Certificate Proxies

Home > User Info > Access > Proxy Certificates

In order to use Single Sign-on (SSO), a user needs to create a temporary credential called a certificate proxy. The proxy confirms that you are authorized by a trusted authority to access grid resources. It also confirms that you are who you say you are because you must enter the passphrase that was used to create the X.509 certificate. If you are using the default TeraGrid Certificate Authority (CA), this is your TeraGrid-wide password—the same one you use to log in to the User Portal. There is no set-up by the user for this CA.

If you are using another CA, there is inital set-up. To create the proxy, you will use the passphrase you used to create your X.509 certficate (or KX.509 if your CA is PSC). The trusted authority may be a certificate from any of the CAs listed on the Single Sign-on for non-default certificates page.

Once a proxy has been created, you can use gsissh to login to any other TeraGrid system, and you may use an GSI-enabled feature of the TeraGrid during that session. The authority of the proxy has a limited lifetime. Default expiration for a proxy session is 12 hours (however, you may create a longer proxy). After it has expired, you must create a new proxy. Proxies are intended for short-term use when the user is submitting many jobs and cannot be troubled to repeat a password for every job.

Proxies provide a convenient alternative to constantly entering passwords, but are also less secure than the user's normal security credential. Therefore, they should be deleted after they are no longer needed (or after they expire).

Creating a Proxy Using myproxy-logon (all sites)

Most TeraGrid users will use MyProxy to generate a certificate proxy. MyProxy is a certificate repository that offers added security, retrieval, and expiration management features.

To create a proxy, run the myproxy-logon command. When requested, enter your TeraGrid-wide password that you received in your account information packet.

tg-login1> myproxy-logon -T -l your_username
Enter MyProxy pass phrase:
A credential has been received for user your_username in /tmp/x509up_u99999.
Trust roots have been installed in /usr/users/your_username/.globus/certificates.

Have you previously run myproxy-init to store a credential? In that case, myproxy-logon will use this credential, and you will need to enter your previously-chosen myproxy-init passphrase instead of your TeraGrid-wide password.

Additional MyProxy Commands

To retrieve a proxy locally once it's been generated at the server, type the following command:

myproxy-get-delegation

To store a credential on the MyProxy server for shorter or longer than 12 hours:

myproxy-init -c

To store a credential with the same lifetime as your current credential (for example, your long-lived credential from the CA), you can use the "-c 0" option to myproxy-init:

$ myproxy-init -c 0 -s myproxy.teragrid.org
Your identity: /C=US/O=National Center for Supercomputing Applications/CN=user name
Enter GRID pass phrase for this identity:
Creating proxy ............................... Done
Proxy Verify OK
Your proxy is valid until: Thu Oct 20 17:29:28 2005
Enter MyProxy pass phrase:
Verifying - Enter MyProxy pass phrase:
A proxy valid for 7278 hours (303.2 days) for user now exists on myproxy.teragrid.org.

IU, NCSA, ORNL, Purdue, SDSC, TACC, UC/ANL

To create a proxy, run the grid-proxy-init program (after you have obtained an X.509 certificate and entered your DN into the grid-mapfile at each site you will be using).  When requested, enter the passphrase you used when you first created your certificate.

% grid-proxy-init

Your output should look like this:

Your identity: /C=US/O=NPACI/OU=SDSC/CN=Your Full Name/USERID=your_username
Enter GRID pass phrase for this identity:your passphrase
Creating proxy ........................ Done
Your proxy is valid until: Tue Dec 23 23:58:15 2003

N.B., If you log on after your proxy has expired, you must type the grid-proxy-init command again.

There are many commands you can use to manage your proxy certificate.  A few helpful commands are listed in the "Additional Information for grid-proxy" section below.

Creating a MyProxy Certificate (all sites)

To create a proxy, run the myproxy-init program (after you have obtained an X.509 certificate and entered your DN into the grid-mapfile at each site you will be using).  When requested, enter the passphrase you used when you first created your certificate. The hostname should always be myproxy.teragrid.org.

% myproxy-init

Your output should look like this:

site/username> myproxy-init -s myproxy.tergrid.org
Your identity: /C=US/O=NPACI/OU=SDSC/CN=Full Name/USERID=username
Enter GRID pass phrase for this identity:
Creating proxy ......................................................................... Done
Proxy Verify OK
Your proxy is valid until: Fri Dec 24 16:11:18 2004

N.B., If you log on after your proxy has expired, you must type the myproxy-init command again.

Additional MyProxy commands

To retrieve a proxy locally once it's been generated at the server type the following command:

myproxy-get-delegation

To set the lifetime of the credentials you store on the MyProxy server to longer (or shorter) than the default of one week, use the myproxy-init -c option. To store a credential with the same lifetime as your current credential (for example, your long-lived credential from the CA), you can use the "-c 0" option to myproxy-init:

$ myproxy-init -c 0 -s myproxy.teragrid.org
Your identity: /C=US/O=National Center for Supercomputing Applications/CN=user name
Enter GRID pass phrase for this identity:
Creating proxy ............................... Done
Proxy Verify OK
Your proxy is valid until: Thu Oct 20 17:29:28 2005
Enter MyProxy pass phrase:
Verifying - Enter MyProxy pass phrase:
A proxy valid for 7278 hours (303.2 days) for user now exists on myproxy.teragrid.org.

For KCA sites, you can set $X509_USER_KEY and $X509_USER_CERT to tell MyProxy to read the credentials from the location where KCA puts them:

$ export X509_USER_CERT='grid-proxy-info -path'
$ export X509_USER_KEY='grid-proxy-info -path'
$ myproxy-init -c 0 -s myproxy.teragrid.org
Your identity: /C=US/O=National Center for Supercomputing Applications/CN=user name/CN=793146486
Creating proxy .............................. Done
Proxy Verify OK
Your proxy is valid until: Wed Dec 22 03:55:42 2004
Enter MyProxy pass phrase:
Verifying - Enter MyProxy pass phrase:
A proxy valid for 17 hours (0.7 days) for user now exists on myproxy.teragrid.org.