Bug 2900 – Job submssion does not work using relative path in global_security_descriptor.xml and absolute path in sudoers.

Bug 2900 - Job submssion does not work using relative path in global_security_descriptor.xml and absolute path in sudoers.

Summary:

Job submssion does not work using relative path in global_security_descripto...

Status:	RESOLVED FIXED

Product:	Java WS Security
Component:	Authentication
Version:	3.9.5
Platform:	All Linux

Importance:	P3 normal
Target Milestone:	---
Assigned To:	Sam Meder

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2005-03-08 04:42 by Thilo Boehm
Modified:	2005-04-09 10:55 (History)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note

You need to log in before you can comment on or make changes to this bug.

Description From Thilo Boehm 2005-03-08 04:42:40

global_security_descriptor.xml:

<?xml version="1.0" encoding="UTF-8"?>
<securityConfig xmlns="http://www.globus.org">
    <credential>
        <key-file value="etc/grid-security/containerkey.pem"/>
        <cert-file value="etc/grid-security/containercert.pem"/>
    </credential>
<gridmap value="etc/grid-security/grid-mapfile"/>
</securityConfig>

sudoers:

tboehm  ALL=(ibmgrid) NOPASSWD: /opt/IBMGrid/libexec/globus-gridmap-and-execute
-g  /opt/IBMGrid/etc/grid-security/grid-mapfile
/opt/IBMGrid/libexec/globus-job-manager-script.pl *
tboehm  ALL=(ibmgrid) NOPASSWD: /opt/IBMGrid/libexec/globus-gridmap-and-execute
-g /opt/IBMGrid/etc/grid-security/grid-mapfile
/opt/IBMGrid/libexec/globus-gram-local-proxy-tool *

Server out:
[50]: https://127.0.0.1:8443/wsrf/services/ManagedJobFactoryService
2005-03-08 11:36:11,419 INFO  authorization.ServiceAuthorizationChain
[Thread-9,authorize:281] Authorized
"/O=Grid/OU=GlobusTest/OU=simpleCA/CN=IBMGRID" to invoke
"{http://www.globus.org/namespaces/2004/10/gram/job}createManagedJob".
2005-03-08 11:36:13,696 INFO  exec.RunQueue [Thread-9,<clinit>:48] Starting
state machine with 16 run queues.
2005-03-08 11:38:18,564 INFO  authorization.ServiceAuthorizationChain
[Thread-8,authorize:281] Authorized
"/O=Grid/OU=GlobusTest/OU=simpleCA/CN=IBMGRID" to invoke
"{http://www.globus.org/namespaces/2004/10/gram/job/exec}getMultipleResourceProperties".
2005-03-08 11:38:20,134 INFO  authorization.ServiceAuthorizationChain
[Thread-9,authorize:281] Authorized
"/O=Grid/OU=GlobusTest/OU=simpleCA/CN=IBMGRID" to invoke
"{http://wsrf.globus.org/core/notification}destroy".

Client out:
 globusrun-ws -submit -f
/opt/IBMGrid/share/globus_wsrf_gram_service_test_unit/test.xml
Submitting job...Done.
Job ID: uuid:e2f4b57c-8fbd-11d9-ad6a-000255094c86
Termination time: 03/09/2005 10:36 GMT
globusrun-ws: Error querying job state
an unknown error occurred

There is no appropriate message about error.

------- Comment #1 From Peter Lane 2005-03-08 10:33:01 -------

I'm not sure why it's allowing the connection to the factory, but this would
seem to be a core security issue.  Reassigning...

------- Comment #2 From Sam Meder 2005-03-09 10:52:27 -------

It's unclear what the issue is. Can you rerun the globusrun-ws step with
GLOBUS_ERROR_OUTPUT=1 in the environment?

/Sam

------- Comment #3 From Thilo Boehm 2005-03-09 11:25:51 -------

The result:
export GLOBUS_ERROR_OUTPUT=1
[ibmgrid@lnxwsrf5 ibmgrid]$ globusrun-ws -submit -f
/opt/IBMGrid/share/globus_wsrf_gram_service_test_unit/test.xml
globus_error_put(): globus_common: unable to parse ip

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

Submitting job...globus_error_put(): globus_sysconfig: File does not exist:
/etc/grid-security/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /etc/grid-security/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/opt/IBMGrid/etc/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /opt/IBMGrid/etc/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/home/ibmgrid/.globus/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /home/ibmgrid/.globus/hostcert.pem is not
a valid file

globus_error_put(): globus_sysconfig: Could not find a valid certificate file:
The host cert could not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_credential: Error reading host credential
globus_sysconfig: Could not find a valid certificate file: The host cert could
not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/.

globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/..

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

Done.
Job ID: uuid:b53e54b4-90bf-11d9-8167-000255094c86
Termination time: 03/10/2005 17:21 GMT
globus_error_put(): globus_sysconfig: File does not exist:
/etc/grid-security/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /etc/grid-security/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/opt/IBMGrid/etc/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /opt/IBMGrid/etc/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/home/ibmgrid/.globus/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /home/ibmgrid/.globus/hostcert.pem is not
a valid file

globus_error_put(): globus_sysconfig: Could not find a valid certificate file:
The host cert could not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_credential: Error reading host credential
globus_sysconfig: Could not find a valid certificate file: The host cert could
not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/.

globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/..

globus_error_put(): globus_xio_http: End of Entity

globus_error_put(): globus_xio_http: End of Entity

globus_error_put(): globus_xio_http: End of Entity

globus_error_put(): globus_xio_http: End of Entity

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_service_engine_module: Session Failed:
{http://wsrf.globus.org/core/notification/service}NotificationConsumerService
an unknown error occurred

globus_error_put(): globus_sysconfig: File does not exist:
/etc/grid-security/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /etc/grid-security/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/opt/IBMGrid/etc/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /opt/IBMGrid/etc/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/home/ibmgrid/.globus/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /home/ibmgrid/.globus/hostcert.pem is not
a valid file

globus_error_put(): globus_sysconfig: Could not find a valid certificate file:
The host cert could not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_credential: Error reading host credential
globus_sysconfig: Could not find a valid certificate file: The host cert could
not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/.

globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/..

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): Error querying job state
an unknown error occurred

globus_error_put(): globus_xio: Operation was canceled

globus_error_put(): globus_xio: Operation was canceled

globus_error_put(): globus_xio: Operation was canceled

globus_error_put(): globus_xio: Operation was canceled

globus_error_put(): globus_xio: Operation was canceled

globus_error_put(): globus_xio: Operation was canceled

globus_error_put(): globus_service_engine_module: Session failed to start
globus_xio: Operation was canceled

globus_error_put(): globus_sysconfig: File does not exist:
/etc/grid-security/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /etc/grid-security/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/opt/IBMGrid/etc/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /opt/IBMGrid/etc/hostcert.pem is not a
valid file

globus_error_put(): globus_sysconfig: File does not exist:
/home/ibmgrid/.globus/hostcert.pem is not a valid file

globus_error_put(): globus_sysconfig: Error with certificate filename
globus_sysconfig: File does not exist: /home/ibmgrid/.globus/hostcert.pem is not
a valid file

globus_error_put(): globus_sysconfig: Could not find a valid certificate file:
The host cert could not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_credential: Error reading host credential
globus_sysconfig: Could not find a valid certificate file: The host cert could
not be found in:
1) env. var. X509_USER_CERT
2) /etc/grid-security/hostcert.pem
3) $GLOBUS_LOCATION/etc/hostcert.pem
4) $HOME/.globus/hostcert.pem

The host key could not be found in:
1) env. var. X509_USER_KEY
2) /etc/grid-security/hostkey.pem
3) $GLOBUS_LOCATION/etc/hostkey.pem
4) $HOME/.globus/hostkey.pem



globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/.

globus_error_put(): globus_sysconfig: File is a directory: File:
/opt/IBMGrid/share/certificates/..

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio: An end of file occurred

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): globus_xio_buffer: Buffer EOF

globus_error_put(): Error querying job state
an unknown error occurred

globus_error_put(): globus_wsrf_core_tools_module: Failed to get resource:
Failed to get service descriptor from EPR Address

globus_error_put(): globus_notification_consumer: Unknown resource
globus_wsrf_core_tools_module: Failed to get resource: Failed to get service
descriptor from EPR Address

globusrun-ws: Error querying job state
an unknown error occurred

------- Comment #4 From Thilo Boehm 2005-03-09 11:28:33 -------

The server is running with host credentials, the user with it's credential.

------- Comment #5 From Sam Meder 2005-04-09 10:55:02 -------

Committed a patch that should make this work (I've only tested in standalone
mode without sudo, but the effect of the patch is that g-g-a-e gets called with
a absolute gridmap path).

Can you confirm that this is fixed and let me know?

/Sam