one to many job mapping

-- the job submission user needs be one particular user,

-- the job execution user should be mapped to various users.



In order for LSF to support such use case, an enhancement is to add

1) a new bsub option to specify the job execution user

2) a new UserMapping section in lsb.users to define policy for user mapping, for example, the EXECUTION_USER (user/user group) whom a SUBMISSION_USER (user/user group) can to be mapped to.

What the customer seeks is the ability to allow one user to submit jobs to run as other users.

Requirements:

We must be able to specify which user can run as other users.
Imagine there is a LSF config file called lsf.one2many. It looks like this (below). We can add and remove as many 'one to many' users as we wish.
# elevated user or group # users or groups they can run as
cromwell bpappas,cking,apappas
pallas mjohnston, amy, doug

This means that user cromwell can run jobs as users bpappas,cking,apappas.
This means that user pallas can run jobs as users mjohnston, amy, doug

Note, the examples above show users that need this privilege. Groups should be uses as well. groups of user with privileges and groups of users they can run as.

# elevated group # users or groups they can run as
cmgroup bpappas,cking,apappas
pmgroup jgroup, amy, doug


2. bsub must be able to allow a user to attempt to run as other users using a flag like -o2m.

Example:
$whoami
cromwell

$bsub -o2m apappas


3. LSF should fail on a job submission if the user is not allowed to submit the job as another user. It must thrown out an error like it would for other error scenarios.

Example error output:
$whoami
cromwell
$bsub -o2m doug


4. LSF must charge the resource utilization (cpu time used, etc) to the user that actually runs the job on the execution or batch node.


Here are some scenarios to better express what they require:

$whoami
cromwell

$bsub -o2m apappas


$ssh node001
$ps| grep
1234 apappas >some job>

$bsub -o2m doug




$whoami
pallas

$bsub -o2m doug


$ssh node002
$ps| grep
5678 doug


$ cat lsb.one2many
# elevated user #users that can run as: user1,user2, user3, ...
cromwell bpappas,cking,apappas
pallas mjohnston, amy, doug

Imagine there is a command called b02m and it shows who can run as other users:

$bo2m
cromwell bpappas,cking,apappas
pallas mjohnston, amy, doug