OCM Configuration

Introduction

The Infinite Scale OCM service provides federated sharing functionality based on ScienceMesh and the OCM 1.1.0 HTTP API.

Overview:

  • ScienceMesh ScienceMesh Logo is the Federated Science Cloud Mesh that connects existing and heterogeneous sites in a transparent way. It provides a managed white list of trusted federated sites.

  • The Open Cloud Mesh Protocol (OCM) provides the disovery and use of the RESTful API endpoints, request and response headers, possible response codes, request and response formats, hypermedia controls, error handling etc. Using this protocol, consumers do not need to accept a share, the shared resource will be available to them immediately.

Both API’s have their roots in CERN where providing resources to trusted partners in an easy way is a key for their daily scientific work.

See the Setting Up Federations Using ScienceMesh for details on how to set up sharing between users via a federation using OCM, the configuration of which is described here.

Default Values

  • OCM listens on port 9280 by default.

Enable OCM

To enable OpenCloudMesh, you have to set the following environment variable.

OCIS_ENABLE_OCM=true

Trust Between Instances

For security, privacy, and data protection reasons, federation invitations are restricted to trusted instances. These must be defined by the administrator before users create a federation.

The OCM service implements an invitation workflow for trusted instances when creating federated shares.

The list of trusted providers for an instance is defined by a json file. Note that this ocmproviders.json file, which contains this configuration, is expected to be in the root of the Infinite Scale config directory, unless otherwise specified. See the OCM_OCM_PROVIDER_AUTHORIZER_PROVIDERS_FILE environment variable for more details.

If you want all instances of a federation to trust each other, you can use an ocmproviders.json file like this for all instances. The following sample federation consists of two instances: cloud.owncloud.test and cloud.ocis.test, which can use the Invitation Workflow described below to create, send, and accept invitations.

[
    {
        "name": "oCIS Test",
        "full_name": "oCIS Test provider",
        "organization": "oCIS",
        "domain": "cloud.ocis.test",
        "homepage": "https://ocis.test",
        "description": "oCIS Example cloud storage",
        "services": [
            {
                "endpoint": {
                    "type": {
                        "name": "OCM",
                        "description": "cloud.ocis.test Open Cloud Mesh API"
                    },
                    "name": "cloud.ocis.test - OCM API",
                    "path": "https://cloud.ocis.test/ocm/",
                    "is_monitored": true
                },
                "api_version": "1.1.0",
                "host": "http://cloud.ocis.test"
            },
            {
                "endpoint": {
                    "type": {
                        "name": "Webdav",
                        "description": "cloud.ocis.test Webdav API"
                    },
                    "name": "cloud.ocis.test Example - Webdav API",
                    "path": "https://cloud.ocis.test/dav/",
                    "is_monitored": true
                },
                "api_version": "1.1.0",
                "host": "https://cloud.ocis.test/"
            }
        ]
    },
    {
        "name": "ownCloud Test",
        "full_name": "ownCloud Test provider",
        "organization": "ownCloud",
        "domain": "cloud.owncloud.test",
        "homepage": "https://owncloud.test",
        "description": "ownCloud Example cloud storage",
        "services": [
            {
                "endpoint": {
                    "type": {
                        "name": "OCM",
                        "description": "cloud.owncloud.test Open Cloud Mesh API"
                    },
                    "name": "cloud.owncloud.test - OCM API",
                    "path": "https://cloud.owncloud.test/ocm/",
                    "is_monitored": true
                },
                "api_version": "1.1.0",
                "host": "http://cloud.owncloud.test"
            },
            {
                "endpoint": {
                    "type": {
                        "name": "Webdav",
                        "description": "cloud.owncloud.test Webdav API"
                    },
                    "name": "cloud.owncloud.test Example - Webdav API",
                    "path": "https://cloud.owncloud.test/dav/",
                    "is_monitored": true
                },
                "api_version": "1.1.0",
                "host": "https://cloud.owncloud.test/"
            }
        ]
    }
]
The domain must not contain the protocol as it must match the GOCDB site object domain.

Invitation Workflow

After the federation is set up, but before a resource can be shared between remote users, a user must be invited by the sharer. See Setting up Federations Using ScienceMesh for more details.

Internally, a request is sent to the ScienceMesh API. The generated token is passed to the recipient who then accepts the invitation. As a result, remote users are added on both sides and the data for this grant is stored in a file defined by the OCM_OCM_INVITE_MANAGER_JSON_FILE environment variable.

Configuration

Environment Variables

The ocm service is configured via the following environment variables. Read the Environment Variable Types documentation for important details. Column IV shows with which release the environment variable has been introduced.

404: Not Found

  • 8.2.0

404: Not Found

YAML Example

  • 8.2.0

404: Not Found