/usr/share/doc/slurm-wlm-doc/html/authplugins.html is in slurm-wlm-doc 17.11.2-1build1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 | <!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width" />
<title>Slurm Workload Manager</title>
<link rel="shortcut icon" href="favicon.ico" />
<link rel="stylesheet" type="text/css" href="fonts.css" />
<link rel="stylesheet" type="text/css" href="reset.css" />
<link rel="stylesheet" type="text/css" href="style.css" />
<link rel="stylesheet" type="text/css" href="slurm.css" />
<script src="jquery.min.js"></script>
</head>
<body>
<div class="container container--main">
<header class="site-header" role="banner">
<div class="site-masthead">
<h1 class="site-masthead__title site-masthead__title--slurm">
<a href="/" rel="home">
<span class="slurm-logo">Slurm Workload Manager</span>
</a>
</h1>
<div class="site-masthead__title">
<a href="https://www.schedmd.com/" rel="home">
<span class="site-logo">SchedMD</span>
</a>
</div>
<button class="site-masthead__trigger menu-trigger" type="button" role="button" aria-label="Toggle Navigation"><span class="menu-trigger__lines"></span></button>
</div>
<nav class="site-nav">
<h2 class="site-nav__title">Navigation</h2>
<div class="slurm-title">
<div class="slurm-logo"><a href="/">Slurm Workload Manager</a></div>
<div class="slurm-title__version">Version 17.11</div>
</div>
<ul class="site-nav__menu site-menu menu" role="navigation">
<li class="site-menu__item">
<div>About</div>
<ul>
<li><a href="overview.html">Overview</a></li>
<li><a href="news.html">What's New</a></li>
<li><a href="team.html">Slurm Team</a></li>
<li><a href="meetings.html">Meetings</a></li>
<li><a href="testimonials.html">Testimonials</a></li>
<li><a href="disclaimer.html">Legal Notices</a></li>
</ul>
</li>
<li class="site-menu__item">
<div>Using</div>
<ul>
<li><a href="tutorials.html">Tutorials</a></li>
<li><a href="documentation.html">Documentation</a></li>
<li><a href="faq.html">FAQ</a></li>
<li><a href="publications.html">Publications</a></li>
</ul>
</li>
<li class="site-menu__item">
<div>Installing</div>
<ul>
<li><a href="download.html">Download</a></li>
<li><a href="quickstart_admin.html">Installation Guide</a></li>
</ul>
</li>
<li class="site-menu__item">
<div>Getting Help</div>
<ul>
<li><a href="https://www.schedmd.com/services.php">Support</a></li>
<li><a href="mail.html">Mailing Lists</a></li>
<li><a href="https://www.schedmd.com/services.php">Training</a></li>
<li><a href="troubleshoot.html">Troubleshooting</a></li>
</ul>
</li>
</ul>
</nav>
</header>
<div class="content" role="main">
<section class="slurm-search">
<div class="container" id="cse">
<gcse:search></gcse:search>
</div>
</section>
<div class="section">
<div class="container">
<h1><a name="top">Slurm Authentication Plugin API</a></h1>
<h2> Overview</h2>
<p> This document describes Slurm authentication plugins and the API that defines
them. It is intended as a resource to programmers wishing to write their own SLURM
authentication plugins.</p>
<p>Slurm authentication plugins are Slurm plugins that implement the Slurm authentication
API described herein. They must conform to the Slurm Plugin API with the following
specifications:</p>
<p><span class="commandline">const char plugin_type[]</span><br>
The major type must be "auth." The minor type can be any recognizable
abbreviation for the type of authentication. We recommend, for example:</p>
<ul>
<li><b>none</b> — A plugin that implements the API without providing any actual
authentication service. This may be used for testing purposes, but is not suitable for
production use due to lack of effective security.</li>
<li><b>munge</b> — LLNL's Munge protocol (recommended plugin for production use).</li>
</ul>
<p><span class="commandline">const char plugin_name[]</span><br>
Some descriptive name for the plugin.
There is no requirement with respect to its format.</p>
<p><span class="commandline">const uint32_t plugin_version</span><br>
If specified, identifies the version of Slurm used to build this plugin and
any attempt to load the plugin from a different version of Slurm will result
in an error.
If not specified, then the plugin may be loadeed by Slurm commands and
daemons from any version, however this may result in difficult to diagnose
failures due to changes in the arguments to plugin functions or changes
in other Slurm functions used by the plugin.</p>
<p>The programmer is urged to study <span class="commandline">src/plugins/auth/none/auth_none.c</span>
for an example implementation of a Slurm authentication plugin.</p>
<p class="footer"><a href="#top">top</a></p>
<h2>Data Objects</h2>
<p> The implementation must support an opaque class, which it defines, to be used
as an authentication "credential." This class must encapsulate all user-specific
information necessary for the operation of the API specification below. The credential
is referred to in Slurm code by an anonymous pointer (void *).</p>
<p>The implementation must maintain (though not necessarily directly export) an
enumerated <b>errno</b> to allow Slurm to discover as practically as possible
the reason for any failed API call. The following enumerated integer values (declared
in <span class="commandline">src/common/slurm_auth.h</span>) must be used when
appropriate.</p>
<p style="margin-left:.2in">SLURM_AUTH_BADARG> —an argument to an API function
was invalid or malformed.<br>
SLURM_AUTH_MEMORY> —a request could not be satisfied because memory for it
could not be allocated.<br>
SLURM_AUTH_NOUSER> —a credential is improper because it refers to an unknown
user.<br>
SLURM_AUTH_INVALID> —a credential is improper because the validation of it
has failed. This is specifically distinct from the expiration of a credential.<br>
SLURM_AUTH_MISMATCH> —a credential could not be properly unpacked because it
is of an incompatible type or version.</p>
<p>These values must not be used as return values in integer-valued functions
in the API. The proper error return value from integer-valued functions is SLURM_ERROR.
While it is most practical to associate a different errno with each instance of
a credential, this is not necessarily enforced by the API. The implementation
should endeavor to provide useful and pertinent information by whatever means
is practical. In most cases, this means an errno for each credential, since plugins
must be re-entrant. If a plugin maintains a global errno in place of or in addition
to a per-credential errno, it is not required to enforce mutual exclusion on it.
Successful API calls are not required to reset any errno to a known value. However,
the initial value of any errno, prior to any error condition arising, should be
SLURM_SUCCESS. </p>
<p>Plugins may assign implementation-specific values to errno so long as they
do not conflict with the values assigned above. This is done programmatically
by assigning plugin-specific errno values which are arithmetically greater than
or equal to the symbol SLURM_AUTH_FIRST_LOCAL_ERROR.</p>
<p class="footer"><a href="#top">top</a></p>
<h2>API Functions</h2>
<p>The following functions must appear. Functions which are not implemented should
be stubbed.</p>
<p class="commandline"> int init (void)
<p style="margin-left:.2in"><b>Description</b>:<br>
Called when the plugin is loaded, before any other functions are
called. Put global initialization here.
<p style="margin-left:.2in"><b>Returns</b>: <br>
<span class="commandline">SLURM_SUCCESS</span> on success, or<br>
<span class="commandline">SLURM_ERROR</span> on failure.</p>
<p class="commandline"> void fini (void)
<p style="margin-left:.2in"><b>Description</b>:<br>
Called when the plugin is removed. Clear any allocated storage here.
<p style="margin-left:.2in"><b>Returns</b>: None.</p>
<p><b>Note</b>: These init and fini functions are not the same as those
described in the <span class="commandline">dlopen (3)</span> system library.
The C run-time system co-opts those symbols for its own initialization.
The system <span class="commandline">_init()</span> is called before the SLURM
<span class="commandline">init()</span>, and the SLURM
<span class="commandline">fini()</span> is called before the system's
<span class="commandline">_fini()</span>.</p>
<p class="commandline">void *slurm_auth_create(char *auth_info);</p>
<p style="margin-left:.2in"><b>Description</b>: Allocates from the free store
an anonymous credential object and returns a pointer to it. The pointer should
be valid until passed to <span class="commandline">slurm_auth_destroy()</span> for
disposal. Slurm will not pass
credentials to the API which have not been allocated by this function.</p>
<p style="margin-left:.2in"><b>Arguments</b>:<br>
<span class="commandline">argv</span> (input) plugin specific
information.
<span class="commandline">auth_info</span> (input) plugin specific
identification of the server.</p>
<p style="margin-left:.2in"><b>Returns</b>: A pointer to a newly allocated credential
if successful. On failure, the plugin should return NULL and set its errno to
an appropriate value to indicate the reason for failure.</p>
<p class="commandline">int slurm_auth_destroy (void *cr);</p>
<p style="margin-left:.2in"><b>Description</b>: Deallocates a credential that
was allocated with <span class="commandline">slurm_auth_alloc()</span> and any
associated storage that has been allocated for it during its use.</p>
<p style="margin-left:.2in"><b>Arguments</b>:<span class="commandline"> cr</span>
(input) pointer to the credential that is to be deallocated. Cannot
be NULL.</p>
<p style="margin-left:.2in"><b>Returns</b>: SLURM_SUCCESS if successful. On failure,
the plugin should return SLURM_ERROR and set the errno to an appropriate value
to indicate the reason for failure.</p>
<p class="footer"><a href="#top">top</a></p>
<p class="commandline">int slurm_auth_verify (void *cr, char *auth_info );</p>
<p style="margin-left:.2in"><b>Description</b>: Verifies that a credential is
in order and correctly identifies the associated user. It also verifies that the
credential has not expired. If verification is successful, the return values of
<span class="commandline">slurm_auth_get_uid()</span> and
<span class="commandline">slurm_auth_get_gid()</span>
in subsequent calls must correspond to the actual verified system UID and GID
of the user associated with the credential. Verification must fail if the credential
has not previously been activated, even if a credential implementation cannot
exist in an unactivated state. A credential's valid term is defined at activation
and verification must fail if the credential has expired, even if it would otherwise
be valid.</p>
<p style="margin-left:.2in"><b>Arguments</b>: <br>
<span class="commandline">cr</span> (input) pointer to the credential
which is to be verified. Cannot be NULL.<br>
<span class="commandline">auth_info</span> (input) plugin specific
identification of the server.</p>
<p style="margin-left:.2in"><b>Returns</b>: SLURM_SUCCESS if the credential is
verified to be in order and has not expired. If the credential cannot be verified,
or if the credential has expired, the function should return SLURM_ERROR and set
its errno to an appropriate value to indicate the reason for failure.</p>
<p class="commandline">uid_t slurm_auth_get_uid (void *cr, char *auth_info);<br>
gid_t slurm_auth_get_gid (void *cr, char *auth_info);</p>
<p style="margin-left:.2in"><b>Description</b>: Extracts the numerical UID (GID)
of the user corresponding to the given credential. Slurm considers this value
trustworthy only if the credential has been successfully verified using
<span class="commandline">slurm_auth_verify()</span>.
An unverified credential does not immediately give rise to an error condition
in these functions, since this would require a plugin to distinguish between a
verified and an unverified credential, which may be computationally expensive.
A plugin may consider the lack of verification as an error.</p>
<p style="margin-left:.2in"><b>Arguments</b>:<br>
<span class="commandline">cr</span> (input) pointer to the credential
containing the desired identification. Cannot be NULL.<br>
<span class="commandline">auth_info</span> (input) plugin specific
identification of the server.</p>
<p style="margin-left:.2in"><b>Returns</b>: If successful, the Linux UID (GID)
associated with the credential. In case of error, SLURM_AUTH_NOBODY should be
returned and errno set appropriately to indicate the cause of the failure.</p>
<p class="footer"><a href="#top">top</a></p>
<p class="commandline">int slurm_auth_pack (void *cr, Buf buf);</p>
<p style="margin-left:.2in"><b>Description</b>: Marshals a credential into a buffer
for transmission according to the Slurm packing protocol. All authentication plugins
must first pack the plugin_type and then the plugin_version data before any plugin-specific
data elements are packed. slurm_auth_pack() and slurm_auth_pack() are strictly
reciprocal. The esult of a packing followed by an unpacking must be a functionally
equivalent credential. A credential is deemed appropriate for marshalling at any
time after its allocation and before its destruction.</p>
<p style="margin-left:.2in"><b>Arguments</b>:<br>
<span class="commandline">cr</span> (input) pointer to the credential
to pack.<br>
<span class="commandline">buf</span> (input/output) the buffer
into which the credential should be packed.</p>
<p style="margin-left:.2in"><b>Returns</b>: SLURM_SUCCESS if successful. On failure
the plugin should return SLURM_ERROR and set the errno to indicate the reason
for the failure.</p>
<p class="commandline">int slurm_auth_unpack (void *cr, Buf buf);</p>
<p style="margin-left:.2in"><b>Description</b>: Unmarshals a credential from a
buffer according to the Slurm packing protocol into a supplied (and presumed empty)
credential object. The unmarshalled credential is not assumed to be activated
or verified. The <span class="commandline">plugin_type</span> and <span class="commandline">plugin_version</span>
data should first be unpacked from the buffer and verified for applicability.
The API does not enforce that they must be equivalent, merely compatible. Compatibility
is implementation-dependent.</p>
<p style="margin-left:.2in"><b>Arguments</b>:<br>
<span class="commandline">cr</span> (output) pointer to the
credential to pack.<br>
<span class="commandline">buf</span> (input/output) the buffer
from which the credential should be unpacked.</p>
<p style="margin-left:.2in"><b>Returns</b>: SLURM_SUCCESS if the credential was
successfully unpacked. In case of failure, the function should return SLURM_ERROR
and set errno appropriately to indicate the cause of the failure. If the function
fails, no assumptions are made about the state of the credential except its suitability
for destruction via <span class="commandline">slurm_auth_destroy()</span>.</p>
<p class="commandline">int slurm_auth_print (void *cr, FILE *fp);</p>
<p style="margin-left:.2in"><b>Description</b>: Writes a human-readable representation
of the credential to a standard I/O stream. There are no strict API constraints
on the behavior of this function, however it is recommended that the information
be as complete and as concise as possible. For example, lengthy digital "signatures"
need not be printed bitwise, but may be represented by their checksum. The intent
is to provide a depiction of the credential for debugging purposes.</p>
<p style="margin-left:.2in"><b>Arguments</b>: None.</p>
<p style="margin-left:.2in"><b>Returns</b>: SLURM_SUCCESS if successful. On failure
the plugin should return SLURM_ERROR and set the errno appropriately to indicate
the cause of failure.</p>
<p class="footer"><a href="#top">top</a></p>
<p class="commandline">int slurm_auth_errno (void *cr);</p>
<p style="margin-left:.2in"><b>Description</b>: Returns the current value of errno.
Whether the value is associated with the given credential or with the plugin as
a whole is implementation-dependent. Because this function can be used to discover
the reason why a credential allocation has failed, the argument is advisory. </p>
<p style="margin-left:.2in"><b>Arguments</b>: <span class="commandline">cr</span>
(input) pointer to the credential, the status of whose most recently executed
API function is to be returned. This value may be NULL, indicating that the most
recent errno value applicable to the plugin as a whole is to be returned.</p>
<p style="margin-left:.2in"><b>Returns</b>: The current value of errno or SLURM_SUCCESS
if there is no error to report.</p>
<p class="commandline">const char *slurm_auth_errstr (int errno);</p>
<p style="margin-left:.2in"><b>Description</b>: Provides a human-readable string
associated with the given errno. The plugin need only supply error strings for
the errno values it defines and not for errno values listed above that are required
by the API.</p>
<p style="margin-left:.2in"><b>Arguments</b>: <span class="commandline">errno</span>
(input) the plugin-specific errno for which a corresponding error message is desired.</p>
<p style="margin-left:.2in"><b>Returns</b>: A pointer to a static error message.
This function must always return a pointer to a string, even if the string is
empty or ambiguous such as "unknown error."</p>
<p class="footer"><a href="#top">top</a></p>
<p style="text-align:center;">Last modified 27 March 2015</p>
</div> <!-- END .container -->
</div> <!-- END .section -->
</div> <!-- END .content -->
</div> <!-- END .main -->
<footer class="site-footer" role="contentinfo">
<nav class="footer-nav section">
<div class="container">
<p><a href="disclaimer.html" target="_blank" class="privacy">Legal Notices</a></p>
</div>
</nav>
</footer>
</body>
</html>
|