The Intel® MPI Library supports several authentication methods under the Microsoft Windows* OS:
Domain-based authorization with the delegation ability
Limited domain-based authorization
The password-based authorization is the most common method of providing remote node access through a user’s existing account name and password. Intel MPI Library allows you to encrypt your login information and store it in the registry with the mpiexec -register command . You need to do this once, during the first application run.
Intel® MPI Library additionally supports domain-based authorization with the delegation ability as well as limited domain-based authorization. The domain-based authorization methods use the Security Service Provider Interface (SSPI) provided by Microsoft* in the Windows* OS environment. The SSPI allows a domain to authenticate the user on the remote machine by the domain policies. You do not need to enter and store your account name and password when using such methods.
This feature is supported on clusters under Windows HPC Server 2012 R2. Microsoft's Kerberos Distribution Center* must be enabled on your domain controller (this is the default behavior).
Using the domain-based authorization method with the delegation ability requires specific installation of the domain. You can perform this installation by using the Intel® MPI Library installer if you have domain administrator rights or by following the instructions below.
Active Directory* Setup
To enable the delegation in the Active Directory*, do the following:
Log in on the domain controller under the administrator account.
Enable the delegation for cluster nodes:
Go to Administrative Tools.
In the Active Directory Users and Computers administrative utility open the Computers list.
Right click on a desired computer object and select Properties.
Select the Delegation tab and check the Trust this computer for delegation to any service (Kerberos only) option.
Enable the delegation for users:
In the Active Directory Users and Computers administrative utility open the Users list.
Right click on a desired user object and select Properties.
Select the Account tab and disable the Account is sensitive and cannot be delegated option.
- Make sure the Hydra service is installed and running on the cluster nodes. To check this, enter the command:
If the service is not running, use the following command to install and run it:
hydra_service -installNOTE:Run this command as an administrator.
Register service principal name (SPN) for cluster nodes. Use one of the following methods for registering SPN:
Use the setspn.exe utility from Microsoft*. For example, execute the following command on the domain controller:
> setspn.exe -A impi_hydra/<host>:<port>/impi_hydra <host>
- <host> is the cluster node name.
- <port> is the Hydra port. The default value is 8679. Change this number only if your hydra service uses the non-default port.
Log into each desired node under the administrator account and execute the command:
> hydra_service -register_spn
To select a user authorization method, use the I_MPI_AUTH_METHOD environment variable with the password, delegate, or impersonate argument. For more details, see the Developer Reference, section User Authorization.