Wondering if anyone has integrated Open OnDemand with AFS. Trying to figure out authentication since I need a token to access the home directory.

I just want to mark this as resolved. I have it working. Apache 2.4/mod_auth_gssapi/mod_waklog (OpenAFS/Kerberos) plus a qsub wrapper and epilog cleanup script for orphaned processes.

Correct. I want to verify the value of KRB5CCNAME set in profile

Do you have this setting in this file? I think you need it for anything to pass to Nginx. You can add env > /tmp/env.txt directly in the profile, but you need this config below for it to be injected into the Nginx’s environment. # /etc/ood/config/nginx_stage.yml pun_custom_env_declarations: - …

Yes I have that setting. I’ll check the file.

SUDO_USER is correct. KRB5CCNAME is not.

You mean UNPRIV_USER? Do you have a typo (could it be that simple)? #!/bin/bash # SUDO_COMMAND is something like '... nginx_stage -u ktrout -a ...' UNPRIV_USER=$(echo $SUDO_COMMAND | sed -r 's#.+\-u (.+) \-a.+#\1#g') export KRB5CCNAME="FILE:/var/run/httpd/clientcaches/$UNPRIV_USER@ENEA.IT"

That’s expected because UNPRIV_USER is just a temporary variable. [image] dbarstis: SUDO_USER is correct. KRB5CCNAME is not. KRB5CCNAME is not correct, but it’s there?

In /proc/self/environ yes. KRB5CCNAME=FILE:/tmp/krb5cc_34180_G7hUSG

Sorry, not self - that’s a magic keyword for the current process (I’m guessing your terminal/bash session). You need to try to start a PUN and find your Nginx worker processes’ PID through ps and see it’s environment through /proc/<PID of the Nginx worker>/environ.

So: root 425524 1 0 16:29 ? 00:00:00 nginx: master process (dbars dbarstis 425527 425524 0 16:29 ? 00:00:00 nginx: worker process /proc/425527/environ is a binary file. strings, od and grep -a return nothing.

Open OnDemand and AFS

General Discussion

dbarstis (David Barstis) December 7, 2023, 9:23pm 50

Sorry. I saw a SUDO_USER variable and copied/pasted. UNPRIV_USER is not in /proc/self/environ

KerberizedNFS with OOD

Topic		Replies	Views
$Home Directory Doesn't Exist (CAS, SELinux, & University Controlled AD) Get Help ondemand2 , question	29	2375	May 25, 2022
How to disable Passenger security check update Get Help question	16	2136	May 10, 2022
Can OOD auth be handled by PAM? Get Help	26	5131	August 26, 2021
CAS integration: (was 401 Unauthorized) now is: Index of / Get Help question	35	445	October 9, 2024
How to automatically set the path to a remote-user's local cached file Get Help	3	305	November 21, 2023

Open OnDemand and AFS

Related topics