Lukas,
Glad to hear it's working for you.
The role enforcement is on my radar. It's something I think we should
try to schedule.
On Aviary verus QMF, others may want to chime in but here are my
thoughts. One reason is to remove dependencies and simplify
installation. Aviary is a general interface that allows manipulation of
jobs in condor through an RPC mechanism, with no need to install and
configure a QMF messaging broker as a middleman. Everything you need is
bundled with condor, you just need a SOAP client to communicate with it
(and the SUDS and ssl packages we use in cumin and the examples are
packaged with RHEL already). This reduces the amount of setup and
knowledge a user needs in order to do remote ops on jobs, and I would
argue it reduces complexity. For users using condor without cumin, I
think this is an attractive option.
Cumin at this point still has need of QMF to do basic object
discovery, so the addition of Aviary has not reduced
complexity/setup/dependencies specifically in the case of Cumin. But,
if we look at bundled services like Aviary as a potential migration
path, then in the future the overall architecture of a cumin/condor
deployment can hopefully be simplified and the end-user experience
improved. Not that it's bad now, but we are always looking for ways to
make it better!
Best,
Trevor
On Tue, 2011-11-22 at 17:26 +0100, Lukas Slebodnik wrote:
Thaks for all replies.
I found out, that I skipped few lines :) when I read Management Console
Installation Guide. There is paragraph noted as Important with warning that
Cumin must connect to the MRG Messaging broker using password authentication for
full operability.
I found in qmf sources (and Messaging User guide) simple acl.
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/2/html-single/Me...
acl allow cumin@QPID all all
acl allow anonymous@QPID all all
acl deny all all
But like you mentioned: cumin is missing role enforcement. So users can remove
each others jobs. Similar with condor setting QUEUE_ALL_USERS_TRUSTED = True.
So I probably retain the option to manipulate jobs only in "Grid User"
section.
One more question at the end. Why do you try to replace qmf communication with
aviary?
Lukas
On Fri, Nov 18, 2011 at 04:00:27PM -0500, Trevor McKay wrote:
> Hi Lukas,
>
> Thanks for your comments. A few different issues here...
>
> On Fri, 2011-11-18 at 17:12 +0100, Lukas Slebodnik wrote:
> > Hi all,
> >
> > In our company, we mainly use Cumin to job monitoring, but Cumin has also
> > possibility to manage jobs (hold, release, remove). We have installed Cumin
> > version 0.1.4916. This version communicate with condor through python-qmf.
> > If I try to remove(release, hold) job, Cumin will report error message:
> > "Remove: Failed (Forbidden)". This is a reason why we decided to
comment out
> > this features from Cumin, so our users can't see it.
>
> I believe the issue you are running into here is that cumin must
> authenticate to the QMF broker as the "cumin" user, otherwise certain
> restrictions on actions are enforced by condor.
>
> To do this, a "cumin" user must be created in the SASL database for the
> broker, and the cumin.conf file must be updated.
>
> On the machine where the broker is running, do this (this will prompt
> for a password and create the cumin user):
>
> $ sudo -u qpidd /usr/sbin/saslpasswd2 -f /var/lib/qpidd/qpidd.sasldb -u QPID cumin
>
> Then, change the "brokers:" setting in /etc/cumin/cumin.conf to include
> credentials for the "cumin" user. A broker address with authentication
> credentials looks like this (your username will be "cumin")
>
> brokers: username/password@hostname:port
>
> Then, restart cumin. This should take care of it.
>
> >
> > Last week I tried the latest version of Cumin from svn (rev. 5117). But job
> > management also do not work. Is it in qpid or condor configuration problem?
>
> same issue.
>
> > I noticed, that latest version of Cumin can communicate with Condor using
> > aviary project. I installed latest condor-aviary (from Condor 7.6.4 ).
> > I configured Cumin to use aviary and then suddenly job management work very
> > well. But after some testing I noticed that, I was able to remove any user
jobs,
> > although I was only ordinary user (without admin role). I also tried to use
> > example aviary python scripts and result was the same. I removed any user
jobs.
>
> Aviary does not at this point have any checks on user identity. It's
> pretty new, this is something we should explore in the future.
>
> > Is it also a configuration issue like with qmf?
>
> QMF has ACLs, but I confess I have not explored them deeply, they may be
> applicable here.
>
> However, when talking to condor through QMF, you are restricted from
> doing certain things unless you connect to the broker as "cumin".
>
> For QMF, if an admin were to keep the "cumin" user password secret, so
> that users could not freely connect to the broker as the "cumin" user
> then these job operations would be protected (as you saw above!)
>
> But, cumin is missing role enforcement.....
>
> > What is a purpose of admin role in cumin? Because I did not noticed any
> > differences.
>
> Currently, there is not really any role enforcement in Cumin. Ideally,
> admin users will see the "Administrator" view and regular users will
> only see the User Grid view.
>
> Jobs in the User Grid view are filtered for the user, so they would not
> see the jobs of other users.
>
> Enforcing the roles would provide some protection, so you could not
> operate through the GUI on objects you could not see.
>
> However, to protect against hackers constructing their own http requests
> for the cumin web-server, cumin would probably also need to enforce some
> checks on user activity at the code level.
>
> > Regards,
> > Lukas
> > _______________________________________________
> > cumin-users mailing list
> > cumin-users(a)lists.fedorahosted.org
> >
https://fedorahosted.org/mailman/listinfo/cumin-users
>
>
> _______________________________________________
> cumin-users mailing list
> cumin-users(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/cumin-users
_______________________________________________
cumin-users mailing list
cumin-users(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cumin-users