Hi Patrick,
Here is what I think you are doing and how it plays out.
You are running globusrun-ws with this multi-job http://pastie.org/279433
globusrun-ws will delegate all credentials for the jobs. It will
delegate a full credential to the multi-job service (mmjfs) and
limited credentials to all of the subjob services (mjfs).
If the subjob services are actually gridway services that are going to
submit a gram job to yet another gram service, then as you know (or
discovered) you need a full credential at each subjob service. I
don't think there are options for globusrun-ws to do that for you.
But I think you should be able to duplicate all or part of the
delegation that globusrun-ws does. So delegate a full credential to
each of the delegation services co-located with the subjob services
and add those delegation EPRs into the appropriate single job
description in the multijob job description. I can't tell from you
description if that is what you actually tried.
Did I understand what you are trying to do correctly? If so, why do
you want to do it this way? What is multijob providing you? The
target user for multijobs has been the MPIg folks. So there has not
been much testing or development outside of their use case.
-Stu
On Sep 25, 2008, at Sep 25, 2:01 PM, Patrick Armstrong wrote:
Hi Everyone,
I'd like to run multijobs on a Globus 4.0.8 host running GridWay,
which will eventually route the jobs to a couple clusters also
running GT 4.0.8. As far as I can tell from the GT4 GRAM Security
Model document [1], MultiJobs are supposed to have a full credential
delegated so they can start subjobs.
This doesn't seem to be happening though, since I get proxy errors
from GridWay. For example, when I submit this job (http://pastie.org/279433
), I get the following error in the GridWay log:
Thu Sep 25 10:50:00 2008 [EM][E]: Job submission failed: Limited
proxy is not accepted
And when I check the delegated proxy with grid-proxy-info, I find
that it's a Proxy draft (pre-RFC) compliant limited proxy.
I have found that if I delegate a full credential with globus-
credential-delegate, and then set try to use the -Jf option in
globus-credential-delegate, my job fails because the credential
doesn't actually get copied to the ~/.globus directory of my
gridmapped user. When I then submit a dummy job using the Fork job
factory, the credential does get copied into the directory. After
this point, my MultiJobs *do* work, because the credential has been
copied over by another job. Even so, I have to use the
jobCredentialEndpoint element in my job description.
Is there some other way that I'm supposed to delegate full
credentials with MultiJobs? Am I misunderstanding something
completely?
--patrick
References:
1. http://www-unix.globus.org/security/gt4-review/GT4-GRAM-Security-oct27.doc
(Page 7)
