Re: [HTCondor-users] Myproxy usage clarification

[Jaime Frey <jfrey@xxxxxxxxxxx>]

On Dec 2, 2019, at 9:18 AM, Gabriele Fronzà <gabriele.fronze@xxxxxxxxxx> wrote:

Hello everyone,

This is my first message to this users mailing list, so Iâd like to say hello to everybody!

I work in the Virgo-LIGO collaboration from the Virgo side and I handle the infrastructural part of offline computing and storage.

I am working on porting a computing task that used to (and still does) run on LSF towards running on an HTC cluster installed in Bologna (CNAF).

One issue I was dealing with was the certificate expiration before computing ended, caused by un-extendible and expiring VOMS extensions.

I just started testing it using the CNAF MyProxy server to delegate proxy renewal and Iâd like to know wether I setup everything correctly or not.

The steps I followed are:

• myproxy-init on the submit node, picking my custom password (e.g. dummypasswd). The command returns "A proxy valid for 168 hours (7.0 days) for user gfronze now exists on myproxy.cnaf.infn.itâ so I suppose gfronze is my MyProxyCredentialName value.
• The submit file contains all the following settings:

use_x509userproxy = true

MyProxyCredentialName = gfronze

MyProxyPassword = dummypasswd

MyProxyHost = myproxy.cnaf.infn.it:7512

MyProxyNewProxyLifetime = 2880

MyProxyRefreshThreshold = 600

• The line "use_x509userproxy = trueâ was necessary to be able to submit the jobs. My understanding is that I should still launch the jobs using my own proxy, while HTC should contact MyProxy whenever needed to rearm the personal proxy. Am I correct?
• voms-proxy-init on the submit node.
• Launch the computing job via "condor_submit -pool ce02-htc.cr.cnaf.infn.it:9619 -remote ce02-htc.cr.cnaf.infn.it -spool test-cw-myproxy.subâ

Is the workflow I am following the right one to make use of MyProxy in HTC?

Do anyone has suggestions on how to handle this expiring proxies+long computation thing other than MyProxy (if MyProxy is not the ideal one)?

Thank you in advance for any reply!

HTCondorâs support for MyProxy is fairly old, and I donât know if anyoneâs tried it recently. Also, it only works with the grid universe. To have HTCondor do the refreshing from MyProxy, you could start a condor_schedd on your submit node (if there isnât one already), then submit your jobs locally as Condor-C jobs (grid universe, resource type âcondorâ). Your submit file would specify that the local schedd should submit the jobs to the schedd at ce02-htc.cr.cnaf.infn.it.

A couple notes if you want to try this:

* You need to set MYPROXY_GET_DELEGATION in the local Condor configuration file to point to the myproxy-get-delegation executable.

* The MyProxyCredentialName attribute in the submit file should match the -k argument used with myproxy-init and myproxy-get-delegation.

* HTCondor on your local machine will do the refresh from the MyProxy server and then push the new credential to the remote pool.

Thanks and regards,

Jaime Frey

UW-Madison HTCondor Project