User authentication

When a user claims a job belongs a project, License Scheduler checks if this user belongs to this project, since projects assign fairshare priority, and preemption is based on ownership. When users submit jobs to license projects they do not belong to, the request is refused, or the job gets put in a "default" bucket with a low number of shares or no shares at all.

Administrators can control who can run what project. By default, such authentication is not enabled for compatibility with the previous versions of License Scheduler.

When enabled, user authentication has the following behavior:

  • If the user belongs to the project, allow the license request

  • If the user does not belong to the project or the project does not match any projects in the configuration, reject the request

  • If a default project is configured in the LS user authentication configuration file ls.users, change the project to default and allow the license request

  • If the project equals default, no authentication is needed, allow the request

Enable user authentication

  • For LSF jobs, configure LSF to use the authentication esub (esub.ls_auth). In lsf.conf, add the line:

LSB_ESUB_METHOD=ls_auth
  • For taskman jobs, define AUTH=Y in lsf.licensescheduler.

  • Configure users and their associated projects in the LSF_CONFDIR/ls.users file.

Users must make sure projects configured in ls.users, including the default project, conform to lsf.licensescheduler configuration.

Sample ls.users file

# The format is same as /etc/group 
#
# client_name1:::user1,user2,user3
# 
# Each line represents client, the client name is followed by 
# a colon.
Project1:::user1,user2
Project2:::user1,user2,user3
default:::