Faq

From Public PIC Wiki
Revision as of 15:49, 26 June 2026 by Msantama (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

How do I reset my password?

You can reset your password using the following link: https://www.pic.es/user/auth/forgotpw

Can an undergraduate student in my group have an account?

Yes. Undergraduate students can have PIC accounts without any problem.

How do I get a Kerberos token?

A valid token is needed to interface with some PIC services, like the Hadoop platform (HDFS, Hive, Spark, ...) or CTA. Tokens are issued for the machine in which they are requested, if you hop to another machine, you may need to get another token.

In order to get a token, run the following commands on a terminal. If you are on JupyterLab, use Launcher → Terminal. 

kinit -n -c ~/.fast.ccache @PIC.ES
kinit -T ~/.fast.ccache

You could also define an alias for your own convenience: 

alias kinit="kinit -n -c ~/.fast.ccache @PIC.ES; kinit -T ~/.fast.ccache"

Optionally, you can check the presence and expiration date of your token using: 

klist

I lost access to my OTP, how can I reset it?

Follow these steps to recover your account and configure a new OTP token.

  1. On the login page, click Forgot password / OTP or go here.
  2. Enter your username. You should receive a recovery email in your inbox.
  3. Open the email and follow the recovery link.
  4. Scan the new QR code with your authenticator app.
  5. Enter the generated OTP code and a device name.
    • The device name is mandatory.
  6. Change your password when prompted.
    • This is required for security reasons.
  7. Log in again as usual.
    • On the OTP selection page, you will see two devices.
    • Select the device with the name you just entered.
    • The old one will usually appear as unnamed (if no name was set previously).

Afterwards, we recommend removing the old OTP factor from the user profile section.

How can I manage my OTP devices or add a second one (like a browser extension)?

Our Keycloak system allows you to register multiple OTP devices simultaneously. This means you can add a browser extension on your computer as a secondary OTP option without breaking or removing your existing mobile phone setup.

For the browser extension, we recommend the open-source Authenticator (available for Chrome, Firefox, and Edge): Authenticator Extension Website.

Steps to add a browser extension (or another device)

  1. Install the Authenticator extension in your browser.
  2. Go to your PIC Account Security page.
  3. Under the Two-factor authentication section, click the blue link on the right: "Set up Authenticator application".
  4. If prompted to re-authenticate, enter your password and current mobile OTP code.
  5. A new QR code will appear on your screen.
  6. Scan the code or enter the secret key:
    • Using the extension: Click the extension icon in your toolbar, select the Scan QR code option (the square camera graphic at the top right), and drag a box over the QR code on the screen.
    • Using a second phone: Open your authenticator app and scan the QR code normally.
    • Fallback: If you cannot scan the QR code, click "Unable to scan?" to reveal the plain-text secret key, which you can copy and paste into your app manually.
    Scanning the QR Code with the Browser Extension
  7. Finalize registration: The app/extension will start generating 6-digit codes. On the Keycloak page, enter the current 6-digit code and provide a Device Name (e.g., Work Laptop or Browser Extension), then click Submit.
  8. Logging in: From now on, when you log in, Keycloak will display a list of your registered devices. You can choose whichever device is closest at hand to provide the code.

Note on sharing a single QR code: You can scan the exact same QR code onto both your phone and extension simultaneously during a fresh setup. However, once registration is complete, Keycloak will never show that specific QR code again. If you want to add a new device later, you must follow the steps above to generate a new, separate device profile.

Managing and Deleting Devices

1. If you remove an old device from Keycloak

If you click Delete next to an old device on your PIC security page, please note that Keycloak cannot reach into your physical device to delete the profile.

  • Action Required: You must manually delete the corresponding account from your mobile app or browser extension immediately.
  • Why? If you don't, your app will keep generating "ghost" codes. If you register a new device later, you will end up with multiple entries named "PIC" in your app, leading to confusion and "Invalid code" errors.

2. If you delete ALL your devices from Keycloak

If you decide to start fresh and delete every single device listed on your account security page, Keycloak will clear your OTP status. The very next time you attempt to log into any PIC service, Keycloak will automatically block the login and prompt you to set up a brand-new OTP device from scratch.

What is the simplest way to avoid repeated SSH authentication?

The easiest way is to configure your SSH connection using ControlMaster, which allows multiple sessions to reuse a single authenticated connection.

On your client machine, edit the file ~/.ssh/config and add the following lines: 

Host *
    ControlMaster auto
    ControlPath ~/.ssh/cm-%r@%h:%p
    ControlPersist yes

Instead of Host *, you can restrict this to a specific host, for example: 

Host ui04.pic.es

Initiate the first SSH connection and authenticate via the provided URL. You will see something like: 

$ ssh ui04.pic.es
(tallada@ui04.pic.es) Authenticate at https://idp.pic.es/realms/PIC/device?user_code=FPTB-HKEV and press ENTER.

Complete the authentication in your browser, then press ENTER. Once authenticated, the SSH connection remains open in the background, and you can safely close your terminal session. The connection will persist indefinitely (until machine reboot or a network interruption).

Subsequent SSH connections to the same host will reuse the existing session and will not require authentication again: 

$ ssh ui04.pic.es
Last login: Tue Apr 14 13:25:33 2026 from 10.212.134.205
[tallada@ui04 ~]$

How can I use SFTP from the GNOME Files application?

When connecting to PIC systems using SFTP with the GNOME Files application (Nautilus) it is required to use a GVFS-compatible SSH control socket and a manual mount of the remote filesystem.

First, start a persistent SSH control master session: 

ssh -fNMS "$XDG_RUNTIME_DIR/gvfsd-sftp/%C" user@ui04.pic.es

This step establishes an authenticated SSH session that GNOME Files can reuse.

Then mount the remote filesystem using GVFS: 

gio mount sftp://user@ui04.pic.es

After this, the remote filesystem should appear in the GNOME Files application and can be accessed directly. For example: 

sftp://user@ui04.pic.es/nfs/pic.es/user/u/user

This workaround is required because GNOME Files does not directly support interactive browser-based authentication flows for SFTP connections.

Reference

For additional context and troubleshooting discussion, see: https://superuser.com/questions/1781804/ubuntu-nautilus-sftp-to-server-that-has-2fa-on-is-not-working

Retrieved from "http://pwiki.pic.es/index.php?title=Faq&oldid=1373"