Hola Arnau,
> # /VO_lhcb/Role_pilot, ce05.pic.es:2119/jobmanager-lcgpbs-gshort64, resource,
> grid
> dn: GlueVOViewLocalID=/VO_lhcb/Role_pilot,GlueCEUniqueID=ce05.pic.es:2119/jobm
> anager-lcgpbs-gshort64,Mds-Vo-name=resource,o=grid
> objectClass: GlueCETop
> objectClass: GlueVOView
> objectClass: GlueCEInfo
> objectClass: GlueCEState
> objectClass: GlueCEAccessControlBase
> objectClass: GlueCEPolicy
> objectClass: GlueKey
> objectClass: GlueSchemaVersion
> GlueVOViewLocalID: /VO_lhcb/Role_pilot
> GlueCEAccessControlBaseRule: VOMS:/VO=lhcb/Role=pilot
That ACBR is still wrong. It should be this:
GlueCEAccessControlBaseRule: VOMS:/lhcb/Role=pilot
How did you manage to end up with the extra "VO="?
> VOVIEW for "global" lhcb and a DENY for all the above roles.
>
> dn: GlueVOViewLocalID=lhcb,GlueCEUniqueID=ce05.pic.es:2119/jobmanager-lcgpbs-g
> short64,Mds-Vo-name=resource,o=grid
> objectClass: GlueCETop
> objectClass: GlueVOView
> objectClass: GlueCEInfo
> objectClass: GlueCEState
> objectClass: GlueCEAccessControlBase
> objectClass: GlueCEPolicy
> objectClass: GlueKey
> objectClass: GlueSchemaVersion
> GlueVOViewLocalID: lhcb
> GlueCEAccessControlBaseRule: VO:lhcb
That ACBR format is OK.
> GlueCEStateRunningJobs: 0
>
>
> so in the above output a DENY for VOMS:/VO=lhcb/Role=pilot is missing...
Note: LHCb's DIRAC system apparently cannot handle DENY tags...
> (also for prod and lcgadmin out of this example)...
>
> am I right?
>
> If so, could you please check my yaim's conf and try to figure out
> what's wrong with it?
>
> # grep lhcb ../groups.conf
> "/lhcb"::::
> "/lhcb/Role=user"::::
> "/lhcb/Role=production":::prd:
> "/lhcb/Role=lcgadmin":::sgm:
> "/lhcb/Role=pilot":::pilot:
> "/lhcb/*":::
OK.
> #ce05.pic.es
> GSHORT64_GROUP_ENABLE=
> lhcb
> VO=lhcb/Role=lcgadmin
> VO=lhcb/Role=production
> VO=lhcb/Role=pilot
OK.
> [...]
>
> 1.-) no DENY entries
>
> 2.-) dynamic scheduller does not show correct job info per VOVIEW
Could both be related to the bad format.
|