Faq - Revision history

Msantama at 15:49, 26 June 2026

2026-06-26T15:49:47Z

Msantama at 11:16, 27 April 2026

2026-04-27T11:16:02Z

Tallada at 15:05, 15 April 2026

2026-04-15T15:05:17Z

Tallada at 14:09, 15 April 2026

2026-04-15T14:09:44Z

Tallada: /* What is the simplest way to avoid repeated SSH authentication? */

2026-04-15T13:57:45Z

What is the simplest way to avoid repeated SSH authentication?

Tallada: /* What is the simplest way to avoid repeated SSH authentication? */

2026-04-15T13:57:33Z

What is the simplest way to avoid repeated SSH authentication?

Tallada: /* What is the simplest way to avoid repeated SSH authentication? */

2026-04-15T13:57:07Z

What is the simplest way to avoid repeated SSH authentication?

Tallada at 13:55, 15 April 2026

2026-04-15T13:55:37Z

Tallada at 13:32, 15 April 2026

2026-04-15T13:32:08Z

Tallada at 13:24, 15 April 2026

2026-04-15T13:24:23Z

← Older revision		Revision as of 15:49, 26 June 2026
Line 47:		Line 47:

	Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].		Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].
		+
		+	== How can I manage my OTP devices or add a second one (like a browser extension)? ==
		+
		+	Our Keycloak system allows you to register multiple OTP devices simultaneously. This means you can add a browser extension on your computer as a secondary OTP option without breaking or removing your existing mobile phone setup.
		+
		+	For the browser extension, we recommend the open-source '''Authenticator''' (available for Chrome, Firefox, and Edge): [https://authenticator.cc/ Authenticator Extension Website].
		+
		+	=== Steps to add a browser extension (or another device) ===
		+
		+	# Install the '''Authenticator''' extension in your browser.
		+	# Go to your [https://idp.pic.es/realms/PIC/account/account-security/signing-in PIC Account Security page].
		+	# Under the '''Two-factor authentication''' section, click the blue link on the right: '''"Set up Authenticator application"'''.
		+	# ''If prompted to re-authenticate, enter your password and current mobile OTP code.''
		+	# A new QR code will appear on your screen.
		+	# '''Scan the code or enter the secret key:'''
		+	#* '''Using the extension:''' Click the extension icon in your toolbar, select the '''Scan QR code''' option (the square camera graphic at the top right), and drag a box over the QR code on the screen.
		+	#* '''Using a second phone:''' Open your authenticator app and scan the QR code normally.
		+	#* '''Fallback:''' If you cannot scan the QR code, click '''"Unable to scan?"''' to reveal the plain-text secret key, which you can copy and paste into your app manually.
		+	#:[[File:OTp-with-extension.png\|none\|500px\|Scanning the QR Code with the Browser Extension]]
		+	# '''Finalize registration:''' The app/extension will start generating 6-digit codes. On the Keycloak page, enter the current 6-digit code and provide a '''Device Name''' (e.g., ''Work Laptop'' or ''Browser Extension''), then click '''Submit'''.
		+	# '''Logging in:''' From now on, when you log in, Keycloak will display a list of your registered devices. You can choose whichever device is closest at hand to provide the code.
		+
		+	<blockquote>'''Note on sharing a single QR code:''' You ''can'' scan the exact same QR code onto both your phone and extension simultaneously during a fresh setup. However, once registration is complete, Keycloak will never show that specific QR code again. If you want to add a new device later, you must follow the steps above to generate a new, separate device profile.</blockquote>
		+
		+	----
		+
		+	=== Managing and Deleting Devices ===
		+
		+	==== 1. If you remove an old device from Keycloak ====
		+
		+	If you click '''Delete''' next to an old device on your PIC security page, please note that '''Keycloak cannot reach into your physical device to delete the profile.'''
		+
		+	* '''Action Required:''' You must '''manually delete''' the corresponding account from your mobile app or browser extension immediately.
		+	* '''Why?''' If you don't, your app will keep generating "ghost" codes. If you register a new device later, you will end up with multiple entries named "PIC" in your app, leading to confusion and "Invalid code" errors.
		+
		+	==== 2. If you delete ALL your devices from Keycloak ====
		+
		+	If you decide to start fresh and delete every single device listed on your account security page, Keycloak will clear your OTP status. The very next time you attempt to log into any PIC service, Keycloak will automatically block the login and prompt you to set up a brand-new OTP device from scratch.

	== What is the simplest way to avoid repeated SSH authentication? ==		== What is the simplest way to avoid repeated SSH authentication? ==

← Older revision		Revision as of 11:16, 27 April 2026
Line 85:		Line 85:
	</li>		</li>
	</ol>		</ol>
		+	== How can I use SFTP from the GNOME Files application? ==
		+
		+	When connecting to PIC systems using SFTP with the GNOME Files application (Nautilus) it is required to use a GVFS-compatible SSH control socket and a manual mount of the remote filesystem.
		+
		+	First, start a persistent SSH control master session:
		+
		+	<pre>
		+	ssh -fNMS "$XDG_RUNTIME_DIR/gvfsd-sftp/%C" user@ui04.pic.es
		+	</pre>
		+
		+	This step establishes an authenticated SSH session that GNOME Files can reuse.
		+
		+	Then mount the remote filesystem using GVFS:
		+
		+	<pre>
		+	gio mount sftp://user@ui04.pic.es
		+	</pre>
		+
		+	After this, the remote filesystem should appear in the GNOME Files application and can be accessed directly. For example:
		+
		+	<pre>
		+	sftp://user@ui04.pic.es/nfs/pic.es/user/u/user
		+	</pre>
		+
		+	This workaround is required because GNOME Files does not directly support interactive browser-based authentication flows for SFTP connections.
		+
		+	=== Reference ===
		+
		+	For additional context and troubleshooting discussion, see:
		+	https://superuser.com/questions/1781804/ubuntu-nautilus-sftp-to-server-that-has-2fa-on-is-not-working

@@ Line 48: / Line 48: @@
 Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].
-=== What is the simplest way to avoid repeated SSH authentication? ===
+== What is the simplest way to avoid repeated SSH authentication? ==
 The easiest way is to configure your SSH connection using '''ControlMaster''', which allows multiple sessions to reuse a single authenticated connection.

@@ Line 33: / Line 33: @@
 Follow these steps to recover your account and configure a new OTP token.
-# On the Keycloak login page, click '''Forgot password / OTP'''.
+# On the login page, click '''Forgot password / OTP''' or go [https://www.pic.es/reset here].
 # Enter your username. You should receive a recovery email in your inbox.
 # Open the email and follow the recovery link.

@@ Line 64: / Line 64: @@
 Host ui04.pic.es
 </pre>
 Initiate the first SSH connection and authenticate via the provided URL. You will see something like:

@@ Line 66: / Line 66: @@
-Initiate the first SSH connection and authenticate via the provided URL:
+Initiate the first SSH connection and authenticate via the provided URL. You will see something like:
 <pre>
 $ ssh ui04.pic.es
 (tallada@ui04.pic.es) Authenticate at https://idp.pic.es/realms/PIC/device?user_code=FPTB-HKEV and press ENTER.
 </pre>

@@ Line 51: / Line 51: @@
 The easiest way is to configure your SSH connection using '''ControlMaster''', which allows multiple sessions to reuse a single authenticated connection.
-<ol>
+On your client machine, edit the file <code>~/.ssh/config</code> and add the following lines:
 <pre>
 Host *
@@ Line 65: / Line 64: @@
 Host ui04.pic.es
 </pre>
-<li>Initiate the first SSH connection and authenticate via the provided URL:
 <pre>
@@ Line 80: / Line 79: @@
 Complete the authentication in your browser, then press ENTER.
-</li>
+Once authenticated, the SSH connection remains open in the background, and you can safely close your terminal session.
 The connection will persist indefinitely (until machine reboot or a network interruption).
-<li>Subsequent SSH connections to the same host will reuse the existing session and will not require authentication again:
+Subsequent SSH connections to the same host will reuse the existing session and will not require authentication again:
 <pre>
 $ ssh ui04.pic.es
 </pre>
 </li>
 </ol>

← Older revision		Revision as of 13:55, 15 April 2026
Line 47:		Line 47:

	Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].		Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].
		+
		+	=== What is the simplest way to avoid repeated SSH authentication? ===
		+	The easiest way is to configure your SSH connection using '''ControlMaster''', which allows multiple sessions to reuse a single authenticated connection.
		+
		+	<ol>
		+	<li>On your client machine, edit the file <code>~/.ssh/config</code> and add the following lines:
		+	<pre>
		+	Host *
		+	ControlMaster auto
		+	ControlPath ~/.ssh/cm-%r@%h:%p
		+	ControlPersist yes
		+	</pre>
		+
		+	Instead of <code>Host *</code>, you can restrict this to a specific host, for example:
		+
		+	<pre>
		+	Host ui04.pic.es
		+	</pre>
		+	</li>
		+
		+	<li>Initiate the first SSH connection and authenticate via the provided URL:
		+
		+	<pre>
		+	$ ssh ui04.pic.es
		+	</pre>
		+
		+	You will see something like:
		+
		+	<pre>
		+	(tallada@ui04.pic.es) Authenticate at https://idp.pic.es/realms/PIC/device?user_code=FPTB-HKEV and press ENTER.
		+	</pre>
		+
		+	Complete the authentication in your browser, then press ENTER.
		+	</li>
		+
		+	<li>Once authenticated, the SSH connection remains open in the background, and you can safely close your terminal session.
		+
		+	The connection will persist indefinitely (until machine reboot or a network interruption).
		+	</li>
		+
		+	<li>Subsequent SSH connections to the same host will reuse the existing session and will not require authentication again:
		+
		+	<pre>
		+	$ ssh ui04.pic.es
		+	</pre>
		+	</li>
		+	</ol>

← Older revision		Revision as of 13:32, 15 April 2026
Line 29:		Line 29:
	klist		klist
	</pre>		</pre>
		+
		+	== I lost access to my OTP, how can I reset it? ==
		+	Follow these steps to recover your account and configure a new OTP token.
		+
		+	# On the Keycloak login page, click '''Forgot password / OTP'''.
		+	# Enter your username. You should receive a recovery email in your inbox.
		+	# Open the email and follow the recovery link.
		+	# Scan the new QR code with your authenticator app.
		+	# Enter the generated OTP code and a device name.
		+	#* The device name is mandatory.
		+	# Change your password when prompted.
		+	#* This is required for security reasons.
		+	# Log in again as usual.
		+	#* On the OTP selection page, you will see two devices.
		+	#* Select the device with the name you just entered.
		+	#* The old one will usually appear as '''unnamed''' (if no name was set previously).
		+
		+	Afterwards, we recommend removing the old OTP factor from the [https://idp.pic.es/realms/PIC/account/account-security/signing-in user profile section].

← Older revision		Revision as of 13:24, 15 April 2026
Line 5:		Line 5:
	== Can an undergraduate student in my group have an account? ==		== Can an undergraduate student in my group have an account? ==
	Yes. Undergraduate students can have PIC accounts without any problem.		Yes. Undergraduate students can have PIC accounts without any problem.
		+
		+	== How do I get a Kerberos token? ==
		+	A valid token is needed to interface with some PIC services, like the Hadoop platform (HDFS, Hive, Spark, ...) or CTA.
		+	Tokens are issued for the machine in which they are requested, if you hop to another machine, you may need to get another token.
		+
		+	In order to get a token, run the following commands on a terminal.
		+	If you are on JupyterLab, use ''Launcher'' → ''Terminal''.
		+
		+	<pre>
		+	kinit -n -c ~/.fast.ccache @PIC.ES
		+	kinit -T ~/.fast.ccache
		+	</pre>
		+
		+	You could also define an alias for your own convenience:
		+
		+	<pre>
		+	alias kinit="kinit -n -c ~/.fast.ccache @PIC.ES; kinit -T ~/.fast.ccache"
		+	</pre>
		+
		+	Optionally, you can check the presence and expiration date of your token using:
		+
		+	<pre>
		+	klist
		+	</pre>