10/18/24 13:24:11 recognized WRITE as authorization level, using command 60021. Destination: schedd tier2-ce2.lnf.infn.it Remote Version: $CondorVersion: 10.9.0 2023-09-28 BuildID: 678228 PackageID: 10.9.0-1 $ Local Version: $CondorVersion: 23.9.6 2024-08-08 BuildID: 748275 PackageID: 23.9.6-1 GitSHA: dfdd9eaa $ Session ID: tier2-ce2:24280:1729250651:58898 Instruction: WRITE Command: 60021 Encryption: AES Integrity: AES Authenticated using: SCITOKENS All authentication methods: SCITOKENS Remote Mapping: prdatlas006@htc_lnf_90 Authorized: TRUE
This can't work with recent HTCondor-CEs that no longer support GSI
condor_ping result:10/18/24 13:24:13 recognized WRITE as authorization level, using command 60021. WARNING: GSI authentication is enabled by your security configuration! GSI is no longer supported. For details, see https://htcondor.org/news/plan-to-replace-gst-in-htcss/ 10/18/24 13:24:13 SECMAN: no classad from server, failing WRITE failed! SECMAN:2011:Connection closed during command authorization. Probably due to an unknown command.
This could work only with recent HTCondor-CEs, but only with special individual SSL mapping for certificate subject:
SSL "/DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac" unix_accountcondor_ping result:
10/18/24 13:24:14 recognized WRITE as authorization level, using command 60021. Destination: schedd tier2-ce2.lnf.infn.it Remote Version: $CondorVersion: 10.9.0 2023-09-28 BuildID: 678228 PackageID: 10.9.0-1 $ Local Version: $CondorVersion: 23.9.6 2024-08-08 BuildID: 748275 PackageID: 23.9.6-1 GitSHA: dfdd9eaa $ Session ID: tier2-ce2:24280:1729250655:58899 Instruction: WRITE Command: 60021 Encryption: AES Integrity: AES Authenticated using: SSL All authentication methods: SSL Remote Mapping: ops004@htc_lnf_90 Authorized: TRUE
{ "wlcg.ver": "1.0", "sub": "7dee38a3-6ab8-4fe2-9e4c-58039c21d817", "aud": [ "tier2-ce2.lnf.infn.it:9619", "condor://tier2-ce2.lnf.infn.it:9619", "https://wlcg.cern.ch/jwt/v1/any" ], "nbf": 1729250650, "scope": "compute.read compute.cancel compute.modify compute.create", "iss": "https://atlas-auth.cern.ch/", "exp": 1729596250, "iat": 1729250650, "jti": "8a57141b-731b-4826-b0d0-fa175cf7379d", "client_id": "7dee38a3-6ab8-4fe2-9e4c-58039c21d817" }
subject : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac/CN=1887078256/CN=531038141 issuer : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac/CN=1887078256 identity : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac type : RFC3820 compliant impersonation proxy strength : 2048 path : /tmp/x509up_u48.prd.htcondor.16031 timeleft : 11:59:52 key usage : Digital Signature, Key Encipherment === VO atlas extension information === VO : atlas subject : /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=vokac/CN=610071/CN=Petr Vokac issuer : /DC=ch/DC=cern/OU=computers/CN=atlas-auth.web.cern.ch attribute : /atlas/Role=production/Capability=NULL attribute : /atlas/Role=NULL/Capability=NULL attribute : /atlas/alarm/Role=NULL/Capability=NULL attribute : /atlas/cz/Role=NULL/Capability=NULL attribute : /atlas/team/Role=NULL/Capability=NULL attribute : testattr = testvalue (atlas) attribute : nickname = vokac (atlas) timeleft : 11:59:52 uri : voms-atlas-auth.app.cern.ch:443