1

I configured a Slurm head node as follows:

  • sssd to contact openLDAP
  • slurmctld/slurmdbd/slurmd/munged to act as the Slurm controller and compute node

...where ray.williams is an LDAP user. Its UID can be mapped on the node. SSH login works fine.

$ id ray.williams
$ uid=10000(ray.williams) gid=10000(powerlifters) groups=10000(powerlifters)

When I add this user into the Slurm accounting database, it does not complain that the user does not exist.

$ sacctmgr create account name=default
Associations
  A = default    C = hydra

$ sacctmgr create user name=ray.williams account=default
Adding User(s)
  ray.williams
Associations =
  U = ray.willi A = default    C = hydra
Non Default Settings

However, the UID is wrongly mapped to 4294967294, which looks like an unsigned -1 (https://www.suse.com/support/kb/doc/?id=000017244). This is the same UID as if I entered a username that didn't exist. There is no way to supply the correct UID to sacctmgr on the command line.

$ scontrol show assoc | grep ray.williams
UserName=ray.williams(4294967294) DefAccount=default DefWckey=(null) AdminLevel=Not Set
ClusterName=hydra Account=default UserName=ray.williams(4294967294) Partition= ID=4

As a result, this user cannot submit jobs. I confirmed that this only affects LDAP users, as local user IDs are mapped properly.

$ su ray.williams
$ srun -A root -N4 -l /bin/hostname
srun: error: Unable to allocate resources: Invalid account or account/partition combination specified

The log reveals that the jobs were denied, likely because UID 10000 could not be found in the Slurm accounting database.

$ cat /var/log/slurm/slurmd.log
[2020-11-09T17:05:47.010] job_submit.lua: [Rule 0/part] Default partition - job from uid 10000(ray.williams), setting default partition to 'pgrinux'
[2020-11-09T17:05:47.010] _job_create: invalid account or partition for user 10000, account 'default', and partition 'pgrinux'
[2020-11-09T17:05:47.010] _slurm_rpc_allocate_resources: Invalid account or account/partition combination specified

Do you know how I can get Slurm and SSSD/LDAP to exchange the correct user ID?

Many thanks!

NB: For good measure, here are snippets of some configuration files in case they are helpful.

$ cat /etc/slurm/slurmd.conf
PartitionName=pgrinux      Nodes=d1p-test-grinux[01-05] Default=YES AllowGroups=ALL AllowAccounts=ALL

$ cat /etc/sssd/sssd.conf
[sssd]
domains = local.lan
config_file_version = 2
services = nss, pam
debug_level = 9

[pam]
pam_verbosity = 9

[domain/local.lan]
id_provider = ldap
auth_provider = ldap
cache_credentials = true
default_shell = /bin/bash
mkhomedir = false
ldap_access_order = filter
ldap_access_filter = (objectClass=posixAccount)
ldap_search_base = dc=local,dc=lan
ldap_uri = ldaps://d1p-test-ldap02
ldap_id_use_start_tls = false
ldap_tls_reqcert = never

$ getent passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
chrony:x:998:995::/var/lib/chrony:/sbin/nologin
vagrant:x:1000:1000:vagrant:/home/vagrant:/bin/bash
vboxadd:x:997:1::/var/run/vboxadd:/bin/false
slurm:x:991:991:SLURM workload manager:/var/lib/slurm:/bin/bash
munge:x:801:801:MUNGE Uid 'N' Gid Emporium:/var/lib/munge:/sbin/nologin
mysql:x:27:27:MariaDB Server:/var/lib/mysql:/sbin/nologin
sssd:x:800:800:User for sssd:/:/sbin/nologin
Nicolas De Jay
  • 209
  • 2
  • 11

1 Answers1

1

The solution turned out to be in the getent passwd.

I changed the following configuration in sssd:

$ cat /etc/sssd/sssd.conf
[domain/local.lan]
enumerate = true

I removed the users and added them again, and it worked.

Nicolas De Jay
  • 209
  • 2
  • 11