Re: [HTCondor-users] GSI_ASSIST_GRIDMAP not calling out

Mailing List Archives Authenticated access	UW Madison Computer Sciences Department Computer Systems Lab

Hi Stephen,

I am not sure but could be related to your GSI_PEP_CALLOUT_CONFÂfile?

In our HTCondor-CE, we have defined in /etc/sysconfig/condor-ce:

export GSI_AUTHZ_CONF=/etc/grid-security/gsi-authz.conf

export GSI_PEP_CALLOUT_CONF=/etc/grid-security/gsi-pep-callout-condor.conf

The gsi_authz.conf file is exactly as yours and the gsi-pep-callout-condor.conf file:

pep_ssl_server_capath /etc/grid-security/certificates/

pep_ssl_client_cert /etc/grid-security/condorcert.pem

pep_ssl_client_key /etc/grid-security/condorkey.pem

pep_url https://argus_server:8154/authz

pep_timeout 30 # seconds

xacml_resourceid http://authz-interop.org/xacml/resource/resource-type/htcondor-ce

Cheers,

Carles

On Thu, 20 Dec 2018 at 18:24, Stephen Jones <sjones@xxxxxxxxxxxxxxxx> wrote:

Hi all,

I have a HTCondor-CE that contains a condor-mapfile that has
GSS_ASSIST_GRIDMAP, to make a callout to ARGUS.

# cd /etc/condor-ce/
# cat condor_mapfile
GSI (.*) GSS_ASSIST_GRIDMAP

...

I've set the GSI_AUTHZ_CONF value to be right:

# echo $GSI_AUTHZ_CONF
/etc/grid-security/gsi-authz.conf

And the conf file file looks OK:

# cat /etc/grid-security/gsi-authz.conf
globus_mapping /usr/lib64/libgsi_pep_callout.so argus_pep_callout

And the library is installed:

# ls -lrt /usr/lib64/libgsi_pep_callout.so
lrwxrwxrwx 1 root root 27 Dec 20 16:22 /usr/lib64/libgsi_pep_callout.so
-> libgsi_pep_callout.so.1.0.1

Yet, when I try it out, it never calls out to my ARGUS server:

12/20/18 17:14:03 ZKM: setting default map to gsi@unmapped
12/20/18 17:14:03 ZKM: name to map is
'/C=UK/O=eScience/OU=Liverpool/L=CSD/CN=stephen jones'
12/20/18 17:14:03 ZKM: pre-map: current user is 'gsi'
12/20/18 17:14:03 ZKM: pre-map: current domain is 'unmapped'
12/20/18 17:14:03 ZKM: map file already loaded.
12/20/18 17:14:03 ZKM: attempting to map
'/C=UK/O=eScience/OU=Liverpool/L=CSD/CN=stephen jones'
12/20/18 17:14:03 ZKM: GSI was used, and FQAN is present.
12/20/18 17:14:03 ZKM: 1: attempting to map
'/C=UK/O=eScience/OU=Liverpool/L=CSD/CN=stephen
jones,/dteam/Role=NULL/Capability=NULL,/dteam/NGI_UK/Role=NULL/Capability=NULL'
12/20/18 17:14:03 ZKM: 2: mapret: 0 included_voms: 1 canonical_user:
GSS_ASSIST_GRIDMAP
12/20/18 17:14:03 Globus-based mapping failed; will use gsi@unmapped.
12/20/18 17:14:03 ZKM: post-map: current user is 'gsi'
12/20/18 17:14:03 ZKM: post-map: current domain is 'unmapped'
12/20/18 17:14:03 ZKM: post-map: current FQU is 'gsi@unmapped'
12/20/18 17:14:03 AUTHENTICATE: Exchanging keys with remote side.
12/20/18 17:14:03 AUTHENTICATE: Result of end of authenticate is 1.
12/20/18 17:14:03 DC_AUTHENTICATE: authentication of
<138.253.178.91:13663> did not result in a valid mapped user name, which
is required for this command (1112 QMGMT_WRITE_CMD), so aborting.

Does anyone know what might be stopping it?

Cheers,

Ste

--
Steve JonesÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Âsjones@xxxxxxxxxxxxxxxx
Grid System AdministratorÂ Â Â Â Â Â Â Âoffice: 220
High Energy Physics DivisionÂ Â Â Â Â Â tel (int): 43396
Oliver Lodge LaboratoryÂ Â Â Â Â Â Â Â Âtel (ext): +44 (0)151 794 3396
University of LiverpoolÂ Â Â Â Â Â Â Â Âhttp://www.liv.ac.uk/physics/hep/

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

Mailing List Archives

Authenticated access

Re: [HTCondor-users] GSI_ASSIST_GRIDMAP not calling out