---

glexec/Argus Pilot Service: Home Page

---

• Start Date: Tue 24 Nov 2009
• End Date (tentative): 12 April 2010
• Description: Pilot Service of glexec/Argus @ FZK, SWITCH, CESNET, SRCE, INFN
• Coordinator: Antonio Retico
• Contact e-mail: egee-pilot-argus@cern.ch
• Status : In Progress
• Related meetings

---

Description

Use cases

• Experiment framework using glexec for production pilot jobs.
• Test of grid-wise banning feature by OSCT
• Gathering of requirements and analysis for monitoring tools

Objective and metrics

Objective:

1. Chain glexec - Argus demonstrated to interact correctly with LHC Exepriments' frameworks for pilot jobs
2. Maintenance and operations of the Argus service declared supportable by the sites
3. OSCT able to ban a user on the whole pilot infrastructure without specific intervention of the site administrators
4. Collection of exhaustive requirements for the implementation of monitoring tools

Planning

Initial plan

Task	Owner	Start Date	Due Date	Status
Set-up repositories and documentation	SA1, SA3, CNAF	23-Nov-09	24-Nov-09	Done
Preliminary installation (ARGUS, WN, CE)	SWITCH	25-Nov-09	27-Nov-09	Done
Core installations (ARGUS, WN, CE)	FZK, SRCE, CESNET, CNAF	30-Nov-09	10-Dec-09	In progress

Constraints and milestones

• kick-off with sites: 25-Nov (11 AM CET)
• 1st site technically available for Experiments to test (SWITCH): 1-Dec
• kick-off with experiments: 1-Dec (11 AM CET)
• All sites technically available for Experiments to test: 15-Jan
• Indicative start of Alice developments to integrate glexec: 18-Jan
• Indicative start of CMS developments to integrate glexec: 15-Feb
• END of activity (proposed): 31-Mar

Technical documentation

Installation Documentation

Yum repo:

Argus service

• Repository URL : http://grid-it.cnaf.infn.it/apt/glite/pps/pilot/ARGUS/argus/sl5/x86_64/
• INFO : the repository includes PATCH:3076
• Certification report of the Argus patch: ArgusCertification

Worker Node

• Repository URL : http://grid-it.cnaf.infn.it/apt/glite/pps/pilot/ARGUS/glite-WN/sl5/x86_64/
• INFO : the repository is synchronised to the production WN repository (link) and contains in addition
  • PATCH:3394 (gLExec SL5)
  • PATCH:3093 (LCMAPS with PEP-c client)

Computing Element

• Repository URL : Production repository (I hope)
• INFO :

Configuration instructions

Both for the Argus service and GLEXEC, YAIM modules are available:

• https://twiki.cern.ch/twiki/bin/view/LCG/Site-info_configuration_variables#ARGUS
• https://twiki.cern.ch/twiki/bin/view/LCG/Site-info_configuration_variables#GLEXEC_wn

For more fine tunings:

• Argus: https://twiki.cern.ch/twiki/bin/view/EGEE/AuthorizationFrameworkArchive

Post configuration tests

In order to test the correct deployment of Argus, after the installation/configuration some basic tests can be done using the pap-admin to store/list/update/remove policies. After this, the pepcli can be used to test authorization requests/responses. pap-admin and pepcli are documented in the Argus main twiki.

In order to test the interaction glexec-Argus do something like this from a whitelisted account on the Worker Node:

export X509_USER_PROXY=<target_proxy>
export GLEXEC_CLIENT_CERT=${GLEXEC_CLIENT_CERT:-$X509_USER_PROXY}
$GLITE_LOCATION/sbin/glexec /usr/bin/whoami

And verify that the returned user is the mapped one.

Configuration requirements for sites supporting Atlas

• if a myproxy server is used to pass the credentials, myproxy-logon has to be installed on the WN (it should be the default in production by now)
• if a plain proxy is retrieved, and adding voms attributes on the WN is needed, the vomses file has to be reachable from the WN.
• both the roles atlas:/atlas/Role=production and atlas:/atlas/usatlas/Role=pilot need to be enabled to submit to the queue

General documentation (user guides)

• Argus user guide: https://twiki.cern.ch/twiki/bin/view/EGEE/AuthorizationFrameworkArchive

Test documentation

• Extract from Argus load and aging test (from GDB 14-Nov-2009)

---

• Certification report of the Argus patch: ArgusCertification

Pilot Layout

SWITCH

Argus one virtual machine with SL5 64 bit, installed from the following repository

http://grid-deployment.web.cern.ch/grid-deployment/glite/cert/3.2/patches/3076/sl5/$basearch/ (an alternative is now available here http://grid-it.cnaf.infn.it/apt/glite/pps/pilot/ARGUS/argus/sl5/x86_64/)

CE One lcg-CE (diana.switch.ch) with two WNs (SL5 64 bit): all as vmware virtual machines. VOs enabled: dteam,dech,ops,atlas (no atlas software installed). The WNs were installed pointing to the following repository

CE endpoint http://grid-it.cnaf.infn.it/apt/glite/pps/pilot/ARGUS/glite-WN/sl5/x86_64/

FZK-LCG2

Argus one virtual machine with SL5 64 bit

CE All CEs at GridKa are usable but please refer to cream-3-fzk.gridka.de. The queue must be "pps". All software installations are available on the PPS WNs. Enabled VOs: alice, atlas, cms, dteam, lhcb and ops.

WNs The PPS cluster has been extended to 300 cores

For alice a separate VOBox is available: test-mw-fzk.gridka.de

CNAF

Argus one virtual machine on SL5/64bit

CE One CREAM CE with two virtual WNs (SL5 64 bit). VOs enabled: dteam, infngrid, ops.

CE endpoint devce.cnaf.infn.it:8443/cream-pbs-cert

Results

Feedback from the experiments

Comments and issues from operations

SWITCH

The instructions to manually install the Argus compatible WNs are wrong. It is recommended that yaim be used instead.

FZK / KIT

reduction of the policy refresh time from 4hours to 15 mins requested: Angela opened the bug
https://savannah.cern.ch/bugs/index.php?62281

List of issues

Issue	Reported by	Bug(s)	Status	Open/Closed
(Affects glexec on WMS-->GLEXEC-->CREAM chain): Wrongly configured GLITE_LOCATION makes sometimes impossible the discovery of the glexec executable	CERN	BUG:62810)fixed with patch 3760 (with provider)	open
The default policy refresh time set to 4hours seems too long	KIT	BUG:62281	To be discussed with JSPG	open
PEPd should require client-cert authentication support for connecting pep clients	CNAF-T1	BUG:60041	fixed with patch 3536 In certification	open

Recommendation for Deployment in production

Final assessment

Tasks and actions:

Actions for SA1 are tracked via the Sa1 Deployment task tracker

CERN Accelerating science

• Sign in
• Directory

CERN Single Sign-On

Sign in with a CERN account, a Federation account or a public service account

New CERN Single Sign-On (SSO) Portal

?Please note that CERN IT is starting migrating to the new CERN SSO Portal. Hence, you might face a new look-and-feel prior to signing in to certain services. The URL for the new SSO Portal is "https://auth.cern.ch" and you should only accept that web address (or this current page) when logging into CERN. Thanks for being vigilant and alert! For more details, see https://cern.ch/security/?

[ Click to expand ]

Sign in with your CERN account

Reminder: you have agreed to comply with the CERN computing rules, in particular OC5. CERN implements the measures necessary to ensure compliance.

Use credentials

Username or Email address	Password
		WebForm_PostBackOptions("ctl00$ctl00$NICEMasterPageBodyContent$SiteContentPlaceholder$btnFormsLogin", "", true, "credentials", "", false, false))" id="ctl00_ctl00_NICEMasterPageBodyContent_SiteContentPlaceholder_btnFormsLogin" class="button_signin" />
Remember Username or Email Address	Need password help ?

Use one-click authentication

	Sign in using your current Windows/Kerberos credentials [autologon]
	Use your current authentication token. You need Internet Explorer on CERN Windows or Firefox on SLC (Firefox help here).

http://cern.ch/ca" href="http://egee-pre-production-service.web.cern.ch/egee-pre-production-service/MPS//auth/sslclient/?wa=wsignin1.0&wreply=https%3A%2F%2Fegee-pre-production-service.web.cern.ch%2FShibboleth.sso%2FADFS&wct=2020-01-29T15%3A16%3A13Z&wtrealm=https%3A%2F%2Fegee-pre-production-service.web.cern.ch%2FShibboleth.sso%2FADFS&wctx=cookie%3A1580310973_b1e8">Sign in using your CERN Certificate http://cern.ch/ca." href="http://egee-pre-production-service.web.cern.ch/egee-pre-production-service/MPS//javascript:__doPostBack('ctl00$ctl00$NICEMasterPageBodyContent$SiteContentPlaceholder$hlCertificateAutologon','')">[autologon]

You can get a CERN certificate on the CERN Certification Authority website.

Use strong two factor authentication [show]

Two Factor Authentication Two factor authentication using your CERN credentials and a verification code like SMS code or Google Authenticator, a device like Yubikeys or Smartcards or biometry.

Sign in with a public service account

Facebook, Google, Live, etc. Authenticate using an external account provider such as Facebook, Google, Live, Yahoo, Orange.

Sign in with your organization or institution account

Enter the name of the organisation you are affiliated with... Al Musanna College of Technology American Museum of Natural History - Richard Gilde... A?Sharqiyah University Bayan College EduGain_http://adfs.du.edu.om/adfs/services/trust German University of Technology Ibri Vocational College Ibra College of Technology International Maritime College Oman Majan University College Modern College of Business and Science Military Technological College Muscat College Nizwa College of Technology North Idaho College Oman Research and Education Network (OMREN) Salalah College of Technology Shinas College of Technology Shinas Vocational College Sultan Qaboos University Sur University College Umeå University University of Buraimi Bridgewater College College of Sharia Sciences Linköping University Sohar University Research Council Oman University of Nizwa The University of Auckland Chalmers Middle East College Stellenbosch University Quinnipiac University Technical University of Denmark (DTU) VIB EduGain_http://wap.nddl-lca.fr/adfs/services/trust The University of New South Wales (UNSW) University of Tasmania Empa Université de Lausanne ZHAW - Zürcher Hochschule für Angewandte Wissensch... Universität Bern HEP Vaud - Haute école pédagogique du canton de Va... HSR - Hochschule für Technik Rapperswil ETH Zurich HES-SO - Haute École Spécialisée de Suisse occiden... PSI - Paul Scherrer Institut SWITCH Staff Universität Basel VHO - Virtual Home Organization EduGain_https://accounts.google.com/o/saml2?idpid=C01l49spm Ibri College of Technology Alytus University of Applied Sciences EduGain_https://auth.lmu.edu/idpb/shibboleth Manhattan College Owens Community College University of Nebraska at Omaha University of British Columbia Universite Saint-Louis - Bruxelles EduGain_https://birk.wayf.dk/birk.php/sso.sdu.dk/wayf Copenhagen Business School COREEN set.ID by KAFE Charité - Universitätsmedizin Berlin IGTF Certificate Proxy SWITCH edu-ID University of Nebraska EduGain_https://fedcnam.cnam.fr/idp/shibboleth The University of Sydney Klaipeda University Temple University EduGain_https://fs.tti.tamu.edu/adfs/services/trust The University of Hong Kong Bedrijfsbureau Humanitiescluster KNAW Korea Institute of Oriental Medicine Korea Institute of Science and Technology Informat... Korea Research Institute of Bioscience and Biotech... ULisboa - Instituto Superior Técnico Vilnius University of Applied Sciences National Institute for Astrophysics - INAF Ghent University Argonne National Laboratory National Infrastructures for Research and Technolo... EduGain_https://idp.agreenium.fr/idp American University Assistance Publique - Hôpitaux de Marseille American University of Beirut University of Birmingham MPI of Biochemistry Brookhaven National Laboratory California Institute of Technology CANARIE Cardiff University Swinburne University of Technology Unizin College of Physicians and Surgeons Pakistan CSC - IT Center for Science Ltd. California State University, San Bernardino Deutsches Elektronen-Synchrotron DESY DFN Office Dublin Institute for Advanced Studies GARR TU Dublin - City Campus Deutsches Schifffahrtsmuseum (DSM) Duquesne University European Molecular Biology Laboratory - EMBL-EBI University of Edinburgh EduGain_https://idp.ego-gw.it/idp/shibboleth ENSMM Besançon - National School of Mechanical and... ENSAE - École Nationale de la Statistique et de l'... EPFL - EPF Lausanne Esigelec Fermi National Accelerator Laboratory University of Glasgow Galway-Mayo Institute of Technology DZ e-Science GRID IDP Grinnell College Georgia State University University of Hawaii HEAnet Staff Higher Education Commission Pakistan Hochschule Bremerhaven University of Applied Scien... Esslingen University of Applied Sciences University of Applied Sciences Karlsruhe Hochschule Wismar Iowa State University University Hospitals Institute - ICM INFN - National Institute for Nuclear Physics Leibniz Institute for Plasma Science and Technolog... INRA - Institut National de la Recherche Agronomiq... Stockholm University Forschungszentrum Jülich GmbH Jisc University of Kelaniya - Sri Lanka Loughborough University LEARN - Sri Lanka LIGO-India Scientific Collaboration Leibniz Supercomputing Centre (LRZ) Maeen IdP EduGain_https://idp.merit.edu MiraCosta Community College District Morgan State University Murdoch University Ecole Nationale Supérieure d'Architecture de Nante... National Center for Supercomputing Applications North Dakota State University NED University of Engineering and Technology Pakis... University of Newcastle KIFÜ University of Delaware EduGain_https://idp.oar.net/idp/shibboleth Ohio Technology Consortium (OH-TECH) rSmart Ohio Supercomputer Center (OSC) University of Pennsylvania PH Freiburg Princeton University Politehnica University of Bucharest IdP Royal College of Physicians of Ireland Rice University Agency ARNIEC RoEduNet IdP Universität zu Köln Karlsruhe Institute of Technology (KIT) EduGain_https://idp.shom.fr/idp SIGMA CLERMONT SISSA Southern Methodist University Scuola Superiore Sant'Anna University of St Andrews Texas A&M University - San Antonio University of Alabama, The University "Alexandru Ioan Cuza" from Iasi Université Clermont Auvergne Catholic University of Louvain IDP - ULB (Universite libre de Bruxelles) University of New England Universität Bremen University of Calabria Université de Genève Universität Heidelberg University of Macerata. The University of Melbourne University of Modena e Reggio Emilia Universität Oldenburg EduGain_https://idp.uni-potsdam.de/idp/shibboleth University of Strasbourg Universität Tübingen EduGain_https://idp.univ-corse.fr/idp/shibboleth University of Wuppertal University of Nebraska Medical Center Paris-Sud University University of Saskatchewan University of Tennessee University of Victoria The University of Western Australia University of Wisconsin-Milwaukee VSB - TU Ostrava VUB - IDP (Vrije Universiteit Brussel) University of Warwick Whitman College Willamette University William & Mary Western Michigan University The College of Wooster XSEDE Vienna University of Technology Science and Technology Facilities Council EduGain_https://idp1.desy.de/idp/shibboleth Griffith University Australian National University Blekinge Institute of Technology University of Dunaújváros Jacobs University Bremen gGmbH Université Paris 8 - Vincennes University of Nevada, Reno University of Gothenburg Pohang University of Science and Technology University of Birmingham (Development IdP) Idp-lab.martinique.univ-antilles.fr Curtin University University of Liege - ULG EduGain_https://idptest.ciep.fr/idp/shibboleth Université de Bordeaux Lund University Université d'Aix Marseille Victoria University Universiteit Antwerpen University of Toronto ISM University of Management and Economics Thomas Jefferson National Accelerator Facility Korea Astronomy and Space Science Institute Seoul National University King's College London SZTAKI staff University of Munich (LMU) AAI@EduHr Single Sign-On Service Aristotle University of Thessaloniki Boston College SUNY The College at Brockport Carnegie Mellon University University of Helsinki Institute of Accelerating Systems and Applications... Kaunas University of Technology Klaipeda State University of Applied Sciences LIGO Scientific Collaboration Mykolas Romeris University National Technical University of Athens NYU Langone Health Oregon State University RWTH Aachen University Santa Clara University University of Florida Universität Hamburg (UHH) University of Wisconsin-Madison Lithuanian University of Health Sciences Lithuanian Sports University Marijampole College DZ e-Science MEDECINE IDP A. T. Still University NERC Wigner Research Centre for Physics University of Colorado Denver | Anschutz Medical C... Coast Community College District SANReN Competency Area TENET South Africa University of Cape Town Queen's University Belfast DHBW Stuttgart Korea University Boston University Universität Mainz University of Nebraska-Lincoln EduGain_https://shib1.univ-nc.nc/idp/shibboleth University of Wisconsin-Platteville University of New-Caledonia (UNC) CTLES - Centre Technique du Livre de l'Enseignemen... Technical University of Liberec Eckerd College Ecole Nationale Supérieure d'Architecture de Clerm... Imperial College London McGill University Moravian Library Salisbury University University of Michigan University Grenoble Alpes - UGA University of Guam Ecole Nationale des Chartes Baylor University Observatoire de Paris Gesellschaft für wissenschaftliche Datenverarbeitu... Max-Planck Institutes (in MetaDir of GWDG) Georg-August University Göttingen Alfred Wegener Institute, Helmholtz Centre for Pol... Bates College Cornell University Institute for Research in Fundamental Sciences (IP... California State University, Fresno University of Missouri System Deakin University The George Washington University german academic exchange service Lehigh University University of Georgia SSO Florida Gulf Coast University Leibniz-Universität Hannover The University of Memphis New York Genome Center University College Dublin Idp test ssov3.institutoptique.fr Technical University of Munich (TUM) University of South Australia Vytautas Magnus University AAF Virtual Home Tuakiri Virtual Home Universcience-EPPDCSI EduGain_https://wap.nddl-lca.fr/idp/shibboleth Aarhus University Cedar Crest College University At Albany, State University of New York Hochschule für Technik und Wirtschaft - HTW Berlin Karlstad University Uppsala University Indiana University of Pennsylvania ESRF - European Synchrotron Radiation Facility CESNET Centro de Estudios Monetarios y Financieros Institute for High Energy Physics Universität Erlangen-Nürnberg Universität Münster Université Rennes 2 Macquarie University The University of Queensland University of Alaska Statewide System The University of Arizona University of California, Berkeley Columbia University Duke University Internet2 Johns Hopkins Lawrence Berkeley National Laboratory Massachusetts Institute of Technology Northern Arizona University National Institutes of Health (NIH) Northwestern University Ohio State University Stanford University Texas A & M University University of Alabama at Birmingham University of California, Davis University of Chicago University of California, Santa Barbara University of California, Santa Cruz University of Illinois at Urbana-Champaign University of Maryland Baltimore County University of Maryland College Park University of North Carolina at Chapel Hill University of Utah University of Virginia KU Leuven Association EGI

Why is my organisation not listed?

[show debug information]

Debug

Server

ADFS12
User Agent: TWiki::Net/30610 libwww-perl/6.05

Related sites

• Need password help ?
• Create/Check your account
• EduGain disclaimer settings
• Service Desk +41 22 76 77777
• Computing Status Board
• Connection using IPv6

Tasks for other participants are tracked here

Open

Assigned to	Due date	Description	State	Closed	Notify
GiuseppeMIsurelli	2010-02-19	Provide a report describing the issues being faced by CNAF for the installation of glexec on the WNs. INFN-T1 is experiencing a problem on the stability of GPFS interacting with the WN on demand system adopted locally into the resource center. Since they decided to provide virtual WNs for the pilot, the issue is affecting consequently the deployment of the glexec WN component into the site.	openclosed	2010-02-19 MaartenLitmaath		edit

Assigned to	Due date	Description	State	Closed	Notify
GianniPucciani	2010-02-19	Provide functional specification of glexec tests being implemented at SRCE	openclosed			edit
ChadLaJoie	2010-02-03	Provide instructions on how to preserve local policies during the upgrade of the Argus server to a newer version both in an e-mail to the sites and in the PATCH:3536 this was done on the 2nd of February This is done now at https://savannah.cern.ch/patch/?3536	openclosed	2010-03-02 MaartenLitmaath		edit

Closed

Assigned to	Due date	Description	State	Closed	Notify
AngelaPoschlad	2010-02-03	Open a bug to request the reduction of the policy refresh time from 4hours to 15 mins 3-2-10: Angeal opened the bug https://savannah.cern.ch/bugs/index.php?62281	openclosed	2010-02-05 MaartenLitmaath		edit
AntonioRetico	2009-12-18	Provide the timeline for an installation of a reasonable scale (>100WNs) to be available to Atlas in order to test glexec in production Update 18-Dec (Andrea Ceccanti) : Converging on CANF offering the first large-scale installation. They are currently working to the installation at the T! and they hope to have finished before Christmas or alternatively by the 6th of January in order to be ready by the 15th. If the preliminary tests now undergoing suceed they are Ok to use Argus 1.1 whenit will be in status "Ready for Certification"	openclosed	2009-12-18 AntonioRetico		edit
Main.SWITCH, Main.NIKHEF, Main.SA3	2009-12-01	Finalise the YAIM configuration for Argus -compatible GLEXEC_WN	openclosed	2009-12-18 AntonioRetico		edit
GianniPucciani	2009-12-04	enumerate available deployment scenarios and see whether new developments have to be requested (or re-negotiations are needed with the sites) Update 26-Nov. After discussion with JRA1 and SA3 it was proposed to extend the support of the clients on SL4 . A new patch has been requested to the developers Antonio Update 1-Dec During the last meeting Gianni was put in charge to open the bug with the change request Update 18-Dec (Gianni) : All new developments are now tracked by bugs	openclosed	2009-12-08 MaartenLitmaath		edit
GianniPucciani	2009-12-01	provide reference for basic testing for site administrators in the twiki Update 1-Dec : info now available in #Post_configuration_tests	openclosed	2009-12-03 MaartenLitmaath		edit
AngelaPoschlad	2009-12-01	reply to proposed timelines for FZK Angela confirmed that staring on the 30th is fine for her	openclosed	2009-11-26 MaartenLitmaath		edit

History

30-Mar-2010 : Check point (PPIslandFollowUp2010x03x30):

• Argus 1.1 server part in "Ready for Rollout"

17-Mar-2010 : Check point (PPIslandFollowUp2010x03x17):

• Installation at CNAF T1 finished
• Decision to use the production repository for future operations
• Testing of the OSCT global banning list approved.
• Pilot end date shifts to the 16th of April
• Further developments and tests to be followed within the GDB

16-Feb-2010 : Check point (PPIslandFollowUp2010x02x16):

• Installation at KIT/FZK scaled-up to 300 cores

2-Feb-2010 : Check point (PPIslandFollowUp2010x02x02):

• All sites will be soon requested to upgrade to the new version of Argus PATCH:3536 . CNAF-T1 will be the first, the other will follow
• All sites requested to apply the workaround in BUG:62206 in order for the Argus servers to star being published in the information system.
• Integration works in progress for Alice
• Integration works confirmed to start at mid February for CMS

18-Dec-2009 : Check point (PPIslandFollowUp2009x12x18):

• Testing of Argus version 1.1. in progress at CNAF
• installation in progress at all sites. Platform expected available by the 15th of Dec

1-Dec-2009 : Fist installaiton at SWITCH available for testing

1-Dec-2009 : kick-off with the experiments (PPIslandKickOff2009x12x01)

25-Nov-2009 : kick-off with sites (PPIslandKickOff2009x11x25)

24-Nov-2009 : Pilot Home page created