Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need longer idtoken lifetimes for decision engine #453

Open
StevenCTimm opened this issue Mar 13, 2023 · 4 comments
Open

Need longer idtoken lifetimes for decision engine #453

StevenCTimm opened this issue Mar 13, 2023 · 4 comments
Labels
operations Issue filed by Operations team

Comments

@StevenCTimm
Copy link
Contributor

We discovered today that the DE is making idtoken that are only good for 1 day.
Attempted to increase this value with idtoken_lifetime but Marco tells us that this knob actually
doesn't work.

There's a known patch for this against the glideinwms frontend but not the decision engine.

@StevenCTimm
Copy link
Contributor Author

Marco released glideinwms 3.10.2-rc1 release candidate which (if the frontend.xml file was thus configured) was able to make long idtokens on a frontend, but not on a decision engine. More investigation needed. the routines patched in that release are in the common glideinwms libraries which are installed both on the frontend and on the decision engine but it appears that the patched code in question (cvWParams.py and cvWParamDict.py) is not called in the decision engine to create the tokens.

Examination of decisionengine_modules/glideinwms/glide_frontend_element.py shows this at line 1334

            duration = 24 * one_hr

I will bump this to 120 and see what it does.

@StevenCTimm
Copy link
Contributor Author

That worked. production and dev currently patched.

@StevenCTimm
Copy link
Contributor Author

Note that it is important to solve the general case of how to renew because at some HPC sites we can be sitting in the queue for a month. I don't think we want month-long tokens out in the wild. I have bumped the priority of this in the htcondor queue up to level 1 "fire".

@StevenCTimm
Copy link
Contributor Author

Also it is the point of this Issue to make the DE respect whatever is written for idtoken_lifetime in the configuration file, just as the frontend already does.

@StevenCTimm StevenCTimm added the operations Issue filed by Operations team label May 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
operations Issue filed by Operations team
Projects
None yet
Development

No branches or pull requests

1 participant