{"action":"created","issue":{"url":"https://api.github.com/repos/ganga-devs/ganga/issues/45","labels_url":"https://api.github.com/repos/ganga-devs/ganga/issues/45/labels{/name}","comments_url":"https://api.github.com/repos/ganga-devs/ganga/issues/45/comments","events_url":"https://api.github.com/repos/ganga-devs/ganga/issues/45/events","html_url":"https://github.com/ganga-devs/ganga/issues/45","id":118053665,"number":45,"title":"Dirac proxy multi VO problems","user":{"login":"alexanderrichards","id":4686942,"avatar_url":"https://avatars.githubusercontent.com/u/4686942?v=3","gravatar_id":"","url":"https://api.github.com/users/alexanderrichards","html_url":"https://github.com/alexanderrichards","followers_url":"https://api.github.com/users/alexanderrichards/followers","following_url":"https://api.github.com/users/alexanderrichards/following{/other_user}","gists_url":"https://api.github.com/users/alexanderrichards/gists{/gist_id}","starred_url":"https://api.github.com/users/alexanderrichards/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexanderrichards/subscriptions","organizations_url":"https://api.github.com/users/alexanderrichards/orgs","repos_url":"https://api.github.com/users/alexanderrichards/repos","events_url":"https://api.github.com/users/alexanderrichards/events{/privacy}","received_events_url":"https://api.github.com/users/alexanderrichards/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ganga-devs/ganga/labels/DIRAC","name":"DIRAC","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-11-20T14:36:18Z","updated_at":"2015-11-27T15:03:10Z","closed_at":null,"body":"Here is an email from simon quoting an LSST user:\r\n```\r\nWe've been given the long report below from a user testing the LSST VO\r\nusing ganga + our DIRAC server. The gist of it seems to be that ganga is\r\ngetting a vanilla proxy, which the DIRAC server will then attach a VOMS\r\nproxy to at job submission time. Unfortunately this user is a member of\r\nmultiple VOs and DIRAC sometimes picks a different VO to the one they're\r\ntrying to test... I guess the questions we need to answer are:\r\n\r\n - Is this behaviour reproducible by us?\r\n - Is there some way to get ganga to get a VOMS proxy so that there is no\r\n   room for the DIRAC server to make any decisions on the VO?\r\n\r\nWould you be able to have a look at this?\r\n```\r\n\r\nThe original email is below. Hopefully this is a small fix but obviously the new credentials system will be the proper solution.\r\n\r\n>Most of the jobs following those 4 failed with a mixture of \r\n>\r\n>Stalling for more than 11700 sec and Job stalled: pilot not running\r\n>\r\n>at all sites but Birmingham where they weren't supposed to run.\r\n>\r\n>Since I put the right dirac-proxy-init in .gangarc I looked a bit better at what happens and it seems >not to care, it just generates a plain proxy. \r\n>\r\n>if I run the dirac command standalone I get this proxy\r\n>{quote}\r\n>aforti@vm7>dirac-proxy-init -g lsst_user -M\r\n>Generating proxy...\r\n>Enter Certificate password:\r\n>Added VOMS attribute /lsst\r\n>Uploading proxy for lsst_user...\r\n>Proxy generated:\r\n>subject      : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy/CN=proxy\r\n>issuer       : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy\r\n>identity     : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti\r\n>timeleft     : 23:53:59\r\n>DIRAC group  : lsst_user\r\n>path         : /tmp/x509up_u500\r\n>username     : alessandra.forti\r\n>properties   : NormalUser\r\n>VOMS         : True\r\n>VOMS fqan    : ['/lsst']\r\n>\r\n>Proxies uploaded:\r\n> DN                                                       | Group                   | Until (GMT)\r\n> /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti | vo.northgrid.ac.uk_user | 2016/11/03 11:48\r\n> /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti | gridpp_user             | 2016/11/03 11:48\r\n> /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti | lsst_user               | 2016/11/03 11:48\r\n>aforti@vm7>voms-proxy-info -all\r\n>subject   : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy/CN=proxy\r\n>issuer    : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy\r\n>identity  : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=proxy\r\n>type      : proxy\r\n>strength  : 1024 bits\r\n>path      : /tmp/x509up_u500\r\n>timeleft  : 23:53:42\r\n>key usage : Digital Signature, Key Encipherment, Data Encipherment\r\n>=== VO lsst extension information ===\r\n>VO        : lsst\r\n>subject   : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti\r\n>issuer    : /DC=com/DC=DigiCert-Grid/O=Open Science Grid/OU=Services/CN=voms1.fnal.gov\r\n>attribute : /lsst/Role=NULL/Capability=NULL\r\n>timeleft  : 23:53:42\r\n>uri       : voms1.fnal.gov:15003\r\n>{quote}\r\n>\r\n>when I put that command in ganga this is what happen instead\r\n>\r\n>{quote}\r\n>aforti@vm7>grep dirac-proxy-init .gangarc\r\n>[defaults_GridCommand]init = dirac-proxy-init -g lsst_user -M\r\n>\r\n>aforti@vm7>ganga\r\n>Your identity: /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti\r\n>Enter GRID pass phrase for this identity:\r\n>Creating proxy ........................................................................................................................... Done\r\n>Your proxy is valid until: Fri Nov 20 23:16:25 2015\r\n>\r\n>*** Welcome to Ganga ***\r\n>Version: Ganga-6-1-6-hotfix1\r\n>Documentation and support: http://cern.ch/ganga\r\n>Type help() or help('index') for online help.\r\n>\r\n>This is free software (GPL), and you are welcome to redistribute it\r\n>under certain conditions; type license() for details.\r\n>\r\n>\r\n>Ganga.Utility.Config               : INFO     reading config file /home/aforti/.gangarc\r\n>\r\n>\r\n>In [1]:\r\n>Do you really want to exit ([y]/n)? y\r\n>Ganga.Core.MonitoringComponent     : INFO     Stopping the monitoring component...\r\n>aforti@vm7>voms-proxy-info -all\r\n>subject   : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti/CN=400330830\r\n>issuer    : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti\r\n>identity  : /C=UK/O=eScience/OU=Manchester/L=HEP/CN=alessandra forti\r\n>type      : RFC compliant proxy\r\n>strength  : 1024 bits\r\n>path      : /tmp/x509up_u500\r\n>timeleft  : 23:59:43\r\n>key usage : Digital Signature, Key Encipherment, Data Encipherment\r\n>{quote}\r\n>\r\n>it generates a plain proxy without VOMS information. With LHCb this still works because they have >only LHCb on their servers but with the multi-VO gridpp Dirac it picks the first VO I belong to to run >the jobs if the jobs are submitted without VOMS credentials."},"comment":{"url":"https://api.github.com/repos/ganga-devs/ganga/issues/comments/160155767","html_url":"https://github.com/ganga-devs/ganga/issues/45#issuecomment-160155767","issue_url":"https://api.github.com/repos/ganga-devs/ganga/issues/45","id":160155767,"user":{"login":"drmarkwslater","id":13677368,"avatar_url":"https://avatars.githubusercontent.com/u/13677368?v=3","gravatar_id":"","url":"https://api.github.com/users/drmarkwslater","html_url":"https://github.com/drmarkwslater","followers_url":"https://api.github.com/users/drmarkwslater/followers","following_url":"https://api.github.com/users/drmarkwslater/following{/other_user}","gists_url":"https://api.github.com/users/drmarkwslater/gists{/gist_id}","starred_url":"https://api.github.com/users/drmarkwslater/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drmarkwslater/subscriptions","organizations_url":"https://api.github.com/users/drmarkwslater/orgs","repos_url":"https://api.github.com/users/drmarkwslater/repos","events_url":"https://api.github.com/users/drmarkwslater/events{/privacy}","received_events_url":"https://api.github.com/users/drmarkwslater/received_events","type":"User","site_admin":false},"created_at":"2015-11-27T15:03:10Z","updated_at":"2015-11-27T15:03:10Z","body":"Found the problem! It seems that python (or at least Ganga) doesn't like:\r\n\r\n[group]param=value\r\n\r\ninstead of:\r\n\r\n[group]\r\nparam=value\r\n\r\nI've updated the docs for the GridPP wiki and will check to see if this is a Python or Ganga limitation.\r\n\r\nThanks!\r\n\r\nMark"}}