[torqueusers] Question regarding configuring a queue with acl_groups

[Michael Homa]

I'm configuring torque (version 2.2.1) for a university-based cluster. I'm
setting up an execution queue for jobs submitted by staff employees and not
from students; I've already established queues for students). I've
configured the "staff" queue with the key attributes:

   acl_user_enable = True
   acl_group_enable = True
   acl_logic_or = True    <-- added to try solving my problem
   acl_groups = -student

No accounts entered for acl_user entry. (Again, the acl_logic_or as well
as the acl_user_enable were added in an attempt to solve my problem.)

According to the PBS ERS and pbs_queue_attributes(7) man page, the (not
group) is permitted with the -<group_name> entry

I've created a test account with the following attributes:
   uid=52180(mhoma) gid=1234(mpitest) groups=100(users),1234(mpitest)

The /etc/group file confirms that mpitest exists with mhoma:
   mpitest:x:1234:mhoma

I've confirmed that -students is in the appropriate acl_group entry:
   cd acl_groups
   ls
      dedicated  staff  student_long  student_medium  student_short
   cat staff
      -student

When I submit a hello_world script to the staff queue (either with the
script containing the destination staff or via the -q option on qsub
command):

  #PBS -N hello_world
  #PBS -q staff
  /home/homes51/mhoma/a.out

I get a "qsub: Unauthorized Request". So I set up a test matrix of the two
key queue attributes (acl_group_sloppy and acl_group) and the results of
qsub results:

   +---------------------------------------------------------------+
   | acl_group_sloppy  |  acl_group  |    Results                  |
   +-------------------+-------------+-----------------------------+
   |        true       |   mpitest   | job queued as expected      |
   |        false      |   mpitest   | failed though I expected it |
   |                                     to queue                  |
   |        false      |   -student  | failed - not expected       |
   |        true       |   -student  | failed - not expected       |
   +---------------------------------------------------------------+

So, I'm at a loss as to why the NOT student does not work. I tried
changing the server log_level to 7 to get additional information. No
additional information. I added the @localhost to the acl_groups
entry. Same result. I also tried the -W group_list=mpitest on the
qsub command. If someone knows which src program contains the
appropriate code, I can look at the logic. Is there any way (I don't
see any looking at the docs) to generate a more detailed explanation of
why the request failed? Or, if I'm trying to do something not permitted
or just being stupid (after spending eight hours on this particular
problem, I would not discount the latter), let me know because I'm out
of ideas.

Sorry for the length of the note.

Michael Homa
Operating Systems Support and Database Group
Academic Computing and Communication Center
University of Illinois at Chicago
email:  mhoma at uic.edu