[HTCondor-users] unsubscribe

[Richard RANDRIATOAMANANA <richard.randriatoamanana@xxxxxxxxxxxxxxxxx>]

---

From: "Thomas Birkett - STFC UKRI via HTCondor-users" <htcondor-users@xxxxxxxxxxx>
To: "Bockelman, Brian" <BBockelman@xxxxxxxxxxxxx>, "HTCondor-Users Mail List" <htcondor-users@xxxxxxxxxxx>
Cc: "Thomas Birkett - STFC UKRI" <thomas.birkett@xxxxxxxxxx>, condor-users@xxxxxxxxxxx
Sent: Monday, July 15, 2024 4:19:49 PM
Subject: Re: [HTCondor-users] Condor and tokens

Hi Brian,

 

Thank you! That makes perfect sense, I will get in touch with the ARC community and see if I can piece the puzzle together.

 

Many thanks again,

 

Tom

 

From: Bockelman, Brian <BBockelman@xxxxxxxxxxxxx>
Date: Monday, 15 July 2024 at 13:58
To: HTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>
Cc: condor-users@xxxxxxxxxxx <condor-users@xxxxxxxxxxx>, Birkett, Thomas (STFC,RAL,SC) <thomas.birkett@xxxxxxxxxx>
Subject: Re: [HTCondor-users] Condor and tokens

Hi Thomas,

 

It's a good question!  I don't think it's well-trodden ground...

 

Those attributes are populated from the security session used to submit the job.  Unlike VOMS, there's no way to turn them on/off -- it's always on.

 

How does the ARC CE interact with HTCondor?  If it uses the same token itself is given, then you'll get these attributes.  If it does something else (like runs condor_submit as the target user), it probably uses the "FS" authentication and does not actually submit to HTCondor using the token (and hence no attributes).

 

So -- this might be more of an ARC question in the end.

 

Brian

On Jul 15, 2024, at 4:33âAM, Thomas Birkett - STFC UKRI via HTCondor-users <htcondor-users@xxxxxxxxxxx> wrote:

 

Hi all,

 

I realise this question may have been asked a million times before so apologies in advance if Iâm walking heavily trodden ground! Iâm currently looking at testing tokens for CMS and ATLAS. Our estate uses Nordugrid ARC-CE 6.20.1 and HTCondor 10.0.9. 

 

Iâm struggling to figure out how the `AuthToken` ClassAds are enabled, ClassAdâs such as `AuthTokenGroups` and `AuthTokenIssuer`. We currently using routing rules for our x509 jobs (using the classad `x509UserProxyVOName`) which required the config `USE_VOMS_ATTRIBUTES = True` and we wish to use the same logic for jobs submitted with tokens. Looking through the HTCondor manuals, using the `AuthToken` ClassAdâs will do a similar mapping logic for our routing. Any help would be gratefully received.

 

Many thanks,

 

Thomas Birkett

Senior Systems Administrator

Scientific Computing Department  

Science and Technology Facilities Council (STFC)

Rutherford Appleton Laboratory, Chilton, Didcot 
OX11 0QX

 

<image001.png>

 

 

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

 

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature