<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<div class="moz-cite-prefix">On 2/22/19 12:54 AM, Chris Samuel
wrote:<br>
</div>
<blockquote type="cite" cite="mid:3627066.BFLgRgZ6ST@quad">
<pre class="moz-quote-pre" wrap="">On Thursday, 21 February 2019 8:20:36 AM PST נדב טולדו wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Yeah I have, before i installed pbis and introduce lsass.so the slurm module
worked well Is there anyway to debug?
I am seeing in syslog that the slurm module is adopting into the job context
but then i am getting out of context somehow and have access to all
resources.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Yes, check the documentation and review your PAM configuration. As I
mentioned it sounds like you've got things in the wrong order there.
<a class="moz-txt-link-freetext" href="https://slurm.schedmd.com/pam_slurm_adopt.html#PAM_CONFIG">https://slurm.schedmd.com/pam_slurm_adopt.html#PAM_CONFIG</a>
</pre>
</blockquote>
<p>I second this. PAM is extremely sensitive to the module order by
design. <br>
</p>
<p>Also, to debug, most PAM modules have a debug option you can use
to enable the logging of debug messages. If you check the man
pages for any pam modules, you'll see the debug options. For
pam_slurm_adopt, see
<a class="moz-txt-link-freetext" href="https://slurm.schedmd.com/pam_slurm_adopt.html">https://slurm.schedmd.com/pam_slurm_adopt.html</a>. It looks like you
can set a log_level setting: <br>
</p>
<p>
<blockquote type="cite">
<dl compact="compact">
<dt><b>log_level</b></dt>
<dd>See <a
href="https://slurm.schedmd.com/slurm.conf.html#OPT_SlurmdDebug">
SlurmdDebug</a> in slurm.conf for available options.
The default log_level is <b>info</b>.
</dd>
</dl>
</blockquote>
</p>
<p><br>
</p>
<p>So to set the debugging level for pam_slurm_adopt, all the way
up, you'd do something like this in your PAM file: <br>
</p>
<pre>account sufficient pam_slurm_adopt.so debug=debug5
</pre>
<p>If you can't tell what's going on just from that, I would see how
to enable debugging for all the PAM modules in the rest of the
stack, to get a better picture of what's going on throughout the
whole authentication process. When your done, don't forget to turn
off logging so you don't fill your log files with unnecessary
noise. <br>
</p>
<p><br>
</p>
<p>--</p>
<p>Prentice<br>
</p>
<p><br>
</p>
<br>
</body>
</html>