Hey Joe, What are the disadvantages of configuring GRAM with "-tag-with-dn-hash", or stated differently, why not make this the default and only behavior?
JP On Mar 26, 2010, at 9:46 AM, Joseph Bester wrote: > On Mar 25, 2010, at 9:45 PM, Vladimir Mencl wrote: >> >> Hi, >> >> We are evaluating how GRAM5 would work in the Australian ARCS Grid and >> New Zealand BeSTGRID. >> >> I have deployed GRAM5 in an environment where we are mapping multiple >> users (different DNs) from the same VO to a single shared account. >> >> We are getting some errors... which look like clashes of different >> credentials (different DNs) under the same job manager. >> >>> From what I could find in the documentation: >> http://www.globus.org/toolkit/docs/5.0/5.0.0/execution/key/#execution-approach >> >> : Job Manager: The globus-job-manager daemon processes job requests and >> coordinates file transfers. >> : There is one long-lived instance of this per user per LRM and one >> short-lived instance per job. >> >> The problem might be that we are using GRAM5 in a way which is not >> really supported - mapping different grid identities to a shared account. >> >> The problems we are getting are: >> >> * when one user (grid identity, DN) submits a job, everything works fine >> * When another user (different DN) submits a job while the first one is >> still active, things start to break: >> >> ** globusrun does not receive job status update notifications >> ** even when cancelling a job (Ctrl-C), globusrun does not receive the >> confirm the job was cancelled >> >> Could someone please confirm if GRAM5 job manager can handle multiple >> identities (DNs) under the same local account? >> >> Or what settings need to be put in place to make it work? >> >> Thanks a lot in advance. >> >> Cheers, >> Vladimir > > > That model is not supported by 5.0.0. > > Try this patch. It uses the DN of the certificate to come up with a > semi-unique token that is appended to the service tag. Jobs with different > tags will run in separate job managers and won't deal with each other's creds. > > Joe > > <shared-account.diff>
