CILogon Portal Support

The portal application of the DataONE Coordinating Nodes interacts with the CILogon infrastructure to retrieve the client certificate generated by CILogon once a user has authenticated with their identity provider. The portal uses a public key generated from the CN wild card certificate to identify itself when requesting authenticated client certificates from CILogon. The public key is registered with CILogon to produce a myproxy id that is recorded with the portal configuration.

The following steps should be followed to register an environment with CILogon. This procedure should be repeated whenever the server certificate for the CNs is changed.

1. Find the public key for the certificate used by the server. The dataone-cn-portal buildout postinst script will create a file based on the public certificate that is configured for the given CN (usually a wildcard for the domain). For our test environments, it is:

   /etc/ssl/certs/_.test.dataone.org.crt.publickey
   

   It’s the stuff between BEGIN/END PUBLIC KEY.

2. Register this public key with CILogon to get a myproxy id:

   https://cilogon.org/oauth/register
   

   You should only register with the round-robin hostname (once per environment) and use URLs that are not machine-specific. Here’s an example from SANDBOX2:

   Name:          DataONE Coordinating Node - Sandbox 2
   Home uri:      https://cn-sandbox-2.test.dataone.org/portal
   Failure uri:   https://cn-sandbox-2.test.dataone.org/portal/pages/client-error.jsp
   Creation time: Wed Jan 28 17:37:48 CST 2015
   Generated
   identifier:    myproxy:oa4mp,2012:/client/66a303882b6e4bec1e91cbf2ccda1e8
   

3. Include this myproxy id in the portal configuration file. Config file:

   /var/lib/tomcat7/webapps/portal/WEB-INF/client.xml
   

   For more permanent CN buildouts (e.g., DEV2), include it in the dataone-cn-portal postinst script such that the correct myproxy id will be set in the config file on installation in this environment (there is a big condition block for this).

4. By now, CILogon will have reported back to the email address you registered with that the myproxy client registration is active.