Remote Cluster Requires multi-factor authentication every time, but the cluster profile manager only asks for a password

Hi,

My school has a supercomputing cluster with the matlab parallel server. Normally, we have to log in with ssh and submit any jobs by copying scripts and setting up matlab to run on the command line. This is a hassle when sometimes I just want to offload my current project to the server, but I don't want to go through the process of making sure it can accept inputs and outputs from the command line. The server uses a SLURM job scheduler, and I have received permission from the administration to try and get matlab to recognize the server as a remote cluster. I've gone through the wizard from here: https://www.mathworks.com/matlabcentral/fileexchange/52807-parallel-computing-toolbox-plugin-for-matlab-parallel-server-with-slurm, and everything seems almost ok. However, I can never get passed the job test because the supercomputer requires multi-factor authentication to connet to it. That is, everytime you connect to the login node, you must provide a password and a 'token' that changes every 30 seconds. However, when I try to use the validation tool for the cluster, I only get asked to provide a password. The authentication fails, of course. I want to know if there is a way to have matlab request the token as well and use it to authenticate.

I dug into the file remoteClusterAccess.m and found the following lines:

passwordMsg = getString(message('parallel:cluster:EnterPasswordForUserOnMachine', obj.Username, hostname));
password = obj.solicitPassword(passwordMsg);
%tokenMsg = getString(message('parallel:cluster:EnterPasswordForUserOnMachine', obj.Username, hostname));
%token = obj.solicitPassword(tokenMsg);

credentialParameters.put(PasswordCredentialDescription.USERNAME, javaUsername);
credentialParameters.put(PasswordCredentialDescription.PASSWORD, password);
%credentialParameters.put(PasswordCredentialDescription.PASSWORD, token);
credentials = PasswordCredentialDescription.INSTANCE.create(credentialParameters);     

I tried adding the commented lines to see what would happen. Changing the PasswordCredentialDescription.PASSWORD bit with the token seems to update that field, but if I try to to something like PasswordCredentialDescription.TOKEN that doesn't work. Clearly that isn't an acceptable input. I've tried looking through the files to see where the acceptable inputs are defined and what happens to them, but I have had no luck.

It seems like an easy enough thing to just pass another character vector through to ssh, but there are so many files to dig through and I just can't seem to find out where to go.

Also, it's worth noting that editing the various .m files does change the validation steps. And putting debugging breaks on the lines will stop the validation steps, so that can be handy.

Answer 1

[Meg Glade]

As of R2020b, the option for MFA isn't available. However, there are some cases where having an SSH session open (with MFA) is enough.

I recommend experimenting to see whether your system will work if there is an open SSH connection which already was authenticated with the code. If this doesn't work from you, please contact MathWorks Technical Support; we'd be happy to hear more about your use case so we can pass it along to our developers and consider an enhancement request.

[Joseph Shirley]

An open SSH session does not work for me, but I look forward to more features in future releases. Thanks!