NIH LISTSERV
NIH LISTSERV
CAGRID_USERS-L archives -- August 2006 (#7)

Go to: Previous Message | Next Message
Previous in Topic | Next in Topic
Previous by Same Author | Next by Same Author
Previous Page (August 2006) | Back to Main CAGRID_USERS-L Page


Options: Reply | Post a New Message | Join or Leave CAGRID_USERS-L, or Change Options | Search
View: Chronologically | Most Recent First | Wrap Text (Proportional Font) | Don't Wrap Text (Non-proportional Font)
* 

Content-class: urn:content-classes:message
Content-Type: text/plain; charset="us-ascii"
Thread-Topic: attempting to run dorian service in globus container
Thread-Index: Aca6baQprFR36YE1QgGfA3uJQ48xqwACSBZw
Message-ID:  <[log in to unmask]>
Date:         Mon, 7 Aug 2006 19:18:19 -0400
Reply-To:     caGrid Users discussion Forum <[log in to unmask]>
Sender:       caGrid Users discussion Forum <[log in to unmask]>
From:         "Stephen A. Langella" <[log in to unmask]>
Subject:      Re: attempting to run dorian service in globus container


Joel,

	The first error you are getting might be a firewall issue .  The
second error your are getting looks like you are telling Dorian to
register to an https index service using http.  In your registration.xml
change you index service from
http://10.3.8.1:8443/wsrf/services/DefaultIndexService to
https://10.3.8.1:8443/wsrf/services/DefaultIndexService.  If you wish to
disable registration you can go so in the jndi-config.xml by setting
performRegistration to false.  I am glad to see you were able to get
Dorian up and running.

--Steve


Stephen Langella MS
Senior Research Specialist
Ohio State University
Department of Biomedical Informatics
Multiscale Computing Laboratory
 
Office: (614) 292-9253
Cell: (614) 805-0469
[log in to unmask]
-----Original Message-----
From: caGrid Users discussion Forum [mailto:[log in to unmask]]
On Behalf Of Joel Schneider
Sent: Monday, August 07, 2006 5:53 PM
To: [log in to unmask]
Subject: Re: attempting to run dorian service in globus container

Stephen A. Langella wrote:
> 	An error is occurring when trying to create the database for the
> Dorian Certificate Authority.  My best guess is that the tableExists
> function in gov.nih.nci.cagrid.dorian.common.Database is not working
on
> with your db.  In the past week I have replaced this code as we were
> having a problem on some dual core machines with it.  I have included
> the new version of the tableExists function below.  I am hoping if you
> paste this code over the previous code, rebuild, and redeploy it will
> work.  Unfortunately I have no way of testing this, since I don't have
a
> Solaris box available to me.  If we had a Solaris box that we ran our
> nightly testing on, this problem would have been caught.  In order to
> avoid such problems in the future I will do what I can to get the
caGrid
> team access to a Solaris box such that we may run our testing.

With the modified tableExists method and some other tweaks, I was able
to get the globus 4.0.2 container (running under Solaris) to start the
cagrid/Dorian service without encountering a fatal error.

Two other minor steps were taken in order to get the cagrid/Dorian
service started:

1. Delete the existing DORIAN database remnant ("drop database DORIAN"
    in mysql).  The leftover, partial DORIAN database seemed to confuse
    the setup procedure of the cagrid/Dorian service.  The presumably
    complete DORIAN database now contains CERTIFICATE_AUTHORITY,
    CREDENTIALS, IDP_ASSERTER, IDP_USERS, IFS_USERS, TRUST_MANAGER, and
    TRUST_MANAGER_AUTH_METHODS tables.

2. Add "e.printStackTrace();" to the catch(Exception e) section of the
    gov.nih.nci.cagrid.dorian.service.Dorian constructor.  This was
    needed in order to gain additional information on a fatal error that
    generated a DorianInternalFault at Dorian.java:117, saying only "An
    unexpected error occurred in configuring the service".

    The cause of the DorianInternalFault was a typo in the
    dorian-conf.xml file.  With the typo fixed, it became possible to
    start the globus container, including the new cagrid/Dorian service.

The cagrid/Dorian service now starts successfully, but generates an
error message every 10 minutes, saying it couldn't connect to
cagrid04.bmi.ohio-state.edu:708:

> 2006-08-07 14:05:20,451 WARN  client.ServiceGroupRegistrationClient
[Timer-6,status:471] Warning: Could not register
https://10.3.8.1:8443/wsrf/services/cagrid/Dorian to servicegroup at
http://cagrid04.bmi.ohio-state.edu:7080/wsrf/services/DefaultIndexServic
e -- check the URL and that the remote service is up.  Remote exception
was ; nested exception is:
>         java.net.ConnectException: Connection timed out

The above error makes sense, considering our current firewall policies.
I modified the URL in registration.xml to point at 10.3.8.1:8443, but
that triggered a slightly different set of error messages:

> 2006-08-07 15:58:06,324 ERROR container.GSIServiceThread
[ServiceThread-16,process:145] Error processing request
> java.io.IOException: Token length 1347375956 > 33554432
>         at
org.globus.gsi.gssapi.net.impl.GSIGssInputStream.readToken(GSIGssInputSt
ream.java:93)
>         at
org.globus.gsi.gssapi.net.impl.GSIGssInputStream.readHandshakeToken(GSIG
ssInputStream.java:54)
>         at
org.globus.gsi.gssapi.net.impl.GSIGssSocket.readToken(GSIGssSocket.java:
60)
>         at
org.globus.gsi.gssapi.net.GssSocket.authenticateServer(GssSocket.java:12
2)
>         at
org.globus.gsi.gssapi.net.GssSocket.startHandshake(GssSocket.java:142)
>         at
org.globus.gsi.gssapi.net.GssSocket.getOutputStream(GssSocket.java:161)
>         at
org.globus.wsrf.container.GSIServiceThread.process(GSIServiceThread.java
:102)
>         at
org.globus.wsrf.container.ServiceThread.run(ServiceThread.java:302)
> 2006-08-07 15:58:06,333 WARN  client.ServiceGroupRegistrationClient
[Timer-5,status:471] Warning: Could not register
https://10.3.8.1:8443/wsrf/services/cagrid/Dorian to servicegroup at
http://10.3.8.1:8443/wsrf/services/DefaultIndexService -- check the URL
and that the remote service is up.  Remote exception was ; nested
exception is:
>         java.net.SocketException: Broken pipe

Is the DefaultIndexService registration essential?  If not, is there an
easy way to disable it?


> 	To answer your question Dorian can generate you a new CA
> certificate / private key or you can import your own.  For the beta
> release we don't have any tooling for importing your own, if you wish
to
> do so, you need to do it programmatically.  For the caGrid 1.0 release
> we will provide a command line tool for importing your own CA
> credentials.  

Thanks for the info, and for your help.

Best regards,
Joel

-- 
Joel Schneider                National Marrow Donor Program
Software Developer            3001 Broadway Street NE
phone: 612-617-8321           Minneapolis, MN 55413
email: [log in to unmask]      http://www.marrow.org/



Back to: Top of message | Previous page | Main CAGRID_USERS-L page

NIH LISTSERV Home Page

CIT
Center for Information Technology
National Institutes of Health
Bethesda, Maryland 20892
301 594 6248 (v) 301 496 8294 (TDD)
Comments and Assistance
Accessibility wheelchair icon