We've been given the long report below from a user testing the LSST VO
using ganga + our DIRAC server. The gist of it seems to be that ganga is
getting a vanilla proxy, which the DIRAC server will then attach a VOMS
proxy to at job submission time. Unfortunately this user is a member of
multiple VOs and DIRAC sometimes picks a different VO to the one they're
trying to test... I guess the questions we need to answer are:
- Is this behaviour reproducible by us?
- Is there some way to get ganga to get a VOMS proxy so that there is no
room for the DIRAC server to make any decisions on the VO?
Would you be able to have a look at this?
The original email is below. Hopefully this is a small fix but obviously the new credentials system will be the proper solution.
Most of the jobs following those 4 failed with a mixture of
Stalling for more than 11700 sec and Job stalled: pilot not running
at all sites but Birmingham where they weren't supposed to run.
Since I put the right dirac-proxy-init in .gangarc I looked a bit better at what happens and it seems >not to care, it just generates a plain proxy.
if I run the dirac command standalone I get this proxy
{quote}
aforti@vm7>dirac-proxy-init -g lsst_user -M
Generating proxy...
Enter Certificate password:
Added VOMS attribute /lsst
Uploading proxy for lsst_user...
Proxy generated:
subject : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy/CN=proxy
issuer : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy
identity : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti
timeleft : 23:53:59
DIRAC group : lsst_user
path : /tmp/x509up_u500
username : alessandra.forti
properties : NormalUser
VOMS : True
VOMS fqan : ['/lsst']
Proxies uploaded:
DN | Group | Until (GMT)
/C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti | vo.northgrid.ac.uk_user | 2016/11/03 11:48
/C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti | gridpp_user | 2016/11/03 11:48
/C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti | lsst_user | 2016/11/03 11:48
aforti@vm7>voms-proxy-info -all
subject : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy/CN=proxy
issuer : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy
identity : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy
type : proxy
strength : 1024 bits
path : /tmp/x509up_u500
timeleft : 23:53:42
key usage : Digital Signature, Key Encipherment, Data Encipherment
=== VO lsst extension information ===
VO : lsst
subject : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti
issuer : /DC=com/DC=DigiCert-Grid/O=Open Science Grid/OU=Services/CN=voms1.fnal.gov
attribute : /lsst/Role=NULL/Capability=NULL
timeleft : 23:53:42
uri : voms1.fnal.gov:15003
{quote}
when I put that command in ganga this is what happen instead
{quote}
aforti@vm7>grep dirac-proxy-init .gangarc
[defaults_GridCommand]init = dirac-proxy-init -g lsst_user -M
aforti@vm7>ganga
Your identity: /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti
Enter GRID pass phrase for this identity:
Creating proxy ........................................................................................................................... Done
Your proxy is valid until: Fri Nov 20 23:16:25 2015
*** Welcome to Ganga ***
Version: Ganga-6-1-6-hotfix1
Documentation and support: http://cern.ch/ganga
Type help() or help('index') for online help.
This is free software (GPL), and you are welcome to redistribute it
under certain conditions; type license() for details.
Ganga.Utility.Config : INFO reading config file /home/aforti/.gangarc
In [1]:
Do you really want to exit ([y]/n)? y
Ganga.Core.MonitoringComponent : INFO Stopping the monitoring component...
aforti@vm7>voms-proxy-info -all
subject : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=400330830
issuer : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti
identity : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti
type : RFC compliant proxy
strength : 1024 bits
path : /tmp/x509up_u500
timeleft : 23:59:43
key usage : Digital Signature, Key Encipherment, Data Encipherment
{quote}
it generates a plain proxy without VOMS information. With LHCb this still works because they have >only LHCb on their servers but with the multi-VO gridpp Dirac it picks the first VO I belong to to run >the jobs if the jobs are submitted without VOMS credentials.