.create}(hhhj\ubah}(h]h!]h#]h%]h']nameMNStorage.createhC[http://releases.dataone.org/online/d1-architecture-1.0.0/apis/MN_APIs.html#MNStorage.createuh)h1hj@hEKubh and }(h and hj@hhhNhNubh2)}(h`MNStorage.update`_h]hMNStorage.update}(hhhjrubah}(h]h!]h#]h%]h']nameMNStorage.updatehC[http://releases.dataone.org/online/d1-architecture-1.0.0/apis/MN_APIs.html#MNStorage.updateuh)h1hj@hEKubh# services, or can be set using the }(h# services, or can be set using the hj@hhhNhNubh2)}(h"`CNAuthorization.setAccessPolicy`_h]hCNAuthorization.setAccessPolicy}(hhhjubah}(h]h!]h#]h%]h']nameCNAuthorization.setAccessPolicyhCjhttp://releases.dataone.org/online/d1-architecture-1.0.0/apis/CN_APIs.html#CNAuthorization.setAccessPolicyuh)h1hj@hEKubh service.}(h service.hj@hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hMhjahhubh|)}(ho.. _SystemMetadata: http://releases.dataone.org/online/d1-architecture-1.0.0/apis/Types.html#Types.AccessPolicyh]h}(h]systemmetadataah!]h#]systemmetadataah%]h']hCjuh)h{hMhjahhhh*hKubh|)}(hm.. _AccessPolicy: http://releases.dataone.org/online/d1-architecture-1.0.0/apis/Types.html#Types.AccessPolicyh]h}(h] accesspolicyah!]h#] accesspolicyah%]h']hCjuh)h{hM hjahhhh*hKubh|)}(hq.. _MNStorage.create: http://releases.dataone.org/online/d1-architecture-1.0.0/apis/MN_APIs.html#MNStorage.createh]h}(h]mnstorage-createah!]h#]mnstorage.createah%]h']hCjluh)h{hM hjahhhh*hKubh|)}(hq.. _MNStorage.update: http://releases.dataone.org/online/d1-architecture-1.0.0/apis/MN_APIs.html#MNStorage.updateh]h}(h]mnstorage-updateah!]h#]mnstorage.updateah%]h']hCjuh)h{hMhjahhhh*hKubh|)}(h.. _CNAuthorization.setAccessPolicy: http://releases.dataone.org/online/d1-architecture-1.0.0/apis/CN_APIs.html#CNAuthorization.setAccessPolicyh]h}(h]cnauthorization-setaccesspolicyah!]h#]cnauthorization.setaccesspolicyah%]h']hCjuh)h{hMhjahhhh*hKubeh}(h]access-control-policiesah!]h#]access control policiesah%]h']uh)h hh hhhh*hKubh )}(hhh](h)}(h%Configuration as a replication targeth]h%Configuration as a replication target}(hjhjhhhNhNubah}(h]h!]h#]h%]h']uh)hhjhhhh*hMubh,)}(hXDataONE is designed to enable a robust preservation environment through replication of digital objects at multiple Member Nodes. Any Member Node in DataONE that implements the Tier 4 Service interface can offer to act as a target for object replication. Currently, Metacat configuration supports turning this replication function on or off. When the 'Act as a replication target' checkbox is checked, then Metacat will notify the Coordinating Nodes in DataONE that it is available to house replicas of objects from other nodes. Shortly thereafter, the Coordinating Nodes may notify Metacat to replicate objects from throughout the system, which it will start to do. There objects will begin to be listed in the Metacat catalog.h]hXDataONE is designed to enable a robust preservation environment through replication of digital objects at multiple Member Nodes. Any Member Node in DataONE that implements the Tier 4 Service interface can offer to act as a target for object replication. Currently, Metacat configuration supports turning this replication function on or off. When the ‘Act as a replication target’ checkbox is checked, then Metacat will notify the Coordinating Nodes in DataONE that it is available to house replicas of objects from other nodes. Shortly thereafter, the Coordinating Nodes may notify Metacat to replicate objects from throughout the system, which it will start to do. There objects will begin to be listed in the Metacat catalog.}(hjhjhhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hMhjhhubj!)}(hFuture versions of Metacat will allow finer specification of the Node Replication Policy, which determines the set of objects that it is willing to replicate, using constraints on object size, total objects, source nodes, and object format types.h]h,)}(hFuture versions of Metacat will allow finer specification of the Node Replication Policy, which determines the set of objects that it is willing to replicate, using constraints on object size, total objects, source nodes, and object format types.h]hFuture versions of Metacat will allow finer specification of the Node Replication Policy, which determines the set of objects that it is willing to replicate, using constraints on object size, total objects, source nodes, and object format types.}(hj hj ubah}(h]h!]h#]h%]h']uh)h+hh*hM hjubah}(h]h!]h#]h%]h']uh)j hjhhhh*hNubeh}(h]%configuration-as-a-replication-targetah!]h#]%configuration as a replication targetah%]h']uh)h hh hhhh*hMubh )}(hhh](h)}(hObject Replication Policiesh]hObject Replication Policies}(hj,hj*hhhNhNubah}(h]h!]h#]h%]h']uh)hhj'hhhh*hM&ubh,)}(hXIn addition to access control, each object also can have a ``ReplicationPolicy`` associated with it that determines whether DataONE should attempt to replicate the object for failover and backup purposes to other Member Nodes in the federation. Both the ``RightsHolder`` and ``AuthoritativeMemberNode`` for an object can set the ``ReplicationPolicy``, which consists of fields that describe how many replicas should be maintained, and any nodes that are preferred for housing those replicas, or that should be blocked from housing replicas.h](h;In addition to access control, each object also can have a }(h;In addition to access control, each object also can have a hj8hhhNhNubjs)}(h``ReplicationPolicy``h]hReplicationPolicy}(hhhjAubah}(h]h!]h#]h%]h']uh)jrhj8ubh associated with it that determines whether DataONE should attempt to replicate the object for failover and backup purposes to other Member Nodes in the federation. Both the }(h associated with it that determines whether DataONE should attempt to replicate the object for failover and backup purposes to other Member Nodes in the federation. Both the hj8hhhNhNubjs)}(h``RightsHolder``h]h RightsHolder}(hhhjTubah}(h]h!]h#]h%]h']uh)jrhj8ubh and }(h and hj8hhhNhNubjs)}(h``AuthoritativeMemberNode``h]hAuthoritativeMemberNode}(hhhjgubah}(h]h!]h#]h%]h']uh)jrhj8ubh for an object can set the }(h for an object can set the hj8hhhNhNubjs)}(h``ReplicationPolicy``h]hReplicationPolicy}(hhhjzubah}(h]h!]h#]h%]h']uh)jrhj8ubh, which consists of fields that describe how many replicas should be maintained, and any nodes that are preferred for housing those replicas, or that should be blocked from housing replicas.}(h, which consists of fields that describe how many replicas should be maintained, and any nodes that are preferred for housing those replicas, or that should be blocked from housing replicas.hj8hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hM'hj'hhubh,)}(hThese ReplicationPolicies can be embedded inside of the ``SystemMetadata`` that accompany submission of an object through the `MNStorage.create`_ and `MNStorage.update`_ services, or can be set using the `CNReplication.setReplicationPolicy`_ service.h](h8These ReplicationPolicies can be embedded inside of the }(h8These ReplicationPolicies can be embedded inside of the hjhhhNhNubjs)}(h``SystemMetadata``h]hSystemMetadata}(hhhjubah}(h]h!]h#]h%]h']uh)jrhjubh4 that accompany submission of an object through the }(h4 that accompany submission of an object through the hjhhhNhNubh2)}(h`MNStorage.create`_h]hMNStorage.create}(hhhjubah}(h]h!]h#]h%]h']nameMNStorage.createhCjluh)h1hjhEKubh and }(h and hjhhhNhNubh2)}(h`MNStorage.update`_h]hMNStorage.update}(hhhjubah}(h]h!]h#]h%]h']nameMNStorage.updatehCjuh)h1hjhEKubh# services, or can be set using the }(h# services, or can be set using the hjhhhNhNubh2)}(h%`CNReplication.setReplicationPolicy`_h]h"CNReplication.setReplicationPolicy}(hhhjubah}(h]h!]h#]h%]h']name"CNReplication.setReplicationPolicyhCmhttp://releases.dataone.org/online/d1-architecture-1.0.0/apis/CN_APIs.html#CNReplication.setReplicationPolicyuh)h1hjhEKubh service.}(h service.hjhhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hM/hj'hhubh|)}(h.. _CNReplication.setReplicationPolicy: http://releases.dataone.org/online/d1-architecture-1.0.0/apis/CN_APIs.html#CNReplication.setReplicationPolicyh]h}(h]"cnreplication-setreplicationpolicyah!]h#]"cnreplication.setreplicationpolicyah%]h']hCjuh)h{hM3hj'hhhh*hKubeh}(h]object-replication-policiesah!]h#]object replication policiesah%]h']uh)h hh hhhh*hM&ubh )}(hhh](h)}(h"Generating DataONE System Metadatah]h"Generating DataONE System Metadata}(hj hj hhhNhNubah}(h]h!]h#]h%]h']uh)hhj hhhh*hM7ubh,)}(hXWhen a Metacat instance becomes a Member Node, System Metadata must be generated for the existing content. This can be invoked in the Replication configuration screen of the Metacat administration interface. Initially, Metacat instances will only need to generate System Metadata for their local content (the ``localhost`` entry). In cases where Metacat has participated in replication with other Metacat servers, it may be useful to generate System Metadata for those replica records as well. Please consult both the replication partner's administrator and the DataONE administrators before generating System Metadata for replica content.h](hX5When a Metacat instance becomes a Member Node, System Metadata must be generated for the existing content. This can be invoked in the Replication configuration screen of the Metacat administration interface. Initially, Metacat instances will only need to generate System Metadata for their local content (the }(hX5When a Metacat instance becomes a Member Node, System Metadata must be generated for the existing content. This can be invoked in the Replication configuration screen of the Metacat administration interface. Initially, Metacat instances will only need to generate System Metadata for their local content (the hj hhhNhNubjs)}(h ``localhost``h]h localhost}(hhhj# ubah}(h]h!]h#]h%]h']uh)jrhj ubhX? entry). In cases where Metacat has participated in replication with other Metacat servers, it may be useful to generate System Metadata for those replica records as well. Please consult both the replication partner’s administrator and the DataONE administrators before generating System Metadata for replica content.}(hX= entry). In cases where Metacat has participated in replication with other Metacat servers, it may be useful to generate System Metadata for those replica records as well. Please consult both the replication partner's administrator and the DataONE administrators before generating System Metadata for replica content.hj hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hM8hj hhubj)}(hhh](j)}(h.. figure:: images/screenshots/image069.png :align: center The replication configuration screen for generating System Metadata. h]h}(h]h!]h#]h%]h']uriimages/screenshots/image069.pngj}j*jJ suh)jhj< hh*hMBubj)}(hDThe replication configuration screen for generating System Metadata.h]hDThe replication configuration screen for generating System Metadata.}(hjN hjL ubah}(h]h!]h#]h%]h']uh)jhh*hMBhj< ubeh}(h]id2ah!]h#]h%]h']jcenteruh)jhMBhj hhhh*ubeh}(h]"generating-dataone-system-metadataah!]h#]"generating dataone system metadataah%]h']uh)h hh hhhh*hM7ubh )}(hhh](h)}(hApache configuration detailsh]hApache configuration details}(hjo hjm hhhNhNubaAh}(h]h!]h#]h%]h']uh)hhjj hhhh*hMEubh,)}(hX A number of Apache directives are required for a Member Node to function at Tier 2 or higher and various combinations of these directives may be required for your installation depending on which version of Apache you are running and other requirements detailed below.h]hX A number of Apache directives are required for a Member Node to function at Tier 2 or higher and various combinations of these directives may be required for your installation depending on which version of Apache you are running and other requirements detailed below.}(hj} hj{ hhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hMGhjj hhubh,)}(hXIt's recommended to use LetsEncrypt_ to enable TLS (HTTPS) for your installation and ensure the following directives are set in your VirtualHost to set up both TLS across your host and also enable client certificate based authentication of requests from the Coordinating Node.h](hIt’s recommended to use }(hIt's recommended to use hj hhhNhNubh2)}(h LetsEncrypt_h]h LetsEncrypt}(hhhj ubah}(h]h!]h#]h%]h']name LetsEncrypthChttps://letsencrypt.org/uh)h1hj hEKubh to enable TLS (HTTPS) for your installation and ensure the following directives are set in your VirtualHost to set up both TLS across your host and also enable client certificate based authentication of requests from the Coordinating Node.}(h to enable TLS (HTTPS) for your installation and ensure the following directives are set in your VirtualHost to set up both TLS across your host and also enable client certificate based authentication of requests from the Coordinating Node.hj hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hMIhjj hhubh,)}(h[Ensure your configuration has directives similar to the following at the VirtualHost level:h]h[Ensure your configuration has directives similar to the following at the VirtualHost level:}(hj hj hhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hMKhjj hhubj)}(hXSSLEngine on SSLOptions +StrictRequire +StdEnvVars +ExportCertData SSLVerifyClient none # The default, but explicitly included here SSLVerifyDepth 10 SSLCertificateFile /etc/letsencrypt/live//cert.pem SSLCertificateKeyFile /etc/letsencrypt/live//privkey.pem SSLCertificateChainFile /etc/letsencrypt/live//chain.pem SSLCACertificatePath /etc/ssl/certs/ # Enable authentication with client certificates only for the REST API and # only when the request's user agent isn't a web brwoser or common programming # environment (i.e., is the DataONE Coordinating Node) /d1/mn"> SSLVerifyClient optional h]hXSSLEngine on SSLOptions +StrictRequire +StdEnvVars +ExportCertData SSLVerifyClient none # The default, but explicitly included here SSLVerifyDepth 10 SSLCertificateFile /etc/letsencrypt/live//cert.pem SSLCertificateKeyFile /etc/letsencrypt/live//privkey.pem SSLCertificateChainFile /etc/letsencrypt/live//chain.pem SSLCACertificatePath /etc/ssl/certs/ # Enable authentication with client certificates only for the REST API and # only when the request's user agent isn't a web brwoser or common programming # environment (i.e., is the DataONE Coordinating Node) /d1/mn"> SSLVerifyClient optional }(hhhj ubah}(h]h!]h#]h%]h']jjuh)jhMOhjj hhhh*ubh,)}(hlNote: Setting `SSLVerifyClient none` and the `Location` block above is a workaround for two separate issues:h](hNote: Setting }(hNote: Setting hj hhhNhNubhtitle_reference)}(h`SSLVerifyClient none`h]hSSLVerifyClient none}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh and the }(h and the hj hhhNhNubj )}(h `Location`h]hLocation}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh5 block above is a workaround for two separate issues:}(h5 block above is a workaround for two separate issues:hj hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hMbhjj hhubj)}(hhh](j)}(hhh](h)}(hX>Safari 11 attempts to send a client certificate when `SSLVerifyClient` is set to `optional` even though other browsers do not. Without the above `Location` directive, Safari 11 users will be prompted to select a client certificate to authenticate with even when attempting to browse as a public (unauthenticated) user.h]h,)}(hj h](h5Safari 11 attempts to send a client certificate when }(h5Safari 11 attempts to send a client certificate when hj ubj )}(h`SSLVerifyClient`h]hSSLVerifyClient}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh is set to }(h is set to hj ubj )}(h `optional`h]hoptional}(hhhj& ubah}(h]h!]h#]h%]h']uh)j hj ubh6 even though other browsers do not. Without the above }(h6 even though other browsers do not. Without the above hj ubj )}(h `Location`h]hLocation}(hhhj9 ubah}(h]h!]h#]h%]h']uh)j hj ubh directive, Safari 11 users will be prompted to select a client certificate to authenticate with even when attempting to browse as a public (unauthenticated) user.}(h directive, Safari 11 users will be prompted to select a client certificate to authenticate with even when attempting to browse as a public (unauthenticated) user.hj ubeh}(h]h!]h#]h%]h']uh)h+hh*hMdhj ubah}(h]h!]h#]h%]h']uh)hhj ubh)}(hlibcurl deprecated sending the HTTP `Expect` header with POST requests and programmatic uploads from clients such as the R dataone package will fail unless this `Location` directive is in place and `SSLVerifyClient` is set to `none`. h]h,)}(hlibcurl deprecated sending the HTTP `Expect` header with POST requests and programmatic uploads from clients such as the R dataone package will fail unless this `Location` directive is in place and `SSLVerifyClient` is set to `none`.h](h$libcurl deprecated sending the HTTP }(h$libcurl deprecated sending the HTTP hj\ ubj )}(h`Expect`h]hExpect}(hhhje ubah}(h]h!]h#]h%]h']uh)j hj\ ubhu header with POST requests and programmatic uploads from clients such as the R dataone package will fail unless this }(hu header with POST requests and programmatic uploads from clients such as the R dataone package will fail unless this hj\ ubj )}(h `Location`h]hLocation}(hhhjx ubah}(h]h!]h#]h%]h']uh)j hj\ ubh directive is in place and }(h directive is in place and hj\ ubj )}(h`SSLVerifyClient`h]hSSLVerifyClient}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj\ ubh is set to }(h is set to hj\ ubj )}(h`none`h]hnone}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj\ ubh.}(hjMhj\ ubeh}(h]h!]h#]h%]h']uh)h+hh*hMehjX ubah}(h]h!]h#]h%]h']uh)hhj ubeh}(h]h!]h#]h%]h']jIjJjKhjLjMuh)jhj ubh,)}(hhIf you are running a version of Apache older than 2.4.29, the above set of directives should work fully.h]hhIf you are running a version of Apache older than 2.4.29, the above set of directives should work fully.}(hj hj ubah}(h]h!]h#]h%]h']uh)h+hh*hMghj ubh,)}(hXIf you are running a version of Apache between 2.4.29 and 2.4.39, omit the entire `Location` block in the above snippet and set `SSLVerifyClient optional` instead of `none` across your VirtualHost. Apache 2.4.29 introduced a bug which causes significant delays on TLS renegotiation when using the above `Location` block. But note that this will cause Safari 11 users to see the erroneous client certificate prompt mentioned above. Programmatic uploads from environments such as R will still work.h](hRIf you are running a version of Apache between 2.4.29 and 2.4.39, omit the entire }(hRIf you are running a version of Apache between 2.4.29 and 2.4.39, omit the entire hj ubj )}(h `Location`h]hLocation}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh$ block in the above snippet and set }(h$ block in the above snippet and set hj ubj )}(h`SSLVerifyClient optional`h]hSSLVerifyClient optional}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh instead of }(h instead of hj ubj )}(h`none`h]hnone}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh across your VirtualHost. Apache 2.4.29 introduced a bug which causes significant delays on TLS renegotiation when using the above }(h across your VirtualHost. Apache 2.4.29 introduced a bug which causes significant delays on TLS renegotiation when using the above hj ubj )}(h `Location`h]hLocation}(hhhj ubah}(h]h!]h#]h%]h']uh)j hj ubh block. But note that this will cause Safari 11 users to see the erroneous client certificate prompt mentioned above. Programmatic uploads from environments such as R will still work.}(h block. But note that this will cause Safari 11 users to see the erroneous client certificate prompt mentioned above. Programmatic uploads from environments such as R will still work.hj ubeh}(h]h!]h#]h%]h']uh)h+hh*hMihj ubh,)}(htIf you are running a version of Apache newer than or equal to 2.4.39, the above set of directives should work fully.h]htIf you are running a version of Apache newer than or equal to 2.4.39, the above set of directives should work fully.}(hj- hj+ ubah}(h]h!]h#]h%]h']uh)h+hh*hMkhj ubeh}(h]h!]h#]h%]h']uh)jhjj hhhh*hNubh,)}(hXThe DataONE Certiciate Authority certificate - available from the DataONE administrators - will also need to be added to the directory specified by ``SSLCACertificatePath`` in order to validate client certificates signed by that authority. DataONE has also provided a CA chain file that may be used in lieu of directory-based CA confinguration. The `SSLCACertificateFile` directive should be used when configuring your member node with the DataONE CA chain.h](hThe DataONE Certiciate Authority certificate - available from the DataONE administrators - will also need to be added to the directory specified by }(hThe DataONE Certiciate Authority certificate - available from the DataONE administrators - will also need to be added to the directory specified by hj? hhhNhNubjs)}(h``SSLCACertificatePath``h]hSSLCACertificatePath}(hhhjH ubah}(h]h!]h#]h%]h']uh)jrhj? ubh in order to validate client certificates signed by that authority. DataONE has also provided a CA chain file that may be used in lieu of directory-based CA confinguration. The }(h in order to validate client certificates signed by that authority. DataONE has also provided a CA chain file that may be used in lieu of directory-based CA confinguration. The hj? hhhNhNubj )}(h`SSLCACertificateFile`h]hSSLCACertificateFile}(hhhj[ ubah}(h]h!]h#]h%]h']uh)j hj? ubhV directive should be used when configuring your member node with the DataONE CA chain.}(hV directive should be used when configuring your member node with the DataONE CA chain.hj? hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hMmhjj hhubh,)}(hAWhen these changes have been applied, Apache should be restarted:h]hAWhen these changes have been applied, Apache should be restarted:}(hjv hjt hhhNhNubah}(h]h!]h#]h%]h']uh)h+hh*hMrhjj hhubj)}(h@cd /etc/ssl/certs sudo c_rehash sudo /etc/init.d/apache2 restarth]h@cd /etc/ssl/certs sudo c_rehash sudo /etc/init.d/apache2 restart}(hhhj ubah}(h]h!]h#]h%]h']jjuh)jhMvhjj hhhh*ubh|)}(h).. _LetsEncrypt: https://letsencrypt.org/h]h}(h] letsencryptah!]h#] letsencryptah%]h']hCj uh)h{hMzhjj hhhh*hKubeh}(h]apache-configuration-detailsah!]h#]apache configuration detailsah%]h']uh)h hh hhhh*hMEubh )}(hhh](h)}(h-Configure Tomcat to allow DataONE identifiersh]h-Configure Tomcat to allow DataONE identifiers}(hj hj hhhNhNubah}(h]h!]h#]h%]h']uh)hhj hhhh*hM}ubh,)}(h4Edit ``/etc/tomcat/catalina.properties`` to include:h](hEdit }(hEdit hj hhhNhNubjs)}(h#``/etc/tomcat/catalina.properties``h]h/etc/tomcat/catalina.properties}(hhhj ubah}(h]h!]h#]h%]h']uh)jrhj ubh to include:}(h to include:hj hhhNhNubeh}(h]h!]h#]h%]h']uh)h+hh*hM~hj hhubj)}(h}org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=trueh]h}org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true}(hhhj ubah}(h]h!]h#]h%]h']jjuh)jhMhj hhhh*ubeh}(h]-configure-tomcat-to-allow-dataone-identifiersah!]h#]-configure tomcat to allow dataone identifiersah%]h']uh)h hh hhhh*hM}ubeh}(h]dataone-member-node-supportah!]h#]dataone member node supportah%]h']uh)h hhhhhh*hKubah}(h]h!]h#]h%]h']sourceh*uh)hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj error_encodingUTF-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh* _destinationN _config_files]pep_referencesN pep_base_url https://www.python.org/dev/peps/pep_file_url_templatepep-%04drfc_referencesN rfc_base_urlhttps://tools.ietf.org/html/ tab_widthKtrim_footnote_reference_spacefile_insertion_enabled raw_enabledKsyntax_highlightlong smart_quotessmartquotes_localesNcharacter_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xformembed_stylesheetcloak_email_addressesenvNgettext_compactubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(dataone](h3hKh`herest]j[adataone service interface]jqafour distinct tiers]jacilogon]jaincommon]jadataone web site]j2asystemmetadata]j{a accesspolicy]jamnstorage.create](j\jemnstorage.update](jrjecnauthorization.setaccesspolicy]ja"cnreplication.setreplicationpolicy]ja letsencrypt]j aurefids}nameids}(j j hhj>j;jwjtjWjTjcj`jojljjjjjjjjj8j5j^j[jVjSjjjjjjjjjjjjj$j!j j jjjg jd j j j j j j u nametypes}(j Nhj>NjwNjWjcjojNjNjjj8Nj^NjVjNjjjjjj$Nj Njjg Nj Nj j Nuh}(j h hh}j;hjtjAjTjNj`jZjljfjjzjjjjjjj5jj[j;jSjMjjajjjjjjjjjjj!jj j'jjjd j j jj j j j j jjj\ j< u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startKid_startKparse_messages]transform_messages] transformerN decorationNhhub.