From 17b2a90a5251babb8871a357ccf92496743f7a43 Mon Sep 17 00:00:00 2001 From: dCache Bot Date: Thu, 17 Sep 2026 13:51:26 +0000 Subject: [PATCH] [skip-ci] docs: document VOMS root FQAN matching in grid-vorolemap Assisted-by: reasoning/desy-assistant --- docs/TheBook/src/main/markdown/config-gplazma.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/TheBook/src/main/markdown/config-gplazma.md b/docs/TheBook/src/main/markdown/config-gplazma.md index 63f16daa093..9aed122a747 100644 --- a/docs/TheBook/src/main/markdown/config-gplazma.md +++ b/docs/TheBook/src/main/markdown/config-gplazma.md @@ -1766,6 +1766,10 @@ Therefore each line has three fields: the user's DN, the user's FQAN, and the us The FQAN is sometimes semantically referred to as the “role”. The same user can be mapped to different usernames depending on what their FQAN is. The FQAN is determined by how the user creates their proxy, for example, using [`voms-proxy-init`](config-gplazma.md#voms-proxy-certificate). The FQAN contains the user's Group, Role (optional), and Capability (optional). The latter two may be set to the string “NULL”, in which case they will be ignored by the plug-in. Therefore the three lines in the example above are equivalent. +When matching a FQAN against a `grid-vorolemap` entry, the `voms` plug-in accepts both the VO root itself and any FQAN below it. For example, for the VO `some-vo`, both the FQAN `/some-vo` and `/some-vo/Role=production` are recognised. This means a user with a proxy carrying the root FQAN `/some-vo` can be mapped using a `grid-vorolemap` entry such as + + "/C=DE/O=GermanGrid/OU=DESY/CN=John Doe" "/some-vo" somevo + Example: If a user is authorized in multiple roles, for example