Public PIC Wiki - User contributions [en]

Gitlab

2026-09-16T10:29:03Z

Msantama:

== Introduction ==

[https://about.gitlab.com/ Gitlab] is a Dev(Sec)Ops platform to handle all the elements in the software development life cycle.

Main features:
* Git repository management
* Software development planning
* Continuous Integration and Continuous Deployment (CI/CD)

The service can be accessed at [https://gitlab.pic.es] with your PIC account.

The groups inside gitlab are not synced with the LDAP groups, if you want to have access to some specific group or project in gitlab you have to request it through the application.

== Official Gitlab documentation ==

The official Gitlab documentation can be found here: https://docs.gitlab.com/

Make sure that the documentation you are viewing applies to the Free (Community Edition) distribution and the version deployed at '''gitlab.pic.es'''. You can easily find the version number in the Help menu.

The official documentation can be overwhelming, here are some useful links:

* [https://gitlab.pic.es/help/user/ssh.md#generate-an-ssh-key-pair Generate an SSH key pair]
* [https://docs.gitlab.com/ee/topics/git/lfs/ git LFS]
* [https://docs.gitlab.com/ee/user/project/web_ide/index.html Web IDE]
* [https://docs.gitlab.com/ee/ci/yaml/ CI/CD .yaml file syntax reference]
* [https://docs.gitlab.com/ee/ci/caching/ GitLab CI/CD Caching]
* [https://docs.gitlab.com/ee/user/project/pages/ GitLab Pages]

== Best practices / recommendations ==

=== General rules ===

* '''Make small and atomic changes''' Commit / push often.
* '''Use branches for dedicated/long developments'''
* '''Keep the main branch stable''' the tests should always pass (yes you should have tests!!)
* '''Write descriptive commit messages''' Avoid messages like “changes”, “test” or “.”
* '''Adopt a branching strategy''' [https://nvie.com/posts/a-successful-git-branching-model/ gitflow], trunk-based,...
* '''Do code reviews if possible''' Specially if working in a team

=== Our contributions ===

* '''Use git!!''' If you work alone or in a team, use it!
* '''Do not upload big binary files to a git repository''' Git is not for data, it is for code. If you still want to do it you can use git LFS (see above).
* '''Use .gitignore to track only relevant files''' [https://git-scm.com/docs/gitignore official docs] and [https://github.com/github/gitignore/tree/main some examples]
* '''Do not track jupyter notebooks (.ipynb)''' pair them with a script using [[JupyterHub#jupytext|jupytext]]
* '''Do not upload confidential data''' passwords, ssh keys, etc will be there forever

== GitLab CI/CD Cache ==

GitLab Runners at PIC support S3 distributed caching to speed up pipelines by reusing dependencies (e.g., Python `venv` or `pip` packages) across job runs.

* '''Official docs:''' [https://docs.gitlab.com/ee/ci/caching/ GitLab Caching Documentation]
* '''Retention policy:''' Unused cache files are automatically deleted after 30 days.

=== Cache vs. Artifacts (Important) ===
It is very common to confuse caches and artifacts. Please use them correctly:
* '''Use Cache for dependencies:''' Cache is meant to store downloaded internet dependencies (like `node_modules/`, Python `venv/`, or `.cache/pip/`) to speed up future pipeline runs. It is '''not''' meant for system-wide packages (e.g., `apt-get install`) or custom binaries. Also, the cache is not guaranteed to exist (your job must always be capable of installing things from scratch if the cache is missing).
* '''Use Artifacts for build results:''' Artifacts are used to pass intermediate files (compiled code, test reports, generated HTML) between different stages of the '''same''' pipeline execution, or to let users download them. Do not use the cache to pass files between stages.

=== Quick example (Python) ===

<pre>
image: python:3.10

cache:
key: "python-deps-$CI_COMMIT_REF_SLUG"
paths:
- .cache/pip
- venv/

variables:
PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

stages:
- build
- test

build_job:
stage: build
script:
# Always check and install from scratch if the cache is missing/empty
- if [ ! -d "venv" ]; then python -m venv venv; fi
- source venv/bin/activate
- pip install -r requirements.txt

test_job:
stage: test
script:
- source venv/bin/activate
- pytest
</pre>

== GitLab Pages ==

You can publish static websites (documentation, Sphinx, Doxygen, HTML/JS) directly from your CI/CD pipeline under <code>https://pages.pic.es</code>.

* '''Official docs:''' [https://docs.gitlab.com/ee/user/project/pages/ GitLab Pages User Guide]

=== Requirements & Quick example ===

To publish a website, your pipeline configuration must meet three simple requirements:
# The job must be named exactly '''<code>pages</code>'''.
# The website files must be generated in or moved to the '''<code>public/</code>''' directory.
# The '''<code>public/</code>''' directory must be defined as a job artifact.

<pre>
pages:
stage: deploy
script:
- mkdir public
- echo "<h1>GitLab Pages at PIC</h1>" > public/index.html
artifacts:
paths:
- public
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
</pre>

== Troubleshooting ==

=== Errors in CI/CD jobs ===

* ''pods XXXX is forbidden: exceeded quota'': There's a limit on the amount of resources that can be used simultaneously for CI/CD jobs. This takes into account your own jobs and jobs from other projects. You should be able to retry the pipeline after some period to wait for resources to be freed. If it doesn't work contact the administrator.
* ''ERROR: Preparation failed: couldn't prepare overwrites: invalid build requests specified: the resource "XXXXXX" requested "X" is higher than limit allowed "X"'': Your job requested more than the allowed resources. Lower down the amount of resources requested.
* ''ERROR: Job failed (system failure): Error in container build: exit code: 137, reason: 'OOMKilled''': The job exceeded the memory limit and it was killed. Try increasing the memory requested for you CI/CD job. If this is not enough contact the servicea administrator.

=== Configure resource limits in CI/CD jobs ===

Gitlab CI/CD jobs run as pods on one of PIC's kubernetes clusters. Pods can have resource requests and limits. Resource requests are effectively allocated for the pod, which will be killed if it exceeds the resource limits.

Default resources are:
* 1GiB memory and 0.5 cpu requested
* 2GiB memory and 1 cpu limit

Default resources can be overwritten by setting environment variables in the job configuration in .gitlab-ci.yml like this:

cicd_job:
image: python:3.11-slim
variables:
KUBERNETES_CPU_REQUEST: "1"
KUBERNETES_CPU_LIMIT: "2"
KUBERNETES_MEMORY_REQUEST: "4Gi"
KUBERNETES_MEMORY_LIMIT: "6Gi"

Maximum resources that can be overwritten are:
* 6 GiB memory and 2 cpu requested
* 8 GiB memory and 4 cpu limit

Faq

2026-06-26T15:49:47Z

Msantama:

== How do I reset my password? ==
You can reset your password using the following link:
https://www.pic.es/user/auth/forgotpw

== Can an undergraduate student in my group have an account? ==
Yes. Undergraduate students can have PIC accounts without any problem.

== How do I get a Kerberos token? ==
A valid token is needed to interface with some PIC services, like the Hadoop platform (HDFS, Hive, Spark, ...) or CTA.
Tokens are issued for the machine in which they are requested, if you hop to another machine, you may need to get another token.

In order to get a token, run the following commands on a terminal.
If you are on JupyterLab, use ''Launcher'' → ''Terminal''.

<pre>
kinit -n -c ~/.fast.ccache @PIC.ES
kinit -T ~/.fast.ccache
</pre>

You could also define an alias for your own convenience:

<pre>
alias kinit="kinit -n -c ~/.fast.ccache @PIC.ES; kinit -T ~/.fast.ccache"
</pre>

Optionally, you can check the presence and expiration date of your token using:

<pre>
klist
</pre>

== I lost access to my OTP, how can I reset it? ==
Follow these steps to recover your account and configure a new OTP token.

# On the login page, click '''Forgot password / OTP''' or go [https://www.pic.es/reset here].
# Enter your username. You should receive a recovery email in your inbox.
# Open the email and follow the recovery link.
# Scan the new QR code with your authenticator app.
# Enter the generated OTP code and a device name.
#* The device name is mandatory.
# Change your password when prompted.
#* This is required for security reasons.
# Log in again as usual.
#* On the OTP selection page, you will see two devices.
#* Select the device with the name you just entered.
#* The old one will usually appear as '''unnamed''' (if no name was set previously).

Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].

== How can I manage my OTP devices or add a second one (like a browser extension)? ==

Our Keycloak system allows you to register multiple OTP devices simultaneously. This means you can add a browser extension on your computer as a secondary OTP option without breaking or removing your existing mobile phone setup.

For the browser extension, we recommend the open-source '''Authenticator''' (available for Chrome, Firefox, and Edge): [https://authenticator.cc/ Authenticator Extension Website].

=== Steps to add a browser extension (or another device) ===

# Install the '''Authenticator''' extension in your browser.
# Go to your [https://idp.pic.es/realms/PIC/account/account-security/signing-in PIC Account Security page].
# Under the '''Two-factor authentication''' section, click the blue link on the right: '''"Set up Authenticator application"'''.
# ''If prompted to re-authenticate, enter your password and current mobile OTP code.''
# A new QR code will appear on your screen.
# '''Scan the code or enter the secret key:'''
#* '''Using the extension:''' Click the extension icon in your toolbar, select the '''Scan QR code''' option (the square camera graphic at the top right), and drag a box over the QR code on the screen.
#* '''Using a second phone:''' Open your authenticator app and scan the QR code normally.
#* '''Fallback:''' If you cannot scan the QR code, click '''"Unable to scan?"''' to reveal the plain-text secret key, which you can copy and paste into your app manually.
#:[[File:OTp-with-extension.png|none|500px|Scanning the QR Code with the Browser Extension]]
# '''Finalize registration:''' The app/extension will start generating 6-digit codes. On the Keycloak page, enter the current 6-digit code and provide a '''Device Name''' (e.g., ''Work Laptop'' or ''Browser Extension''), then click '''Submit'''.
# '''Logging in:''' From now on, when you log in, Keycloak will display a list of your registered devices. You can choose whichever device is closest at hand to provide the code.

<blockquote>'''Note on sharing a single QR code:''' You ''can'' scan the exact same QR code onto both your phone and extension simultaneously during a fresh setup. However, once registration is complete, Keycloak will never show that specific QR code again. If you want to add a new device later, you must follow the steps above to generate a new, separate device profile.</blockquote>

----

=== Managing and Deleting Devices ===

==== 1. If you remove an old device from Keycloak ====

If you click '''Delete''' next to an old device on your PIC security page, please note that '''Keycloak cannot reach into your physical device to delete the profile.'''

* '''Action Required:''' You must '''manually delete''' the corresponding account from your mobile app or browser extension immediately.
* '''Why?''' If you don't, your app will keep generating "ghost" codes. If you register a new device later, you will end up with multiple entries named "PIC" in your app, leading to confusion and "Invalid code" errors.

==== 2. If you delete ALL your devices from Keycloak ====

If you decide to start fresh and delete every single device listed on your account security page, Keycloak will clear your OTP status. The very next time you attempt to log into any PIC service, Keycloak will automatically block the login and prompt you to set up a brand-new OTP device from scratch.

== What is the simplest way to avoid repeated SSH authentication? ==
The easiest way is to configure your SSH connection using '''ControlMaster''', which allows multiple sessions to reuse a single authenticated connection.

On your client machine, edit the file <code>~/.ssh/config</code> and add the following lines:
<pre>
Host *
ControlMaster auto
ControlPath ~/.ssh/cm-%r@%h:%p
ControlPersist yes
</pre>

Instead of <code>Host *</code>, you can restrict this to a specific host, for example:

<pre>
Host ui04.pic.es
</pre>

Initiate the first SSH connection and authenticate via the provided URL. You will see something like:

<pre>
$ ssh ui04.pic.es
(tallada@ui04.pic.es) Authenticate at https://idp.pic.es/realms/PIC/device?user_code=FPTB-HKEV and press ENTER.
</pre>

Complete the authentication in your browser, then press ENTER.
Once authenticated, the SSH connection remains open in the background, and you can safely close your terminal session.
The connection will persist indefinitely (until machine reboot or a network interruption).

Subsequent SSH connections to the same host will reuse the existing session and will not require authentication again:

<pre>
$ ssh ui04.pic.es
Last login: Tue Apr 14 13:25:33 2026 from 10.212.134.205
[tallada@ui04 ~]$
</pre>
</li>
</ol>
== How can I use SFTP from the GNOME Files application? ==

When connecting to PIC systems using SFTP with the GNOME Files application (Nautilus) it is required to use a GVFS-compatible SSH control socket and a manual mount of the remote filesystem.

First, start a persistent SSH control master session:

<pre>
ssh -fNMS "$XDG_RUNTIME_DIR/gvfsd-sftp/%C" user@ui04.pic.es
</pre>

This step establishes an authenticated SSH session that GNOME Files can reuse.

Then mount the remote filesystem using GVFS:

<pre>
gio mount sftp://user@ui04.pic.es
</pre>

After this, the remote filesystem should appear in the GNOME Files application and can be accessed directly. For example:

<pre>
sftp://user@ui04.pic.es/nfs/pic.es/user/u/user
</pre>

This workaround is required because GNOME Files does not directly support interactive browser-based authentication flows for SFTP connections.

=== Reference ===

For additional context and troubleshooting discussion, see:
https://superuser.com/questions/1781804/ubuntu-nautilus-sftp-to-server-that-has-2fa-on-is-not-working

File:OTp-with-extension.png

2026-06-26T15:36:52Z

Msantama:

Faq

2026-04-27T11:16:02Z

Msantama:

Lost OTP

2026-04-13T08:49:55Z

Msantama: Created page with "<span id="otp-recovery-guide-lost-otp-device"></span> = OTP Recovery Guide (Lost OTP Device) = If you lose access to your OTP device, follow these steps to recover your accou..."

<span id="otp-recovery-guide-lost-otp-device"></span>
= OTP Recovery Guide (Lost OTP Device) =

If you lose access to your OTP device, follow these steps to recover your account and configure a new OTP method.

# On the Keycloak login page, click '''Forgot password / OTP'''.
# Enter your username. You should receive a recovery email in your inbox.
# Open the email and follow the recovery link.
# Scan the new QR code with your authenticator app.
# Enter the generated OTP code and a device name.
#* The device name is mandatory.
# Change your password when prompted.
#* This is required for security reasons.
# Log in again as usual.
#* On the OTP selection page, you will see two devices.
#* Select the device with the name you just entered.
#* The old one will usually appear as '''unnamed''' (if no name was set previously).

<span id="recommended-cleanup"></span>
== Recommended Cleanup ==

After logging in, go to:

https://idp.pic.es/realms/PIC/account/account-security/signing-in

Then delete the previous OTP device. If it had no custom name, it may appear as '''otp'''.

Main Page

2026-04-13T08:49:12Z

Msantama: /* Getting started */

== Getting started ==
* [[PIC description|Introduction to PIC]]
* [[PIC account|Get a PIC account]]
* [[Lost OTP|Reset your OTP]]
* [[PIC_User_Manual | User manual]]
* [[faq| Frequently asked questions]]

== Services ==
=== User interfaces ===
* [[Login machines]]
* [[JupyterHub]]

=== Distributed computing ===
* [[HTCondor]]
* [[Dask]]
* Spark:
** [[Spark on Jupyter|on Jupyter]]
** [[Spark_on_farm|on HTCondor]]

=== Storage ===
* [[Storage]]
* [[Hadoop Distributed File System (HDFS)]]
* [[HDFS Access via VOSpace]]
* [[Transferring data to/from PIC]]

=== Other services ===
* [[Gitlab]]
* [[CosmoHub]]

== Experiments ==

* [[Euclid]]
* [[AGN ICE]]
* [[ICFO]]

PIC account

2026-02-17T12:52:35Z

Msantama:

<span id="pic-quick-user-guide"></span>
= PIC — Quick user guide =

This short guide explains how to register, confirm your account, request access to a group, and what to do after access is granted.

Follow these steps if you are a PIC user and need access to resources managed through the account Experiments page.

<span id="create-your-pic-account"></span>
== 1) Create your PIC account ==

# Open the [https://idp.pic.es/realms/PIC/protocol/openid-connect/auth?client_id=register&scope=openid%20email%20profile&response_type=code&redirect_uri=https%3A%2F%2Fidp.pic.es%2Frealms%2FPIC%2Faccount%2Fexperiments&prompt=create PIC registration page].
# Fill the registration form with your name, a PIC-acceptable username (we recommend first letter of the name + surname truncated at 8 chars), and your email.
# Choose a password and submit the form.
# You will receive an email with a confirmation link — click the link to activate your account.

Notes:

* If you don’t receive the email, check your spam folder.
* Password rules are enforced; if the site rejects your password, follow the guidance on the form.
* If you have trouble with the registration form or email confirmation, contact the PIC administrators at [mailto:user-support@pic.es user-support@pic.es].

[[File:Registration_form.png|500px|left]]

<div style="clear: both"></div>

<span id="log-in-and-open-account-experiments"></span>
== 2) Log in and open Account → Experiments ==

# Log in to PIC with your new account.
# Go to <code>Account</code> and open the <code>Experiments</code> page (if you used the registration link you should already be there, otherwise [https://idp.pic.es/realms/PIC/account/experiments click here to open it]).

From there, you may find a list of projects you can validate your membership in. If you are a member of any project, just click the <code>Request Access</code> button to start the process.

[[File:Experiments_page.png|500px|left]]

<div style="clear: both"></div>

<span id="request-access-flows"></span>
== 3) Request access flows ==

Depending on the project/experiment you have selected, one of the following flows will be triggered:

<ol style="list-style-type: upper-alpha;">
<li><p>If that project has a configured IDP with us, you will be asked to log in. For example, if your are coming from a university, you may be asked to log in with your university credentials. After successful login, you will be linked to the project and granted access to the corresponding resources.</p></li>
<li><p>If your project does not have a configured Identity Provider (IDP), your access request must come from a sponsor. A sponsor is the person who directed you to register at PIC and request access to a specific project (e.g., a project lead, thesis advisor, or teacher). When you request access, you may be prompted to either select a sponsor from a pre-configured list or manually provide their full name and email address.</p></li></ol>

* If your sponsor is in the pre-configured list, you can select them directly and submit the request.
* If your sponsor is not in the list, you can enter their name and email.

[[File:Sponsor_input.png|500px|left]]

<div style="clear: both"></div>

[[File:Sponsor_modal.png|500px|left]]

<div style="clear: both"></div>

<span id="after-access-is-granted-try-services"></span>
== 4) After access is granted — try services ==

Disclaimer: Rigth after access is granted some services may still be unavailable for a few minutes while background scripts run and permissions are fully applied. If you encounter issues, wait a few minutes and retry before contacting support.

Once the contact or IDP approval is completed and you are a member of the group:

* You should be able to access group-only web UIs and services.
* You may be able to SSH to service UIs or jump hosts the PIC team provides (follow PIC-specific SSH instructions).
* You can open Jupyter (or other service UIs) and run notebooks or jobs according to the permissions granted by your group.

<span id="lost-membership-due-to-inactivity-or-offboarding"></span>
== 5) Lost membership due to inactivity or offboarding ==
[[File:Lost Membership.png|500px|left]]
<div style="clear: both"></div>

For IDP groups we periodically (or on login) verify your membership in the external IDP project.

* If you are no longer a member (inactivity / removal) you will be offboarded and shown a message at login. You can then re-request access via the Experiments page.
* If you encounter issues re-requesting, contact the administrators.

<span id="grace-period-only-for-idps-that-do-not-grant-offline-access"></span>
=== Grace period (only for IDPs that DO NOT grant offline access) ===

Some external IDPs do not allow us to request offline tokens. In that case your group may define a <code>gracePeriodDays</code> value.

What this means for you:

# At the end of each grace period window your membership will be removed automatically and the IDP link will be cleared. You must log back into the external institution to regain membership.
# During the grace period, if your institution grants you new privileges (e.g. access to new data) and you do not see them reflected in PIC, you can force a refresh by UNLINKING and re-linking the IDP account:
#* Go to: Account → Account Security → [https://idp.pic.es/realms/PIC/account/account-security/linked-accounts Linked Accounts]
#* Click <code>Unlink</code> for the external IDP.
#* Confirm (ask the contact if unsure), then link again via the Experiments page or the linking button.
#* After re-linking, new privileges should appear (may take a short delay of a few minutes).

If in doubt before unlinking, ask the group’s contact person. Unlinking does not delete your PIC account but it can make you temporarily lose access to some services.

<span id="troubleshooting-common-issues"></span>
== Troubleshooting & common issues ==

* I didn’t get the confirmation email: check spam, then contact admins.
* The Experiments page shows no groups: ask your admin if your account has correct attributes or if the group exists.
* I requested access but nothing happened: contact the group’s contact person or the admin team; provide the request time and the group name.

– End of guide –

PIC account

2026-02-17T12:45:08Z

Msantama:

<span id="pic-quick-user-guide"></span>
= PIC — Quick user guide =

This short guide explains how to register, confirm your account, request access to a group, and what to do after access is granted.

Follow these steps if you are a PIC user and need access to resources managed through the account Experiments page.

<span id="create-your-pic-account"></span>
== 1) Create your PIC account ==

# Open the PIC registration page https://idp.pic.es/realms/PIC/protocol/openid-connect/auth?client_id=register&scope=openid%20email%20profile&response_type=code&redirect_uri=https%3A%2F%2Fidp.pic.es%2Frealms%2FPIC%2Faccount%2Fexperiments&prompt=create .
# Fill the registration form with your name, a PIC-acceptable username (we recommend first letter of the name + surname truncated at 8 chars), and your email.
# Choose a password and submit the form.
# You will receive an email with a confirmation link — click the link to activate your account.

Notes:

* If you don’t receive the email, check your spam folder.
* Password rules are enforced; if the site rejects your password, follow the guidance on the form.
* If you have trouble with the registration form or email confirmation, contact the PIC administrators (user-support@pic.es).

[[File:Registration_form.png|500px|left]]

<div style="clear: both"></div>

<span id="log-in-and-open-account-experiments"></span>
== 2) Log in and open Account → Experiments ==

# Log in to PIC with your new account.
# Go to <code>Account</code> and open the <code>Experiments</code> page (if you used the registration link you should already be there, else click https://idp.pic.es/realms/PIC/account/experiments).

From there, you may find a list of projects you can validate your membership in. If you are a member of any project, just click the <code>Request Access</code> button to start the process.

[[File:Experiments_page.png|500px|left]]

<div style="clear: both"></div>

<span id="request-access-flows"></span>
== 3) Request access flows ==

Depending on the project/experiment you have selected, one of the following flows will be triggered:

<ol style="list-style-type: upper-alpha;">
<li><p>If that project has a configured IDP with us, you will be asked to log in. For example, if your are coming from a university, you may be asked to log in with your university credentials. After successful login, you will be linked to the project and granted access to the corresponding resources.</p></li>
<li><p>If your project does not have a configured Identity Provider (IDP), your access request must come from a sponsor. A sponsor is the person who directed you to register at PIC and request access to a specific project (e.g., a project lead, thesis advisor, or teacher). When you request access, you may be prompted to either select a sponsor from a pre-configured list or manually provide their full name and email address.</p></li></ol>

* If your sponsor is in the pre-configured list, you can select them directly and submit the request.
* If your sponsor is not in the list, you can enter their name and email.

[[File:Sponsor_input.png|500px|left]]

<div style="clear: both"></div>

[[File:Sponsor_modal.png|500px|left]]

<div style="clear: both"></div>

<span id="after-access-is-granted-try-services"></span>
== 4) After access is granted — try services ==

Disclaimer: Rigth after access is granted some services may still be unavailable for a few minutes while background scripts run and permissions are fully applied. If you encounter issues, wait a few minutes and retry before contacting support.

Once the contact or IDP approval is completed and you are a member of the group:

* You should be able to access group-only web UIs and services.
* You may be able to SSH to service UIs or jump hosts the PIC team provides (follow PIC-specific SSH instructions).
* You can open Jupyter (or other service UIs) and run notebooks or jobs according to the permissions granted by your group.

<span id="lost-membership-due-to-inactivity-or-offboarding"></span>
== 5) Lost membership due to inactivity or offboarding ==
[[File:Lost Membership.png|500px|left]]
<div style="clear: both"></div>

For IDP groups we periodically (or on login) verify your membership in the external IDP project.

* If you are no longer a member (inactivity / removal) you will be offboarded and shown a message at login. You can then re-request access via the Experiments page.
* If you encounter issues re-requesting, contact the administrators.

<span id="grace-period-only-for-idps-that-do-not-grant-offline-access"></span>
=== Grace period (only for IDPs that DO NOT grant offline access) ===

Some external IDPs do not allow us to request offline tokens. In that case your group may define a <code>gracePeriodDays</code> value.

What this means for you:

# At the end of each grace period window your membership will be removed automatically and the IDP link will be cleared. You must log back into the external institution to regain membership.
# During the grace period, if your institution grants you new privileges (e.g. access to new data) and you do not see them reflected in PIC, you can force a refresh by UNLINKING and re-linking the IDP account:
#* Go to: Account → Account Security → Linked Accounts (Example URL: <code>https://idp.pic.es/realms/PIC/account/account-security/linked-accounts</code>)
#* Click <code>Unlink</code> for the external IDP.
#* Confirm (ask the contact if unsure), then link again via the Experiments page or the linking button.
#* After re-linking, new privileges should appear (may take a short delay of a few minutes).

If in doubt before unlinking, ask the group’s contact person. Unlinking does not delete your PIC account but it can make you temporarily lose access to some services.

<span id="troubleshooting-common-issues"></span>
== Troubleshooting & common issues ==

* I didn’t get the confirmation email: check spam, then contact admins.
* The Experiments page shows no groups: ask your admin if your account has correct attributes or if the group exists.
* I requested access but nothing happened: contact the group’s contact person or the admin team; provide the request time and the group name.

– End of guide –

File:Registration form.png

2026-02-17T12:34:04Z

Msantama: A registration form example

== Summary ==
A registration form example

File:Experiments page.png

2026-02-17T12:33:27Z

Msantama: The look of the experiments page in the account

== Summary ==
The look of the experiments page in the account

File:Sponsor input.png

2026-02-17T12:32:43Z

Msantama: The sponsor input field from the account

== Summary ==
The sponsor input field from the account

File:Sponsor modal.png

2026-02-17T12:32:06Z

Msantama: The sponsor modal of the account

== Summary ==
The sponsor modal of the account

PIC account

2026-02-17T12:28:33Z

Msantama:

<span id="pic-quick-user-guide"></span>
= PIC — Quick user guide =

This short guide explains how to register, confirm your account, request access to a group, and what to do after access is granted.

Follow these steps if you are a PIC user and need access to resources managed through the account Experiments page.

<span id="create-your-pic-account"></span>
== 1) Create your PIC account ==

# Open the PIC registration page https://idp.pic.es/realms/PIC/protocol/openid-connect/auth?client_id=register&scope=openid%20email%20profile&response_type=code&redirect_uri=https%3A%2F%2Fidp.pic.es%2Frealms%2FPIC%2Faccount%2Fexperiments&prompt=create .
# Fill the registration form with your name, a PIC-acceptable username (we recommend first letter of the name + surname truncated at 8 chars), and your email.
# Choose a password and submit the form.
# You will receive an email with a confirmation link — click the link to activate your account.

Notes:

* If you don’t receive the email, check your spam folder.
* Password rules are enforced; if the site rejects your password, follow the guidance on the form.
* If you have trouble with the registration form or email confirmation, contact the PIC administrators (user-support@pic.es).

<span id="log-in-and-open-account-experiments"></span>
== 2) Log in and open Account → Experiments ==

# Log in to PIC with your new account.
# Go to <code>Account</code> and open the <code>Experiments</code> page (if you used the registration link you should already be there, else click https://idp.pic.es/realms/PIC/account/experiments).

From there, you may find a list of projects you can validate your membership in. If you are a member of any project, just click the <code>Request Access</code> button to start the process.

<span id="request-access-flows"></span>
== 3) Request access flows ==

Depending on the project/experiment you have selected, one of the following flows will be triggered:

<ol style="list-style-type: upper-alpha;">
<li><p>If that project has a configured IDP with us, you will be asked to log in. For example, if your are coming from a university, you may be asked to log in with your university credentials. After successful login, you will be linked to the project and granted access to the corresponding resources.</p></li>
<li><p>If your project does not have a configured Identity Provider (IDP), your access request must come from a sponsor. A sponsor is the person who directed you to register at PIC and request access to a specific project (e.g., a project lead, thesis advisor, or teacher). When you request access, you may be prompted to either select a sponsor from a pre-configured list or manually provide their full name and email address.</p></li></ol>

* If your sponsor is in the pre-configured list, you can select them directly and submit the request.
* If your sponsor is not in the list, you can enter their name and email.

<span id="after-access-is-granted-try-services"></span>
== 4) After access is granted — try services ==

Disclaimer: Rigth after access is granted some services may still be unavailable for a few minutes while background scripts run and permissions are fully applied. If you encounter issues, wait a few minutes and retry before contacting support.

Once the contact or IDP approval is completed and you are a member of the group:

* You should be able to access group-only web UIs and services.
* You may be able to SSH to service UIs or jump hosts the PIC team provides (follow PIC-specific SSH instructions).
* You can open Jupyter (or other service UIs) and run notebooks or jobs according to the permissions granted by your group.

<span id="lost-membership-due-to-inactivity-or-offboarding"></span>
== 5) Lost membership due to inactivity or offboarding ==
[[File:Lost Membership.png|500px|left]]
<div style="clear: both"></div>

For IDP groups we periodically (or on login) verify your membership in the external IDP project.

* If you are no longer a member (inactivity / removal) you will be offboarded and shown a message at login. You can then re-request access via the Experiments page.
* If you encounter issues re-requesting, contact the administrators.

<span id="grace-period-only-for-idps-that-do-not-grant-offline-access"></span>
=== Grace period (only for IDPs that DO NOT grant offline access) ===

Some external IDPs do not allow us to request offline tokens. In that case your group may define a <code>gracePeriodDays</code> value.

What this means for you:

# At the end of each grace period window your membership will be removed automatically and the IDP link will be cleared. You must log back into the external institution to regain membership.
# During the grace period, if your institution grants you new privileges (e.g. access to new data) and you do not see them reflected in PIC, you can force a refresh by UNLINKING and re-linking the IDP account:
#* Go to: Account → Account Security → Linked Accounts (Example URL: <code>https://idp.pic.es/realms/PIC/account/account-security/linked-accounts</code>)
#* Click <code>Unlink</code> for the external IDP.
#* Confirm (ask the contact if unsure), then link again via the Experiments page or the linking button.
#* After re-linking, new privileges should appear (may take a short delay of a few minutes).

If in doubt before unlinking, ask the group’s contact person. Unlinking does not delete your PIC account but it can make you temporarily lose access to some services.

<span id="troubleshooting-common-issues"></span>
== Troubleshooting & common issues ==

* I didn’t get the confirmation email: check spam, then contact admins.
* The Experiments page shows no groups: ask your admin if your account has correct attributes or if the group exists.
* I requested access but nothing happened: contact the group’s contact person or the admin team; provide the request time and the group name.

– End of guide –

PIC account

2025-11-14T12:12:01Z

Msantama:

<span id="pic-quick-user-guide"></span>
= PIC — Quick user guide =

This short guide explains how to register, confirm your account, request access to a group, and what to do after access is granted.

Follow these steps if you are a PIC user and need access to resources managed through the account Experiments page.

<span id="create-your-pic-account"></span>
== 1) Create your PIC account ==

# Open the PIC registration page (the site registration link provided by PIC).
# Fill the registration form with your name, a PIC-acceptable username (we recommend first letter of the name + surname truncated at 8 chars), and your email.
# Choose a password and submit the form.
# You will receive an email with a confirmation link — click the link to activate your account.

Notes:

* If you don’t receive the email, check your spam folder and then contact the administrators.
* Password rules are enforced by the realm; if the site rejects your password, follow the guidance on the form.

<span id="log-in-and-open-account-experiments"></span>
== 2) Log in and open Account → Experiments ==

# Log in to PIC with your new account.
# Go to <code>Account</code> and open the <code>Experiments</code> page (if you used the registration link you should already be there, else navigate to it).

What you can do here:

* Link external IDPs (if offered) for automatic group membership.
* Request access to groups that are managed manually (non-IDP groups).

<span id="request-access-to-a-group-manual-approval-flow"></span>
== 3) Request access to a group (manual approval flow) ==

# On the Experiments page, find the group you need and click <code>Request Access</code>.
# Either:
#* Select a configured sponsor for the group (if available), or
#* Enter sponsor name and email in the provided fields.
# Submit the request.

What happens next:

* If the group is backed by an external IDP, you may be asked to log in to that IDP (e.g., Google) to complete linking.
* If the group uses manual approval, a signed approval email will be sent to the group’s contact person(s) or the chosen sponsor.
* Until the request is approved, you can only use your account and public parts of services. Please do not send multiple requests for the same group while waiting for approval.

<span id="after-access-is-granted-try-services"></span>
== 4) After access is granted — try services ==

Once the contact or IDP approval is completed and you are a member of the group:

* You should be able to access group-only web UIs and services.
* You may be able to SSH to service UIs or jump hosts the PIC team provides (follow PIC-specific SSH instructions).
* You can open Jupyter (or other service UIs) and run notebooks or jobs according to the permissions granted by your group.

If a resource still seems unavailable after membership is granted, wait a few minutes (background scripts may run) and retry. If the problem persists, contact the administrators with:

* Your username
* The group name
* A short description of the problem

<span id="lost-membership-due-to-inactivity-or-offboarding"></span>
== 5) Lost membership due to inactivity or offboarding ==

For IDP groups we periodically (or on login) verify your membership in the external IDP project.

* If you are no longer a member (inactivity / removal) you will be offboarded and shown a message at login. You can then re-request access via the Experiments page.
* If you encounter issues re-requesting, contact the administrators.

<span id="grace-period-only-for-idps-that-do-not-grant-offline-access"></span>
=== Grace period (only for IDPs that DO NOT grant offline access) ===

Some external IDPs do not allow us to request offline tokens. In that case your group may define a <code>gracePeriodDays</code> value.

What this means for you:

# At the end of each grace period window your membership will be removed automatically and the IDP link will be cleared. You must log back into the external IDP (and if needed re-link or re-request access) to regain membership.
# During the grace period, if your institution grants you new privileges (e.g. access to new data) and you do not see them reflected in PIC, you can force a refresh by UNLINKING and re-linking the IDP account:
#* Go to: Account → Account Security → Linked Accounts (Example URL: <code>https://idp-test.pic.es/realms/PIC/account/account-security/linked-accounts</code>)
#* Click <code>Unlink</code> for the external IDP.
#* Confirm (ask the contact if unsure), then link again via the Experiments page or the linking button.
#* After re-linking, new privileges should appear (may take a short delay while scripts run).

If in doubt before unlinking, ask the group’s contact person. Unlinking does not delete your PIC account; it only removes the connection to that external project until you link again.

[[File:Lost Membership.png|500px|left]]

<div style="clear: both"></div>

<span id="troubleshooting-common-issues"></span>

<span id="troubleshooting-common-issues"></span>
== Troubleshooting & common issues ==

* I didn’t get the confirmation email: check spam, then contact admins.
* The Experiments page shows no groups: ask your admin if your account has correct attributes or if the group exists.
* I requested access but nothing happened: contact the group’s contact person or the admin team; provide the request time and the group name.

– End of guide –

PIC account

2025-11-05T14:53:59Z

Msantama: /* 1) Create your PIC account */

PIC account

2025-11-05T14:51:31Z

Msantama: /* 1) Create your PIC account */

PIC account

2025-11-05T11:02:03Z

Msantama:

PIC account

2025-11-05T10:57:52Z

Msantama: /* 5) Lost membership due to inactivity or offboarding */

PIC account

2025-11-05T10:57:33Z

Msantama: /* 5) Lost membership due to inactivity or offboarding */

PIC account

2025-11-05T10:57:18Z

Msantama: /* 5) Lost membership due to inactivity or offboarding */

PIC account

2025-11-05T10:55:12Z

Msantama: /* 5) Lost membership due to inactivity or offboarding */

File:Lost Membership.png

2025-11-05T10:53:53Z

Msantama:

PIC account

2025-11-05T09:35:27Z

Msantama: /* 3) Request access to a group (manual approval flow) */

PIC account

2025-11-05T09:20:01Z

Msantama: /* 1) Create your PIC account */

PIC account

2025-11-05T09:19:22Z

Msantama: /* 1) Create your PIC account */

PIC account

2025-11-04T16:33:54Z

Msantama: