Administering Platform LSF - SAS

About User Authentication
About User Authentication
User authentication options
LSF recognizes UNIX and Windows authentication environments, including
different Windows domains and individual Windows workgroup hosts.
◆ In a UNIX environment, user accounts are validated at the system level, so
your user account is valid on all hosts.
◆ In a Windows domain environment, user accounts are validated at the
domain level, and your user account is valid on all hosts in your domain
(and might be valid in other domains, if there is a trust relationship).
◆ In a Windows workgroup environment, each host authenticates the user
account, so your local account is only valid on one host.
To enable LSF users to execute commands remotely, you must specify the
authentication method LSF uses to authorize remote execution across the
network.
You have the following choices:
◆ External authentication (eauth)
◆ Privileged ports (setuid)
◆ Identification daemon (identd)
If you change the authentication type while the LSF daemons are running, you
must shut down and restart the LSF daemons on each LSF server host, so that
the daemons will use the new authentication method.
External authentication (eauth)
LSF_EAUTH in
lsf.conf
External authentication uses the LSF eauth executable installed in
LSF_SERVERDIR. Optionally, you may choose to write your own eauth
executable that uses some site-specific authentication method such as Kerberos
or DCE client authentication using the GSSAPI.
Examples of these can be found in the LSF_MISC/examples/krb and
LSF_MISC/examples/dce directories. Installation instructions are found in the
README file in these directories.
By default, eauth uses an internal key to encrypt authentication data. To use
an external key to improve security, configure the parameter LSF_EAUTH_KEY
in the lsf.sudoers file. The default eauth program is installed without
setuid permission. If you use LSF_EAUTH_KEY, eauth must be setuid.
The eauth mechanism can pass data (such as authentication credentials) from
users to execution hosts. The environment variable LSF_EAUTH_AUX_DATA
specifies the full path to a file where data, such as a credential, is stored. The
mechanisms of eauth -c and eauth -s allow the LSF daemons to pass this
data using a secure exchange.
Installation with lsfinstall sets LSF_AUTH=eauth in lsf.conf automatically. To use
another authentication mechanism, you must change the value of LSF_AUTH and
restart all LSF daemons.
494
Administering Platform LSF