On Wed, 10 Nov 2004, Ron Trompert wrote:
> > This sounds baffling, the UI shouldn't come into it once the
> > job is in the
> > RB.
> Maybe one UI puts something else on the RB than another UI?
That might be true indeed, particularly when the LCG/VDT/Globus
versions are different, but that does not seem to be the case here.
However, it reminds me of a problem recently experienced by
someone submitting from Pakistan to various RBs at CERN:
all his jobs got aborted because, for some reason yet unknown,
the delegated proxy was invalid! So, the original proxy was OK,
the job got accepted, but then the delegated proxy supplied by
the UI was bad, such that the RB could not do anything on behalf
of the user. We suspected the UI somehow and suggested using a
CERN UI instead, but we did not yet learn of the result.
Here is more fuel to the fire. I tried submitting a job to your
RB and got this:
-------------------------------------------------------------------
Selected Virtual Organisation name (from --config-vo option): dteam
**** Error: API_NATIVE_ERROR ****
Error while calling the "NSClient::multi" native api
AuthenticationException: Failed to establish security context...
**** Error: UI_NO_NS_CONTACT ****
Unable to contact any Network Server
-------------------------------------------------------------------
But my proxy is accepted OK by the gridftpd, which is how I could
copy the NS logfile and find the corresponding failures:
-------------------------------------------------------------------
10 Nov, 23:03:29 -F- "Manager::run": Manager: Failed to acquire credentials...
10 Nov, 23:05:01 -F- "Manager::run": Manager: Failed to acquire credentials...
10 Nov, 23:05:30 -F- "Manager::run": Manager: Failed to acquire credentials...
-------------------------------------------------------------------
I also saw you are running the 2.4.27 kernel on your RB, while
most UIs are running versions like 2.4.20-30.7.cernsmp: I suppose
there could be some unexpected incompatibility? What about (g)libc?
Were there no suspicious warnings when you installed/upgraded your RB?
> [...]
>
> It could not be a firewalling issue unless the myproxy server tries to
> communicate with the UI over a port that is filtered. But at our site
> (SARA) traffic between UI and RB is not filtered. I will try to find out
> why I get the "authorization failed".
There is no communication back to the UI.
|