Re: [HTCondor-users] Kerberos credentials forwarding in DAGMAN jobs

[Cole Bollig <cabollig@xxxxxxxx>]

Hi Andreas,

I have a suspicion that this may be an unintended consequence of DAGMan using a new job submission method called direct submit (DAGMan process directly submits jobs to the Schedd). This behavior became the default in V9.7.0 of HTCondor. Does setting DAGMAN_USE_DIRECT_SUBMIT=False in the AP configuration fix the issue?

-Cole Bollig

---

From: HTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> on behalf of Andreas Haupt <andreas.haupt@xxxxxxx>
Sent: Tuesday, October 31, 2023 11:35 AM
To: htcondor-users@xxxxxxxxxxx <htcondor-users@xxxxxxxxxxx>
Subject: [HTCondor-users] Kerberos credentials forwarding in DAGMAN jobs

 

Dear all,

we recently upgraded one of our clusters to version 10.0.9 from 9.0.17.

Now kerberos credentials of DAG child jobs do not get forwarded to the
execution hosts any longer and $KRB5CCNAME is not available as consequence.

"Standard" jobs still get their credentials forwarded reliably.

As this still worked with 9.0 and only affects DAG jobs, I wonder if there
is some "magic knob" that the user (or me, the admin) has to set in order to
make krb credentials forwarding for DAG jobs work again.

Thanks,
Andreas
--
| Andreas Haupt            | E-Mail: andreas.haupt@xxxxxxx
|  DESY Zeuthen            | WWW:    http://www.zeuthen.desy.de/~ahaupt
|  Platanenallee 6         | Phone:  +49/33762/7-7359
|  D-15738 Zeuthen         | Fax:    +49/33762/7-7216