@@ -6,24 +6,27 @@ Token Authentication Overview
66How to Tell When Incoming Jobs Are Using Tokens
77-----------------------------------------------
88
9- The authentication method of a job is recorded in two places: the ` AuditLog ` files in ` /var/log/condor-ce ` .
10- In addition, an incoming (pre-routed) job on a CE will have the following classad attributes:
9+ If an incoming (pre-routed) pilot on a CE has a token, it will have the following classad attributes:
1110
11+ | Attribute | Meaning |
12+ | ------------------| -------------------------------------|
1213| AuthTokenId | A UUID of the token |
1314| AuthTokenIssuer | The URL of the issuer of the token |
1415| AuthTokenScopes | Any scope restrictions on the token |
1516| AuthTokenSubject | The 'sub' field of the token |
1617
1718(A pre-routed job is a job without ` RoutedJob=True ` in its classad.)
1819
19- Note: a job may have both a token and an X.509 proxy;
20- presence of any ` x509* ` attributes does not indicate the absence of a token.
20+ !!! note
21+ A job may have both a token and an X.509 proxy.
22+ Presence of any ` x509* ` attributes does not indicate the absence of a token.
2123
22- To see which authentication method was used for a job, look at the ` /var/log/condor-ce/AuditLog* ` files.
23- Find a line saying ` Submitting new job <JOBID> ` (where ` <JOBID> ` is a job ID like ` 21249.0 ` ).
24- The line before that should say what authentication method was used.
25- Authentication via a token will say ` AuthMethod=SCITOKENS ` ;
26- authentication via a proxy will say ` AuthMethod=GSI ` .
24+ To see which authentication method was used for a job:
25+ - Examine the ` /var/log/condor-ce/AuditLog* ` files.
26+ - Find a line saying ` Submitting new job <JOBID> ` (where ` <JOBID> ` is a job ID like ` 21249.0 ` ).
27+ The line before that should say what authentication method was used.
28+ - Authentication via a token will say ` AuthMethod=SCITOKENS ` .
29+ - Authentication via a proxy will say ` AuthMethod=GSI ` .
2730
2831
2932VOs Supporting Token Authentication for Pilot Submission
@@ -34,10 +37,15 @@ These are the VOs that support or partially support using tokens for pilot submi
3437| VO Name | Testing Tokens | Using Tokens in Production |
3538| :--------| ----------------| ----------------------------|
3639| ATLAS | Yes | No |
40+ | EIC | Yes | No |
3741| CMS | Yes | No |
42+ | CLAS12 | Yes | No |
3843| GLOW | Yes | Yes |
44+ | GlueX | Yes | No |
45+ | IceCube | Yes | No |
46+ | LIGO | Yes | No |
3947| OSG | Yes | Yes |
4048
41- Until all of the VOs you support are using tokens in production, your CE has to remain on OSG 3.5,
49+ Until all of the VOs you support are using tokens in production, your CE should remain on OSG 3.5,
4250with the 3.5-upcoming repositories enabled.
4351
0 commit comments