slurm-token-helper

A helper backend to generate Slurm JWT token via RESTful API

Requirements

• scontrol must be available on the system (Slurm must be installed)
• The service must run on a node with sufficient Slurm privileges to generate JWT tokens

Configuration

Copy the example config and fill in your values:

cp config.yaml.example config.yaml

host: localhost
port: 8080
api_token: your-secret-token-here

config.yaml is excluded from version control. Never commit it as it contains secrets.

Usage

Start the service:

./slurm-token-helper

Generate a token by calling the API with your api_token in the Authorization header:

curl -H "Authorization: Bearer your-secret-token-here" \
  http://localhost:8080/api/token/<username>

The response is a JWT token string that can be used to submit jobs to Slurm.

Demonization

To run the service as a daemon, you can use systemd on Linux. Create a service file at /etc/systemd/system/slurm-token-helper.service with the following content:

# /etc/systemd/system/slurm-token-helper.service
# GitHub: https://github.com/NYCU-SDC/slurm-token-helper

[Unit]
Description=Slurm Token Helper API Service (https://github.com/NYCU-SDC/slurm-token-helper)
After=network.target slurmctld.service
Wants=slurmctld.service

[Service]
Type=simple

# needs permission to run scontrol
User=slurm
Group=slurm

# where config.yaml lives
WorkingDirectory=/opt/slurm-token-helper
# your binary
ExecStart=/opt/slurm-token-helper/slurm-token-helper
Restart=on-failure
RestartSec=5

# Logging (view with: journalctl -u slurm-token-helper -f)
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/slurm-token-helper

[Install]
WantedBy=multi-user.target

Ensure the service file can be read by the user set in the service (e.g., slurm), then enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable slurm-token-helper
sudo systemctl start slurm-token-helper