[HTCondor-users] file open error on AP side from DELEGATE_GSI_CRED_SCHEDD

[Stefano Belforte <stefano.belforte@xxxxxxx>]

Hi experts,

Follow up of 
https://www-auth.cs.wisc.edu/lists/htcondor-users/2026-January/msg00023.shtml 



We have now an Alma9.7 container with HTCÂ version
'$CondorVersion: 25.0.8 2026-03-10 BuildID: UW_Python_Wheel_Build RC $'

From there we use v2 python API to refresh X509 proxy on a remote AP

schedd.refreshGSIProxy(ad['ClusterId'], ad['ProcID'], proxy, -1)

The AP also runs HTC 25.0.8 on Alma9.7

The call fails with an HTCondorException w/o any details.

On AP siide, looking at SchedLog, GSI handshake works, but then

04/07/26 18:48:23 Number of Active Workers 0
04/07/26 18:48:30 Remote entity presented valid token with payload 
{"iat":1642519166,"iss":"\"cmsgwms-global.cern.ch\"","jti":"01be75a9f9845eebe786f9a17d2461f7","sub":"crabtw@cms"}.
04/07/26 18:48:30 (cid:932) Command=DELEGATE_GSI_CRED_SCHEDD, 
peer=<137.138.159.63:33827>
04/07/26 18:48:30 (cid:932) AuthMethod=IDTOKENS, AuthId=(null), 
CondorId=crabtw@cms
04/07/26 18:48:30 ReliSock::get_x509_delegation_finish(): delegation 
failed to complete: Failed to open proxy file
04/07/26 18:48:30 Delegation error: 
C0241D0F5A7F0000:error:8000000D:system library:BIO_new_file:Permission 
denied:crypto/bio/bss_file.c:67:calling 
fopen(/etc/condor/condor_local/spool/8283/0/cluster10428283.proc0.subproc0/5267401399ee13b6837deacb824594bde73ab2b4, 
r)
C0241D0F5A7F0000:error:10080002:BIO routines:BIO_new_file:system 
lib:crypto/bio/bss_file.c:77:

04/07/26 18:48:30 updateGSICred(499): failed to read expiration time of 
updated proxy for job 10428283.0: unable to read proxy file
04/07/26 18:48:30 (cid:932) Refresh GSI cred for job 10428283.0 failed


Note that the called was mapped toÂCondorId=crabtw@cms , who owns the file

belforte@vocms059/condor> ls -l 
/etc/condor/condor_local/spool/8283/0/cluster10428283.proc0.subproc0/5267401399ee13b6837deacb824594bde73ab2b4
-rw------- 1 crabtw zh 15245 Apr 1 12:04 
/etc/condor/condor_local/spool/8283/0/cluster10428283.proc0.subproc0/5267401399ee13b6837deacb824594bde73ab2b4
belforte@vocms059/condor>

So I can't fathom why the fopen(..,r) can fail

Can you give some hint for how to progress ?

Thanks !

Stefano