Re: [HTCondor-users] Error trying to set Owner attribute to Computing On Demand (COD) job.

[don_vanchos <hozblok@xxxxxxxxx>]

Hello,

Yes, I set QUEUE_SUPER_USER_MAY_IMPERSONATE, QUEUE_SUPER_USERS and VALID_COD_USERS settings, but it doesn't solve the problem.

As I can see, QUEUE_SUPER_USER_MAY_IMPERSONATE does not affect COD jobs, and 'user101' can't pretend to be 'rootuser'.

I read in the documentation https://htcondor.readthedocs.io/en/latest/misc-concepts/computing-on-demand.html#cod-application-attributes:
"If the condor_startd daemon is executing as root on the resource where a COD application will run, the user must also define 'Owner' to specify what user name the application will run as."
But I see that no value of 'Owner' works, all of them lead to an error, except "rootuser" or missing value. So I do not understand the documentation and it looks like the 'Owner' field is not working or does not make sense. (The error is 'Error: Owner specified in ClassAd as 'user101' yet request sent by user 'rootusr', possible security attack, request refused!')

How can I get around this error to impersonate users for the case of COD jobs?

ÐÑ, 9 ÐÐÐ. 2019 Ð. Ð 20:00, MÃtyÃs Selmeci <matyas@xxxxxxxxxxx>:

I think this is what QUEUE_SUPER_USER_MAY_IMPERSONATE (https://htcondor.readthedocs.io/en/stable/admin-manual/configuration-macros.html) is for.

-Mat

On 8/9/19 3:40 AM, Alexander Prokhorov wrote:

Dear John,

Is it possible to overcome this limitation somehow? Actually, we are building and app which uses HT Condor as a calculation runtime and all appâs services (read HT Condo clients) always run from a single user âserverâ. We need to somehow impersonate real cluster users when we do requests to HT Condor. We succeeded in this with vanilla and universe jobs. Isnât this possible with COD tasks?

All the best,

Alexander A. Prokhorov

prokher@xxxxxxxxx

On 8 Aug 2019, at 21:33, John M Knoeller <johnkn@xxxxxxxxxxx> wrote:

You must set the Owner attribute to the same username that your python script is running as, anything else

would be a security violation

Â

-tj

Â

From:ÂHTCondor-users <htcondor-users-bounces@xxxxxxxxxxx>ÂOn Behalf OfÂdon_vanchos
Sent:ÂThursday, August 8, 2019 11:15 AM
To:ÂHTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>
Subject:Â[HTCondor-users] Error trying to set Owner attribute to Computing On Demand (COD) job.

Â

Hello,

Â

I am using python API for COD jobs and simple example is:
claim = htcondor.Claim(slot_ad)
claim.requestCOD()
job = {
"Cmd": "/bin/echo",
"JobUniverse": 5,
"Iwd": "/some/dir",
"Out": "test.out",
"Err": "test.err",
"StarterUserLog": "test.log",
"Owner": "user101",
"Args": "hello world",
}
claim.activate(job)

After that I get the following error (from `htcondor.enable_debug()`):
```
08/08/19 15:39:29 (fd:4) (pid:6314) (D_HOSTNAME) IsLocal: N, IdStr: startd at <192.168.128.6:9618>, Error: Owner specified in ClassAd as 'user101' yet request sent by user 'rootusr', possible security attack, request refused!
```

How can I make a cod-job run from a specific user? If I cannot make activation from another user, what is the effect of the `Owner` attribute?

Â

My settings:
QUEUE_SUPER_USERS = $(QUEUE_SUPER_USERS) rootusr
VALID_COD_USERS = $(QUEUE_SUPER_USERS)

Â

--Â

Sincerely yours,
Ivan Ergunov                         mailto:hozblok@xxxxxxxxx

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

--

Sincerely yours,
Ivan Ergunov                         mailto:hozblok@xxxxxxxxx