October 2007 - ogsa-hpcp-wg

HPC Base Profile experiences document
by Glenn Wasson 01 Nov '07

01 Nov '07

All, Attached is a draft of the HPC Basic Profile experiences document that we have been working on as part of the OGF document process. Please read as we will be discussing this document on the call tomorrow. If you are interested in contributing to this document, I need 3 things: 1. corrected / additional information for the implementers table in section 2. I did not know the exact software stack for everyone listed there and it is possible that other groups have done interop testing that I am unaware of. 2. does section 3 reflect your experience? 3. did you encounter any issues and resolutions that you think should be added to section 4? Thanks, Glenn

2 1

HPC Basic Profile Compliance Tester support for client authentication using X509
by Glenn Wasson 31 Oct '07

31 Oct '07

All, I have added support to allow the HPC Basic Profile Compliance Tester to identify clients via X.509 (instead of just username/password). The service's URL is https://opteron4.cs.virginia.edu:45885/FormServerTemplates/HPCBasicProfileCo mplianceTester.aspx. On the left hand side, you will now see a radio button labeled "Client authentication". It has 2 options, "Username/password" and "X.509". If you select "Username / password", the username and password boxes will function as before. If you select "X.509", then those boxes will be disabled and the compliance tester will attempt to make a mutually-authenticated SSL connection to your service. The certificate that the compliance tester uses is available at http://www.cs.virginia.edu/~gsw2c/HPCBasicProfileComplianceTesterCert.pem. If you want to test your service's X.509 authentication, download and install this cert where ever it needs to go so that your service will trust the HPCBP Compliance tester. This is a self-signed cert that will expire about a week after SuperComputing. Please let me know if you have problems. Glenn

2 1

SC2007 HPC Profile Interop Fest - security, X.509 certification
by Gabor ROCZEI 30 Oct '07

30 Oct '07

Dear Glenn Wasson, During the SC07 demo NorduGrid would like to use the x509 mutual auth security option. Please configure the tester so that it'll accept our cert. The IGTF approved CA package can be downloaded from nordugrid repository: http://download.nordugrid.org/software/igtf/releases/latest/noarch/ca_NIIF-… Please let us know what kind of cert the tester is using. Provided the tester is configured properly it supports the x509 method, does it? Citation from you: "Here is the link to the compliance tester. To correct what Steven wrote in the minutes below, the compliance tester can only handle username/password authentication. I will need to install people’s root certs so that the compliance tester (the client) can trust your service for the https connection (required by HPCP), but no X.509 mutual auth is supported right now." Best regards, Gabor Roczei NIIF Intitute / Nordugrid / KnowARC -- Gabor ROCZEI +36-30-690-0008 Research Associate roczei(a)niif.hu NIIF/HUNGARNET, HUNGARY +36-1-4503061/5015 http://www.niif.hu/en National Information Infrastructure Development Institute (NIIFI) H-1132 Budapest, Victor Hugo u. 18-22. Key 0x6FABD32A: BD86 701C F6D2 8DE3 6D6B 6C03 8BFD FAB1 6FAB D32A

1 0

Telecon - November 1st 2007
by Steven Newhouse 30 Oct '07

30 Oct '07

Time: 9.30AM (Pacific), 12.30PM (East Coast), 5.30PM (UK) Call details: PIN - 2719140 USA: 866 500 6738 UK +44 118 909 2000 I'll try and supply further local numbers if people require them. Agenda 1. OGF IPR Notice 2. Agenda Bashing 3. Report on status (All) 4. SC07 Demo & Press release 5. Experiences document 6. Any Other Business

1 0

error responses from BES
by Glenn Wasson 29 Oct '07

29 Oct '07

Hey all, I'm trying to interpret the BES document's text on throwing errors in cases where the input vector is of length 1 (all that is required by HPCBP). Section 6.2 of the BES v1.0 spec says: The GetActivityStatuses, TerminateActivities, and GetActivityDocuments operations take a vector of activity EPRs as input and operate on all the referenced activities. Since an input vector may contain EPRs that are either unknown to a BES or for which the BES cannot execute the requested operation, the following failure semantics MUST be provided by a compliant BES: . If a request fails for some reason that applies to all the specified activities-e.g., due to an authorization fault-then the BES MUST respond with an appropriate fault response message. . If a request can succeed for one or more of the specified activities then the BES MUST respond with a vector of response elements, where each element corresponds to the equivalent activity designated in the input EPR vector. Each response element MUST be either an element describing the results of the request, as applied to the designated activity, or a SOAP-1.1 fault element describing why the request could not be applied to the designated activity (e.g., because the EPR could not be resolved to any known activity within the BES). My interpretation of this is that if one of these operations takes a vector of length 1, the first bullet says that a failure (which by definition applies to all specified activities) allows me to simply return a soap fault. However, reading the text of the actual sections for those methods (6.2.2, 6.2.3, 6.2.4) it seems that even for vectors of length 1, I should return any fault information inside a, for example, GetActivityStatusesResponse message. Further, the WSDL shown in the BES spec for (we'll again use this as an example) GetActivityStatuses is: <wsdl:operation name="GetActivityStatuses"> <soap:operation soapAction="http://schemas.ggf.org/bes/2006/08/besfactory/BESFactoryPortType /GetActivityStatuses" /> <wsdl:input name="GetActivityStatuses"> <soap:body use="literal" /> </wsdl:input> <wsdl:output name="GetActivityStatusesResponse"> <soap:body use="literal" /> </wsdl:output> <wsdl:fault name="UnknownActivityIdentifierFault"> <soap:fault name="UnknownActivityIdentifierFault" use="literal" /> </wsdl:fault> </wsdl:operation> To me, the <wsdl:fault> element indicates that it is legitimate to throw an UnknownActivityIdentifierFault "directly", i.e. not inside the Fault element of a GetActivityStatusesResponse message. So, my questions are: 1. should it be the case that the only permissible response from a BES for the GetActivityStatuses (or similar) method is a GetActivityStatusesResponse message (which would then contain appropriate faults)? - in this case, it seems that the WSDL should be changed and the text in 6.2 clarified 2. or should we allow cases where faults can be returned directly? - in which case the text of 6.2.2 (and 6.2.3 and 6.2.4) should be clarified 3. or is the UnknownActivityIdentifierFault special and so that one can be thrown directly, while faults of other types need to be inside a GetActivityStatusResponse message? - this seems like a strange option to me. Not sure what our ability is to change the BES text based on its point in the OGF document pipeline, but at this point I'm trying to figure out what to do for interop. Glenn

2 1

Platform endpoint
by Christopher Smith 26 Oct '07

26 Oct '07

Hi all, I've finally put up an endpoint and updated the wiki with the bits of information needed to access it. You do need a username and password to access the service, and I will be creating these as people ask me. Of course, things couldn't go that smoothly. I will be away next week and completely out of touch and offline. But I have created a username for Marty's group to use, so if you ask nicely, he might let you use it. :-) I won't be around to fix any bugs, but if you do find problems, please email me so that when I'm back I can fix them. Cheers, -- Chris

1 0

NorduGrid wants to join "SC2007 HPC Profile Interop Fest"
by Balazs Konya 26 Oct '07

26 Oct '07

Dear Marty Humphrey, NorduGrid would like to take part in this year's HPCP SC07 interoperability demonstrations (Nordugrid will have its own booth at SC07). During the GIN session at OGF21 we were informed that the HPCP group and you were coordinating this year's event. Unfortunately because of overlapping program we could not attend the "HPC Profile -- SC 2008 interopfest" session at OGF21. Would it be possible to read the notes if there are such (was this session really about SC08 and not SC07)? NorduGrid coordinates the development of the Advanced Resource Connector (ARC) middleware. As part of the recent ongoing development ARC acquired a new job management interface, the A-REX component which is a BES-compliant and JSDL capable job submission and management interface. As a first step we'd already listed NorduGrid's A-REX on the SC07 HPCP page as an implementation (http://forge.ogf.org/sf/go/projects.ogsa-hpcp-wg/wiki) and studied all the available material on the gridforge, joined the HPCP OGSA-WG (Gabor Roczei is our representative). Unfortunately, the information available on the "SC2007 HPC Profile Interop Fest Status" and the linked "HPC Basic Profile Compliance test" pages leaves many questions open. In particular, we'd like to know more about the followings: 1) how will the security be treated?, what will be used for authentication/authorization? 2) what sort of jobs will be submitted and by what kind of client(s)? Would be useful to be able to check out an example jsdl job request. Is the HPCBasicProfileComplianceTester page already functional? 3) What are the plans related to data stage in? 4) In general, what is the communication channel for the SC07 preparations, where can we post our questions? Is it the ogsa-hpcp-wg(a)ogf.org mailing list? best regards, Balazs Konya Technical Coordinator NorduGrid Collaboration ps: Marty, due to the approaching SC07 i decided to post my mail directly to the ogsa-hpcp-wg list as well. If this is the right discussion forum let's keep the discussion here.

2 1

HPCP Demo Data Sheet and Press Release
by John Ehrig 26 Oct '07

26 Oct '07

Hi All, I know many of you are still playing "day job catch-up" from OGF21, but unless we are only making minor changes to the SC06 data sheet, then we really need to get cranking on it now. So far I have received only one small change request. Is the 07 demo essentially the same as the 06 demo? Also, I have gotten no feedback on the press release. I believe we do need to explain our significant progress from last year in the press release, especially in turns of implementations. Can someone bullet that out for me? Can we get some quotes similar to last year? John Ehrig Open Grid Forum Enterprise and Marketing Program Manager 925 275-6677 www.ogf.org <http://www.ogf.orgopen/> Open Forum | Open Standards

1 0

SC2007 interop wiki page is available for edits
by Marty Humphrey 18 Oct '07

18 Oct '07

Folks, I mentioned in our OGF21 session that I would confirm that the sc2007 wiki page is ready for edits/contributions. It is. :^) http://forge.ogf.org/sf/go/projects.ogsa-hpcp-wg/wiki Let's start filling out this page and getting ready for an excellent SC 2007! -- Marty ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Activity Filters
by Steven Newhouse 17 Oct '07

17 Oct '07

The HPCBP contains a BasicFilter element as an extension to the GetFactoryAttributes operation request. This allows the requesting entity to select either the list of activities and/or the list of contained resources. There is no additional filtering operations. For large clusters or large job queues the returned XML document will become very large. To ensure that the returned document just contains information that the client is interested in, it is proposed to specify an extension that will filter the returned results. Some search options could include (within the HPCBP activities can be equated to jobs): * Return activities just relating to the currently authorized user * Return activities just relating to a specified user(s) * Return activities in a specified state * Return activities with a specified job id range [assumes there is an underlying numerical job id - not mandated in any specification - but fairly common] * Return activities active within a specified time/date range. WRT to reducing the size of the resource section of the document... I would propose exploiting the homogeneous nature of many clusters by eliminating duplicate elements. So a cluster containing 16 identical nodes and a head node would return a document (psudeo form) <nodes count="16"> <resource details> Compute Node information </resource details> </nodes count> <nodes count="1"> <resource details> Head node information </resource details> </nodes count> Instead of returning an XML document with 17 resource details elements. In addition the returned resource details could be filtered by 'used' and 'available' if they were running a job or were available for running a job. If there are any further uses that come to mind please respond to this. Once we have some consensus I'll draft some XML for discussion on a later call. Steven

1 0