locked
HPC job submission issue from outside of the cluster domain RRS feed

  • Question

  • We have a POC cluster setup in a lab environment which we want users to be able to submit jobs to from our production domain with their laptops. Users have accounts in both domains and there is no trust relationship between the two domains. When setting up the  HPC utilities we have the users setup to access the headnode using the lab credentials (in control panel -> user accounts ->advanced tab ->manage passwords). However, when the user runs the job manager utility the utility itself runs using the credentials that they used to login to the computer, which creates a problem. When a user tries to submit a job, he has to type in his lab credentials to do it which won't be a big deal but since the Job Manager console is running under the production credentials while the job was run under his lab credentials, the Job Manager does not allow the user to manage the job and he/she cannot see the job under "My Jobs" and can only see the job running under "All Jobs" with no way to cancel it . The only solution I see is to create a 1 way trust in which the lab forest trusts the prod forest, add users from the trusted domain into the cluster and then this problem would go away but is there another way around this issue?

    Thanks,

    • Moved by parmita mehtaModerator Wednesday, February 24, 2010 8:48 AM (From:Windows HPC Server Deployment, Management, and Administration)
    Tuesday, February 23, 2010 10:44 PM

Answers

  • You'll need to set up the trust relationship between the production and lab environment.   As you described above, the user's logon credentials are used to authenticate communication from the client to the Head Node.   Those are the credentials used to check what jobs the user has running, etc.  The credentials the users set in the credential manager are the runas credentials used to the run the jobs, but the logon (production) credentials are the submitters credentials.
    Setting up the trust should solve the problem.
    Chris
    • Marked as answer by ccrall Thursday, March 18, 2010 3:08 PM
    Monday, March 8, 2010 4:29 PM

All replies

  • You'll need to set up the trust relationship between the production and lab environment.   As you described above, the user's logon credentials are used to authenticate communication from the client to the Head Node.   Those are the credentials used to check what jobs the user has running, etc.  The credentials the users set in the credential manager are the runas credentials used to the run the jobs, but the logon (production) credentials are the submitters credentials.
    Setting up the trust should solve the problem.
    Chris
    • Marked as answer by ccrall Thursday, March 18, 2010 3:08 PM
    Monday, March 8, 2010 4:29 PM
  • Hi,

    Please find a step-by-step guide with all required configuration steps under: http://www.winhpc.net/2010/03/04/AccessingTheHPCSHeadnodeFromADifferentDomainOrWorkgroupClientMachine.aspx

    Cheers,

    Sandro

    Tuesday, March 23, 2010 6:00 PM
  • thanks guys,

    Sandro i have already performed the steps needed. the link does not fix the issue i am having. ccrall's answer is exactly the problem i am having. i just wanted to know if there is a workaround for it.

    ccrall,

    thank you for the response. i won't be able to create the trust relationship as long as the cluster is in the lab because as per our network policy we don't create trusts between labs and prod domains.

    If there is no work around except of creating the trust relationship, this thread can be closed.

    Wednesday, March 24, 2010 2:14 AM