[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [HTCondor-users] IDTOKENS and cli

To allow users to query the collector (i.e. use condor_status) without a token, we suggest allowing the ANONYMOUS or CLAIMTOBE authentication method for the READ and CLIENT authorization levels. If you donât set the authentication methods, CLAIMTOBE is enabled by default. If you use the get_htcondor tool to configure your machines, ANONYMOUS is enabled.

If youâre setting the authentication methods explicitly on your config file, then try using these values:


The -authz argument to condor_token_create specifies authorization levels, not command names. UPDATE_SCHEDD_AD, QUERY_STARTD_ADS, and UPDATE_AD_GENERIC are command names and thus wonât do anything in the token.
The authorization levels are described here: https://htcondor.readthedocs.io/en/latest/admin-manual/security.html#access-level-descriptions

 - Jaime

On Apr 25, 2022, at 4:46 PM, Michael Thomas <wart@xxxxxxxxxxx> wrote:

I'm still flailing about trying to get idtokens working on a new 9.0.12 schedd in my cluster.

I was finally able to get the schedd talking to the collector by issuing a new token with condor_token_create (and a long list of permissions), then signing it on the CM:

condor_token_create -identity schedd@xxxxxxxxxxxxxxxxxxxxxxxx -authz DAEMON -authz UPDATE_SCHEDD_AD -authz READ -authz WRITE -authz QUERY_STARTD_ADS -authz UPDATE_AD_GENERIC -authz ADMINISTRATOR

However, I'm unable to get some CLI commands to work.  Notably, the 'condor_status' command, when run as root, returns:

# condor_status
Error: communication error
SECMAN:2010:Received "DENIED" from server for user condor@xxxxxxxxxxxxxxxxxxxxxxxx using method IDTOKENS.

The collector reports the following error:

04/25/22 16:41:03 DC_AUTHENTICATE: message authenticator enabled with key id ldas-condor:2734:1650922863:33339.
04/25/22 16:41:03 DC_AUTHENTICATE: Success.
04/25/22 16:41:03 DC_AUTHENTICATE: authentication of <> was successful but resulted in a limited authorization which did not include this command (5 QUERY_STARTD_ADS), so aborting.

...which seems odd considering that I explicitly included QUERY_STARTD_ADS in the token request above.

As a user, it won't even authenticate:

$ condor_status
Error: communication error
AUTHENTICATE:1003:Failed to authenticate with any method
AUTHENTICATE:1004:Failed to authenticate using IDTOKENS
AUTHENTICATE:1004:Failed to authenticate using FS

Any suggestions on where to look next?

HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting

The archives can be found at: