nordugrid-arc-hed 5.3.0~rc1-1 / usr / share / arc / profiles / general.xml

<?xml version="1.0" encoding="utf-8"?>
<!--
 Profiles are used to convert INI-style configuration files into XMLs
which are then consumed by 'arched' and possibly other utilities.
INI-style files consist of sections marked by 
  [section name]
at beginning of section. Each section contains
  tag=value
elements. Profiles is a template for XML file with some parts of it
replaced by information from INI-style confguration during processing.
That processing is called mapping.
 Special tag 'profile' in special section [common] defines which template 
to use. 'value' of 'profile' tag is either absolute path to file containing
XML profile or name of profile (name of file with path and .xml suffix
stripped) installed along with ARC, usually at INSTALL_PATH/share/arc.
 If there is no 'profile' tag in [common] section then profile from 
INSTALL_PATH/share/arc/general.xml is used.
 Each element/configuration block which should be configurable from a INI
config, should be present in the profile and appended with the following
attributes depending on how the mapping should be done.
 * inisections: Its value defines a space separated ordered list of INI
    sections in which the element can be configured.
 * initag: Its value defines the name of the tag to use in INI to set value
    of the element.
 * initype: Its value defines type of mapping. Possible values are: single,
    attribute, multi, multielement, and multisection.
   * single: It is the default if no initype has been specified. Will map
      one tag to one element. The first tag from first 'inisection' is used.
   * attribute: Will map one tag to one attribute.
   * multi: Will map multiple tags (identical tag names in same section) to 
      multiple elements. Tags from first 'inisection' are used.
   * multielement: Is used to multiple tags (identical tag names in same 
      section) to a XML tree structure.
   * multisection: Maps multiple ini sections to multiple XML tree structures.
      First tag from every 'inisection' is used.
 * inidefaultvalue: Its value defines the default value of the element in
    case the corresponding tag was not specified in INI.
 * initokenenables: Used to enable different elements/blocks in the
    profile, based on the presence of a specific section or the presence of
    a specific tag (optional) with a specific value (optional) in a specific 
    section. The format of this attribute is: '<section>[#<tag>[=<value>]]'.
 * initokendisables: Opposite of initokenenables. The element is enabled unless
    the specific tag is present. The format is the same as initokenenables.
-->
<ArcConfig
    xmlns="http://www.nordugrid.org/schemas/loader/2009/08"
    xmlns:ahash="http://www.nordugrid.org/schemas/ahash/2009/08"
    xmlns:arex="http://www.nordugrid.org/schemas/a-rex/2009/08"
    xmlns:bar="http://www.nordugrid.org/schemas/bartender/2009/08"
    xmlns:base="http://www.nordugrid.org/schemas/arcconfig/2009/08"
    xmlns:echo="http://www.nordugrid.org/schemas/echo/2009/08"
    xmlns:infosys="http://www.nordugrid.org/schemas/InfoRegisterConfig/2008"
    xmlns:ip="http://www.nordugrid.org/schemas/a-rex/InfoProvider/2009/08"
    xmlns:isis="http://www.nordugrid.org/schemas/isis/2009/08"
    xmlns:java="http://www.nordugrid.org/schemas/javawrapper/2009/08"
    xmlns:lib="http://www.nordugrid.org/schemas/librarian/2009/08"
    xmlns:lrms="http://www.nordugrid.org/schemas/a-rex/LRMS/2009/08"
    xmlns:py="http://www.nordugrid.org/schemas/pythonwrapper/2009/08"
    xmlns:shep="http://www.nordugrid.org/schemas/shepherd/2009/08"
    xmlns:tcp="http://www.nordugrid.org/schemas/tcp/2009/08"
    xmlns:tls="http://www.nordugrid.org/schemas/tls/2009/08"
    xmlns:janitor="http://www.nordugrid.org/schemas/Janitor/2009/08"
  >
  <base:Server>
    <base:PidFile inisections="common" initag="pidfile" inidefaultvalue="/var/run/arched.pid"/>
    <base:User inisections="common" initag="user"/>
    <base:Group inisections="common" initag="group"/>
    <base:Logger>
      <base:File inisections="common" initag="logfile" inidefaultvalue="/var/log/arc/arched.log"/>
      <base:Level inisections="common" initag="loglevel" inidefaultvalue="WARNING"/>
      <!-- By default Logrotate is used. Configuring arc-logrotatation might cause problems.
      <Maxsize inisections="common" initag="logmaxsize">10000000</Maxsize>
      <Backups inisections="common" initag="logbackups">10</Backups>
      -->
    </base:Logger>
  </base:Server>
  <ModuleManager>
    <Path initype="multi" inisections="common" initag="libpath" inidefaultvalue="/usr/lib/arc"/>
  </ModuleManager>
  <Plugins>
    <Name>mcctcp</Name>
    <Name initokendisables="common#secure=no">mcctls</Name>
    <Name>mcchttp</Name>
    <Name>mccsoap</Name>
    <Name>arcshc</Name>
    <Name initokenenables="common#identitymap">identitymap</Name>
    <Name initokenenables="arex#identitymap">identitymap</Name>
    <Name initokenenables="arex">arex</Name>
    <Name initokenenables="isis">isis</Name>
    <Name initokenenables="echo">echo</Name>
  </Plugins>
  <Chain>
    <Component name="tcp.service" id="tcp">
      <next initokendisables="common#secure=no" id="tls"/>
      <next initokenenables="common#secure=no" id="http"/>
      <tcp:Listen>
        <tcp:Interface inisections="common" initag="interface" inidefaultvalue="localhost"/>
        <tcp:Port inisections="common" initag="port" inidefaultvalue="443"/>
        <tcp:Version inisections="common" initag="ipversion" inidefaultvalue="4"/>
      </tcp:Listen>
    </Component>
    <Component initokendisables="common#secure=no" name="tls.service" id="tls">
      <next id="http"/>
      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="common#identitymap">
        <!-- identitymap=path in [common] enables mapping of user DN to local username -->
        <PDP name="allow.pdp">
          <LocalList inisections="common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>
      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="common#gridmap">
        <!-- gridmap=path in [common] filters users by their DN -->
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>
      <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
      <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
      <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      <tls:VOMSCertTrustDNChain>
        <tls:VOMSCertTrustRegex>.*</tls:VOMSCertTrustRegex>
      </tls:VOMSCertTrustDNChain>
      <tls:VOMSProcessing inisections="common" initag="voms_processing" inidefaultvalue="standard"/>
    </Component>
    <Component name="http.service" id="http">
      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="common#policystore">
        <!-- policystore=path in [common] applies policy file. Attributes up to HTTP level can be used.  -->
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>
      <next id="soap">POST</next>
      <next id="plexer">GET</next>
      <next id="plexer">HEAD</next>
      <next id="plexer">PUT</next>
    </Component>
    <Component name="soap.service" id="soap">
      <next id="plexer"/>
      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="common#usernametokenfile">
        <!-- usernametokenfile=path in [common] authorizes requests using UsernameToken in SOAP header. -->
        <Process>extract</Process>
        <PasswordSource inisections="common" initag="usernametokenfile"/>
      </SecHandler>
      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="common#x509token_cert_dir">
        <!-- x509token_cert_dir=path in [common] checks X.509 signatures of SOAP requests against known CAs. -->
        <Process>extract</Process>
        <CACertificatesDir inisections="common" initag="x509token_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Component>
    <Plexer name="plexer.service" id="plexer">
      <next id="a-rex" inisections="arex" initag="endpointpattern" initokenenables="arex" inidefaultvalue="^/arex\(/\|$\)"/>
      <next id="isis" inisections="isis" initag="endpointpattern" initokenenables="isis" inidefaultvalue="^/isis$"/>
      <next id="echo" inisections="echo" initag="endpointpattern" initokenenables="echo" inidefaultvalue="^/echo$"/>
      <next id="pyecho" inisections="pyecho" initag="endpointpattern" initokenenables="pyecho" inidefaultvalue="^/pyecho$"/>
      <next id="javaecho" inisections="javaecho" initag="endpointpattern" initokenenables="javaecho" inidefaultvalue="^/javaecho$"/>
      <next id="bartender" inisections="bartender" initag="endpointpattern" initokenenables="bartender" inidefaultvalue="^/bartender$"/>
      <next id="ahash" inisections="ahash" initag="endpointpattern" initokenenables="ahash" inidefaultvalue="^/ahash$"/>
      <next id="librarian" inisections="librarian" initag="endpointpattern" initokenenables="librarian" inidefaultvalue="^/librarian$"/>
      <next id="shepherd" inisections="shepherd" initag="endpointpattern" initokenenables="shepherd" inidefaultvalue="^/shepherd$"/>
      <next id="hopi-chelonia" inisections="shepherd" initag="hopi-endpointpattern" initokenenables="shepherd" inidefaultvalue="^/shepherd/"/>
      <next id="hopi" inisections="hopi" initag="endpointpattern" initokenenables="hopi" inidefaultvalue="^/hopi"/>
      <next id="datadeliveryservice" inisections="datadelivery-service" initag="endpointpattern" initokenenables="datadelivery-service" inidefaultvalue="^/datadeliveryservice"/>
    </Plexer>

    <Service name="a-rex" id="a-rex" initokenenables="arex">
      <!-- Optional endpoint element is advised in case of multiple IP adresses -->
      <arex:endpoint inisections="arex" initag="endpoint"/>
      <!-- Use information generated by identity.map plugin or default provided below -->
      <arex:usermap>
        <arex:defaultLocalName inisections="arex" initag="defaultlocalname" inidefaultvalue="nobody"/>
      </arex:usermap>
      <arex:gmrun inisections="arex" initag="gmrunmode" inidefaultvalue="internal"/>
      <arex:commonName inisections="arex" initag="commonname" inidefaultvalue="A-REX"/>
      <arex:longDescription inisections="arex" initag="description"/>
      <arex:OperatingSystem inisections="arex" initag="operatingsystem"/>
      <arex:debugLevel inisections="arex" initag="loglevel" inidefaultvalue="WARNING"/>
      <arex:serviceMail inisections="arex" initag="servicemail"/>
      <arex:loadLimits>
        <arex:maxJobsTracked inisections="arex" initag="maxjobstracked"/>
        <arex:maxJobsRun inisections="arex" initag="maxjobsrun"/>
        <arex:maxJobsTotal inisections="arex" initag="maxjobstotal"/>
        <arex:maxJobsPerDN inisections="arex" initag="maxjobsperdn"/>
        <arex:maxJobsTransferred inisections="arex" initag="maxjobstransferred" inidefaultvalue="10"/>
        <arex:maxJobsTransferredAdditional inisections="arex" initag="maxjobstransferredadditional" inidefaultvalue="1"/>
        <arex:maxFilesTransferred inisections="arex" initag="maxfilestransferred" inidefaultvalue="5"/>
        <arex:wakeupPeriod inisections="arex" initag="wakeupperiod" inidefaultvalue="120"/>
        <arex:maxLoadShare inisections="arex" initag="maxloadshare"/>
        <arex:loadShareType inisections="arex" initag="loadsharetype"/>
        <arex:shareLimit initype="multisection" inisections="arex/sharelimit">
          <arex:name inisections="#this" initag="name"/>
          <arex:limit inisections="#this" initag="limit"/>
        </arex:shareLimit>
      </arex:loadLimits>
      <arex:dataTransfer>
        <arex:secureTransfer inisections="arex" initag="securetransfer" inidefaultvalue="false"/>
        <arex:passiveTransfer inisections="arex" initag="passivetransfer" inidefaultvalue="false"/>
        <arex:localTransfer inisections="arex" initag="localtransfer" inidefaultvalue="false"/>
        <arex:enableDTR inisections="arex" initag="enable_dtr" inidefaultvalue="false"/>
        <arex:preferredPattern inisections="arex" initag="preferredpattern"/>
        <arex:timeouts>
          <arex:minSpeed inisections="arex" initag="minspeed" inidefaultvalue="0"/>
          <arex:minSpeedTime inisections="arex" initag="minspeedtime" inidefaultvalue="300"/>
          <arex:minAverageSpeed inisections="arex" initag="minaveragespeed" inidefaultvalue="0"/>
          <arex:maxInactivityTime inisections="arex" initag="maxinactivitytime" inidefaultvalue="300"/>
        </arex:timeouts>
        <arex:DTR>
          <arex:maxDelivery inisections="arex/data-staging" initag="maxdelivery"/>
          <arex:maxProcessor inisections="arex/data-staging" initag="maxprocessor"/>
          <arex:maxEmergency inisections="arex/data-staging" initag="maxemergency"/>
          <arex:maxPrepared inisections="arex/data-staging" initag="maxprepared"/>
          <arex:shareType inisections="arex/data-staging" initag="sharetype"/>
          <arex:definedShare initype="multisection" inisections="arex/data-staging/defined-share">
            <arex:name inisections="#this" initag="name"/>
            <arex:priority inisections="#this" initag="priority"/>
          </arex:definedShare>
          <arex:deliveryService initype="multi" inisections="arex/data-staging" initag="deliveryservice"/>
          <arex:localDelivery inisections="arex/data-staging" initag="localdelivery" inidefaultvalue="false"/>
          <arex:remoteSizeLimit inisections="arex/data-staging" initag="remotesizelimit" inidefaultvalue="0"/>
          <arex:useHostCert inisections="arex/data-staging" initag="usehostcert" inidefaultvalue="false"/>
          <arex:dtrLog inisections="arex/data-staging" initag="dtrlog"/>
        </arex:DTR>
        <arex:maxRetries inisections="arex" initag="maxtransfertries" inidefaultvalue="10"/>
        <arex:mapURL initype="multisection" inisections="arex/urlmap">
          <link initype="attribute" inisections="#this" initag="link"/>
          <arex:from inisections="#this" initag="from"/>
          <arex:to inisections="#this" initag="to"/>
          <arex:at inisections="#this" initag="at"/>
        </arex:mapURL>
        <arex:Globus>
          <arex:gridmapfile inisections="arex common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
          <arex:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <arex:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <arex:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
          <arex:TCPPortRange inisections="arex" initag="tcpportrange"/>
          <arex:UDPPortRange inisections="arex" initag="udpportrange"/>
        </arex:Globus>
        <arex:httpProxy inisections="arex" initag="httpproxy"/>
      </arex:dataTransfer>
      <arex:jobLogPath inisections="arex" initag="joblogpath"/>
      <arex:jobReport initokenenables="arex/jobreport">
        <arex:publisher inisections="arex/jobreport" initag="publisher" inidefaultvalue="jura"/>
        <arex:destination inisections="arex/jobreport" initag="destination"/>
        <arex:expiration inisections="arex/jobreport" initag="expiration"/>
        <arex:type inisections="arex/jobreport" initag="type"/>
        <arex:parameters inisections="arex/jobreport" initag="parameters"/>
      </arex:jobReport>
      <arex:authPlugin initype="multisection" inisections="arex/authplugin">
        <timeout initype="attribute" inisections="#this" initag="timeout"/>
        <onSuccess initype="attribute" inisections="#this" initag="onsuccess"/>
        <onFailure initype="attribute" inisections="#this" initag="onfailure"/>
        <onTimeout initype="attribute" inisections="#this" initag="ontimeout"/>
        <arex:state inisections="#this" initag="state"/>
        <arex:command inisections="#this" initag="command"/>
      </arex:authPlugin>
      <arex:control>
        <arex:username inisections="arex" initag="username" inidefaultvalue="."/>
        <arex:controlDir inisections="arex" initag="controldir" inidefaultvalue="/var/spool/arc/jobstatus"/>
        <arex:sessionRootDir initype="multi" inisections="arex" initag="sessionrootdir"/>
        <arex:cache>
          <arex:location initype="multisection" inisections="arex/cache/location">
            <arex:path inisections="#this" initag="path"/>
            <arex:link inisections="#this" initag="link"/>
          </arex:location>
          <arex:remotelocation initype="multisection" inisections="arex/cache/remotelocation">
            <arex:path inisections="#this" initag="path"/>
            <arex:link inisections="#this" initag="link"/>
          </arex:remotelocation>
          <arex:highWatermark inisections="arex/cache" initag="highwatermark" inidefaultvalue="80"/>
          <arex:lowWatermark inisections="arex/cache" initag="lowwatermark" inidefaultvalue="70"/>
          <arex:cacheLogFile inisections="arex/cache" initag="logfile" inidefaultvalue="/var/log/arc/cache-clean.log"/>
          <arex:cacheLogLevel inisections="arex/cache" initag="loglevel" inidefaultvalue="2"/>
          <arex:cacheLifetime inisections="arex/cache" initag="lifetime"/>
          <arex:cacheCleanTimeout inisections="arex/cache" initag="cachecleantimeout"/>
        </arex:cache>
        <arex:defaultTTL inisections="arex" initag="defaultttl" inidefaultvalue="604800"/>
        <arex:defaultTTR inisections="arex" initag="defaultttr" inidefaultvalue="2592000"/>
        <arex:maxReruns inisections="arex" initag="maxreruns" inidefaultvalue="5"/>
        <arex:noRootPower inisections="arex" initag="norootpower" inidefaultvalue="false"/>
      </arex:control>

      <arex:helperUtility initype="multisection" inisections="arex/helperutil">
          <arex:username inisections="#this" initag="username"/>
          <arex:command inisections="#this" initag="command"/>
      </arex:helperUtility>

      <arex:LRMSName initokenenables="lrms/fork">fork</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/fork">
        <arex:type>fork</arex:type>
        <arex:defaultShare inisections="lrms/fork" initag="defaultshare"/>

        <!-- Doesnt make sense for fork -->
        <arex:sharedFilesystem inisections="lrms/fork" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/fork" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/fork" initag="scratchdir"/>
        <arex:runtimeDir inisections="lrms/fork" initag="runtimedir"/>
        <arex:GNUTimeUtility inisections="lrms/fork" initag="gnutime" inidefaultvalue="/usr/bin/time"/>
      </arex:LRMS>

      <arex:LRMSName initokenenables="lrms/pbs">pbs</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/pbs">
        <arex:type>pbs</arex:type>
        <arex:defaultShare inisections="lrms/pbs" initag="defaultshare"/>

        <arex:sharedFilesystem inisections="lrms/pbs" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/pbs" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/pbs" initag="scratchdirectory"/>
        <arex:runtimeDir inisections="lrms/pbs" initag="runtimedirectory"/>
        <arex:GNUTimeUtility inisections="lrms/pbs" initag="gnutime"/>

        <lrms:pbs_bin_path inisections="lrms/pbs" initag="bin_path"/>
        <lrms:pbs_log_path inisections="lrms/pbs" initag="log_path"/>
        <lrms:dedicated_node_string inisections="lrms/pbs" initag="dedicated_node_string"/>
        <lrms:maui_bin_path inisections="lrms/pbs" initag="maui_bin_path"/>
      </arex:LRMS>

      <arex:LRMSName initokenenables="lrms/sge">sge</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/sge">
        <arex:type>sge</arex:type>
        <arex:defaultShare inisections="lrms/sge" initag="defaultshare"/>

        <arex:sharedFilesystem inisections="lrms/sge" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/sge" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/sge" initag="scratchdirectory"/>
        <arex:runtimeDir inisections="lrms/sge" initag="runtimedirectory"/>
        <arex:GNUTimeUtility inisections="lrms/sge" initag="gnutime"/>

        <lrms:sge_bin_path inisections="lrms/sge" initag="bin_path"/>
        <lrms:sge_root inisections="lrms/sge" initag="root"/>
        <lrms:sge_cell inisections="lrms/sge" initag="cell"/>
        <lrms:sge_qmaster_port inisections="lrms/sge" initag="qmaster_port"/>
        <lrms:sge_execd_port inisections="lrms/sge" initag="execd_port"/>
      </arex:LRMS>

      <arex:LRMSName initokenenables="lrms/condor">condor</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/condor">
        <arex:type>condor</arex:type>
        <arex:defaultShare inisections="lrms/condor" initag="defaultshare"/>

        <arex:sharedFilesystem inisections="lrms/condor" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/condor" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/condor" initag="scratchdirectory"/>
        <arex:runtimeDir inisections="lrms/condor" initag="runtimedirectory"/>
        <arex:GNUTimeUtility inisections="lrms/condor" initag="gnutime"/>

        <lrms:condor_bin_path inisections="lrms/condor" initag="bin_path"/>
        <lrms:condor_config inisections="lrms/condor" initag="condor_config"/>
        <lrms:condor_rank inisections="lrms/condor" initag="rank"/>
      </arex:LRMS>

      <arex:LRMSName initokenenables="lrms/lsf">lsf</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/lsf">
        <arex:type>lsf</arex:type>
        <arex:defaultShare inisections="lrms/lsf" initag="defaultshare"/>

        <arex:sharedFilesystem inisections="lrms/lsf" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/lsf" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/lsf" initag="scratchdirectory"/>
        <arex:runtimeDir inisections="lrms/lsf" initag="runtimedirectory"/>
        <arex:GNUTimeUtility inisections="lrms/lsf" initag="gnutime"/>

        <lrms:lsf_bin_path inisections="lrms/lsf" initag="bin_path"/>
        <lrms:lsf_profile_path inisections="lrms/lsf" initag="profile_path"/>
        <lrms:lsf_architecture inisections="lrms/lsf" initag="architecture"/>
      </arex:LRMS>

      <arex:LRMSName initokenenables="lrms/ll">ll</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/ll">
        <arex:type>ll</arex:type>
        <arex:defaultShare inisections="lrms/ll" initag="defaultshare"/>

        <arex:sharedFilesystem inisections="lrms/ll" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/ll" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/ll" initag="scratchdirectory"/>
        <arex:runtimeDir inisections="lrms/ll" initag="runtimedirectory"/>
        <arex:GNUTimeUtility inisections="lrms/ll" initag="gnutime"/>

        <lrms:ll_bin_path inisections="lrms/ll" initag="bin_path"/>
        <lrms:ll_consumable_resources inisections="lrms/ll" initag="consumable_resources"/>
      </arex:LRMS>

      <arex:LRMSName initokenenables="lrms/slurm">slurm</arex:LRMSName>
      <arex:LRMS initokenenables="lrms/slurm">
        <arex:type>slurm</arex:type>
        <arex:defaultShare inisections="lrms/slurm" initag="defaultshare"/>

        <arex:sharedFilesystem inisections="lrms/slurm" initag="sharedfilesystem"/>
        <arex:sharedScratch inisections="lrms/slurm" initag="sharedscratch"/>
        <arex:scratchDir inisections="lrms/slurm" initag="scratchdirectory"/>
        <arex:runtimeDir inisections="lrms/slurm" initag="runtimedirectory"/>
        <arex:GNUTimeUtility inisections="lrms/slurm" initag="gnutime"/>

        <lrms:slurm_bin_path inisections="lrms/slurm" initag="bin_path"/>
        <lrms:slurm_wakeupperiod inisections="lrms/slurm" initag="wakeupperiod"/>
      </arex:LRMS>

      <arex:InfoproviderWakeupPeriod inisections="arex/info" initag="wakeupperiod" inidefaultvalue="30"/>
      <arex:InfoProvider>
        <arex:debugLevel inisections="arex/info" initag="loglevel" inidefaultvalue="INFO"/>
        <ip:ProviderLog inisections="arex/info" initag="providerlog" inidefaultvalue="/var/log/arc/infoprovider.log"/>

        <ip:ClusterName inisections="arex/info" initag="clustername"/>
        <ip:ClusterAlias inisections="arex/info" initag="clusteralias"/>
        <ip:OtherInfo initype="multi" inisections="arex/info" initag="otherinfo"/>
        <ip:AdminDomain inisections="arex/info" initag="admindomain"/>
        <ip:StatusInfo initype="multi" inisections="arex/info" initag="statusinfo"/>
        <ip:Benchmark initype="multi" inisections="arex/info" initag="benchmark"/>
        <ip:Downtime inisections="arex/info" initag="downtime"/>

        <!-- publish XML rendering of Nordugrid Info System -->
        <!-- only for publication in legacy infosys -->
        <ip:PublishNordugrid initokenenables="arex/info/nordugrid">yes</ip:PublishNordugrid>
        <ip:ClusterOwner initype="multi" inisections="arex/info/nordugrid" initag="clusterowner"/>
        <ip:OpSys initype="multi" inisections="arex/info/nordugrid" initag="operatingsystem"/>
        <ip:Middleware initype="multi" inisections="arex/info/nordugrid" initag="middleware"/>
        <ip:AuthorizedVO initype="multi" inisections="arex/info/nordugrid" initag="authorizedvo"/>
        <ip:LocalSE initype="multi" inisections="arex/info/nordugrid" initag="localse"/>
        <ip:InteractiveContactstring initype="multi" inisections="arex/info/nordugrid" initag="intcontactstring"/>
        <!-- end legacy options -->

        <ip:Location initokenenables="arex/info/location">
          <ip:Name inisections="arex/info/location" initag="name"/>
          <ip:Address inisections="arex/info/location" initag="address"/>
          <ip:Place inisections="arex/info/location" initag="place"/>
          <ip:Country inisections="arex/info/location" initag="country"/>
          <ip:PostCode inisections="arex/info/location" initag="postcode"/>
          <ip:Latitude inisections="arex/info/location" initag="latitude"/>
          <ip:Longitude inisections="arex/info/location" initag="longitude"/>
        </ip:Location>

        <ip:Contact initype="multisection" initokenenables="arex/info/contact" inisections="arex/info/contact">
          <ip:Name inisections="#this" initag="name"/>
          <ip:OtherInfo initype="multi" inisections="#this" initag="otherinfo"/>
          <ip:Detail inisections="#this" initag="detail"/>
          <ip:Type inisections="#this" initag="type"/>
        </ip:Contact>

        <ip:AccessPolicy initype="multisection" initokenenables="arex/info/accesspolicy" inisections="arex/info/accesspolicy">
          <ip:Rule inisections="#this" initag="rule"/>
          <ip:UserDomainID inisections="#this" initag="userdomainid"/>
        </ip:AccessPolicy>

        <ip:MappingPolicy initype="multisection" initokenenables="arex/info/mappingpolicy" inisections="arex/info/mappingpolicy">
          <ip:ShareName inisections="#this" initag="share"/>
          <ip:Rule inisections="#this" initag="rule"/>
          <ip:UserDomainID inisections="#this" initag="userdomainid"/>
        </ip:MappingPolicy>

        <ip:ExecutionEnvironment initype="multisection" initokenenables="arex/info/executionenvironment" inisections="arex/info/executionenvironment">
          <name initype="attribute" inisections="#this" initag="name"/>

          <ip:NodeSelection>
            <ip:Regex initype="multi" inisections="#this" initag="nodeselectionregex"/>
            <ip:Tag initype="multi" inisections="#this" initag="nodeselectiontag"/>
            <ip:Command initype="multi" inisections="#this" initag="nodeselectioncommand"/>
          </ip:NodeSelection>

          <ip:Homogeneous inisections="#this" initag="homogeneous"/>
          <ip:OtherInfo initype="multi" inisections="#this" initag="otherinfo"/>
          <ip:PhysicalCPUs inisections="#this" initag="physicalcpus"/>
          <ip:LogicalCPUs inisections="#this" initag="logicalcpus"/>
          <ip:VirtualMachine inisections="#this" initag="virtualmachine"/>
          <ip:Platform inisections="#this" initag="platform"/>
          <ip:OSFamily inisections="#this" initag="osfamily"/>
          <ip:OSName inisections="#this" initag="osname"/>
          <ip:OSVersion inisections="#this" initag="osversion"/>
          <ip:CPUVendor inisections="#this" initag="cpuvendor"/>
          <ip:CPUModel inisections="#this" initag="cpumodel"/>
          <ip:CPUVersion inisections="#this" initag="cpuversion"/>
          <ip:CPUClockSpeed inisections="#this" initag="cpuclockspeed"/>
          <ip:CPUTimeScalingFactor inisections="#this" initag="cputimescalingfactor"/>
          <ip:WallTimeScalingFactor inisections="#this" initag="walltimescalingfactor"/>
          <ip:MainMemorySize inisections="#this" initag="mainmemorysize"/>
          <ip:VirtualMemorySize inisections="#this" initag="virtualmemorysize"/>
          <ip:NetworkInfo inisections="#this" initag="networkinfo"/>
          <ip:ConnectivityIn inisections="#this" initag="connectivityin"/>
          <ip:ConnectivityOut inisections="#this" initag="connectivityout"/>
          <ip:Benchmark initype="multi" inisections="#this" initag="benchmark"/>
        </ip:ExecutionEnvironment>

        <ip:ComputingShare initype="multisection" inisections="arex/info/share">
          <name initype="attribute" inisections="#this" initag="name"/>
          <ip:Description inisections="#this" initag="description"/>
          <ip:OtherInfo initype="multi" inisections="#this" initag="otherinfo"/>
          <ip:MappingQueue inisections="#this" initag="mappingqueue"/>
          <ip:ExecutionEnvironmentName initype="multi" inisections="#this" initag="executionenvironment"/>
          <ip:MaxVirtualMemory inisections="#this" initag="maxvirtualmemory"/>
          <ip:MaxSlotsPerJob inisections="#this" initag="maxslotsperjob"/>
          <ip:SchedulingPolicy inisections="#this" initag="schedulingpolicy"/>
          <ip:Preemption inisections="#this" initag="preemption"/>

          <lrms:queue_node_string initokenenables="lrms/pbs" inisections="#this" initag="queue_node_string"/>
          <lrms:sge_jobopts initokenenables="lrms/sge" inisections="#this" initag="sge_jobopts"/>
          <lrms:condor_requirements initokenenables="lrms/condor" inisections="#this" initag="condor_requirements"/>
          <lrms:lsf_architecture  initokenenables="lrms/lsf" inisections="#this" initag="lsf_architecture"/>
        </ip:ComputingShare>
      </arex:InfoProvider>

      <arex:useJanitor inisections="arex" initag="usejanitor"/>
      <arex:janitor initokenenables="arex/janitor">
        <janitor:logconf inisections="arex/janitor" initag="logconf"/>
        <janitor:registrationdir inisections="arex/janitor" initag="registrationdir"/>
        <janitor:installationdir inisections="arex/janitor" initag="installationdir"/>
        <janitor:downloaddir inisections="arex/janitor" initag="downloaddir"/>
        <janitor:jobexpirytime inisections="arex/janitor" initag="jobexpirytime"/>
        <janitor:rteexpirytime inisections="arex/janitor" initag="rteexpirytime"/>
        <janitor:uid inisections="arex/janitor" initag="uid"/>
        <janitor:gid inisections="arex/janitor" initag="gid"/>
        <janitor:allow_base inisections="arex/janitor" initag="allow_base"/>
        <janitor:allow_rte inisections="arex/janitor" initag="allow_rte"/>
        <janitor:catalog initype="multisection" initokenenables="arex/janitor/catalog" inisections="arex/janitor/catalog">
          <name initype="attribute" inisections="#this" initag="name"/>
          <janitor:location inisections="#this" initag="location"/>
        </janitor:catalog>
      </arex:janitor>

      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="arex" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="arex" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="arex" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="arex" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="arex#identitymap">
        <!-- identitymap=path in [arex] enables mapping of user DN to local username only for A-REX operations -->
        <PDP name="allow.pdp">
          <LocalList inisections="arex" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="arex#gridmap">
        <!-- gridmap=path in [arex] filters users by their DN for A-REX operations only -->
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="arex" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="common#policystore">
        <!-- policystore=path in [arex] applies policy file. -->
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="arex" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <!-- Not using these SecHandlers because they _require_ SOAP. At least not yet.

       usernametokenfile=path in [arex] authorizes requests using UsernameToken in SOAP header for A-REX operations. 
      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="arex#usernametokenfile">
        <Process>extract</Process>
        <PasswordSource inisections="arex" initag="usernametokenfile"/>
      </SecHandler>

       x509token_cert_dir=path in [arex] checks X.509 signatures of SOAP requests against known CAs. 
      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="arex#x509token_cert_dir">
        <Process>extract</Process>
        <CACertificatesDir inisections="arex" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>

      -->
    </Service>

    <Service name="isis" id="isis" initokenenables="isis">
      <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
      <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
      <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      <!-- The URL where the service can be accessed from outside. -->
      <isis:Endpoint inisections="isis" initag="endpoint"/>
      <!-- Retry: Retry specifies how many times communication to ISIS have to fail/timeout to start treating it as unavailable. -->
      <isis:Retry inisections="isis" initag="retry" inidefaultvalue="5"/>
      <!-- Sparsity: It determines the number of neighbors as a function of the actual number of member nodes of the network. -->
      <isis:Sparsity inisections="isis" initag="sparsity" inidefaultvalue="2"/>
      <!-- ETValid: Period for checking the entries in the soft state database and strip the expired entries (but still keep them). -->
      <isis:ETValid inisections="isis" initag="etvalid" inidefaultvalue="43200"/>
      <!-- ETRemove: Period for checking the entries in the soft state database and remove the expired entries. -->
      <isis:ETRemove inisections="isis" initag="etremove" inidefaultvalue="86400"/>
      <!-- DBPath: Path of directory where the database is locally stored. -->
      <isis:DBPath inisections="isis" initag="dbpath"/>
      <!-- The URLs of other ISISes to form a cloud - could be zero or more. -->
      <isis:InfoProvider initype="multi" inisections="isis" initag="infoprovider"/>
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="isis" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="isis" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="isis" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="isis" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="isis#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="isis common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="isis#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="isis common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="isis#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="isis common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="isis#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="isis common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="isis#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="isis common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="echo" id="echo" initokenenables="echo">
      <echo:prefix inisections="echo" initag="prefix" inidefaultvalue="["/>
      <echo:suffix inisections="echo" initag="suffix" inidefaultvalue="]"/>
      <!-- InfoRegister part: where and how to register this service -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="echo" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="echo" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
          <infosys:ServiceID inisections="register" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="echo#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="echo common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="echo#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="echo common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="echo#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="echo common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="echo#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="echo common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="echo#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="echo common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="pythonservice" id="pyecho" initokenenables="pyecho">
      <py:ClassName>echo_python.EchoService.EchoService</py:ClassName>
      <echo:prefix inisections="pyecho" initag="prefix" inidefaultvalue="["/>
      <echo:suffix inisections="pyecho" initag="suffix" inidefaultvalue="]"/>
      <!-- If we want to register the service, don't use NoRegister, and use InfoRegister. -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="pyecho" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="pyecho" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="pyecho" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="pyecho" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="pyecho#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="pyecho common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="pyecho#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="pyecho common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="pyecho#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="pyecho common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="pyecho#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="pyecho common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="pyecho#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="pyecho common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="javaservice" id="javaecho" initokenenables="javaecho">
      <java:ClassName>EchoService</java:ClassName>
      <java:ClassPath inisections="javaecho" initag="classpath"/>
      <echo:prefix inisections="javaecho" initag="prefix" inidefaultvalue="["/>
      <echo:suffix inisections="javaecho" initag="suffix" inidefaultvalue="]"/>
      <!-- If we want to register the service, don't use NoRegister, and use InfoRegister. -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="javaecho" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="javaecho" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="javaecho" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="javaecho" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="javaecho#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="javaecho common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="javaecho#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="javaecho common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="javaecho#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="javaecho common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="javaecho#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="javaecho common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="javaecho#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="javaecho common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="pythonservice" id="bartender" initokenenables="bartender">
      <bar:ClassName>storage.bartender.bartender.BartenderService</bar:ClassName>
      <!-- LibrarianURL: Zero or more Librarian URLs -->
      <bar:LibrarianURL initype="multi" inisections="bartender" initag="librarianurl"/>
      <!-- ISISURL: Zero or more ISIS URLs (only used if there are no LibrarianURLs) -->
      <bar:ISISURL initype="multi" inisections="bartender chelonia" initag="isisurl"/>
      <!-- ISISCheckingPeriod: How frequently (in seconds) the Bartender checks the ISIS for Librarians -->
      <bar:ISISCheckingPeriod inisections="bartender" initag="isischeckingperiod"/>
      <!-- ProxyStore: Local directory where the Bartender stores the delegated proxies -->
      <bar:ProxyStore initokenenables="bartender/gateway" inisections="bartender/gateway" initag="proxystore" inidefaultvalue="/var/spool/arc/proxy_store"/>
      <!-- GatewayClass: The python class providing gateway functionality. Optional -->
      <bar:GatewayClass initokenenables="bartender/gateway">storage.bartender.gateway.gateway.Gateway</bar:GatewayClass>
      <!-- GatewayCfg: The configuration of the gateway. Optional -->
      <bar:GatewayCfg initokenenables="bartender/gateway">
        <!-- ProxyStore: Where are the proxies stored: should be the same as above -->
        <bar:ProxyStore inisections="bartender/gateway" initag="proxystore" inidefaultvalue="/var/spool/arc/proxy_store"/>
        <!-- CACertificatesDir: Where are the trusted CA certificates stored -->
        <bar:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </bar:GatewayCfg>

      <!-- CLIENTSSL: This section provides the location of key and cert files and the CA dir or path
          for the service to be able to make HTTPS connections to other services. -->
      <ClientSSLConfig>
        <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
        <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
        <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </ClientSSLConfig>

      <!-- If we don't want the service to register, use NoRegister, and don't use InfoRegister. -->
      <!-- <infosys:NoRegister/> -->
      <!-- If we want to register the service, don't use NoRegister, and use InfoRegister. -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="bartender" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="bartender" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="isis" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="register" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="register" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="bartender#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="bartender common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="bartender#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="bartender common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="bartender#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="bartender common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="bartender#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="bartender common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="bartender#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="bartender common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="pythonservice" id="ahash" initokenenables="ahash">
      <ahash:ClassName>storage.ahash.ahash.AHashService</ahash:ClassName>
      <ahash:AHashClass initokenenables="ahash#type=centralized">storage.ahash.ahash.CentralAHash</ahash:AHashClass>
      <ahash:StoreClass initokenenables="ahash#type=centralized">arcom.store.cachedpicklestore.CachedPickleStore</ahash:StoreClass>
      <ahash:AHashClass initokenenables="ahash#type=replicated">storage.ahash.replicatedahash.ReplicatedAHash</ahash:AHashClass>
      <!-- Endpoint: The URL of this service. -->
      <ahash:Endpoint initokenenables="ahash#type=replicated" inisections="ahash" initag="endpoint"/>
      <!-- PeerURL: The URL of other A-Hash services. Can be one ore more. -->
      <ahash:PeerURL initokenenables="ahash#type=replicated" initype="multi" inisections="ahash" initag="peerurl"/>
      <!-- Priority: Set the likeliness of this node to become a master. 0 is non-electible. -->
      <ahash:Priority initokenenables="ahash#type=replicated" inisections="ahash" initag="priority" inidefaultvalue="50"/>
      <!-- CheckPeriod: How often the A-Hash should check for connected nodes. -->
      <ahash:CheckPeriod initokenenables="ahash#type=replicated" inisections="ahash" initag="checkperiod" inidefaultvalue="30"/>
      <!-- StoreCacheTTL: How many changes can be done in cache without actually writing it back into the database. -->
      <ahash:StoreCacheTTL initokenenables="ahash" inisections="ahash" initag="storecachettl" inidefaultvalue="20"/>
      <!-- StoreCfg: The configuration of the store, which is only the path of the directory to store the data. Only the TransDBStore has additional parameters. -->
      <ahash:StoreCfg>
        <!-- DataDir: path of the directory to store the database (for all types of stores) -->
        <ahash:DataDir inisections="ahash" initag="datadir" inidefaultvalue="/var/spool/arc/ahash_data"/>
        <!-- CacheSize: Size of DB cached in memory (only for TransDBStore)-->
        <ahash:CacheSize initokenenables="ahash#type=replicated" inisections="ahash" initag="cachesize" inidefaultvalue="10MB"/>
      </ahash:StoreCfg>

      <ClientSSLConfig initokenenables="ahash#type=replicated">
        <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
        <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
        <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </ClientSSLConfig>

      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="ahash" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="ahash" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="ahash" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="ahash" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="ahash#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="ahash common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="ahash#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="ahash common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="ahash#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="ahash common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="ahash#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="ahash common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="ahash#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="ahash common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="pythonservice" id="librarian" initokenenables="librarian">
      <lib:ClassName>storage.librarian.librarian.LibrarianService</lib:ClassName>
      <!-- AHashURL: Zero or more A-Hash URLs -->
      <lib:AHashURL initype="multi" inisections="librarian" initag="ahashurl"/>
      <!-- ISISURL: Zero or more ISIS URLs (only used if there are no AHashURLs) -->
      <lib:ISISURL initype="multi" inisections="librarian chelonia" initag="isisurl"/>
      <!-- HeartbeatTimeout: how frequently (in seconds) the Shepherds should send heartbeats to the Librarian. -->
      <lib:HeartbeatTimeout inisections="librarian" initag="heartbeattimeout" inidefaultvalue="120"/>
      <!-- CheckPeriod: how frequently (in seconds) the Librarian should check for Shepherds who hasn't sent a heartbeat in time. -->
      <lib:CheckPeriod inisections="librarian" initag="checkperiod" inidefaultvalue="20"/>

      <ClientSSLConfig>
        <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
        <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
        <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </ClientSSLConfig>

      <!-- If we don't want the service to register, use NoRegister, and don't use InfoRegister. -->
      <!-- <infosys:NoRegister/> -->
      <!-- If we want to register the service, don't use NoRegister, and use InfoRegister. -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="librarian" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="librarian" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="librarian" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="librarian" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="librarian#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="librarian common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="librarian#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="librarian common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="librarian#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="librarian common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="librarian#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="librarian common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="librarian#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="librarian common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="pythonservice" id="shepherd" initokenenables="shepherd">
      <shep:ClassName>storage.shepherd.shepherd.ShepherdService</shep:ClassName>
      <!-- ServiceID: the ID of the Shepherd which currently must be its URL -->
      <shep:ServiceID inisections="shepherd" initag="endpoint"/>
      <!-- CheckPeriod: how frequently (in seconds) the Shepherd should check the files it stores. -->
      <shep:CheckPeriod inisections="shepherd" initag="checkperiod" inidefaultvalue="20"/>
      <!-- MinCheckInterval: how long time (in seconds) the Shepherd should sleep between two subsequent file checks. -->
      <shep:MinCheckInterval inisections="shepherd" initag="mincheckinterval" inidefaultvalue="0.1"/>
      <!-- CreatingTimeout: how long time (in seconds) the Shepherd should wait before it decides that a started file upload is failed. -->
      <shep:CreatingTimeout inisections="shepherd" initag="creatingtimeout"/>
      <!-- ChecksumLifetime: how frequently (in seconds) the checksum of the files should be recalculated. -->
      <shep:ChecksumLifetime inisections="shepherd" initag="checksumlifetime"/>

      <shep:StoreClass>arcom.store.cachedpicklestore.CachedPickleStore</shep:StoreClass>
      <!-- StoreCfg: The configuration of the store, which is only the path of the directory to store the data. -->
      <shep:StoreCfg>
        <!-- DataDir: path of the directory to store the database (for all types of stores) -->
        <shep:DataDir inisections="shepherd" initag="datadir" inidefaultvalue="/var/spool/arc/shepherd_data"/>
      </shep:StoreCfg>

      <shep:BackendClass>storage.shepherd.hardlinkingbackend.HopiBackend</shep:BackendClass>
      <!-- BackendCfg: the configuration of the chosen backend -->
      <shep:BackendCfg>
        <!-- StoreDir: path of the local directory to store the files -->
        <shep:StoreDir inisections="shepherd" initag="storedir" inidefaultvalue="/var/spool/arc/shepherd_store"/>
        <!-- TransferDir: path of the local directory from where the storage element service serves the files to the world -->
        <shep:TransferDir inisections="shepherd" initag="transferdir" inidefaultvalue="/var/spool/arc/shepherd_transfer"/>
        <!-- TURLPrefix: the URL of the storage element service, the Shepherd will put the ID of the file to the end of this URL to make a TURL -->
        <shep:TURLPrefix inisections="shepherd" initag="turlprefix"/>
      </shep:BackendCfg>

      <!-- LibrarianURL: Zero or more Librarian URLs -->
      <shep:LibrarianURL initype="multi" inisections="shepherd" initag="librarianurl"/>
      <!-- BartenderURL: Zero or more Bartender URLs -->
      <shep:BartenderURL initype="multi" inisections="shepherd" initag="bartenderurl"/>
      <!-- ISISURL: Zero or more ISIS URLs (only used if there are no LibrarianURLs or no BartenderURLs) -->
      <shep:ISISURL initype="multi" inisections="shepherd chelonia" initag="isisurl"/>
      <!-- ISISCheckingPeriod: How frequently (in seconds) the Shepherd should check the ISIS for Librarians or Bartenders -->
      <shep:ISISCheckingPeriod inisections="shepherd" initag="isischeckingperiod"/>

      <ClientSSLConfig>
        <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
        <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
        <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </ClientSSLConfig>

      <!-- If we don't want the service to register, use NoRegister, and don't use InfoRegister. -->
      <!-- <infosys:NoRegister/> -->
      <!-- If we want to register the service, don't use NoRegister, and use InfoRegister. -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="shepherd" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="shepherd" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="shepherd" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="shepherd" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="shepherd#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="shepherd common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="shepherd#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="shepherd common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="shepherd#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="shepherd common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="shepherd#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="shepherd common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="shepherd#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="shepherd common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>

    <Service name="hopi" id="hopi-chelonia" initokenenables="shepherd">
      <!-- DocumentRoot: the path of the directory where the files are stored which should be served to the world (should be same as the Shepherd's TransferDir) -->
      <DocumentRoot inisections="shepherd" initag="transferdir" inidefaultvalue="/var/spool/arc/shepherd_transfer"/>
      <!-- SlaveMode: if "1" then Hopi runs in a special "Slave mode" which is needed for Chelonia. -->
      <SlaveMode>1</SlaveMode>
    </Service>

    <Service name="hopi" id="hopi" initokenenables="hopi">
      <!-- DocumentRoot: the path of the directory where the files are stored which should be served to the world -->
      <DocumentRoot inisections="hopi" initag="documentroot"/>
      <!-- SlaveMode: if "1" then Hopi runs in a special "Slave mode" which is needed for Chelonia. -->
      <SlaveMode inisections="hopi" initag="slavemode"/>
      <!-- If we don't want the service to register, use NoRegister, and don't use InfoRegister. -->
      <!-- <infosys:NoRegister/> -->
      <!-- If we want to register the service, don't use NoRegister, and use InfoRegister. -->
      <infosys:InfoRegister initokenenables="register">
        <!-- Endpoint: defines URL of the service as seen from outside. -->
        <infosys:Endpoint inisections="hopi" initag="endpoint"/>
        <!-- ServiceID: defines the unique id of the service propagated outside. (Optional, if omitted, the Endpoint will be used as a ServiceID) -->
        <infosys:ServiceID inisections="hopi" initag="serviceid"/>
        <!-- Expiration: defines the expiration time of the information provided by the service (at least 2 minutes). In xsd:duration format. -->
        <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
        <!-- Period: specifies how often registration has to be done (at least 2 minutes). In xsd:duration format. -->
        <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
        <!-- Registrar: One or more Registrars sections specify where to send the registration message -->
        <infosys:Registrar initype="multielement" inisections="register" initag="registrar">
          <!-- URL: The URL of the ISIS service where we want to register this service -->
          <infosys:URL initype="#this"/>
          <!-- Retry: How many times we retry connecting to an ISIS before treat it as unavailable. -->
          <infosys:Retry inisections="register" initag="retry" inidefaultvalue="5"/>
          <!-- Endpoint: defines URL of the service as seen from outside. Optional, custom for this Registrar.-->
          <infosys:Endpoint inisections="hopi" initag="endpoint"/>
          <!-- ServiceID: defines the unique id of the service propagated outside. Optional, custom for this Registrar.-->
          <infosys:ServiceID inisections="hopi" initag="serviceid"/>
          <!-- Expiration: defines the expiration time of the information provided by the service. Optional, custom for this Registrar.-->
          <infosys:Expiration inisections="register" initag="expiration" inidefaultvalue="PT10M"/>
          <!-- Period: specifies how often registration has to be done. Optional, custom for this Registrar.-->
          <infosys:Period inisections="register" initag="period" inidefaultvalue="PT3M"/>
          <tls:KeyPath inisections="common" initag="x509_user_key" inidefaultvalue="/etc/grid-security/hostkey.pem"/>
          <tls:CertificatePath inisections="common" initag="x509_user_cert" inidefaultvalue="/etc/grid-security/hostcert.pem"/>
          <tls:CACertificatesDir inisections="common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
        </infosys:Registrar>
      </infosys:InfoRegister>

      <SecHandler name="identity.map" id="map" event="incoming" initokenenables="hopi#enable_security_handler=identitymap">
        <PDP name="allow.pdp">
          <LocalList inisections="hopi common" initag="identitymap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="pdps" event="incoming" initokenenables="hopi#enable_security_handler=gridmap">
        <PDP name="simplelist.pdp">
          <location initype="attribute" inisections="hopi common" initag="gridmap" inidefaultvalue="/etc/grid-security/grid-mapfile"/>
        </PDP>
      </SecHandler>

      <SecHandler name="arc.authz" id="authz" event="incoming" initokenenables="hopi#enable_security_handler=policystore">
        <PDP name="arc.pdp">
          <PolicyStore>
            <Type>file</Type>
            <Location type="file" inisections="hopi common" initag="policystore"/>
          </PolicyStore>
        </PDP>
      </SecHandler>

      <SecHandler name="usernametoken.handler" id="usernametoken" event="incoming" initokenenables="hopi#enable_security_handler=usernametoken">
        <Process>extract</Process>
        <PasswordSource inisections="hopi common" initag="usernametokenfile"/>
      </SecHandler>

      <SecHandler name="x509token.handler" id="x509token" event="incoming" initokenenables="hopi#enable_security_handler=x509token">
        <Process>extract</Process>
        <CACertificatesDir inisections="hopi common" initag="x509_cert_dir" inidefaultvalue="/etc/grid-security/certificates"/>
      </SecHandler>
    </Service>
    
    <Service name="datadeliveryservice" id="datadeliveryservice" initokenenables="datadelivery-service">
      <!-- Service-specific configuration here -->
      <!-- AllowedDir: File system paths the service is allowed to read/write files to/from -->
      <AllowedDir initype="multi" inisections="datadelivery-service" initag="allowed_dir"/>
      <SecHandler name="arc.authz" id="pdp-datadelivery" event="incoming" initokenenables="datadelivery-service">
        <!-- The authorization policy allows only the specified IP address.
             Optionally for tighter controls allowed DNs can also be specified. -->
        <PDP name="arc.pdp">
          <Policy xmlns="http://www.nordugrid.org/schemas/policy-arc" CombiningAlg="Permit-Overrides" PolicyId="IP Policy">
            <Rule RuleId="IP filter" Effect="Permit">
              <Description>
                Allow only the following IP address to access service
              </Description>
              <Subjects>
                <Subject AttributeId="http://www.nordugrid.org/schemas/policy-arc/types/tcp/remoteendpoint" Type="string" Function="match" inisections="datadelivery-service" initag="allowed_ip" initype="multi"/>
              </Subjects>
              <Resources>
                <Resource AttributeId="http://www.nordugrid.org/schemas/policy-arc/types/http/path" Type="string">/datadeliveryservice</Resource>
              </Resources>
              <Actions>
                <Action AttributeId="http://www.nordugrid.org/schemas/policy-arc/types/http/method" Type="string">POST</Action>
                <Action AttributeId="http://www.nordugrid.org/schemas/policy-arc/types/http/method" Type="string">GET</Action>
                <Action AttributeId="http://www.nordugrid.org/schemas/policy-arc/types/soap/operation" Type="string">datadeliveryservice</Action>
              </Actions>
              <Conditions/>
            </Rule>
          </Policy>
        </PDP>
        <PDP name="simplelist.pdp" initokenenables="datadelivery-service#allowed_dn">
          <DN initype="multi" inisections="datadelivery-service" initag="allowed_dn"/>
        </PDP>
      </SecHandler>
    </Service>
    
  </Chain>
</ArcConfig>