10/18/24 13:23:45 recognized WRITE as authorization level, using command 60021. Destination: schedd grid-htc-ce04.desy.de Remote Version: $CondorVersion: 23.10.1 2024-10-03 BuildID: 759508 PackageID: 23.10.1-1 GitSHA: acedc362 $ Local Version: $CondorVersion: 23.9.6 2024-08-08 BuildID: 748275 PackageID: 23.9.6-1 GitSHA: dfdd9eaa $ Session ID: grid-htc-ce04:4047184:1729250626:61913 Instruction: WRITE Command: 60021 Encryption: AES Integrity: AES Authenticated using: SCITOKENS All authentication methods: SCITOKENS Remote Mapping: atlasprd000@users.htcondor.org Authorized: TRUE
This can't work with recent HTCondor-CEs that no longer support GSI
condor_ping result:10/18/24 13:23:46 recognized WRITE as authorization level, using command 60021. WARNING: GSI authentication is enabled by your security configuration! GSI is no longer supported. For details, see https://htcondor.org/news/plan-to-replace-gst-in-htcss/ 10/18/24 13:23:46 SECMAN: no classad from server, failing WRITE failed! SECMAN:2011:Connection closed during command authorization. Probably due to an unknown command.
This could work only with recent HTCondor-CEs, but only with special individual SSL mapping for certificate subject:
SSL "/DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac" unix_accountcondor_ping result:
10/18/24 13:23:47 recognized WRITE as authorization level, using command 60021. 10/18/24 13:23:48 SECMAN: required authentication with schedd grid-htc-ce04.desy.de failed, so aborting command DC_SEC_QUERY. WRITE failed! AUTHENTICATE:1003:Failed to authenticate with any method AUTHENTICATE:1004:Failed to authenticate using SSL
{ "wlcg.ver": "1.0", "sub": "7dee38a3-6ab8-4fe2-9e4c-58039c21d817", "aud": [ "grid-htc-ce04.desy.de:9619", "condor://grid-htc-ce04.desy.de:9619", "https://wlcg.cern.ch/jwt/v1/any" ], "nbf": 1729250625, "scope": "compute.read compute.cancel compute.modify compute.create", "iss": "https://atlas-auth.cern.ch/", "exp": 1729596225, "iat": 1729250625, "jti": "07ba6f43-df0c-497c-af42-48272b0f44f7", "client_id": "7dee38a3-6ab8-4fe2-9e4c-58039c21d817" }
subject : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac/CN=1887078256/CN=75616627 issuer : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac/CN=1887078256 identity : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac type : RFC3820 compliant impersonation proxy strength : 2048 path : /tmp/x509up_u48.prd.htcondor.6231 timeleft : 11:59:54 key usage : Digital Signature, Key Encipherment === VO atlas extension information === VO : atlas subject : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac issuer : /DC=ch/DC=cern/OU=computers/CN=atlas-auth.web.cern.ch attribute : /atlas/Role=production/Capability=NULL attribute : /atlas/Role=NULL/Capability=NULL attribute : /atlas/alarm/Role=NULL/Capability=NULL attribute : /atlas/cz/Role=NULL/Capability=NULL attribute : /atlas/team/Role=NULL/Capability=NULL attribute : testattr = testvalue (atlas) attribute : nickname = vokac (atlas) timeleft : 11:59:54 uri : voms-atlas-auth.app.cern.ch:443