Project

General

Profile

Bug #22245

Incompatibility with schedd 8.8.1 and frontend at 8.6

Added by Marco Mascheroni 10 months ago. Updated 18 days ago.

Status:
Resolved
Priority:
High
Category:
-
Target version:
Start date:
03/29/2019
Due date:
% Done:

0%

Estimated time:
First Occurred:
Occurs In:
Stakeholders:
Duration:

Description

Edgar reported that the ligo frontend was not able to query a schedd anymore after it was updated to 8.8.1

I debugged this with him and found out that this fixed the problem:

SEC_CLIENT_AUTHENTICATION = OPTIONAL
SEC_CLIENT_INTEGRITY = OPTIONAL

we had to modify creation/lib/cvWCreate.py to make this work at every reconfig.

I'd like to try to replicate this. Should we check schedd versions and report the incompatibility if it's the case?

History

#1 Updated by Parag Mhashilkar 10 months ago

  • Subject changed from Uncompatibility with schedd 8.8.1 and frontend at 8.6 to Incompatibility with schedd 8.8.1 and frontend at 8.6

#2 Updated by Marco Mascheroni 9 months ago

  • Target version changed from v3_5 to v3_5_1

#3 Updated by Marco Mambelli 5 months ago

  • Priority changed from Normal to High

#4 Updated by Lorena Lobato Pardavila 5 months ago

  • Target version changed from v3_5_1 to v3_6_1

#5 Updated by Marco Mascheroni 3 months ago

  • Target version changed from v3_6_1 to v3_6_2

#6 Updated by Marco Mambelli about 2 months ago

  • Assignee changed from Marco Mascheroni to Marco Mambelli

This should have been fixed by
https://cdcvs.fnal.gov/redmine/issues/23372

Relaxing security should not be the solution. In specific these are the lines (in glideinwms-userschedd 3.6.1) that should be of help, because the newest OSG condor disables GSI authentication by default:

/etc/condor/config.d/00_gwms_general.config:SEC_DEFAULT_AUTHENTICATION_METHODS = $(SEC_DEFAULT_AUTHENTICATION_METHODS),FS,GSI
/etc/condor/config.d/00_gwms_general.config:SEC_DAEMON_AUTHENTICATION_METHODS = $(SEC_DAEMON_AUTHENTICATION_METHODS),FS,GSI

Will check w/ Edgar and test if it is still a problem.

#7 Updated by Marco Mambelli about 1 month ago

  • Assignee changed from Marco Mambelli to Marco Mascheroni
  • Status changed from New to Feedback

The versions and the OSG configuration are red herrings.
The problem is that when using condor bindings the env variables CONDOR... are not used (are used instead in the tools) and the correct mapfile set using _CONDOR_CERTIFICATE_MAPFILE was not picked by the bindings.

Changes in v36/22245
There are 2 commits, one w/ pep8, one w/ the functional part

#8 Updated by Marco Mambelli about 1 month ago

  • Assignee changed from Marco Mascheroni to Dennis Box

#9 Updated by Dennis Box 19 days ago

  • Assignee changed from Dennis Box to Marco Mambelli
  • Status changed from Feedback to Accepted

OK to merge

#10 Updated by Marco Mambelli 18 days ago

  • Status changed from Accepted to Resolved


Also available in: Atom PDF