---
name: "libXrdSecgsiVOMS"
section: "1"
platform: "linux"
package: "xrootd-voms-plugins"
version: "5.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/libXrdVoms"
---

# libXrdSecgsiVOMS(1)

XRootD plug-in to extract VOMS attributes

Part of [libXrdVoms(1)](/libXrdVoms/1.md).

## NAME

libXrdVoms - XRootD plug-in to extract VOMS attributes

## SYNOPSIS

```
sec.protparm gsi -vomsfun:libXrdVoms.so
sec.protparm gsi -vomsfunparms:options
```

## DESCRIPTION

The **libXrdVoms** plug-in provides an implementation of the

```
int XrdSecgsiVOMSFun(XrdSecEntity &ent)
int XrdSecgsiVOMSInit(const char *cfg)
```

functions making use of the official VOMS API libraries to validate and extract the VOMS attributes from a VOMS proxy.

## OPTIONS

The following options are available:

**certfmt={raw,pem,x509}**

Certificate format: **raw** to be used with XrdCrypto tools; **pem** PEM base64 format (as in cert files); **x509**, as a STACK\_OF(X509). Default: **raw**.

**grpopt=opt**

Defines how to use the group names information; **opt** is defined as **sel** \* 10 + **which**, with **sel** either **0** (consider all the groups present in the VOMS extension) or **1** (select among those groups specified by the **grps** option; see below); **which** can be either **0** (take the first one) or **1** (take the last) or **2** (take all, comma separated, and created a vertically sliced tuple; see **NOTES** below).

**grps=grp1\[,grp2,...\]**

Group(s) for which the information is extracted; if specified, the grpopt **sel** is set to **1** regardless of the setting; see **NOTES** below.

**vos=vo1\[,vo2,...\]**

VOs to be considered; the first match is taken; see **NOTES** below.

**grpfmt=fmtstring**, **rolefmt=fmtstring**, **vofmt=fmtstring**

String to be used to format the content of XrdSecEntity::grps, XrdSecEntity::role, XrdSecEntity::vorg, respectively. These strings are optional and by default they are empty.

Recognized place holders in the above format strings:

```
<r>: role
<g>: group
<vo>: VO
<an>: Full Qualified Attribute Name
```

For example, rolefmt=\<g\>\|grpfmt=\<r\>\|vofmt="\<vo\> \<an\>" will inverse the group and role, and will add a space and the FQAN in the vorg field of XrdSecEntity.

**dbg**

Force verbose mode.

Multiple options can be specified separated by '\|**'.**

## NOTES

**Specifying grps** or **vos** options forces a failure if the requested group and/or VO is not found. In this regard, this plug-in may act as a sort of authorization filter. Note that most refined authorization based on VOMS information may be achieved using the **libXrdSecgsiAuthzVO** plug-in distributed with XRootD.

Option 'all' for the group selection (which=2) will generated a vertically sliced tuple including VO, group and role fields. For example, the following VOMS attributes

```
attribute : /atlas/de/Role=production/Capability=NULL
attribute : /atlas/de/Role=NULL/Capability=NULL
attribute : /atlas/Role=NULL/Capability=NULL
```

would result in following content in the XrdSecEntity fields:

```
vorg: atlas atlas atlas
grps: /atlas/de /atlas/de /atlas
role: producton NULL NULL
```

The default XrdAcc will take its decision by checking in turn the triplets obtained slicing vertically this tuple.

## EXAMPLES

The following example shows how configure the plugin to select VO=cms, select the first group, use the PEM format for the proxy and switch on debugging; it shows also how to specify multiple options, either on the same line or on multiple lines.

```
sec.protparm gsi -vomsfun:libXrdVoms.so
sec.protparm gsi -vomsfunparms:grpopt=0|vos=cms|certfmt=pem
sec.protparm gsi -vomsfunparms:dbg
```

## FILES

The plug-in files are

```
lib64/libXrdVoms-4.so (or lib/libXrdVoms-4.so)
include/xrootd/private/XrdVoms/XrdVoms.hh
```

and are typically available under **/usr**.

## ENVIRONMENT

The environment **X509\_VOMS\_DIR** must be set to a valid directory; this is typically **/etc/grid-security/vomsdir**.

## DIAGNOSTICS

The **libXrdVoms** plug-in requires **libvomsapi.so** and the openssl libraries. In case of load failure it may be useful to check with ldd if all the required dependencies are correctly resolved.

## LICENSE

LGPL; see http://www.gnu.org/licenses/.

## AUTHOR AND SUPPORT

The **libXrdVoms** plug-in has been implemented by Gerardo Ganis (Gerardo.Ganis@cern.ch). Any request for support should addressed via the project main web site\
 https://github.com/gganis/vomsxrd

or via the XRootD support site\
 https://github.com/xrootd/xrootd