locked
Unable to clear cached credentials on our HPC R2 cluster RRS feed

  • Question

  • At our site this issue is affecting all the users of our HPC R2 cluster.

    We are unable to remove the cached credentials for any user, either by "cluscfg delcreds" or "Clear cached job credentials" from the Options menu in the HPC Cluster Manager.

    Does anyone know of any reason why we might not be able to clear cached credentials?

    Thanks,

    Derek

    Monday, May 16, 2011 8:29 PM

All replies

  • Hi Derek,

    The credentials are stored until those change in th AD. However, following is a way of doing clearing the credentials using the APIs

    Scheduler.DeleteCachedCredentials(string username); 

    Please let me know if following helps your concern.

    Regards,

    Sridutt

    Create say a Console Application with the following code :

    using System;
    
    using System.Collections.Generic;
    
    using System.Linq;
    
    using System.Text;
    
    using Microsoft.Hpc.Scheduler;
    
    using Microsoft.Hpc.Scheduler.Properties;
    
    namespace DeleteCredentials
    
    {
    
     class Program
    
     {
    
     static IScheduler scheduler;
    
     static void Main(string[] args)
    
     {
    
     Console.WriteLine("Enter the name of the user whose credentials you want to delete\t:");
    
     string username=Convert.ToString(Console.ReadLine());
    
     scheduler = new Scheduler();
    
     scheduler.Connect("YourServerName");
    
     scheduler.DeleteCachedCredentials(username);
    
     }
    
    }
    



    Tuesday, May 17, 2011 5:05 AM
  • Hi Derek,

    The credentials are stored until those change in th AD. However, following is a way of doing clearing the credentials using the APIs

    Scheduler.DeleteCachedCredentials(string username); 

    Please let me know if following helps your concern.

    Regards,

    Sridutt

    Create say a Console Application with the following code :

    using System;
    
    
    
    using System.Collections.Generic;
    
    
    
    using System.Linq;
    
    
    
    using System.Text;
    
    
    
    using Microsoft.Hpc.Scheduler;
    
    
    
    using Microsoft.Hpc.Scheduler.Properties;
    
    
    
    namespace DeleteCredentials
    
    
    
    {
    
    
    
     class Program
    
    
    
     {
    
    
    
     static IScheduler scheduler;
    
    
    
     static void Main(string[] args)
    
    
    
     {
    
    
    
     Console.WriteLine("Enter the name of the user whose credentials you want to delete\t:");
    
    
    
     string username=Convert.ToString(Console.ReadLine());
    
    
    
     scheduler = new Scheduler();
    
    
    
     scheduler.Connect("YourServerName");
    
    
    
     scheduler.DeleteCachedCredentials(username);
    
    
    
     }
    
    
    
    }
    
    




     

     

     

    Hi Derek,

    I found a much better way to solve your problem just

     run "cluscfg delcreds" on your headnode

    and all the credentials will be cleared. The above is just the alternate way of achieving the same through API.

    Please let me know if this sorts your problem.

    Regards,

    Sridutt

     

    Tuesday, May 17, 2011 5:42 AM
  • Hi Sridutt,

    Thanks for the idea. However, running cluscfg delcreds on the head node seems to have no effect.

    I am still able to submit and run a job without seeing a prompt to re-enter my credentials.

    Derek

    Tuesday, May 17, 2011 3:22 PM
  • Hi Sridutt,

    Thanks for the idea. However, running cluscfg delcreds on the head node seems to have no effect.

    I am still able to submit and run a job without seeing a prompt to re-enter my credentials.

    Derek


    Hi Derek,

    I just missed on mentioning, once you have run cluscfg delcreds on your headnode please follow it by running the same command on your client. I wasnt aware you were using a client to submit the jobs and had an impression that you using the headnode itself to submit the jobs

    Basically to remove all the cached credentials one has to clear it from both the headnode and the clients, if the credential is not clear on the client the same is automatically cached again on the headnode once the job is submitted. I have tried it and I am pretty certain it will work in your case too.

    Please let me know if this was helpful :)

    Regards,

    Sridutt

    Wednesday, May 18, 2011 5:38 AM
  • Thanks again Sridutt.

    Still no luck :) Even deleting the credentials on the head node and then the client node didn't help.

    I think there must be some problem with how our cluster is managing the cached credentials. We only ever see the credential popup when we change our passwords.

    Derek

    Wednesday, May 18, 2011 3:14 PM
  • Thanks again Sridutt.

    Still no luck :) Even deleting the credentials on the head node and then the client node didn't help.

    I think there must be some problem with how our cluster is managing the cached credentials. We only ever see the credential popup when we change our passwords.

    Derek


    Can you tell me how are you submitting jobs? If by any chance you are using the APIs you can use the following extra line of code before submitting the SubmitJob and it will force the credential popup each time until there are no cached credentials :)

    scheduler.SetInterfaceMode(false, new IntPtr(0));
    

    However, I tried a little experiment to check if 'cluscfg delcreds' worked.

    I only was able to get the popup through SetInterfaceMode when I ran the command 'cluscfg delcreds' on head followed by all the clients. In the meanwhile, if I a job was submitted before 'cluscfg delcreds' was run on all the headnodes and all associated clients then the credentials were also copied or restored on to headnode.

    Thus I suggest you to try clearing on the headnode as well as all the clients where you might have caches the credentials.

    Hope it works out.. let me know :)

    Regards,

    Sridutt

    Thursday, May 19, 2011 7:36 AM
  • Hi Sridutt,

    I've managed to finally clear the cached credentials.

    What I've found is that the credentials were being cached on my client computer, and I needed to make use of the "cmdkey /delete" command to delete the credentials for the target = headnode\domain\username.

    Is this expected or unexpected behaviour? All the HPC documentation only refers to "cluscfg delcreds" as being sufficient.

     

    Thanks,

    Derek

    Wednesday, May 25, 2011 7:35 PM
  • Hi Derek,

    I feel this behaviour is not totally expected, however as I can understand of the caching the client nodes prompt you for credentials until there isnt a cached credential on the headnode or if the credential has been changed and the credentials in the AD do not match the ones on the headnode.

    However, if there exists a situation where in the credentials are deleted on the headnode and if there is a locally cached credential on any of the clients, then the local credentials would be used to submit the job and will be cached automatically on the headnode.

    I feel "cluscfg delcreds" works the best only when headnode is used for job submission.

    What I can think of as an alternative to the tedious job of clearing on all clients as well as the headnode is never to tick the option for saving the credentials when submitting the jobs to the clients because it will be a mammoth task to locate the client node in a cluster of 100+ client machines which has the credentials locally cached and delete it using your suggested method of "cmdkey /delete". Only you may tick the option to save the credentials when you submit using the headnode as clearing this is easy using "cluscfg delcreds".

    I hope my understanding is valid, if not please correct me :)

    Regards,

    Sridutt

    Thursday, May 26, 2011 5:56 AM
  • Thanks Sridutt for your assistance on this. I think your explanation makes sense based on what we've been seeing.

    Derek

    Thursday, May 26, 2011 3:09 PM