Our submissions are always remote, and from the log it seems as though the reason is because the permission check includes the method, ie:
(D_ALWAYS:2) OwnerCheck reject, 'bejones@xxxxxxx' not ad owner: 'bejones@fsauth' UID_DOMAIN=cern.ch
Ben:
I'm curious if this is not so much a consequence of a condor upgrade so much as of a machine reboot or new installation. Perhaps the AP does not have the kerberos ticket stashed, and thus falls back to FS auth. If you submit a vanilla universe job locally on the AP, that should have the side effect of stashing the ticket there, and keeping it stashed. Does that fix the problem?
-greg