Cross-cluster user account mapping

The cross-cluster user account mapping feature enables cross-cluster job submission and execution for a MultiCluster environment that has different user accounts assigned to different hosts. Using this feature, you can map user accounts in a local cluster to user accounts in one or more remote clusters.

Contents

  • About cross-cluster user account mapping

  • Scope

  • Configuration to enable cross-cluster user account mapping

  • Cross-cluster user account mapping behavior

  • Configuration to modify cross-cluster user account mapping behavior

  • Cross-cluster user account mapping commands

About cross-cluster user account mapping

For MultiCluster environments that have different user accounts assigned to different hosts, cross-cluster user account mapping allows you to submit a job from a local host and run the job as a different user on a remote host.
Figure 1. Default behavior (feature not enabled)
Figure 2. With cross-cluster user account mapping enabled

Scope


Applicability

Details

Operating system

  • UNIX hosts

  • Windows hosts

  • A mix of UNIX and Windows hosts within one or more clusters

Not required for

  • Multiple clusters with a uniform user name space

Dependencies

  • UNIX and Windows user accounts must be valid on all hosts in the cluster and must have the correct permissions to successfully run jobs.

  • If users at your site have different user names on UNIX and Windows hosts within a single cluster, you must configure between-host user account mapping at the user level in .lsfhosts.

Limitations

  • You cannot configure this feature at both the system-level and the user-level; LSF ignores system-level mapping if user-level mapping is also defined in .lsfhosts.

  • If one or more clusters include both UNIX and Windows hosts, you must also configure UNIX/Windows user account mapping.

  • If one or more clusters have different user accounts assigned to different hosts, you must also configure between-host user account mapping for those clusters, and then configure cross-cluster user account mapping at the system level only.


Configuration to enable cross-cluster user account mapping

  • LSF administrators can map user accounts at the system level in the UserMap section of lsb.users. Both the remote and local clusters must have corresponding mappings in their respective lsb.users files.

  • Users can map their local accounts at the user level in .lsfhosts. This file must reside in the user’s home directory with owner read-write permissions for UNIX and owner read-write-execute permissions for Windows. Save the .lsfhosts file without a file extension. Both the remote and local hosts must have corresponding mappings in their respective .lsfhosts files.

Restriction:

Define either system-level or user-level mapping, but not both. LSF ignores system-level mapping if user-level mapping is also defined in .lsfhosts.


Configuration file

Level

Syntax

Behavior

lsb.users

System

Required fields:

LOCAL

REMOTE

DIRECTION

  • Maps a user name on a local host to a different user name on a remote host

  • Jobs that execute on a remote host run using a mapped user name rather than the job submission user name

.lsfhosts

User

host_name user_name send

  • Jobs sent from the local account run as user_name on host_name

host_name user_name recv

  • The local account can run jobs received from user_name submitted on host_name

host_name user_name

  • The local account can send jobs to and receive jobs from user_name on host_name

cluster_name user_name

  • The local account can send jobs to and receive jobs from user_name on any host in the cluster cluster_name

+ +

  • The local account can send jobs to and receive jobs from any user on any LSF host


Cross-cluster user account mapping behavior

System-level configuration example

The following example illustrates LSF behavior when the LSF administrator sets up cross-cluster user account mapping at the system level. This example shows the UserMap section of the file lsb.users on both the local and remote clusters.

On cluster1:
Begin UserMap
LOCAL    REMOTE                             DIRECTION
user1    user2@cluster2                     export
user3    user6@cluster2                     export
End UserMap
On cluster2:
Begin UserMap
LOCAL    REMOTE                             DIRECTION
user2    user1@cluster1                     import
user6    user3@cluster1                     import
End UserMap
The mappings between users on different clusters are as follows:
Figure 3. System-level mappings for both clusters
Only mappings configured in lsb.users on both clusters work. In this example, the common user account mappings are:
  • user1@cluster1 to user2@cluster2

  • user3@cluster1 to user6@cluster2

User-level configuration examples

The following examples describe how user account mapping works when configured at the user level in the file .lsfhosts in the user’s home directory. Only mappings configured in .lsfhosts on hosts in both clusters work.

To allow …

On …

In the home directory of …

.lsfhosts must contain the line …

The accounts user1 and user2 to run jobs on all hosts in both clusters:

  • user1 to send jobs to and receive jobs from user2 on cluster2

All hosts in cluster1

user1

cluster2 user2
  • user2 to send jobs to and receive jobs from user1 on cluster1

All hosts in cluster2

user2

cluster1 user1

The account user1 to run jobs on cluster2 using the lsfguest account:

  • user1 to send jobs as lsfguest to all hosts in cluster2

All hosts in cluster1

user1

cluster2 lsfguest send
  • lsfguest to receive jobs from user1 on cluster1

All hosts in cluster2

lsfguest

cluster1 user1 recv

Configuration to modify cross-cluster user account mapping behavior

Not applicable: There are no parameters that modify the behavior of this feature.

Cross-cluster user account mapping commands

Commands for submission


Command

Description

bsub

  • Submits the job with the user name and password of the user who entered the command. The job runs on the execution host with the submission user name and password, unless you have configured cross-cluster user account mapping.

  • With cross-cluster user account mapping enabled, jobs that execute on a remote host run using the account name configured at the system or user level.


Commands to monitor


Command

Description

bjobs -l

  • Displays detailed information about jobs, including the user name of the user who submitted the job and the user name with which the job executed.

bhist -l

  • Displays detailed historical information about jobs, including the user name of the user who submitted the job and the user name with which the job executed.


Commands to control

Not applicable. There are no commands to control the behavior of this feature.

Commands to display configuration

Not applicable. Use a text editor to view .lsfhosts or to view the UserMap section of lsb.users.