XGrid: Authentication failure, Kerberos, Sandbox and parallel code with MPI

Question

Hi,
After a few days of trying to set up a home built fortran code to run in parallel using Xgrid on Mac mini server 10.6.2 I've decided to look for help (before going crazy!).
the code is parallelised fortran (monteCarlo type stuff), which needs to read a file and print results to file.
The hardware is 4 Mac OSX 10.6.2 machines linked through the Mac mini Server.
First problem - without Authentication, Sandbox doesn't allow the executed program to read or write files (though see http://discussions.apple.com/thread.jspa?threadID=2329855&tstart=0). I can submit jobs to XGrid, they run but fail when attempting file reading/writing. so need to use Kerberos (tried changing the sandbox/xgridagentdtasknobody.sb to mirror the -somebody- file but to no avail).
In Server Admin, I set Client,Agent and Controller to Kerberos. Then repeat the job submit (which worked before), as:
xgrid -h localhost -auth Kerberos -job submit /Users/shared/executable
(this time adding the -auth Kerberos)
but get the following errors:
Error returned by gssinit_seccontext:
major error <1> Unspecified GSS failure. Minor code may provide more information
minor error <1> Negative cache rejected lookup for 'xgrid/[email protected]'
error = "could not connect to localhost (Authentication failed)";
What's going wrong?
While I'm here - once I get the parallel Fortran code working on Xgrid, will Xgrid distribute the work between the available processors (i.e. split the one job submission into it's parallel parts, and give these parts to the available resources on the grid)? I have seen a post claiming that this is not the case....that the POOCH application is the only tool available - is this still true in the current XGrid distribution? (it would be a shame to set all this up and find out that Xgrid is not suitable!)
Many thanks for any help or suggestions!
Trevor

Answer 1

Trevor,
First off, did you do anything to set Kerberos up, or did you just change the auth type? Kerberos is considerably more complex than just using password authentication. For xgrid to use kerberos I believe you'll have to have your server set up as an Open Directory Master, your agents bound to the ODM and your users be directory users, not just local. Kerberos is not my strong point but if you want to go that route there should be more info in the Xgrid server docs.
If you want to give password authentication another go I can probably be a little more helpful. Instead of granting read/write to the whole filesystem it's probably a better idea to set up a folder or two that has those rights. On my setup each user has a "Results" folder in their user folder which xgrid can read and write to. You can then edit the last line of the nobody.sb file to looks something like this…
(allow file-read* file-write* (regex "^/(private/)?(tmp|var)|(Users/*/Results)(/|$)"))
It's been a while since I had to edit my file so I'm not 100% on the syntax. You'll need to edit this file on each agent that's a part of your grid, not just the controller. I got my information from this thread.
http://lists.apple.com/archives/xgrid-users/2008/Feb/msg00012.html
For the last part of your post, well it's something I haven't tried because all the apps my users are running are single threaded. But this link should help.
http://lists.apple.com/faq/pub/xgrid_users/index.php?%20sid=3428&aktion=artikel& rubrik=001&id=5&lang=en
If you try this and get the results your looking for I would love to hear about it.
Good luck and I hope this helps.
-Curt.