Re: [HTCondor-users] upgrading from 8.8.x to 9.0.4 - kerberos auth problems

[Jaime Frey <jfrey@xxxxxxxxxxx>]

The only direct change to the Kerberos authentication code that I see was made in HTCondor 8.9.7. Details are here: https://htcondor-wiki.cs.wisc.edu/index.cgi/tktview?tn=7577

If youâre willing to do a little experimenting, itâd be great to see if this release introduces the failures youâre seeing.

The error message you quote is coming from the Kerberos library when a daemon tries to initialize its own Kerberos credentials to authenticate to another daemon that itâs connecting to. If you enable the D_SECURITY debug level for the daemon whose log youâre seeing this message in and send the preceding lines in the log file, that would help narrow down which Kerberos call is failing.

 - Jaime

On Aug 17, 2021, at 3:29 PM, Lee Damon <nomad@xxxxxxxxxxxxxxxxx> wrote:

I have an existing pool of CentOS Stream 8 hosts running 8.8.13 successfully using:

  SEC_DEFAULT_AUTHENTICATION_METHODS = FS, KERBEROS
  SCHEDD.SEC_DEFAULT_AUTHENTICATION_METHODS = FS, KERBEROS
  TOOL.SEC_DEFAULT_AUTHENTICATION_METHODS = FS, KERBEROS
  COLLECTOR.SEC_DEFAULT_AUTHENTICATION_METHODS = FS, KERBEROS

for authentication. When I try to use the same config for 9.0.4 it fails with

  AUTH_ERROR: Client not found in Kerberos database

We're using AD as our Kerberos server.

There are valid host/ entries in the /etc/krb5.keytab files.

I have another cluster in a different lab that is successfully running 9.0 against Kerberos. In both cases I've made no changes to /etc/condor/config.d/00-htcondor-9.0.config. Oddly enough, that cluster is running without the ALLOW_DAEMON = $(ALLOW_WRITE) setting, though I've added that to the cluster that's failing.

I'd prefer not to go through the bother of converting to the new tokens system as I don't really want to have to manually type a password on every host. (It wouldn't be so bad if I could just have puppet drop a common /etc/condor/tokens.d/condor@mypool file in place but that doesn't seem to be sufficient, instead emitting "TOKEN: No token found." error.)

Anyway, getting back on track, any pointers on where I should be looking to see why the kerberos config that works in 8.8.x doesn't work in 9?

I tried running condor_check_config but:

sudo condor_check_config
Traceback (most recent call last):
  File "/bin/condor_check_config", line 92, in <module>
    main()
  File "/bin/condor_check_config", line 84, in main
    message = check_dead_allow_write()
  File "/bin/condor_check_config", line 62, in check_dead_allow_write
    if len(allow_write) :
UnboundLocalError: local variable 'allow_write' referenced before assignment

thanks,

nomad

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/