6.17. Authentication

Before a PMIx server answers a request, it needs to know who is asking. For a connection between processes, “who” usually means the user ID and group ID of the process on the other end of the socket. Those IDs decide which jobs, data, and output the peer may see. This section covers how those IDs can be established, and how far each method can be trusted.

• 6.17.1. Authenticating a Containerized Peer over TCP
  • 6.17.1.1. The Problem
  • 6.17.1.2. 1. Kernel-Attested Credentials over a Unix Socket
  • 6.17.1.3. 2. Host-Side Lookup of the TCP Socket’s Owner
  • 6.17.1.4. 3. A Local Credential Service Verified Remotely
  • 6.17.1.5. 4. Proving Access to a Protected File
  • 6.17.1.6. 5. Recording Identity at connect() with eBPF
  • 6.17.1.7. 6. Identity Assigned by the Launcher
  • 6.17.1.8. 7. Labeled Networking
  • 6.17.1.9. Methods Too Weak to Rely On Alone
  • 6.17.1.10. Comparison
  • 6.17.1.11. Recommendations for HPC Environments
• 6.17.2. The native Mechanism
  • 6.17.2.1. How a Peer Is Authenticated
  • 6.17.2.2. Which Identity Is Used
  • 6.17.2.3. Running a Peer in a Container
  • 6.17.2.4. MCA Parameters
  • 6.17.2.5. Limits