3:01 p.m.
---------------------------------------------------------------------------------------------------------------
EGI BROADCAST TOOL : https://operations-portal.egi.eu/broadcast/send
---------------------------------------------------------------------------------------------------------------
Publication from : Alessandro Paolini <operations(a)egi.eu>
----------------------------------------------------------------------------------------------------------------
Dear VO Managers,
As already discussed, part of our infrastructure is going to change authentication and
authorisation system, from X509 personal certificates to AAI tokens.
This month the HTCondorCE version that is deployed on several sites is reaching its end of
life and we should start soon a migration campaign to a new HTCondorCE version that
dropped the usage of X509 personal certificates in favour of AAI tokens.
This implies that in order to submit jobs to the sites providing a HTCondorCE you will not
be able to use VOMS proxies any longer, but you need a token released by AAI Identity
Proxies like EGI Check-in (https://docs.egi.eu/users/aai/check-in/obtaining-tokens/).
Besides the migration campaign of the sites, we are also going to clone the several VOs
from their VOMS servers to EGI Check-in so the users can get the tokens with the VO
entitlements they need.
The other CE technology deployed by other sites, the ARC-CE, will still support the
VOMS-based authentication and authorisation for the time being (it can actually be
configured to support both the methods).
While we aim to implement this change in a way that should be as smooth as possible, we
appreciate that some VOs might not be ready yet to it so that we are also discussing with
the HTCondorCE team a possible extension, for a few months, of the support of the old
version in order to give more time to the VOs to prepare for the authentication switch;
but this is not yet agreed.
We would like to ask you what is your status concerning this switch, either if you use
central tools (like the EGI Workload Manager based on Dirac) to consume the CE resources
or if you submit jobs through command line.
Please write to "operations egi.eu" and "ucst egi.eu" if you are
ready to the change, how you interact with the CEs, if you need further time to be
prepared for the new way to access the CEs, and what are the main issues you are facing to
get ready for the switch.
Your feedback could be a valuable input for the discussion with the HTCondorCE team about
a possible extension of the support of the VOMS-based authentication in the HTCondorCE
product.
Best regards,
EGi Operations
----------------------------------------------------------------------------------------------------------------
link to this broadcast : https://operations-portal.egi.eu/broadcast/archive/2975
----------------------------------------------------------------------------------------------------------------
