User and Account filters missing from Job List page

[stefanbuligadiomedes]

It seems like some features are missing from my v5.0.0 slurm-web deployment. As it can be seen in the attached screenshots, the jobs are clearly fetched from the slurm rest API and they do have user and account fields. However, when clicking on "Add Filter", there is only the "State" filter available.

I am using slurm 24.11.5, here are my configuration files:

/etc/slurm-web/gateway.ini:

[service]
interface=0.0.0.0
debug=True
debug_flags=ALL

[agents]
url=http://localhost:5012

[ui]
host=http://[redacted]:5011

/etc/slurm-web/agent.ini:

[service]
cluster=ray-cluster

[slurmrestd]
uri=http://coldstorage-backup:6820

Bonus question:
Is it not possible to filter jobs after "FAILED" state? I only see RUNNING/COMPLETED/PENDING as options.

[rezib]

Hello @stefanbuligadiomedes,

It seems like some features are missing from my v5.0.0 slurm-web deployment. As it can be seen in the attached screenshots, the jobs are clearly fetched from the slurm rest API and they do have user and account fields. However, when clicking on "Add Filter", there is only the "State" filter available.

It looks like you haven't setup authentication in Slurm-web. The list of users are currently retrieved from authentication backend, thus users filters cannot be used when authentication is disabled.

Is it not possible to filter jobs after "FAILED" state? I only see RUNNING/COMPLETED/PENDING as options.

No, it is not possible yet. Feel free to open an issue to request this feature.

[rezib]

Thanks, I had a hunch that it's due to the lack of auth but, in theory, the data is coming from slurm API and the filters could be based on that.

Slurm does not store user first name and last name, that's why we are currently relying on authentication backend to fetch users list. We could have implemented a fallback when authentication is disabled but we did not work on this yet. Feel free to reach us if you need such
feature.

Anyway, you're talking about the LDAP authentication, right?

Yes, currently Slurm-web only supports LDAP directories as an authentication backend.

And each user would have to use the same username for authentication as the one under slurm right?

Yes.

Going on, will this automatically enable account filtering as well? Because LDAP auth has no concept of account, that clearly has to be taken from slurm response data.

No, for account filters you just need to customize the authorization policy to add view-account action on anonymous role.

[stefanbuligadiomedes]

Thank you for the help provided so far! I am facing some strange errors with the LDAP authentication. I will post them here, let me know if I should open another topic.

This is my LDAP structure:

ubuntu@my-server:~$ sudo docker exec -it slurm-ldap ldapsearch -x -H ldap://localhost:389 -D "cn=admin,dc=slurm,dc=local" -w admin123 -b "dc=slurm,dc=local" -o ldif-wrap=no
# extended LDIF
#
# LDAPv3
# base <dc=slurm,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# slurm.local
dn: dc=slurm,dc=local
objectClass: top
objectClass: dcObject
objectClass: organization
o: SLURM
dc: slurm

# people, slurm.local
dn: ou=people,dc=slurm,dc=local
objectClass: organizationalUnit
ou: people

# groups, slurm.local
dn: ou=groups,dc=slurm,dc=local
objectClass: organizationalUnit
ou: groups

# users, groups, slurm.local
dn: cn=users,ou=groups,dc=slurm,dc=local
objectClass: posixGroup
cn: users
gidNumber: 1000
memberUid: stefanb

# stefanb, people, slurm.local
dn: uid=stefanb,ou=people,dc=slurm,dc=local
objectClass: inetOrgPerson
objectClass: posixAccount
cn: stefanb
sn: stefanb
uid: stefanb
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/stefanb
loginShell: /bin/bash
userPassword:: [redacted]
mail: stefanb@slurm.local

# search result
search: 2
result: 0 Success

# numResponses: 6
# numEntries: 5

And this is the output of the /slurm-web-ldap-check utility:

ubuntu@my-server:~$ sudo /usr/libexec/slurm-web/slurm-web-ldap-check --debug --debug-flags rfl
[DEBUG] ⸬rfl.settings.loaders:31        ↦ Loading site settings file /etc/slurm-web/gateway.ini
[INFO]  ⸬slurmweb.apps.ldap:22          ↦ Running slurm-web-ldap-check
[DEBUG] ⸬rfl.authentication.ldap:230    ↦ Using DN cn=admin,dc=slurm,dc=local to bind to LDAP directory
[DEBUG] ⸬rfl.authentication.ldap:376    ↦ LDAP search base: ou=groups,dc=slurm,dc=local, scope: subtree, filter: (objectClass=posixAccount), results: [('uid=stefanb,ou=people,dc=slurm,dc=local', {'uid': [b'stefanb']})]
[DEBUG] ⸬rfl.authentication.ldap:122    ↦ LDAP search base: uid=stefanb,ou=people,dc=slurm,dc=local, scope: base filter: (objectClass=posixAccount), results: [('uid=stefanb,ou=people,dc=slurm,dc=local', {'cn': [b'stefanb'], 'gidNumber': [b'1000']})]
[DEBUG] ⸬rfl.authentication.ldap:191    ↦ LDAP search base: ou=groups,dc=slurm,dc=local, scope: subtree, filter: (&(|(objectClass=posixGroup)(objectClass=groupOfNames))(|(memberUid=stefanb)(member=uid=stefanb,ou=people,dc=slurm,dc=local)(gidNumber=1000))), results: [('cn=users,ou=groups,dc=slurm,dc=local', {'cn': [b'users']})]
Found 1 user(s) in LDAP directory:
- stefanb (stefanb) [users]

However, when trying to log in from the webpage, the gateway encounters the following error:

ubuntu@my-server:~$ sudo journalctl -u slurm-web-gateway.service -f
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-7 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /favicon.ico HTTP/1.1" 304 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-6 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /config.json HTTP/1.1" 200 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-8 (process_request_thread): [DEBUG] Login service markdown file /etc/slurm-web/messages/login.md not found
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-8 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /api/messages/login HTTP/1.1" 404 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-9 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /logo/slurm-web_logo_dark.png HTTP/1.1" 304 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-10 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /logo/slurm-web_logo.png HTTP/1.1" 304 -
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [DEBUG] DN user for authentication of user stefanb: uid=stefanb,ou=people,dc=slurm,dc=local
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [DEBUG] LDAP search base: uid=stefanb,ou=people,dc=slurm,dc=local, scope: base filter: (objectClass=posixAccount), results: [('uid=stefanb,ou=people,dc=slurm,dc=local', {'cn': [b'stefanb'], 'gidNumber': [b'1000']})]
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [WARNING] LDAP authentication error for user stefanb: Unable to find group base ou=groups,dc=slurm,dc=local
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:21] "POST /api/login HTTP/1.1" 401 -

Why can it not find the group base ou=groups,dc=slurm,dc=local? It can be seen in the ldapsearch output and in the output of the ldap check command.

gateway.ini:

[service]
interface=0.0.0.0
debug=True
debug_flags=ALL

[agents]
url=http://localhost:5012

[ui]
host=http://51.77.178.71:5011

[authentication]
enabled=yes

[ldap]
uri=ldap://localhost:389
user_base=ou=people,dc=slurm,dc=local
group_base=ou=groups,dc=slurm,dc=local
bind_dn=cn=admin,dc=slurm,dc=local
bind_password=[redacted]
lookup_user_dn=False

I added my custom policy.ini file under /etc/slurm-web/poolicy.ini

[roles]
# Enable anonymous role with basic views
anonymous
# All authenticated users have the user role
user=ALL

[anonymous]
actions=view-stats,view-jobs,view-nodes,view-partitions,view-qos,view-accounts,view-reservations

[user]
actions=view-stats,view-jobs,view-nodes,view-partitions,view-qos,view-accounts,view-reservations

But still no account filters are showing.

[rezib]

[…] I am facing some strange errors with the LDAP authentication. I will post them here, let me know if I should open another topic.

[…]

ubuntu@my-server:~$ sudo journalctl -u slurm-web-gateway.service -f
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-7 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /favicon.ico HTTP/1.1" 304 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-6 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /config.json HTTP/1.1" 200 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-8 (process_request_thread): [DEBUG] Login service markdown file /etc/slurm-web/messages/login.md not found
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-8 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /api/messages/login HTTP/1.1" 404 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-9 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /logo/slurm-web_logo_dark.png HTTP/1.1" 304 -
Jun 26 09:20:18 my-server slurm-web-gateway[224271]: Thread-10 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:18] "GET /logo/slurm-web_logo.png HTTP/1.1" 304 -
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [DEBUG] DN user for authentication of user stefanb: uid=stefanb,ou=people,dc=slurm,dc=local
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [DEBUG] LDAP search base: uid=stefanb,ou=people,dc=slurm,dc=local, scope: base filter: (objectClass=posixAccount), results: [('uid=stefanb,ou=people,dc=slurm,dc=local', {'cn': [b'stefanb'], 'gidNumber': [b'1000']})]
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [WARNING] LDAP authentication error for user stefanb: Unable to find group base ou=groups,dc=slurm,dc=local
Jun 26 09:20:21 my-server slurm-web-gateway[224271]: Thread-11 (process_request_thread): [INFO] 141.94.248.228 - - [26/Jun/2025 09:20:21] "POST /api/login HTTP/1.1" 401 -

It looks like you're facing #587 because your user is not able to read branch ou=groups,dc=slurm,dc=local

I added my custom policy.ini file under /etc/slurm-web/poolicy.ini

[roles]
# Enable anonymous role with basic views
anonymous
# All authenticated users have the user role
user=ALL

[anonymous]
actions=view-stats,view-jobs,view-nodes,view-partitions,view-qos,view-accounts,view-reservations

[user]
actions=view-stats,view-jobs,view-nodes,view-partitions,view-qos,view-accounts,view-reservations

But still no account filters are showing.

After creating this file, you have to restart the agent service, logout in web interface and signin again to get a new token. You can check the permissions associated with your token in Settings > Accounts

[stefanbuligadiomedes]

Yes, I eventually figured it out after looking over the LDAPAuthentication python code. I must say, the behaviour is a bit counterintuitive but in the end, it doesn't really matter.

Regarding account filters, they started working as well once LDAP was enabled. However, with authentication disabled, account filters weren't showing up even with all actions permitted for the anonymous role. Again, this is very counterintuitive, since the existence of an anonymous role implies that those actions should be doable even with no authentication set up.

No, it is not possible yet. Feel free to open an issue to request this feature.

I will do so, should I write an email to you asking about quotas for this feature?

[rezib]

Yes, I eventually figured it out after looking over the LDAPAuthentication python code. I must say, the behaviour is a bit counterintuitive but in the end, it doesn't really matter.

This will be fixed in upcoming release 5.1.0.

Regarding account filters, they started working as well once LDAP was enabled. However, with authentication disabled, account filters weren't showing up even with all actions permitted for the anonymous role. Again, this is very counterintuitive, since the existence of an anonymous role implies that those actions should be doable even with no authentication set up.

This is supposed to work, please open a bug report if you have a reproducer. I tried to reproduced myself but it works for me.

No, it is not possible yet. Feel free to open an issue to request this feature.

I will do so, should I write an email to you asking about quotas for this feature?

This is quite trivial, just open an issue, that's ok.