Between-host user account mapping

The between-host user account mapping feature enables job submission and execution within a cluster that has different user accounts assigned to different hosts. Using this feature, you can map a local user account to a different user account on a remote host.

Contents

  • About between-host user account mapping

  • Scope

  • Configuration to enable between-host user account mapping

  • Between-host user account mapping behavior

  • Configuration to modify between-host user account mapping behavior

  • Between-host user account mapping commands

About between-host user account mapping

For clusters with different user accounts assigned to different hosts., between-host user account mapping allows you to submit a job from a local host and run the job as a different user on a remote host. There are two types of between-host user account mapping:
  • Local user account mapping—for UNIX or Windows hosts, a user can map the local user account to a different user on a remote host

  • Windows workgroup account mapping—allows LSF administrators to map all Windows workgroup users to a single Windows system account, eliminating the need to create multiple users and passwords in LSF. Users can submit and run jobs using their local user names and passwords, and LSF runs the jobs using the mapped system account name and password. With Windows workgroup account mapping, all users have the same permissions because all users map to the same Windows system account.

    Figure 1. Default behavior (feature not enabled)
    Figure 2. With local user account mapping enabled
    Figure 3. With Windows workgroup account mapping enabled

Scope


Applicability

Details

Operating system

  • UNIX hosts

  • Windows hosts

  • A mix of UNIX and Windows hosts within a single clusters

Not required for

  • A cluster with a uniform user name space

  • A mixed UNIX/Windows cluster in which user accounts have the same user name on both operating systems

Dependencies

  • UNIX and Windows user accounts must be valid on all hosts in the cluster and must have the correct permissions to successfully run jobs.

  • For clusters that include both UNIX and Windows hosts, you must also enable the UNIX/Windows user account mapping feature.

Limitations

  • For a MultiCluster environment that has different user accounts assigned to different hosts, you must also enable the cross-cluster user account mapping feature. Do not configure between-host user account mapping if you want to use system-level mapping in a MultiCluster environment; LSF ignores system-level mapping if mapping local user mapping is also defined in .lsfhosts.

  • For Windows workgroup account mapping in a Windows workgroup environment, all jobs run using the permissions associated with the specified system account.


Configuration to enable between-host user account mapping

Between-host user account mapping can be configured in one of the following ways:
  • Users can map their local accounts at the user level in the file .lsfhosts. This file must reside in the user’s home directory with owner read-write permissions for UNIX and owner read-write-execute permissions for Windows. It must not be readable and writable by any other user other than the owner. Save the .lsfhosts file without a file extension. Both the remote and local hosts must have corresponding mappings in their respective .lsfhosts files.

  • LSF administrators can set up Windows workgroup account mapping at the system level in lsb.params.

Local user account mapping configuration

Local user account mapping is enabled by adding lines to the file .lsfhosts. Both the remote and local hosts must have corresponding mappings in their respective .lsfhosts files.

Configuration file

Syntax

Behavior

.lsfhosts

host_name user_name send

  • Jobs sent from the local account run as user_name on host_name

host_name user_name recv

  • The local account can run jobs received from user_name submitted on host_name

host_name user_name

  • The local account can send jobs to and receive jobs from user_name on host_name

+ +

  • The local account can send jobs to and receive jobs from any user on any LSF host


Windows workgroup account mapping

Windows workgroup account mapping is enabled by defining the parameter SYSTEM_MAPPING_ACCOUNT in the file lsb.params.

Configuration file

Parameter and syntax

Default behavior

lsb.params

SYSTEM_MAPPING_ACCOUNT=account

  • Enables Windows workgroup account mapping

  • Windows local user accounts run LSF jobs using the system account name and permissions


Between-host user account mapping behavior

Local user account mapping example

The following example describes how local user account mapping works when configured in the file .lsfhosts in the user’s home directory. Only mappings configured in .lsfhosts on both the local and remote hosts work.

In the following example, the cluster contains hostA, hostB, and hostC. The account user1 is valid on all hosts except hostC, which requires a user account name of user99.

To allow …

On …

In the home directory of …

.lsfhosts must contain the line …

The account user1 to run jobs on all hosts within the cluster:

  • user1 to send jobs to user99 on hostC

hostA

user1

hostC user99 send

hostB

user1

hostC user99 send
  • user99 to receive jobs from user1 on either hostA or hostB

hostC

user99

hostA user1 recv
hostB user1 recv

Windows workgroup account mapping example

The following example describes how Windows workgroup account mapping works when configured in the file lsb.params. In this example, the cluster has a Windows workgroup environment, and only the user account jobuser is valid on all hosts.

To allow …

In lsb.params, configure …

Behavior

All hosts within the cluster to run jobs on any other host within the cluster:

  • Map all local users to user account jobuser

SYSTEM_MAPPING_ACCOUNT=jobuser

When any local user submits an LSF job, the job runs under the account jobuser, using the permissions associated with the jobuser account.


Configuration to modify between-host user account mapping behavior

Not applicable: There are no parameters that modify the behavior of this feature.

Between-host user account mapping commands

Commands for submission


Command

Description

bsub

  • Submits the job with the user name and password of the user who entered the command. The job runs on the execution host with the submission user name and password, unless you have configured between-host user account mapping.

  • With between-host user account mapping enabled, jobs that execute on a remote host run using the account name configured at the system level for Windows workgroups, or at the user level for local user account mapping.


Commands to monitor


Command

Description

bjobs -l

  • Displays detailed information about jobs, including the user name of the user who submitted the job and the user name with which the job executed.

bhist -l

  • Displays detailed historical information about jobs, including the user name of the user who submitted the job and the user name with which the job executed.


Commands to control

Not applicable.

Commands to display configuration


Command

Description

bparams

  • Displays the value of SYSTEM_MAPPING_ACCOUNT defined in lsb.params.

badmin showconf

  • Displays all configured parameters and their values set in lsf.conf or ego.conf that affect mbatchd and sbatchd.

    Use a text editor to view other parameters in the lsf.conf or ego.conf configuration files.

  • In a MultiCluster environment, badmin showconf only displays the parameters of daemons on the local cluster.


Use a text editor to view the file .lsfhosts.