Ticket 10940

Summary:	Slurm with kerberos
Product:	Slurm	Reporter:	Kris Whetham <kwhetham>
Component:	Configuration	Assignee:	Tim McMullan <mcmullan>
Status:	RESOLVED INFOGIVEN	QA Contact:
Severity:	4 - Minor Issue
Priority:	---	CC:	acontois, kwhetham
Version:	20.11.3
Hardware:	Linux
OS:	Linux
Site:	FB (PSLA)	Alineos Sites:	---
Atos/Eviden Sites:	---	Confidential Site:	---
Coreweave sites:	---	Cray Sites:	---
DS9 clusters:	---	HPCnow Sites:	---
HPE Sites:	---	IBM Sites:	---
NOAA SIte:	---	OCF Sites:	---
Recursion Pharma Sites:	---	SFW Sites:	---
SNIC sites:	---	Linux Distro:	---
Machine Name:		CLE Version:
Version Fixed:		Target Release:	---
DevPrio:	---	Emory-Cloud Sites:	---

Description Kris Whetham 2021-02-24 12:21:05 MST

Hi Sched, 

We are looking into using kerberos authentication for users launching Slurm jobs. Slurm documentation https://slurm.schedmd.com/download.html lists AUKS as a mechanism for the application to manage Kerberos credentials to non-interactive applications, like Slurm batch jobs.

We wanted to confirm if AUKS is the recommended solution for using Kerberos with Slurm or if there are other options.

Comment 1 Kris Whetham 2021-02-25 11:52:29 MST

Apologies if this is a duplicate request - please CC acontois@penguincomputing.com, kwhetham@penguincomputing.com if so. Thanks

Comment 2 Tim McMullan 2021-02-25 12:31:36 MST

I took a look internally and AUKS is the only thing that really interacts with kerberos that we are aware of.  AUKS is an external tool that has a plugin for Slurm, so its not something we generally test though.

What is your use case for kerberos authentication along with Slurm jobs?  Its not something we've found a lot of sites asking about, so I'm curious about the use case you have for it.

Thanks!
--Tim

Comment 3 Kris Whetham 2021-02-26 04:56:25 MST

We are exploring ways to use kerberized NFS shares with Slurm and hence the need for AUKS or something like it. If you have some other suggestion that could work better than AUKS for using kerberized NFS shares with Slurm, say with SchedMD support even, please let us know. We are open to a follow up call to discuss. Thank you for your time.

Comment 4 Kris Whetham 2021-03-02 11:51:20 MST

Hi Tim, Any update here?

Comment 5 Tim McMullan 2021-03-02 14:20:29 MST

It seems that the AUKS plugin is the only one we are aware of that will help deal with kerberos directly, and I've been unable to come up with a clever idea to make it work without something like it.

At this point, if the AUKS solution doesn't work, I think this would be a feature request and you would want to chat with Tim Wickberg et al. about the possibility of adding support directly.

Thanks!
--Tim