[Condor-users] condor_q -analyze & kerberos

[Lee Damon <nomad@xxxxxxxxxxxxxxxxxxxxxx>]

My condor pool is set up with the goal that users who authenticated to a 
system (by logging in) do not need to have a kerberos ticket to interact 
with condor but where the systems themselves need one to talk with each 
other (so boxes I don't control can't just join the pool).

Without a kerberos ticket jobs are submitted fine.  condor_q shows them 
just fine.  However, when a user runs condor_q -better they get back:
   Error:  Could not fetch startd ads

If the user gets a kerberos ticket they get actual output from condor_q 
-better.  It would be preferred if the user never had to get a kerberos 
ticket to interact with condor (submitting, queuing, killing, querying, 
etc).

All of the systems are running with the following settings:

 ; condor_config_val SEC_DEFAULT_AUTHENTICATION_METHODS
FS, KERBEROS
 ; condor_config_val SCHEDD.SEC_DEFAULT_AUTHENTICATION_METHODS
FS, KERBEROS
 ; condor_config_val TOOL.SEC_DEFAULT_AUTHENTICATION_METHODS
FS, KERBEROS
 ; condor_config_val COLLECTOR.SEC_DEFAULT_AUTHENTICATION_METHODS
FS, KERBEROS

Any hints on what I should be looking at to change the unwanted behavior 
would be appreciated.

thanks,
nomad