Hi Gonçalo,

I have seen a similar effect. The problem came down to the following:
- The users were member of a VOMS group I did not configure in
  groups.conf.
- lcmaps must map all VOMS group attributes, and fails, as I did not
  configure properly.
- the mapping is done by the old gridmap-file mechanism.

The problem was solved by adding a catch-all line to groups.conf.
Unfortunately, the groups.conf example skipped with yaim does not show
you an example. For the DESY VO, this line looks like:
"/VO=desy/GROUP=/desy/*":::usr:desy

Best

Yves

On Mon, Aug 20, 2007 at 06:41:51PM +0100, Gonçalo Borges wrote:
> Dear All,
> 
> I'm having a very strange problem regarding some specific biomed 
> users... Basically, there are 2 biomed users (up to now) which fail to 
> run jobs here at LIP in biomed queue.
> VOMS authentication is failing and they are mapped to other queues, 
> according to the grid-mapfile, since they also belong to other VOs.
> 
> For example, in the logs, I see that the system tries to authenticate 
> one of this guys via VOMS but it fails with the message:
> 
> LCMAPS 5: 2007-08-20.15:52:27.625102.0000003081.0000075535 : LCMAPS 
> credential mapping request
> LCMAPS 0: 2007-08-20.15:52:27.625102.0000003081.0000075535 : 
> lcmaps.mod-runPlugin(): found plugin 
> /opt/edg/lib/lcmaps/modules/lcmaps_voms.mod
> LCMAPS 0: 2007-08-20.15:52:27.625102.0000003081.0000075535 : 
> lcmaps.mod-runPlugin(): running plugin 
> /opt/edg/lib/lcmaps/modules/lcmaps_voms.mod
> LCMAPS 0: 2007-08-20.15:52:27.625102.0000003081.0000075535 :    
> lcmaps_plugin_voms-plugin_run(): VOMS extensions missing from 
> certificate (failure)!
> LCMAPS 0: 2007-08-20.15:52:27.625102.0000003081.0000075535 :    
> lcmaps_plugin_voms-plugin_run(): voms plugin failed
> (...)
> 
> This is not suppose to happen if these guys start their proxies with 
> "voms-proxy-init --voms biomed". I have asked if they do it this way and 
> they say that's what they do (nevertheless, I asked for the info 
> provided by a "voms-proxy-info --all" from the UI). The funny thing is 
> that other biomed users are running jobs here and, according to the 
> logs, were authenticated via VOMS. You can see that the following time 
> stamps are after those guys jobs and for other biomed user.
> 
> LCMAPS 5: 2007-08-20.15:53:30.537162.0000003081.0000075536 : LCMAPS 
> credential mapping request
> LCMAPS 0: 2007-08-20.15:53:30.537162.0000003081.0000075536 : 
> lcmaps.mod-runPlugin(): found plugin 
> /opt/edg/lib/lcmaps/modules/lcmaps_voms.mod
> LCMAPS 0: 2007-08-20.15:53:30.537162.0000003081.0000075536 : 
> lcmaps.mod-runPlugin(): running plugin 
> /opt/edg/lib/lcmaps/modules/lcmaps_voms.mod
> LCMAPS 0: 2007-08-20.15:53:30.537162.0000003081.0000075536 :    
> lcmaps_plugin_voms-plugin_run(): voms plugin succeeded
> 
> This makes me suspicious that the problem is from their side and not 
> from my side...  So, I checked that their DNs are present in the BIOMED 
> VOMS server, and that those guys are starting their proxies from a UI 
> with the same biomed VOMS certificate I'm using at my site... Everything 
> matches up to now...
> 
> So, I'm missing ideas... Any of yours?
> 
> Cheers
> Goncalo Borges

--------------------------------------------
Yves Kemp
[log in to unmask]            Desy IT  2b/312  
Fon: +49-(0)40-8998-2318        Notkestr. 85
Fax: +49-(0)40-8994-2318     D-22607 Hamburg
--------------------------------------------