CERN Accelerating science

Previous:		Invitation to Perform Y2K Testing	(See printing version)
Next:		New STK 9840 Tape Units Enter Service

Since April 21^st people have been allowed to use a single logonid for all IT services even if they are working for more than one experiment or group. This means, for example, that it is no longer necessary to have accounts

Since April 21^st it has been possible to register the JOAN account on RSPLUS in group Z5.

How Does This Affect Me?

• If you have only one logonid and are working for a single CERN group or experiment then you are not affected.
• If you like having more than one logonid to keep your work for different groups or experiments separate then you are not affected. We will not force you to use a single logonid.
• If you are annoyed because your work for more than one group or experiment means you have to have more than one logonid then you can now ask your group administrator to let you use the logonid of your choice on all services---and this is likely to make it easier for you to access the Mail Servers. See below for more details.
• If you are a group administrator you need to understand the difference between PRIMARY and SECONDARY accounts on a service and how these affect what a user can do---and what you can do for a user. See below for more details.

The account listings provided by phone and xwho have changed slightly to indicate the difference between PRIMARY and SECONDARY accounts but most people won't need to worry about this.

What Does This Mean In Practice?

• People now have a PRIMARY account on each service which associates the logonid to the group code normally used for work on that system. For example, the primary account for JOAN on SHIFTALEPH would be for group code XU and the primary account for JOAN on RSPLUS would be for group Z5. These PRIMARY accounts are the same as the old "ordinary" accounts---it is just that the group code associated with the PRIMARY account can be different on each service.

• People may have a SECONDARY account on a service if they use that service for work associated with more than one group. JOAN, for example, could have a SECONDARY account on RSPLUS for group code XU if she occasionally used RSPLUS for ALEPH work. To use the secondary account the "newacct" command must be issued to set the correct group code, e.g.
  

  	newacct 'jdb$xu' 
  
  
  

  (The quotes are needed on Unix as the $ character has a special meaning to the shell. The account code---especially the 3 letter UUU code---can be found from xwho/phone (phone -A) if you do not know it already.)
  When submitting batch jobs with LSF, the -P option of bsub is needed, e.g.,
  

  	bsub -P xu < my_aleph_script
  
  
  

  and the newacct command must also be issued from within the batch job.

• File space, in particular AFS space, is accounted only against the PRIMARY account. It does not matter if the files contain ALEPH or LHCb programs! Quota allocation can only be altered by the administrator for the PRIMARY account---the account identified by a '$' in phone/xwho output. (This change just extends the "home group" concept that always existed for AFS to other services and so the "home group" becomes the "primary account".)

How Does This Affect Group Administrators?

• Group Administrators can register an account on any service using an existing logonid. Many people will prefer this as it means they will keep easy access to their existing files and to the mail server as they change group. However, it will still be possible to create a new logonid for people who want to separate their work in different areas.
• Group Administrators can register a SECONDARY account on shared services (e.g. RSPLUS) if the person concerned already has an account on that service in another group.
• Group Administrators will need to change PRIMARY (and maybe SECONDARY) accounts as people move between experiments. For example, our ALEPH physicist will have PRIMARY accounts for group XU. As she starts work for LHCb some Z5 accounts (e.g. for AFS and maybe DXPLUS) will initially be SECONDARY accounts. Once she is spending the bulk of her time working on LHCb these should be changed to PRIMARY accounts with the ALEPH accounts on these services becoming SECONDARY accounts.
• Group Administrators must realise that blocking access to a service is at the USER and not at the ACCOUNT level. This means that if ANY account is blocked (whether PRIMARY or SECONDARY) then the user concerned will not be able to use that service at all. Please look to see if any other accounts, whether PRIMARY or SECONDARY, exist for another group before blocking a user account. It may be better to change the group code for the PRIMARY account or to switch the PRIMARY and SECONDARY accounts and then delete (not block) the new SECONDARY account.

For matters related to this article please contact the author.