Computing E-Groups Management

What's new?

Computing Groups

The Computing Groups are now normal E-Groups and are manageable through the standard E-Groups interface:

By default, the newly created accounts are not member of any Computing Group. The account is fully functional and can be used for nearly all operations (read mail, access AIS, etc).
However, the Computing Group is needed to get access to AFS and LXPLUS services. The Computing Group Administrator should add the newcomer's account too the appropriate computing group if AFS and LXPLUS are needed.

Group Administrators

Each Computing E-Group have an associated administrators E-Group, named groupname-admins.
Example: Computing E-Group ZP has a corresponding administrators E-Group ZP-Admins (see them live here)

The groupname-admins E-Group is static, and is managed by the groupname-admins group members themselves.

Management Tips

Static E-Group: manual editing

Group Administrators can edit the Computing E-Groups manually.
Adding a user by name can be done as soon as the user is registered in the HR / AIS application.

Dynamic E-Group: Automate the Computing Group membership

Using a dynamic criteria to fill a Computing E-Group will fully automate the membership generation.
Example: the ZP E-Group belonging to ATLAS could be automated using some criterion like Experiment=ATLAS, along with some other criteria to ensure a proper membership.

Tip: As manually adding members will always be required, we strongly suggest to use sub E-Groups, dynamic and static.
Example: ZP E-Group could have 2 sub E-Groups, one ZP-Dynamic-members and one ZP-Static-members allowing both automation and exceptions.

Moving from one group to another

In case a user is changing experiment, the Group Administrators will remove the user from one Computing E-Group and add him/her to the other Computing E-Group.
Note that in case of dynamic Computing E-Groups the change will be automatic.
However, if the user wants his AFS home directory and files group to be changed, he will have to run a specific set of commands as described here.

Multiple computing groups

A user can be member of more than one computing group. It is not necessary to remove an account from a computing group before adding it to another.

Users can change the primary computing group (i.e. the group that will determine the Unix group id of the account) of their own accounts using the CERN Resources Portal.

Computing E-Groups and AFS

The membership in a Computing E-Group is reflected on AFS in the following way:

  • Members of Computing E-Group 'xx' are members of AFS group 'cern:xx'
  • Admins of Computing E-Group 'xx' (i.e. members of E-Group 'xx-admins') are members of AFS group 'xx'

Created: 2/23/2017
Last reviewed: 2/23/2017
Send the page Send  |  Printable version Print