Skip to content
This repository was archived by the owner on May 23, 2022. It is now read-only.

Commit 35740ba

Browse files
committed
Tweak text, add additional VOs to the table
1 parent b743349 commit 35740ba

File tree

1 file changed

+18
-10
lines changed

1 file changed

+18
-10
lines changed

docs/security/tokens/overview.md

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,27 @@ Token Authentication Overview
66
How to Tell When Incoming Jobs Are Using Tokens
77
-----------------------------------------------
88

9-
The authentication method of a job is recorded in two places: the `AuditLog` files in `/var/log/condor-ce`.
10-
In addition, an incoming (pre-routed) job on a CE will have the following classad attributes:
9+
If an incoming (pre-routed) pilot on a CE has a token, it will have the following classad attributes:
1110

11+
| Attribute | Meaning |
12+
|------------------|-------------------------------------|
1213
| AuthTokenId | A UUID of the token |
1314
| AuthTokenIssuer | The URL of the issuer of the token |
1415
| AuthTokenScopes | Any scope restrictions on the token |
1516
| AuthTokenSubject | The 'sub' field of the token |
1617

1718
(A pre-routed job is a job without `RoutedJob=True` in its classad.)
1819

19-
Note: a job may have both a token and an X.509 proxy;
20-
presence of any `x509*` attributes does not indicate the absence of a token.
20+
!!! note
21+
A job may have both a token and an X.509 proxy.
22+
Presence of any `x509*` attributes does not indicate the absence of a token.
2123

22-
To see which authentication method was used for a job, look at the `/var/log/condor-ce/AuditLog*` files.
23-
Find a line saying `Submitting new job <JOBID>` (where `<JOBID>` is a job ID like `21249.0`).
24-
The line before that should say what authentication method was used.
25-
Authentication via a token will say `AuthMethod=SCITOKENS`;
26-
authentication via a proxy will say `AuthMethod=GSI`.
24+
To see which authentication method was used for a job:
25+
- Examine the `/var/log/condor-ce/AuditLog*` files.
26+
- Find a line saying `Submitting new job <JOBID>` (where `<JOBID>` is a job ID like `21249.0`).
27+
The line before that should say what authentication method was used.
28+
- Authentication via a token will say `AuthMethod=SCITOKENS`.
29+
- Authentication via a proxy will say `AuthMethod=GSI`.
2730

2831

2932
VOs Supporting Token Authentication for Pilot Submission
@@ -34,10 +37,15 @@ These are the VOs that support or partially support using tokens for pilot submi
3437
| VO Name | Testing Tokens | Using Tokens in Production |
3538
|:--------|----------------|----------------------------|
3639
| ATLAS | Yes | No |
40+
| EIC | Yes | No |
3741
| CMS | Yes | No |
42+
| CLAS12 | Yes | No |
3843
| GLOW | Yes | Yes |
44+
| GlueX | Yes | No |
45+
| IceCube | Yes | No |
46+
| LIGO | Yes | No |
3947
| OSG | Yes | Yes |
4048

41-
Until all of the VOs you support are using tokens in production, your CE has to remain on OSG 3.5,
49+
Until all of the VOs you support are using tokens in production, your CE should remain on OSG 3.5,
4250
with the 3.5-upcoming repositories enabled.
4351

0 commit comments

Comments
 (0)