Re: [HTCondor-users] What happens to x509* job attributes when Condor drops GCT?

["Fischer, Max (SCC)" <max.fischer@xxxxxxx>]

Hello Stefano,

thanks for the link and examples!

Weâre currently trying to avoid coding up too many temporary workarounds (hence the interest to know how long the x509 attributes will stay around), yet itâs good to know that we can easily compensate for missing metadata if needed.

Cheers,

Max

On 17. Feb 2022, at 21:50, Stefano Dal Pra <stefano.dalpra@xxxxxxxxxxxx> wrote:

One more comment:

assuming that you might have a number of places in htcondor (or external tools) where the existence of a job classad named X509UserProxyVOName
is required, you could probably just add it yourself with routes in the condor-ce. For example:

JOB_ROUTER_ROUTE_atlas @=jrt
 REQUIREMENTS AuthTokenIssuer =?= "https://atlas-auth.web.cern.ch/"
 UNIVERSE VANILLA
 [...]
 SET X509UserProxyVOName "atlas"
@jrt

And you should see the
X509UserProxyVOName classad defined in the routed job.

Stefano

Il 17/02/22 18:15, Stefano Dal Pra ha scritto:

Hello Max,
I performed a few tests in order to understand that, for what concerns submission to the HTCondor-CE (5.1.x on top of HTCondor 9.0.x)
An example working configuration for the condorce scitokens mapfile and jobrouter can be found here:
https://twiki.cern.ch/twiki/bin/view/LCG/HTCondorCEtokenConfigTips

One use case that i would like to address is, for example, configuration for hierarchical fairshare. I came up with a potentially working
solution which depends however on one assumption about how the equivalent of the FQAN  (i.e. something like to say, "/voname/groupname")
is reported in the jwt. That solution is also reported in the above wiki page.

Cheers,
Stefano

Il 17/02/22 17:57, Fischer, Max (SCC) ha scritto:

Hi all,

in the struggle for switching to WLCG Tokens from GSI we realised that a lot of our infrastructure uses the x509* Job ClassAds such as X509UserProxyVOName. For now these are still there since pilots have a GSI proxy for other tasks anyway, so everything runs smoothly for now.
But itâs not really clear to us how much we can rely on that in the future.

Will HTCondor still be able to provide these job attributes when it drops GSI/GCT in the 10.0 series?

Cheers,
Max

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

Attachment: smime.p7s
Description: S/MIME cryptographic signature