Agent and SLURM communication (Munge / sackd)

[attssystem]

Hi !

In the documentation, I can only see mention of munge when it comes to authentication between slurm web agent and slurmrestd. Is new slurm authentication method sackd available ? I can't find it in the roadmap and can't currently test it but it could be an upcoming need for me.

Thanks :)

[rezib]

Hello @attssystem, as far as I can tell, slurmrestd only supports munge and JWT for authentication. According to Slurm documentation, it does not support auth/slurm and sackd yet. But as soon as it is supported in slurmrestd, I don't see any reason it wouldn't work seamlessly with Slurm-web!

[attssystem]

Hi @rezib, thanks for your answer ! Because we can set AuthType=auth/slurm in slurm.conf (since 23.11) I admited it would have impacted slurmrestd auth as well.

So, does in fact slurmrestd only rely on uid of client when using rest_auth/local as both the api and client (here the agent) are running on the same host ? That's why sackd shouldn't have any impact on slurm web ?

[rezib]

Hi @rezib, thanks for your answer ! Because we can set AuthType=auth/slurm in slurm.conf (since 23.11) I admited it would have impacted slurmrestd auth as well.

Well, I looked a bit further in the source code of slurmrestd rest_auth/local plugin and there is nothing related to munge actually. It just checks for a corresponding UID of the client process on the unix socket. Maybe the phrasing in slurmrestd manpage is a bit confusing, I have not tested yet and I think this is already supposed to work with auth/slurm!

I should probably update the architecture documentation to reflect this fact.

So, does in fact slurmrestd only rely on uid of client when using rest_auth/local as both the api and client (here the agent) are running on the same host ? That's why sackd shouldn't have any impact on slurm web ?

Exactly 👍