From 335a9fb2dfb67605ffd69a5017107d71534f872a Mon Sep 17 00:00:00 2001
From: Dominik Bartkiewicz <bart@schedmd.com>
Date: Wed, 4 May 2022 13:06:36 -0600
Subject: [PATCH 01/34] Prevent credential abuse.

CVE-2022-29500
---
 NEWS                                          |   1 +
 src/api/config_info.c                         |   1 +
 src/api/job_info.c                            |   2 +
 src/api/job_step_info.c                       |   2 +
 src/api/node_info.c                           |   1 +
 src/api/pmi_server.c                          |   1 +
 src/api/reconfigure.c                         |   1 +
 src/api/signal.c                              |   3 +
 src/api/slurm_pmi.c                           |   3 +
 src/api/step_launch.c                         |   2 +
 src/bcast/file_bcast.c                        |   1 +
 src/common/forward.c                          |   5 +-
 src/common/slurm_auth.c                       |  34 ++-
 src/common/slurm_auth.h                       |  16 +-
 src/common/slurm_persist_conn.c               |   1 +
 src/common/slurm_persist_conn.h               |   1 +
 src/common/slurm_protocol_api.c               | 224 +++++++++++++++++-
 src/common/slurm_protocol_api.h               |   3 +
 src/common/slurm_protocol_defs.c              |   4 +
 src/common/slurm_protocol_defs.h              |  14 ++
 src/common/slurmdb_defs.c                     |   1 +
 src/common/slurmdbd_defs.c                    |   1 +
 src/common/stepd_api.c                        |   3 +-
 src/common/stepd_api.h                        |   3 +-
 .../accounting_storage/common/common_as.c     |   1 +
 src/plugins/auth/munge/auth_munge.c           |  64 +++--
 src/plugins/auth/none/auth_none.c             |  17 +-
 src/plugins/mpi/pmi2/setup.c                  |   1 +
 src/plugins/mpi/pmi2/setup.h                  |   1 +
 src/plugins/mpi/pmi2/spawn.c                  |   3 +-
 src/plugins/mpi/pmix/pmixp_utils.c            |   1 +
 src/sattach/sattach.c                         |   1 +
 src/slurmctld/agent.c                         |  19 ++
 src/slurmctld/agent.h                         |   4 +
 src/slurmctld/backup.c                        |   9 +-
 src/slurmctld/controller.c                    |   1 +
 src/slurmctld/fed_mgr.c                       |   2 +
 src/slurmctld/job_mgr.c                       |  12 +-
 src/slurmctld/job_scheduler.c                 |   2 +
 src/slurmctld/node_mgr.c                      |   2 +-
 src/slurmctld/node_scheduler.c                |   3 +
 src/slurmctld/ping_nodes.c                    |   4 +
 src/slurmctld/srun_comm.c                     |  36 ++-
 src/slurmctld/step_mgr.c                      |   3 +
 src/slurmd/slurmd/req.c                       |  21 +-
 src/slurmd/slurmd/slurmd.c                    |   6 +-
 src/slurmd/slurmstepd/io.c                    |   1 +
 src/slurmd/slurmstepd/mgr.c                   |  16 +-
 src/slurmd/slurmstepd/mgr.h                   |   2 +-
 src/slurmd/slurmstepd/req.c                   |   1 +
 src/slurmd/slurmstepd/slurmstepd.c            |  21 +-
 src/slurmd/slurmstepd/slurmstepd_job.c        |   7 +-
 src/slurmd/slurmstepd/slurmstepd_job.h        |   4 +-
 src/slurmdbd/read_config.c                    |   1 +
 src/slurmdbd/slurmdbd.c                       |   1 +
 55 files changed, 521 insertions(+), 74 deletions(-)

diff --git a/NEWS b/NEWS
index 073e3cbee3..7791dc8ca9 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 This file describes changes in recent versions of Slurm. It primarily
 documents those changes that are of interest to users and administrators.
 
+ -- CVE-2022-29500 - Prevent credential abuse.
  -- CVE-2022-29501 - Prevent abuse of REQUEST_FORWARD_DATA.
 
 * Changes in Slurm 17.02.11
diff --git a/src/api/config_info.c b/src/api/config_info.c
index ae8c2e784a..d31eb0f4db 100644
--- a/src/api/config_info.c
+++ b/src/api/config_info.c
@@ -1794,6 +1794,7 @@ slurm_load_slurmd_status(slurmd_status_t **slurmd_status_ptr)
 	}
 	req_msg.msg_type = REQUEST_DAEMON_STATUS;
 	req_msg.data     = NULL;
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	rc = slurm_send_recv_node_msg(&req_msg, &resp_msg, 0);
 
diff --git a/src/api/job_info.c b/src/api/job_info.c
index aa8be2d61c..eccac89d0d 100644
--- a/src/api/job_info.c
+++ b/src/api/job_info.c
@@ -1179,6 +1179,7 @@ slurm_pid2jobid (pid_t job_pid, uint32_t *jobid)
 	req.job_pid      = job_pid;
 	req_msg.msg_type = REQUEST_JOB_ID;
 	req_msg.data     = &req;
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	rc = slurm_send_recv_node_msg(&req_msg, &resp_msg, 0);
 
@@ -1553,6 +1554,7 @@ slurm_network_callerid (network_callerid_msg_t req, uint32_t *job_id,
 
 	req_msg.msg_type = REQUEST_NETWORK_CALLERID;
 	req_msg.data     = &req;
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	if (slurm_send_recv_node_msg(&req_msg, &resp_msg, 0) < 0)
 		return SLURM_ERROR;
diff --git a/src/api/job_step_info.c b/src/api/job_step_info.c
index 8a1a64b725..320fcd5707 100644
--- a/src/api/job_step_info.c
+++ b/src/api/job_step_info.c
@@ -444,6 +444,7 @@ extern int slurm_job_step_stat(uint32_t job_id, uint32_t step_id,
               job_id, step_id, node_list);
 
 	slurm_msg_t_init(&req_msg);
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	memset(&req, 0, sizeof(job_step_id_msg_t));
 	resp_out->job_id = req.job_id = job_id;
@@ -560,6 +561,7 @@ extern int slurm_job_step_get_pids(uint32_t job_id, uint32_t step_id,
               job_id, step_id, node_list);
 
 	slurm_msg_t_init(&req_msg);
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	memset(&req, 0, sizeof(job_step_id_msg_t));
         resp_out->job_id = req.job_id = job_id;
diff --git a/src/api/node_info.c b/src/api/node_info.c
index 9de3682185..290799cf17 100644
--- a/src/api/node_info.c
+++ b/src/api/node_info.c
@@ -670,6 +670,7 @@ extern int slurm_get_node_energy(char *host, uint16_t delta,
 	req.delta        = delta;
 	req_msg.msg_type = REQUEST_ACCT_GATHER_ENERGY;
 	req_msg.data     = &req;
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	rc = slurm_send_recv_node_msg(&req_msg, &resp_msg, 0);
 
diff --git a/src/api/pmi_server.c b/src/api/pmi_server.c
index 577c541b14..d5015fc949 100644
--- a/src/api/pmi_server.c
+++ b/src/api/pmi_server.c
@@ -147,6 +147,7 @@ static void *_msg_thread(void *x)
 	slurm_msg_t msg_send;
 
 	slurm_msg_t_init(&msg_send);
+	slurm_msg_set_r_uid(&msg_send, SLURM_AUTH_UID_ANY);
 
 	debug2("KVS_Barrier msg to %s:%hu",
 		msg_arg_ptr->bar_ptr->hostname,
diff --git a/src/api/reconfigure.c b/src/api/reconfigure.c
index c3c118afb6..85adfbe50a 100644
--- a/src/api/reconfigure.c
+++ b/src/api/reconfigure.c
@@ -159,6 +159,7 @@ _send_message_controller (enum controller_id dest, slurm_msg_t *req)
 	if ((fd = slurm_open_controller_conn_spec(dest)) < 0)
 		slurm_seterrno_ret(SLURMCTLD_COMMUNICATIONS_CONNECTION_ERROR);
 
+	slurm_msg_set_r_uid(req, slurm_conf.slurm_user_id);
 	if (slurm_send_node_msg(fd, req) < 0) {
 		slurm_shutdown_msg_conn(fd);
 		slurm_seterrno_ret(SLURMCTLD_COMMUNICATIONS_SEND_ERROR);
diff --git a/src/api/signal.c b/src/api/signal.c
index a157fa63f4..c4932a477b 100644
--- a/src/api/signal.c
+++ b/src/api/signal.c
@@ -59,6 +59,7 @@ static int _local_send_recv_rc_msgs(const char *nodelist,
 	slurm_msg_t *msg = xmalloc(sizeof(slurm_msg_t));
 
 	slurm_msg_t_init(msg);
+	slurm_msg_set_r_uid(msg, SLURM_AUTH_UID_ANY);
 	msg->msg_type = type;
 	msg->data = data;
 
@@ -99,6 +100,7 @@ static int _signal_batch_script_step(const resource_allocation_response_msg_t
 	rpc.signal = signal;
 
 	slurm_msg_t_init(&msg);
+	slurm_msg_set_r_uid(&msg, slurm_conf.slurmd_user_id);
 	msg.msg_type = REQUEST_SIGNAL_TASKS;
 	msg.data = &rpc;
 	if (slurm_conf_get_addr(name, &msg.address) == SLURM_ERROR) {
@@ -153,6 +155,7 @@ static int _terminate_batch_script_step(const resource_allocation_response_msg_t
 
 	slurm_msg_t_init(&msg);
 	msg.msg_type = REQUEST_TERMINATE_TASKS;
+	slurm_msg_set_r_uid(&msg, slurm_conf.slurmd_user_id);
 	msg.data = &rpc;
 
 	if (slurm_conf_get_addr(name, &msg.address) == SLURM_ERROR) {
diff --git a/src/api/slurm_pmi.c b/src/api/slurm_pmi.c
index b4a8108a3a..50455094dc 100644
--- a/src/api/slurm_pmi.c
+++ b/src/api/slurm_pmi.c
@@ -177,6 +177,7 @@ int slurm_send_kvs_comm_set(kvs_comm_set_t *kvs_set_ptr,
 	_set_pmi_time();
 
 	slurm_msg_t_init(&msg_send);
+	slurm_msg_set_r_uid(&msg_send, SLURM_AUTH_UID_ANY);
 	msg_send.address = srun_addr;
 	msg_send.msg_type = PMI_KVS_PUT_REQ;
 	msg_send.data = (void *) kvs_set_ptr;
@@ -259,6 +260,7 @@ int  slurm_get_kvs_comm_set(kvs_comm_set_t **kvs_set_ptr,
 	data.port = port;
 	data.hostname = hostname;
 	slurm_msg_t_init(&msg_send);
+	slurm_msg_set_r_uid(&msg_send, SLURM_AUTH_UID_ANY);
 	slurm_msg_t_init(&msg_rcv);
 	msg_send.address = srun_addr;
 	msg_send.msg_type = PMI_KVS_GET_REQ;
@@ -343,6 +345,7 @@ static int _forward_comm_set(kvs_comm_set_t *kvs_set_ptr)
 		if (kvs_set_ptr->kvs_host_ptr[i].port == 0)
 			continue;	/* empty */
 		slurm_msg_t_init(&msg_send);
+		slurm_msg_set_r_uid(&msg_send, SLURM_AUTH_UID_ANY);
 		msg_send.msg_type = PMI_KVS_GET_RESP;
 		msg_send.data = (void *) kvs_set_ptr;
 		slurm_set_addr(&msg_send.address,
diff --git a/src/api/step_launch.c b/src/api/step_launch.c
index 4a66c7b99b..89abead8aa 100644
--- a/src/api/step_launch.c
+++ b/src/api/step_launch.c
@@ -804,6 +804,7 @@ void slurm_step_launch_fwd_signal(slurm_step_ctx_t *ctx, int signo)
 	hostlist_destroy(hl);
 
 	slurm_msg_t_init(&req);
+	slurm_msg_set_r_uid(&req, SLURM_AUTH_UID_ANY);
 	req.msg_type = REQUEST_SIGNAL_TASKS;
 	req.data     = &msg;
 
@@ -1650,6 +1651,7 @@ static int _launch_tasks(slurm_step_ctx_t *ctx,
 	}
 
 	slurm_msg_t_init(&msg);
+	slurm_msg_set_r_uid(&msg, SLURM_AUTH_UID_ANY);
 	msg.msg_type = REQUEST_LAUNCH_TASKS;
 	msg.data = launch_msg;
 
diff --git a/src/bcast/file_bcast.c b/src/bcast/file_bcast.c
index 13d45f6e9d..ed79decd01 100644
--- a/src/bcast/file_bcast.c
+++ b/src/bcast/file_bcast.c
@@ -176,6 +176,7 @@ static int _file_bcast(struct bcast_parameters *params,
 	slurm_msg_t msg;
 
 	slurm_msg_t_init(&msg);
+	slurm_msg_set_r_uid(&msg, SLURM_AUTH_UID_ANY);
 	msg.data = bcast_msg;
 	msg.msg_type = REQUEST_FILE_BCAST;
 
diff --git a/src/common/forward.c b/src/common/forward.c
index 703d72eb0c..09fb435756 100644
--- a/src/common/forward.c
+++ b/src/common/forward.c
@@ -250,7 +250,7 @@ void *_forward_thread(void *arg)
 			/*      steps, fwd_msg->timeout); */
 		}
 
-		ret_list = slurm_receive_msgs(fd, steps, fwd_msg->timeout);
+		ret_list = slurm_receive_resp_msgs(fd, steps, fwd_msg->timeout);
 		/* info("sent %d forwards got %d back", */
 		/*      fwd_msg->header.forward.cnt, list_count(ret_list)); */
 
@@ -358,6 +358,9 @@ void *_fwd_tree_thread(void *arg)
 	send_msg.msg_type = fwd_tree->orig_msg->msg_type;
 	send_msg.data = fwd_tree->orig_msg->data;
 	send_msg.protocol_version = fwd_tree->orig_msg->protocol_version;
+	if (fwd_tree->orig_msg->restrict_uid_set)
+		slurm_msg_set_r_uid(&send_msg,
+				    fwd_tree->orig_msg->restrict_uid);
 
 	/* repeat until we are sure the message was sent */
 	while ((name = hostlist_shift(fwd_tree->tree_hl))) {
diff --git a/src/common/slurm_auth.c b/src/common/slurm_auth.c
index f7811e71aa..7ce0887ead 100644
--- a/src/common/slurm_auth.c
+++ b/src/common/slurm_auth.c
@@ -60,7 +60,8 @@ static bool init_run = false;
  * end of the structure.
  */
 typedef struct slurm_auth_ops {
-        void *       (*create)    ( char *auth_info );
+        void *       (*create)    ( char *auth_infouid_t, uid_t r_uid,
+				    void *data, int dlen);
         int          (*destroy)   ( void *cred );
         int          (*verify)    ( void *cred, char *auth_info );
         uid_t        (*get_uid)   ( void *cred, char *auth_info );
@@ -70,6 +71,9 @@ typedef struct slurm_auth_ops {
         int          (*print)     ( void *cred, FILE *fp );
         int          (*sa_errno)  ( void *cred );
         const char * (*sa_errstr) ( int slurm_errno );
+	bool	     (*hash_enable);
+        int	     (*get_data)  (void *cred, char **data,
+					 uint32_t *len);
 } slurm_auth_ops_t;
 /*
  * These strings must be kept in the same order as the fields
@@ -85,7 +89,9 @@ static const char *syms[] = {
 	"slurm_auth_unpack",
 	"slurm_auth_print",
 	"slurm_auth_errno",
-	"slurm_auth_errstr"
+        "slurm_auth_errstr",
+	"hash_enable",
+	"auth_p_get_data"
 };
 
 /*
@@ -125,6 +131,15 @@ slurm_auth_generic_errstr( int slurm_errno )
         }
 }
 
+extern bool slurm_get_plugin_hash_enable(int index)
+{
+       if (slurm_auth_init(NULL) < 0)
+               return true;
+
+       return *(ops[index].hash_enable);
+
+}
+
 extern int slurm_auth_init( char *auth_type )
 {
         int retval = SLURM_SUCCESS;
@@ -182,12 +197,13 @@ slurm_auth_fini( void )
  * the API function dispatcher.
  */
 
-void *g_slurm_auth_create(char *auth_info)
+void *g_slurm_auth_create(char *auth_info, uid_t r_uid,
+			  void *data, int dlen)
 {
 	if (slurm_auth_init(NULL) < 0)
 		return NULL;
 
-        return (*(ops.create))(auth_info);
+	return (*(ops.create))(auth_info, r_uid, data, dlen);
 }
 
 int g_slurm_auth_destroy(void *cred)
@@ -206,6 +222,16 @@ int g_slurm_auth_verify(void *cred, char *auth_info)
         return (*(ops.verify))(cred, auth_info);
 }
 
+int auth_g_get_data(void *cred, char **data, uint32_t *len)
+{
+	cred_wrapper_t *wrap = (cred_wrapper_t *) cred;
+
+	if (!wrap || slurm_auth_init(NULL) < 0)
+		return SLURM_ERROR;
+
+	return (*(ops[wrap->index].get_data))(cred, data, len);
+}
+
 uid_t g_slurm_auth_get_uid(void *cred, char *auth_info)
 {
 	if (slurm_auth_init(NULL) < 0)
diff --git a/src/common/slurm_auth.h b/src/common/slurm_auth.h
index b430809ca5..f7ab7ac68e 100644
--- a/src/common/slurm_auth.h
+++ b/src/common/slurm_auth.h
@@ -88,6 +88,12 @@ enum {
 	ARG_COUNT,
 };
 
+/*
+ * This should be equal to MUNGE_UID_ANY
+ * do not restrict decode via uid
+ */
+#define SLURM_AUTH_UID_ANY -1
+
 /*
  * SLURM authentication context opaque type.
  */
@@ -128,15 +134,23 @@ extern int slurm_auth_init( char *auth_type );
  */
 extern int slurm_auth_fini( void );
 
+/*
+ * Check if plugin type corresponding to the authentication
+ * plugin index supports hash.
+ */
+extern bool slurm_get_plugin_hash_enable(int index);
+
 /*
  * Static bindings for the global authentication context.
  */
-extern void *	g_slurm_auth_create(char *auth_info);
+extern void *	g_slurm_auth_create(char *auth_info, uid_t r_uid,
+				 void *data, int dlen);
 extern int	g_slurm_auth_destroy( void *cred );
 extern int	g_slurm_auth_verify(void *cred, char *auth_info);
 extern uid_t	g_slurm_auth_get_uid( void *cred, char *auth_info );
 extern gid_t	g_slurm_auth_get_gid( void *cred, char *auth_info );
 extern int	g_slurm_auth_pack( void *cred, Buf buf );
+extern int      auth_g_get_data(void *cred, char **data, uint32_t *len);
 
 /*
  * WARNING!  The returned auth pointer WILL have pointers
diff --git a/src/common/slurm_persist_conn.c b/src/common/slurm_persist_conn.c
index 3146e1c867..bfee739097 100644
--- a/src/common/slurm_persist_conn.c
+++ b/src/common/slurm_persist_conn.c
@@ -575,6 +575,7 @@ extern int slurm_persist_conn_open(slurm_persist_conn_t *persist_conn)
 	req_msg.flags |= SLURM_GLOBAL_AUTH_KEY;
 	if (persist_conn->flags & PERSIST_FLAG_DBD)
 		req_msg.flags |= SLURMDBD_CONNECTION;
+	slurm_msg_set_r_uid(&req_msg, persist_conn->r_uid);
 
 	memset(&req, 0, sizeof(persist_init_req_msg_t));
 	req.cluster_name = persist_conn->cluster_name;
diff --git a/src/common/slurm_persist_conn.h b/src/common/slurm_persist_conn.h
index ece44280f5..0d128aab6f 100644
--- a/src/common/slurm_persist_conn.h
+++ b/src/common/slurm_persist_conn.h
@@ -61,6 +61,7 @@ typedef struct {
 	int fd;
 	uint16_t flags;
 	bool inited;
+	uid_t r_uid;
 	char *rem_host;
 	uint16_t rem_port;
 	time_t *shutdown;
diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index ed2f866d0e..f97b6be357 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -869,6 +869,36 @@ char *slurm_get_priority_weight_tres(void)
 	return weights;
 }
 
+static int _check_hash(buf_t *buffer, header_t *header, slurm_msg_t *msg,
+		       void *cred)
+{
+	char *cred_hash = NULL;
+	uint32_t cred_hash_len = 0;
+	int rc;
+	static time_t config_update = (time_t) -1;
+	static bool block_null_hash = true;
+
+	if (config_update != slurm_conf.last_update) {
+		block_null_hash = (xstrcasestr(slurm_conf.comm_params,
+					       "block_null_hash"));
+		config_update = slurm_conf.last_update;
+	}
+
+	rc = auth_g_get_data(cred, &cred_hash, &cred_hash_len);
+
+	if (cred_hash || cred_hash_len) {
+		if (cred_hash_len != 3 || cred_hash[0] != 1 ||
+		    memcmp(cred_hash + 1,
+			   &msg->msg_type, sizeof(msg->msg_type)))
+			rc = SLURM_ERROR;
+	} else if (block_null_hash &&
+		   slurm_get_plugin_hash_enable(msg->auth_index))
+		rc = SLURM_ERROR;
+
+	xfree(cred_hash);
+	return rc;
+}
+
 static int _get_tres_id(char *type, char *name)
 {
 	slurmdb_tres_rec_t tres_rec;
@@ -3190,6 +3220,9 @@ extern int slurm_unpack_received_msg(slurm_msg_t *msg, int fd, Buf buffer)
 		goto total_return;
 	}
 
+	msg->auth_uid = g_slurm_auth_get_uid(auth_cred);
+	msg->auth_uid_set = true;
+
 	/*
 	 * Unpack message body
 	 */
@@ -3200,6 +3233,7 @@ extern int slurm_unpack_received_msg(slurm_msg_t *msg, int fd, Buf buffer)
 	body_offset = get_buf_offset(buffer);
 
 	if ((header.body_length > remaining_buf(buffer)) ||
+	    _check_hash(buffer, &header, msg, auth_cred) ||
 	    (unpack_msg(msg, buffer) != SLURM_SUCCESS)) {
 		rc = ESLURM_PROTOCOL_INCOMPLETE_PACKET;
 		(void) g_slurm_auth_destroy(auth_cred);
@@ -3304,6 +3338,8 @@ int slurm_receive_msg(int fd, slurm_msg_t *msg, int timeout)
 	 */
 	if (slurm_msg_recvfrom_timeout(fd, &buf, &buflen, 0, timeout) < 0) {
 		rc = errno;
+		if (!rc)
+			rc = SLURMCTLD_COMMUNICATIONS_RECEIVE_ERROR;
 		goto endit;
 	}
 
@@ -3466,6 +3502,8 @@ List slurm_receive_msgs(int fd, int steps, int timeout)
 		goto total_return;
 	}
 
+	msg.auth_uid = g_slurm_auth_get_uid(auth_cred);
+	msg.auth_uid_set = true;
 	/*
 	 * Unpack message body
 	 */
@@ -3474,6 +3512,7 @@ List slurm_receive_msgs(int fd, int steps, int timeout)
 	msg.flags = header.flags;
 
 	if ((header.body_length > remaining_buf(buffer)) ||
+	    _check_hash(buffer, &header, &msg, auth_cred) ||
 	    (unpack_msg(&msg, buffer) != SLURM_SUCCESS)) {
 		(void) g_slurm_auth_destroy(auth_cred);
 		free_buf(buffer);
@@ -3515,6 +3554,155 @@ total_return:
 
 }
 
+List slurm_receive_resp_msgs(int fd, int steps, int timeout)
+{
+	char *buf = NULL;
+	size_t buflen = 0;
+	header_t header;
+	int rc;
+	void *auth_cred = NULL;
+	slurm_msg_t msg;
+	buf_t *buffer;
+	ret_data_info_t *ret_data_info = NULL;
+	List ret_list = NULL;
+	int orig_timeout = timeout;
+
+	xassert(fd >= 0);
+
+	slurm_msg_t_init(&msg);
+	msg.conn_fd = fd;
+
+	if (timeout <= 0) {
+		/* convert secs to msec */
+		timeout = slurm_conf.msg_timeout * 1000;
+		orig_timeout = timeout;
+	}
+	if (steps) {
+		if (message_timeout < 0)
+			message_timeout = slurm_conf.msg_timeout * 1000;
+		orig_timeout = (timeout -
+				(message_timeout*(steps-1)))/steps;
+		steps--;
+	}
+
+	log_flag(NET, "%s: orig_timeout was %d we have %d steps and a timeout of %d",
+		 __func__, orig_timeout, steps, timeout);
+	/* we compare to the orig_timeout here because that is really
+	 *  what we are going to wait for each step
+	 */
+	if (orig_timeout >= (slurm_conf.msg_timeout * 10000)) {
+		log_flag(NET, "%s: Sending a message with timeout's greater than %d seconds, requested timeout is %d seconds",
+			 __func__, (slurm_conf.msg_timeout * 10),
+			 (timeout/1000));
+	} else if (orig_timeout < 1000) {
+		log_flag(NET, "%s: Sending a message with a very short timeout of %d milliseconds each step in the tree has %d milliseconds",
+			 __func__, timeout, orig_timeout);
+	}
+
+
+	/*
+	 * Receive a msg. slurm_msg_recvfrom() will read the message
+	 *  length and allocate space on the heap for a buffer containing
+	 *  the message.
+	 */
+	if (slurm_msg_recvfrom_timeout(fd, &buf, &buflen, 0, timeout) < 0) {
+		forward_init(&header.forward);
+		rc = errno;
+		goto total_return;
+	}
+
+	log_flag_hex(NET_RAW, buf, buflen, "%s: read", __func__);
+	buffer = create_buf(buf, buflen);
+
+	if (unpack_header(&header, buffer) == SLURM_ERROR) {
+		free_buf(buffer);
+		rc = SLURM_COMMUNICATIONS_RECEIVE_ERROR;
+		goto total_return;
+	}
+
+	if (check_header_version(&header) < 0) {
+		slurm_addr_t resp_addr;
+		if (!slurm_get_peer_addr(fd, &resp_addr)) {
+			error("%s: Invalid Protocol Version %u from at %pA",
+			      __func__, header.version, &resp_addr);
+		} else {
+			error("%s: Invalid Protocol Version %u from problem connection: %m",
+			      __func__, header.version);
+		}
+
+		free_buf(buffer);
+		rc = SLURM_PROTOCOL_VERSION_ERROR;
+		goto total_return;
+	}
+	//info("ret_cnt = %d",header.ret_cnt);
+	if (header.ret_cnt > 0) {
+		if (header.ret_list)
+			ret_list = header.ret_list;
+		else
+			ret_list = list_create(destroy_data_info);
+		header.ret_cnt = 0;
+		header.ret_list = NULL;
+	}
+
+	/* Forward message to other nodes */
+	if (header.forward.cnt > 0) {
+		error("%s: We need to forward this to other nodes use slurm_receive_msg_and_forward instead",
+		      __func__);
+	}
+
+	if (!(auth_cred = g_slurm_auth_unpack(buffer, header.version))) {
+		error("%s: auth_g_unpack: %m", __func__);
+		free_buf(buffer);
+		rc = ESLURM_PROTOCOL_INCOMPLETE_PACKET;
+		goto total_return;
+	}
+	g_slurm_auth_destroy(auth_cred);
+	/*
+	 * Unpack message body
+	 */
+	msg.protocol_version = header.version;
+	msg.msg_type = header.msg_type;
+	msg.flags = header.flags;
+
+	if ((header.body_length > remaining_buf(buffer)) ||
+	    (unpack_msg(&msg, buffer) != SLURM_SUCCESS)) {
+		free_buf(buffer);
+		rc = ESLURM_PROTOCOL_INCOMPLETE_PACKET;
+		goto total_return;
+	}
+	free_buf(buffer);
+	rc = SLURM_SUCCESS;
+
+total_return:
+	destroy_forward(&header.forward);
+
+	if (rc != SLURM_SUCCESS) {
+		if (ret_list) {
+			ret_data_info = xmalloc(sizeof(ret_data_info_t));
+			ret_data_info->err = rc;
+			ret_data_info->type = RESPONSE_FORWARD_FAILED;
+			ret_data_info->data = NULL;
+			list_push(ret_list, ret_data_info);
+		}
+
+		error("%s: failed: %s",
+		      __func__, slurm_strerror(rc));
+		usleep(10000);	/* Discourage brute force attack */
+	} else {
+		if (!ret_list)
+			ret_list = list_create(destroy_data_info);
+		ret_data_info = xmalloc(sizeof(ret_data_info_t));
+		ret_data_info->err = rc;
+		ret_data_info->node_name = NULL;
+		ret_data_info->type = msg.msg_type;
+		ret_data_info->data = msg.data;
+		list_push(ret_list, ret_data_info);
+	}
+
+	errno = rc;
+	return ret_list;
+
+}
 /* try to determine the UID associated with a message with different
  * message header version, return -1 if we can't tell */
 static int _unpack_msg_uid(Buf buffer)
@@ -3700,6 +3888,9 @@ int slurm_receive_msg_and_forward(int fd, slurm_addr_t *orig_addr,
 		goto total_return;
 	}
 
+	msg->auth_uid = g_slurm_auth_get_uid(auth_cred);
+	msg->auth_uid_set = true;
+
 	/*
 	 * Unpack message body
 	 */
@@ -3713,6 +3904,7 @@ int slurm_receive_msg_and_forward(int fd, slurm_addr_t *orig_addr,
 	}
 
 	if ( (header.body_length > remaining_buf(buffer)) ||
+	    _check_hash(buffer, &header, msg, auth_cred) ||
 	     (unpack_msg(msg, buffer) != SLURM_SUCCESS) ) {
 		(void) g_slurm_auth_destroy(auth_cred);
 		free_buf(buffer);
@@ -3780,6 +3972,7 @@ int slurm_send_node_msg(int fd, slurm_msg_t * msg)
 	int      rc;
 	void *   auth_cred;
 	time_t   start_time = time(NULL);
+	unsigned char auth_payload[3] = { 1 }; /* uint8_t + uint16_t (msg_type) */
 
 	if (msg->conn) {
 		persist_msg_t persist_msg;
@@ -3811,6 +4004,9 @@ int slurm_send_node_msg(int fd, slurm_msg_t * msg)
 		return rc;
 	}
 
+	if (!msg->restrict_uid_set)
+		fatal("%s: restrict_uid is not set", __func__);
+	memcpy(auth_payload + 1, &msg->msg_type, sizeof(msg->msg_type));
 	/*
 	 * Initialize header with Auth credential and message type.
 	 * We get the credential now rather than later so the work can
@@ -3819,10 +4015,14 @@ int slurm_send_node_msg(int fd, slurm_msg_t * msg)
 	 * wait too long for the incoming message.
 	 */
 	if (msg->flags & SLURM_GLOBAL_AUTH_KEY) {
-		auth_cred = g_slurm_auth_create(_global_auth_key());
+		auth_cred = g_slurm_auth_create(_global_auth_key(),
+						msg->restrict_uid, auth_payload,
+						sizeof(auth_payload));
 	} else {
 		char *auth_info = slurm_get_auth_info();
-		auth_cred = g_slurm_auth_create(auth_info);
+		auth_cred = g_slurm_auth_create(auth_info,
+						msg->restrict_uid, auth_payload,
+						sizeof(auth_payload));
 		xfree(auth_info);
 	}
 
@@ -3839,10 +4039,16 @@ int slurm_send_node_msg(int fd, slurm_msg_t * msg)
 	if (difftime(time(NULL), start_time) >= 60) {
 		(void) g_slurm_auth_destroy(auth_cred);
 		if (msg->flags & SLURM_GLOBAL_AUTH_KEY) {
-			auth_cred = g_slurm_auth_create(_global_auth_key());
+			auth_cred = g_slurm_auth_create(_global_auth_key(),
+							msg->restrict_uid,
+							auth_payload,
+							sizeof(auth_payload));
 		} else {
 			char *auth_info = slurm_get_auth_info();
-			auth_cred = g_slurm_auth_create(auth_info);
+			auth_cred = g_slurm_auth_create(auth_info,
+							msg->restrict_uid,
+							auth_payload,
+							sizeof(auth_payload));
 			xfree(auth_info);
 		}
 	}
@@ -4313,6 +4519,7 @@ int slurm_send_recv_controller_msg(slurm_msg_t *req, slurm_msg_t *resp)
 	forward_init(&req->forward, NULL);
 	req->ret_list = NULL;
 	req->forward_struct = NULL;
+	slurm_msg_set_r_uid(req, SLURM_AUTH_UID_ANY);
 
 	if (working_cluster_rec)
 		req->flags |= SLURM_GLOBAL_AUTH_KEY;
@@ -4413,6 +4620,8 @@ int slurm_send_only_controller_msg(slurm_msg_t *req)
 		goto cleanup;
 	}
 
+	slurm_msg_set_r_uid(req, slurm_conf.slurm_user_id);
+
 	if ((rc = slurm_send_node_msg(fd, req)) < 0) {
 		rc = SLURM_ERROR;
 	} else {
@@ -4700,6 +4909,12 @@ extern void slurm_free_msg(slurm_msg_t *msg)
 	}
 }
 
+extern void slurm_msg_set_r_uid(slurm_msg_t *msg, uid_t r_uid)
+{
+	msg->restrict_uid = r_uid;
+	msg->restrict_uid_set = true;
+}
+
 extern char *nodelist_nth_host(const char *nodelist, int inx)
 {
 	hostlist_t hl = hostlist_create(nodelist);
@@ -4896,6 +5111,7 @@ extern int slurm_forward_data(
 	req.len = len;
 	req.data = (char *)data;
 
+	slurm_msg_set_r_uid(&msg, SLURM_AUTH_UID_ANY);
 	msg.msg_type = REQUEST_FORWARD_DATA;
 	msg.data = &req;
 
diff --git a/src/common/slurm_protocol_api.h b/src/common/slurm_protocol_api.h
index ab324b42a0..4fa8ed6ec2 100644
--- a/src/common/slurm_protocol_api.h
+++ b/src/common/slurm_protocol_api.h
@@ -1019,6 +1019,7 @@ int slurm_receive_msg(int fd, slurm_msg_t *msg, int timeout);
  *                errno set.
  */
 List slurm_receive_msgs(int fd, int steps, int timeout);
+List slurm_receive_resp_msgs(int fd, int steps, int timeout);
 
 /*
  *  Receive a slurm message on the open slurm descriptor "fd" waiting
@@ -1289,6 +1290,8 @@ extern int *set_span(int total, uint16_t tree_width);
 extern void slurm_free_msg_members(slurm_msg_t *msg);
 extern void slurm_free_msg(slurm_msg_t * msg);
 
+extern void slurm_msg_set_r_uid(slurm_msg_t *msg, uid_t r_uid);
+
 /* must free this memory with free not xfree */
 extern char *nodelist_nth_host(const char *nodelist, int inx);
 extern int nodelist_find(const char *nodelist, const char *name);
diff --git a/src/common/slurm_protocol_defs.c b/src/common/slurm_protocol_defs.c
index d633fbcb2b..e8fc1ea850 100644
--- a/src/common/slurm_protocol_defs.c
+++ b/src/common/slurm_protocol_defs.c
@@ -51,6 +51,7 @@
 #include "src/common/power.h"
 #include "src/common/slurm_accounting_storage.h"
 #include "src/common/slurm_acct_gather_energy.h"
+#include "src/common/slurm_auth.h"
 #include "src/common/slurm_cred.h"
 #include "src/common/slurm_ext_sensors.h"
 #include "src/common/slurm_jobacct_gather.h"
@@ -104,6 +105,7 @@ extern void slurm_msg_t_init(slurm_msg_t *msg)
 {
 	memset(msg, 0, sizeof(slurm_msg_t));
 
+	msg->auth_uid = SLURM_AUTH_NOBODY;
 	msg->conn_fd = -1;
 	msg->msg_type = (uint16_t)NO_VAL;
 	msg->protocol_version = (uint16_t)NO_VAL;
@@ -129,6 +131,8 @@ extern void slurm_msg_t_copy(slurm_msg_t *dest, slurm_msg_t *src)
 	dest->ret_list = src->ret_list;
 	dest->forward_struct = src->forward_struct;
 	dest->orig_addr.sin_addr.s_addr = 0;
+	if (src->auth_uid_set)
+		slurm_msg_set_r_uid(dest, src->auth_uid);
 	return;
 }
 
diff --git a/src/common/slurm_protocol_defs.h b/src/common/slurm_protocol_defs.h
index 286461d1bb..abca229509 100644
--- a/src/common/slurm_protocol_defs.h
+++ b/src/common/slurm_protocol_defs.h
@@ -50,6 +50,7 @@
 #include "src/common/job_options.h"
 #include "src/common/list.h"
 #include "src/common/macros.h"
+#include "src/common/slurm_auth.h"
 #include "src/common/slurm_cred.h"
 #include "src/common/slurm_protocol_common.h"
 #include "src/common/slurm_persist_conn.h"
@@ -452,6 +453,19 @@ typedef struct slurm_protocol_config {
 typedef struct slurm_msg {
 	slurm_addr_t address;
 	void *auth_cred;
+	uid_t auth_uid;		/* NEVER PACK. Authenticated uid from auth
+				 * credential. Only valid if auth_uid_set is
+				 * true. Set to SLURM_AUTH_NOBODY if not set
+				 * yet.
+				 */
+	bool auth_uid_set;	/* NEVER PACK. True when auth_uid has been set.
+				 * This is a safety measure against handling
+				 * a slurm_msg_t that has been xmalloc()'d but
+				 * slurm_msg_t_init() was not called since
+				 * auth_uid would be root.
+				 */
+	uid_t restrict_uid;
+	bool restrict_uid_set;
 	Buf buffer; /* DON't PACK! ptr to buffer that msg was unpacked from. */
 	slurm_persist_conn_t *conn; /* DON'T PACK OR FREE! this is here to
 				     * distinquish a persistant connection from
diff --git a/src/common/slurmdb_defs.c b/src/common/slurmdb_defs.c
index 73c51ea792..332c4a7ea3 100644
--- a/src/common/slurmdb_defs.c
+++ b/src/common/slurmdb_defs.c
@@ -2897,6 +2897,7 @@ extern int slurmdb_send_accounting_update(List update_list, char *cluster,
 	slurm_set_addr_char(&req.address, port, host);
 
 	req.protocol_version = rpc_version;
+	slurm_msg_set_r_uid(&req, SLURM_AUTH_UID_ANY);
 
 	req.msg_type = ACCOUNTING_UPDATE_MSG;
 	if (slurmdbd_conf)
diff --git a/src/common/slurmdbd_defs.c b/src/common/slurmdbd_defs.c
index 112c46f590..5f95999626 100644
--- a/src/common/slurmdbd_defs.c
+++ b/src/common/slurmdbd_defs.c
@@ -445,6 +445,7 @@ static void _open_slurmdbd_conn(bool need_db)
 			slurm_set_accounting_storage_port(
 				slurmdbd_conn->rem_port);
 		}
+		slurmdbd_conn->r_uid = SLURM_AUTH_UID_ANY;
 	}
 	slurmdbd_shutdown = 0;
 	slurmdbd_conn->shutdown = &slurmdbd_shutdown;
diff --git a/src/common/stepd_api.c b/src/common/stepd_api.c
index 6e2deec93a..4fb3a7c497 100644
--- a/src/common/stepd_api.c
+++ b/src/common/stepd_api.c
@@ -473,7 +473,7 @@ rwfail:
 int
 stepd_attach(int fd, uint16_t protocol_version,
 	     slurm_addr_t *ioaddr, slurm_addr_t *respaddr,
-	     void *job_cred_sig, reattach_tasks_response_msg_t *resp)
+	     void *job_cred_sig, uid_t uid, reattach_tasks_response_msg_t *resp)
 {
 	int req = REQUEST_ATTACH;
 	int rc = SLURM_SUCCESS;
@@ -483,6 +483,7 @@ stepd_attach(int fd, uint16_t protocol_version,
 	safe_write(fd, ioaddr, sizeof(slurm_addr_t));
 	safe_write(fd, respaddr, sizeof(slurm_addr_t));
 	safe_write(fd, job_cred_sig, SLURM_IO_KEY_SIZE);
+	safe_write(fd, &uid, sizeof(uid_t));
 	safe_write(fd, &proto, sizeof(int));
 
 	/* Receive the return code */
diff --git a/src/common/stepd_api.h b/src/common/stepd_api.h
index a700c81f55..06a61f82c0 100644
--- a/src/common/stepd_api.h
+++ b/src/common/stepd_api.h
@@ -187,7 +187,8 @@ int stepd_signal_container(int fd, uint16_t protocol_version, int signal);
  */
 int stepd_attach(int fd, uint16_t protocol_version,
 		 slurm_addr_t *ioaddr, slurm_addr_t *respaddr,
-		 void *job_cred_sig, reattach_tasks_response_msg_t *resp);
+		 void *job_cred_sig, uid_t uid,
+		 reattach_tasks_response_msg_t *resp);
 
 /*
  * Scan for available running slurm step daemons by checking
diff --git a/src/plugins/accounting_storage/common/common_as.c b/src/plugins/accounting_storage/common/common_as.c
index 56511f8231..df679c0534 100644
--- a/src/plugins/accounting_storage/common/common_as.c
+++ b/src/plugins/accounting_storage/common/common_as.c
@@ -375,6 +375,7 @@ extern int cluster_first_reg(char *host, uint16_t port, uint16_t rpc_version)
 		out_msg.msg_type = ACCOUNTING_FIRST_REG;
 		out_msg.flags = SLURM_GLOBAL_AUTH_KEY;
 		out_msg.data = &update;
+		slurm_msg_set_r_uid(&out_msg, SLURM_AUTH_UID_ANY);
 		slurm_send_node_msg(fd, &out_msg);
 		/* We probably need to add matching recv_msg function
 		 * for an arbitray fd or should these be fire
diff --git a/src/plugins/auth/munge/auth_munge.c b/src/plugins/auth/munge/auth_munge.c
index 3f98a3343a..fbcd1bbd52 100644
--- a/src/plugins/auth/munge/auth_munge.c
+++ b/src/plugins/auth/munge/auth_munge.c
@@ -84,6 +84,7 @@
 const char plugin_name[]       	= "Munge authentication plugin";
 const char plugin_type[]       	= "auth/munge";
 const uint32_t plugin_version = SLURM_VERSION_NUMBER;
+bool hash_enable = true;
 
 static int plugin_errno = SLURM_SUCCESS;
 static int bad_cred_test = -1;
@@ -102,12 +103,12 @@ typedef struct _slurm_auth_credential {
 	int  magic;        /* magical munge validity magic                   */
 #endif
 	char   *m_str;     /* munged string                                  */
-	void   *buf;       /* Application specific data                      */
 	bool    verified;  /* true if this cred has been verified            */
-	int     len;       /* amount of App data                             */
 	uid_t   uid;       /* UID. valid only if verified == true            */
 	gid_t   gid;       /* GID. valid only if verified == true            */
 	int cr_errno;
+	void *data;	/* payload data		*/
+	int dlen;	/* payload data length	*/
 } slurm_auth_credential_t;
 
 /*
@@ -154,7 +155,8 @@ int init ( void )
  * allocate a credential.  Whether the credential is populated with useful
  * data at this time is implementation-dependent.
  */
-slurm_auth_credential_t *slurm_auth_create(char *opts)
+slurm_auth_credential_t *slurm_auth_create(char *opts, uid_t r_uid,
+					   void *data, int dlen)
 {
 	int rc, retry = RETRY_COUNT, auth_ttl;
 	slurm_auth_credential_t *cred = NULL;
@@ -191,6 +193,13 @@ slurm_auth_credential_t *slurm_auth_create(char *opts)
 		}
 	}
 
+	rc = munge_ctx_set(ctx, MUNGE_OPT_UID_RESTRICTION, r_uid);
+	if (rc != EMUNGE_SUCCESS) {
+		error("munge_ctx_set failure");
+		munge_ctx_destroy(ctx);
+		return NULL;
+	}
+
 	auth_ttl = slurm_get_auth_ttl();
 	if (auth_ttl)
 		(void) munge_ctx_set(ctx, MUNGE_OPT_TTL, auth_ttl);
@@ -198,8 +207,8 @@ slurm_auth_credential_t *slurm_auth_create(char *opts)
 	cred = xmalloc(sizeof(*cred));
 	cred->verified = false;
 	cred->m_str    = NULL;
-	cred->buf      = NULL;
-	cred->len      = 0;
+	cred->data = NULL;
+	cred->dlen = 0;
 	cred->cr_errno = SLURM_SUCCESS;
 
 	xassert((cred->magic = MUNGE_MAGIC));
@@ -213,7 +222,7 @@ slurm_auth_credential_t *slurm_auth_create(char *opts)
 	ohandler = xsignal(SIGALRM, (SigFunc *)SIG_BLOCK);
 
 again:
-	err = munge_encode(&cred->m_str, ctx, cred->buf, cred->len);
+	err = munge_encode(&cred->m_str, ctx, data, dlen);
 	if (err != EMUNGE_SUCCESS) {
 		if ((err == EMUNGE_SOCKET) && retry--) {
 			debug("Munge encode failed: %s (retrying ...)",
@@ -258,8 +267,8 @@ slurm_auth_destroy( slurm_auth_credential_t *cred )
 	 */
 	if (cred->m_str)
 		free(cred->m_str);
-	if (cred->buf)
-		free(cred->buf);
+	if (cred->data)
+		free(cred->data);
 
 	xfree(cred);
 	return SLURM_SUCCESS;
@@ -351,6 +360,34 @@ slurm_auth_get_gid( slurm_auth_credential_t *cred, char *opts )
 	return cred->gid;
 }
 
+/*
+ * auth_p_verify() must be called first.
+ */
+int auth_p_get_data(slurm_auth_credential_t *cred, char **data, uint32_t *len)
+{
+	if (!cred || !cred->verified) {
+		/*
+		 * This xassert will trigger on a development build if
+		 * the calling path did not verify the credential first.
+		 */
+		xassert(!cred);
+		slurm_seterrno(ESLURM_AUTH_BADARG);
+		return SLURM_ERROR;
+	}
+
+	xassert(cred->magic == MUNGE_MAGIC);
+
+	if (cred->data && cred->dlen) {
+		*data = xmalloc(cred->dlen);
+		memcpy(*data, cred->data, cred->dlen);
+		*len = cred->dlen;
+	} else {
+		*data = NULL;
+		*len = 0;
+	}
+	return SLURM_SUCCESS;
+}
+
 /*
  * Marshall a credential for transmission over the network, according to
  * SLURM's marshalling protocol.
@@ -418,8 +455,6 @@ slurm_auth_unpack( Buf buf )
 	cred = xmalloc(sizeof(*cred));
 	cred->verified = false;
 	cred->m_str    = NULL;
-	cred->buf      = NULL;
-	cred->len      = 0;
 	cred->cr_errno = SLURM_SUCCESS;
 
 	xassert((cred->magic = MUNGE_MAGIC));
@@ -521,14 +556,9 @@ _decode_cred(slurm_auth_credential_t *c, char *socket)
 		return SLURM_ERROR;
 	}
 
-    again:
-	c->buf = NULL;
-	err = munge_decode(c->m_str, ctx, &c->buf, &c->len, &c->uid, &c->gid);
+again:
+	err = munge_decode(c->m_str, ctx, &c->data, &c->dlen, &c->uid, &c->gid);
 	if (err != EMUNGE_SUCCESS) {
-		if (c->buf) {
-			free(c->buf);
-			c->buf = NULL;
-		}
 		if ((err == EMUNGE_SOCKET) && retry--) {
 			debug("Munge decode failed: %s (retrying ...)",
 			      munge_ctx_strerror(ctx));
diff --git a/src/plugins/auth/none/auth_none.c b/src/plugins/auth/none/auth_none.c
index 6bd3beee88..34c7d79b1c 100644
--- a/src/plugins/auth/none/auth_none.c
+++ b/src/plugins/auth/none/auth_none.c
@@ -74,6 +74,7 @@
 const char plugin_name[]       	= "Null authentication plugin";
 const char plugin_type[]       	= "auth/none";
 const uint32_t plugin_version   = SLURM_VERSION_NUMBER;
+bool hash_enable = false;
 
 /*
  * An opaque type representing authentication credentials.  This type can be
@@ -148,7 +149,8 @@ extern int fini ( void )
  * Allocate and initializes a credential.  This function should return
  * NULL if it cannot allocate a credential.
  */
-slurm_auth_credential_t *slurm_auth_create(char *auth_info)
+slurm_auth_credential_t *slurm_auth_create(char *auth_info, uid_t r_uid,
+					   void *data, int dlen)
 {
 	slurm_auth_credential_t *cred;
 	cred = xmalloc(sizeof(slurm_auth_credential_t));
@@ -214,6 +216,19 @@ slurm_auth_get_gid( slurm_auth_credential_t *cred, char *auth_info )
 	}
 }
 
+int auth_p_get_data(slurm_auth_credential_t *cred, char **data, uint32_t *len)
+{
+	if (!cred) {
+		slurm_seterrno(ESLURM_AUTH_BADARG);
+		return SLURM_ERROR;
+	}
+
+	*data = NULL;
+	*len = 0;
+
+	return SLURM_SUCCESS;
+}
+
 /*
  * Marshall a credential for transmission over the network, according to
  * SLURM's marshalling protocol.
diff --git a/src/plugins/mpi/pmi2/setup.c b/src/plugins/mpi/pmi2/setup.c
index 93884fa211..89601f28fe 100644
--- a/src/plugins/mpi/pmi2/setup.c
+++ b/src/plugins/mpi/pmi2/setup.c
@@ -107,6 +107,7 @@ _setup_stepd_job_info(const stepd_step_rec_t *job, char ***env)
 	job_info.ntasks = job->ntasks;
 	job_info.ltasks = job->node_tasks;
 	job_info.gtids = xmalloc(job->node_tasks * sizeof(uint32_t));
+	job_info.uid = job->uid;
 	for (i = 0; i < job->node_tasks; i ++) {
 		job_info.gtids[i] = job->task[i]->gtid;
 	}
diff --git a/src/plugins/mpi/pmi2/setup.h b/src/plugins/mpi/pmi2/setup.h
index cd46da69f7..5e79094fb8 100644
--- a/src/plugins/mpi/pmi2/setup.h
+++ b/src/plugins/mpi/pmi2/setup.h
@@ -58,6 +58,7 @@
 typedef struct pmi2_job_info {
 	uint32_t jobid;  /* Current SLURM job id                      */
 	uint32_t stepid; /* Current step id (or NO_VAL)               */
+	uid_t uid;       /* user id for job */
 	uint32_t nnodes; /* number of nodes in current job step       */
 	uint32_t nodeid; /* relative position of this node in job     */
 	uint32_t ntasks; /* total number of tasks in current job      */
diff --git a/src/plugins/mpi/pmi2/spawn.c b/src/plugins/mpi/pmi2/spawn.c
index a365e8df24..5252f1fa27 100644
--- a/src/plugins/mpi/pmi2/spawn.c
+++ b/src/plugins/mpi/pmi2/spawn.c
@@ -151,7 +151,8 @@ spawn_req_pack(spawn_req_t *req, Buf buf)
 	void *auth_cred;
 	char *auth_info = slurm_get_auth_info();
 
-	auth_cred = g_slurm_auth_create(auth_info);
+	auth_cred = g_slurm_auth_create(auth_info,
+					job_info.uid, NULL, 0);
 	xfree(auth_info);
 	if (auth_cred == NULL) {
 		error("authentication: %s",
diff --git a/src/plugins/mpi/pmix/pmixp_utils.c b/src/plugins/mpi/pmix/pmixp_utils.c
index d7b2266b51..04d958f82e 100644
--- a/src/plugins/mpi/pmix/pmixp_utils.c
+++ b/src/plugins/mpi/pmix/pmixp_utils.c
@@ -338,6 +338,7 @@ static int _pmix_p2p_send_core(char *nodename, const char *address, char *data,
 	msg.forward.timeout = timeout;
 	msg.forward.cnt = 0;
 	msg.forward.nodelist = NULL;
+	slurm_msg_set_r_uid(&msg, slurm_conf.slurmd_user_id);
 	ret_list = slurm_send_addr_recv_msgs(&msg, nodename, timeout);
 	if (!ret_list) {
 		/* This should never happen (when this was
diff --git a/src/sattach/sattach.c b/src/sattach/sattach.c
index 63489050f1..dc03039f3e 100644
--- a/src/sattach/sattach.c
+++ b/src/sattach/sattach.c
@@ -405,6 +405,7 @@ static int _attach_to_tasks(uint32_t jobid,
 	reattach_msg.io_port = io_ports;
 	reattach_msg.cred = fake_cred;
 
+	slurm_msg_set_r_uid(&msg, SLURM_AUTH_UID_ANY);
 	msg.msg_type = REQUEST_REATTACH_TASKS;
 	msg.data = &reattach_msg;
 	msg.protocol_version = layout->start_protocol_ver;
diff --git a/src/slurmctld/agent.c b/src/slurmctld/agent.c
index 1c9d73d754..908ec81929 100644
--- a/src/slurmctld/agent.c
+++ b/src/slurmctld/agent.c
@@ -141,6 +141,7 @@ typedef struct agent_info {
 	uint16_t retry;			/* if set, keep trying */
 	thd_t *thread_struct;		/* thread structures */
 	bool get_reply;			/* flag if reply expected */
+	uid_t r_uid;			/* receiver UID */
 	slurm_msg_type_t msg_type;	/* RPC to be issued */
 	void **msg_args_pptr;		/* RPC data to be used */
 	uint16_t protocol_version;	/* if set, use this version */
@@ -154,6 +155,7 @@ typedef struct task_info {
 	uint32_t *threads_active_ptr;	/* currently active thread ptr */
 	thd_t *thread_struct_ptr;	/* thread structures ptr */
 	bool get_reply;			/* flag if reply expected */
+	uid_t r_uid;			/* receiver UID */
 	slurm_msg_type_t msg_type;	/* RPC to be issued */
 	void *msg_args_ptr;		/* ptr to RPC data to be used */
 	uint16_t protocol_version;	/* if set, use this version */
@@ -391,6 +393,11 @@ static int _valid_agent_arg(agent_arg_t *agent_arg_ptr)
 		     __func__, agent_arg_ptr->node_count, hostlist_cnt);
 		return SLURM_FAILURE;	/* no messages to be sent */
 	}
+	if (!agent_arg_ptr->r_uid_set) {
+		error("%s: r_uid not set for message:%u ",
+		      __func__, agent_arg_ptr->msg_type);
+		return SLURM_ERROR;
+	}
 	return SLURM_SUCCESS;
 }
 
@@ -413,6 +420,7 @@ static agent_info_t *_make_agent_info(agent_arg_t *agent_arg_ptr)
 	thread_ptr = xmalloc(agent_info_ptr->thread_count * sizeof(thd_t));
 	memset(thread_ptr, 0, (agent_info_ptr->thread_count * sizeof(thd_t)));
 	agent_info_ptr->thread_struct  = thread_ptr;
+	agent_info_ptr->r_uid = agent_arg_ptr->r_uid;
 	agent_info_ptr->msg_type       = agent_arg_ptr->msg_type;
 	agent_info_ptr->msg_args_pptr  = &agent_arg_ptr->msg_args;
 	agent_info_ptr->protocol_version = agent_arg_ptr->protocol_version;
@@ -496,6 +504,7 @@ static task_info_t *_make_task_data(agent_info_t *agent_info_ptr, int inx)
 	task_info_ptr->threads_active_ptr= &agent_info_ptr->threads_active;
 	task_info_ptr->thread_struct_ptr = &agent_info_ptr->thread_struct[inx];
 	task_info_ptr->get_reply         = agent_info_ptr->get_reply;
+	task_info_ptr->r_uid = agent_info_ptr->r_uid;
 	task_info_ptr->msg_type          = agent_info_ptr->msg_type;
 	task_info_ptr->msg_args_ptr      = *agent_info_ptr->msg_args_pptr;
 	task_info_ptr->protocol_version  = agent_info_ptr->protocol_version;
@@ -878,6 +887,7 @@ static void *_thread_per_group_rpc(void *args)
 
 	msg.msg_type = msg_type;
 	msg.data     = task_ptr->msg_args_ptr;
+	slurm_msg_set_r_uid(&msg, task_ptr->r_uid);
 #if 0
  	info("sending message type %u to %s", msg_type, thread_ptr->nodelist);
 #endif
@@ -1175,6 +1185,8 @@ static void _queue_agent_retry(agent_info_t * agent_info_ptr, int count)
 	agent_arg_ptr->msg_args = *(agent_info_ptr->msg_args_pptr);
 	*(agent_info_ptr->msg_args_pptr) = NULL;
 
+	set_agent_arg_r_uid(agent_arg_ptr, agent_info_ptr->r_uid);
+
 	j = 0;
 	for (i = 0; i < agent_info_ptr->thread_count; i++) {
 		if (!thread_ptr[i].ret_list) {
@@ -1984,3 +1996,10 @@ extern int retry_list_size(void)
 		return 0;
 	return list_count(retry_list);
 }
+
+/* Set r_uid of agent_arg */
+extern void set_agent_arg_r_uid(agent_arg_t *agent_arg_ptr, uid_t r_uid)
+{
+	agent_arg_ptr->r_uid = r_uid;
+	agent_arg_ptr->r_uid_set = true;
+}
diff --git a/src/slurmctld/agent.h b/src/slurmctld/agent.h
index 93cea823c7..3c216e1b3d 100644
--- a/src/slurmctld/agent.h
+++ b/src/slurmctld/agent.h
@@ -54,6 +54,8 @@ typedef struct agent_arg {
 	uint32_t	node_count;	/* number of nodes to communicate
 					 * with */
 	uint16_t	retry;		/* if set, keep trying */
+	uid_t r_uid;			/* receiver UID */
+	bool r_uid_set;			/* True if receiver UID set*/
 	slurm_addr_t    *addr;          /* if set will send to this
 					   addr not hostlist */
 	hostlist_t	hostlist;	/* hostlist containing the
@@ -114,5 +116,7 @@ extern int retry_list_size(void);
  *	from how slurmd assembles the data from a message
  */
 extern void slurmctld_free_batch_job_launch_msg(batch_job_launch_msg_t * msg);
+/* Set r_uid of agent_arg */
+extern void set_agent_arg_r_uid(agent_arg_t *agent_arg_ptr, uid_t r_uid);
 
 #endif /* !_AGENT_H */
diff --git a/src/slurmctld/backup.c b/src/slurmctld/backup.c
index dc7fc10ab8..67d33dacc9 100644
--- a/src/slurmctld/backup.c
+++ b/src/slurmctld/backup.c
@@ -305,7 +305,7 @@ static void *_background_rpc_mgr(void *no_data)
 	int sockfd;
 	slurm_addr_t cli_addr;
 	slurm_msg_t msg;
-	int error_code;
+	int error_code = SLURM_ERROR;
 	char* node_addr = NULL;
 
 	/* Read configuration only */
@@ -359,8 +359,9 @@ static void *_background_rpc_mgr(void *no_data)
 		slurm_msg_t_init(&msg);
 		if (slurm_receive_msg(newsockfd, &msg, 0) != 0)
 			error("slurm_receive_msg: %m");
+		else
+		        error_code = _background_process_msg(&msg);
 
-		error_code = _background_process_msg(&msg);
 		if ((error_code == SLURM_SUCCESS)			&&
 		    (msg.msg_type == REQUEST_SHUTDOWN_IMMEDIATE)	&&
 		    (slurmctld_config.shutdown_time == 0))
@@ -382,6 +383,10 @@ static int _background_process_msg(slurm_msg_t * msg)
 {
 	int error_code = SLURM_SUCCESS;
 
+	if (!msg->auth_uid_set)
+		fatal("%s: received message without previously validated auth",
+		      __func__);
+
 	if (msg->msg_type != REQUEST_PING) {
 		bool super_user = false;
 		char *auth_info = slurm_get_auth_info();
diff --git a/src/slurmctld/controller.c b/src/slurmctld/controller.c
index ad6dcedcc8..fa06e52005 100644
--- a/src/slurmctld/controller.c
+++ b/src/slurmctld/controller.c
@@ -1653,6 +1653,7 @@ static void _queue_reboot_msg(void)
 				reboot_agent_args->hostlist);
 		debug("Queuing reboot request for nodes %s", host_str);
 		xfree(host_str);
+		set_agent_arg_r_uid(reboot_agent_args, SLURM_AUTH_UID_ANY);
 		agent_queue_request(reboot_agent_args);
 		last_node_update = now;
 		schedule_node_save();
diff --git a/src/slurmctld/fed_mgr.c b/src/slurmctld/fed_mgr.c
index 4c65853d28..49234972d0 100644
--- a/src/slurmctld/fed_mgr.c
+++ b/src/slurmctld/fed_mgr.c
@@ -177,6 +177,8 @@ static int _open_controller_conn(slurmdb_cluster_rec_t *cluster, bool locked)
 		persist_conn->rem_port = cluster->control_port;
 	}
 
+	persist_conn->r_uid = SLURM_AUTH_UID_ANY;
+
 	rc = slurm_persist_conn_open(persist_conn);
 	if (rc != SLURM_SUCCESS) {
 		error("fed_mgr: Unable to open connection to cluster %s using host %s(%u)",
diff --git a/src/slurmctld/job_mgr.c b/src/slurmctld/job_mgr.c
index d350ddfe11..6d8f00162b 100644
--- a/src/slurmctld/job_mgr.c
+++ b/src/slurmctld/job_mgr.c
@@ -5034,6 +5034,7 @@ _signal_batch_job(struct job_record *job_ptr, uint16_t signal, uint16_t flags)
 
 	agent_args->msg_args = kill_tasks_msg;
 	agent_args->node_count = 1;/* slurm/477 be sure to update node_count */
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -12489,8 +12490,7 @@ extern int update_job_str(slurm_msg_t *msg, uid_t uid)
 
 reply:
 	if ((rc != ESLURM_JOB_SETTING_DB_INX) && (msg->conn_fd >= 0)) {
-		slurm_msg_t_init(&resp_msg);
-		resp_msg.protocol_version = msg->protocol_version;
+		response_init(&resp_msg, msg);
 		if (resp_array) {
 			resp_array_msg = _resp_array_xlate(resp_array, job_id);
 			resp_msg.msg_type  = RESPONSE_JOB_ARRAY_ERRORS;
@@ -12590,6 +12590,7 @@ static void _send_job_kill(struct job_record *job_ptr)
 	}
 
 	agent_args->msg_args = kill_job;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -12990,6 +12991,7 @@ abort_job_on_node(uint32_t job_id, struct job_record *job_ptr, char *node_name)
 	agent_info->msg_type	= REQUEST_ABORT_JOB;
 	agent_info->msg_args	= kill_req;
 
+	set_agent_arg_r_uid(agent_info, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_info);
 }
 
@@ -13040,6 +13042,7 @@ kill_job_on_node(uint32_t job_id, struct job_record *job_ptr,
 	agent_info->msg_type	= REQUEST_TERMINATE_JOB;
 	agent_info->msg_args	= kill_req;
 
+	set_agent_arg_r_uid(agent_info, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_info);
 }
 
@@ -13909,6 +13912,7 @@ static void _signal_job(struct job_record *job_ptr, int signal, uint16_t flags)
 	}
 
 	agent_args->msg_args = signal_job_msg;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -13989,6 +13993,7 @@ static void _suspend_job(struct job_record *job_ptr, uint16_t op,
 	}
 
 	agent_args->msg_args = sus_ptr;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -14298,6 +14303,7 @@ extern int job_suspend(suspend_msg_t *sus_ptr, uid_t uid,
 		resp_msg.msg_type  = RESPONSE_SLURM_RC;
 		rc_msg.return_code = rc;
 		resp_msg.data      = &rc_msg;
+		slurm_msg_set_r_uid(&resp_msg, uid);
 		slurm_send_node_msg(conn_fd, &resp_msg);
 	}
 	return rc;
@@ -14452,6 +14458,7 @@ extern int job_suspend2(suspend_msg_t *sus_ptr, uid_t uid,
 			rc_msg.return_code = rc;
 			resp_msg.data      = &rc_msg;
 		}
+		slurm_msg_set_r_uid(&resp_msg, uid);
 		slurm_send_node_msg(conn_fd, &resp_msg);
 
 		if (resp_array_msg) {
@@ -15020,6 +15027,7 @@ extern int job_set_top(top_job_msg_t *top_ptr, uid_t uid, int conn_fd,
 		resp_msg.msg_type  = RESPONSE_SLURM_RC;
 		rc_msg.return_code = rc;
 		resp_msg.data      = &rc_msg;
+		slurm_msg_set_r_uid(&resp_msg, uid);
 		slurm_send_node_msg(conn_fd, &resp_msg);
 	}
 
diff --git a/src/slurmctld/job_scheduler.c b/src/slurmctld/job_scheduler.c
index bb1c7053f6..410a7257f8 100644
--- a/src/slurmctld/job_scheduler.c
+++ b/src/slurmctld/job_scheduler.c
@@ -2384,6 +2384,7 @@ extern void launch_job(struct job_record *job_ptr)
 	agent_arg_ptr->hostlist = hostlist_create(job_ptr->batch_host);
 	agent_arg_ptr->msg_type = REQUEST_BATCH_JOB_LAUNCH;
 	agent_arg_ptr->msg_args = (void *) launch_msg_ptr;
+	set_agent_arg_r_uid(agent_arg_ptr, SLURM_AUTH_UID_ANY);
 
 	/* Launch the RPC via agent */
 	agent_queue_request(agent_arg_ptr);
@@ -3811,6 +3812,7 @@ extern int reboot_job_nodes(struct job_record *job_ptr)
 		node_ptr->last_response = now + slurmctld_conf.resume_timeout;
 	}
 	FREE_NULL_BITMAP(boot_node_bitmap);
+	set_agent_arg_r_uid(reboot_agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(reboot_agent_args);
 
 	if (job_ptr->details)
diff --git a/src/slurmctld/node_mgr.c b/src/slurmctld/node_mgr.c
index 891f609696..e56e3c706d 100644
--- a/src/slurmctld/node_mgr.c
+++ b/src/slurmctld/node_mgr.c
@@ -3572,11 +3572,11 @@ void msg_to_slurmd (slurm_msg_type_t msg_type)
 		xfree (kill_agent_args);
 	} else {
 		debug ("Spawning agent msg_type=%d", msg_type);
+		set_agent_arg_r_uid(kill_agent_args, SLURM_AUTH_UID_ANY);
 		agent_queue_request(kill_agent_args);
 	}
 }
 
-
 /* make_node_alloc - flag specified node as allocated to a job
  * IN node_ptr - pointer to node being allocated
  * IN job_ptr  - pointer to job that is starting
diff --git a/src/slurmctld/node_scheduler.c b/src/slurmctld/node_scheduler.c
index 71c6cfceef..da7ef67e42 100644
--- a/src/slurmctld/node_scheduler.c
+++ b/src/slurmctld/node_scheduler.c
@@ -623,6 +623,7 @@ extern void deallocate_nodes(struct job_record *job_ptr, bool timeout,
 	}
 
 	agent_args->msg_args = kill_job;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -2841,6 +2842,7 @@ extern void launch_prolog(struct job_record *job_ptr)
 		select_g_step_start(build_extern_step(job_ptr));
 
 	/* Launch the RPC via agent */
+	set_agent_arg_r_uid(agent_arg_ptr, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_arg_ptr);
 }
 
@@ -3928,6 +3930,7 @@ extern void re_kill_job(struct job_record *job_ptr)
 	last_job_id = job_ptr->job_id;
 	hostlist_destroy(kill_hostlist);
 	agent_args->msg_args = kill_job;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
diff --git a/src/slurmctld/ping_nodes.c b/src/slurmctld/ping_nodes.c
index 2bf5096cd1..2d2a3dd72a 100644
--- a/src/slurmctld/ping_nodes.c
+++ b/src/slurmctld/ping_nodes.c
@@ -346,6 +346,7 @@ void ping_nodes (void)
 		debug("Spawning ping agent for %s", host_str);
 		xfree(host_str);
 		ping_begin();
+		set_agent_arg_r_uid(ping_agent_args, SLURM_AUTH_UID_ANY);
 		agent_queue_request(ping_agent_args);
 	}
 
@@ -360,6 +361,7 @@ void ping_nodes (void)
 		      host_str, reg_agent_args->node_count);
 		xfree(host_str);
 		ping_begin();
+		set_agent_arg_r_uid(reg_agent_args, SLURM_AUTH_UID_ANY);
 		agent_queue_request(reg_agent_args);
 	}
 
@@ -520,6 +522,7 @@ extern void run_health_check(void)
 		debug("Spawning health check agent for %s", host_str);
 		xfree(host_str);
 		ping_begin();
+		set_agent_arg_r_uid(check_agent_args, SLURM_AUTH_UID_ANY);
 		agent_queue_request(check_agent_args);
 	}
 }
@@ -579,6 +582,7 @@ extern void update_nodes_acct_gather_data(void)
 			info("Updating acct_gather data for %s", host_str);
 		xfree(host_str);
 		ping_begin();
+		set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 		agent_queue_request(agent_args);
 	}
 }
diff --git a/src/slurmctld/srun_comm.c b/src/slurmctld/srun_comm.c
index 0c6ef82d0a..f22a7a859b 100644
--- a/src/slurmctld/srun_comm.c
+++ b/src/slurmctld/srun_comm.c
@@ -55,7 +55,7 @@
  */
 static void _srun_agent_launch(slurm_addr_t *addr, char *host,
 			       slurm_msg_type_t type, void *msg_args,
-			       uint16_t protocol_version)
+			       uid_t r_uid, uint16_t protocol_version)
 {
 	agent_arg_t *agent_args = xmalloc(sizeof(agent_arg_t));
 
@@ -65,6 +65,7 @@ static void _srun_agent_launch(slurm_addr_t *addr, char *host,
 	agent_args->hostlist   = hostlist_create(host);
 	agent_args->msg_type   = type;
 	agent_args->msg_args   = msg_args;
+	set_agent_arg_r_uid(agent_args, r_uid);
 	agent_args->protocol_version = protocol_version;
 
 	agent_queue_request(agent_args);
@@ -130,6 +131,7 @@ extern void srun_allocate (uint32_t job_id)
 
 		_srun_agent_launch(addr, job_ptr->alloc_node,
 				   RESPONSE_RESOURCE_ALLOCATION, msg_arg,
+				   job_ptr->user_id,
 				   job_ptr->start_protocol_ver);
 	}
 }
@@ -152,7 +154,7 @@ extern void srun_allocate_abort(struct job_record *job_ptr)
 		msg_arg->step_id  = NO_VAL;
 		_srun_agent_launch(addr, job_ptr->alloc_node,
 				   SRUN_JOB_COMPLETE,
-				   msg_arg,
+				   msg_arg, job_ptr->user_id,
 				   job_ptr->start_protocol_ver);
 	}
 }
@@ -206,7 +208,8 @@ extern void srun_node_fail (uint32_t job_id, char *node_name)
 		msg_arg->step_id  = step_ptr->step_id;
 		msg_arg->nodelist = xstrdup(node_name);
 		_srun_agent_launch(addr, step_ptr->host, SRUN_NODE_FAIL,
-				   msg_arg, step_ptr->start_protocol_ver);
+				   msg_arg, job_ptr->user_id,
+				   step_ptr->start_protocol_ver);
 	}
 	list_iterator_destroy(step_iterator);
 
@@ -218,7 +221,8 @@ extern void srun_node_fail (uint32_t job_id, char *node_name)
 		msg_arg->step_id  = NO_VAL;
 		msg_arg->nodelist = xstrdup(node_name);
 		_srun_agent_launch(addr, job_ptr->alloc_node, SRUN_NODE_FAIL,
-				   msg_arg, job_ptr->start_protocol_ver);
+				   msg_arg, job_ptr->user_id,
+				   job_ptr->start_protocol_ver);
 	}
 }
 
@@ -252,7 +256,7 @@ extern void srun_ping (void)
 			msg_arg->job_id  = job_ptr->job_id;
 			msg_arg->step_id = NO_VAL;
 			_srun_agent_launch(addr, job_ptr->alloc_node,
-					   SRUN_PING, msg_arg,
+					   SRUN_PING, msg_arg, job_ptr->user_id,
 					   job_ptr->start_protocol_ver);
 		}
 	}
@@ -283,6 +287,7 @@ extern void srun_step_timeout(struct step_record *step_ptr, time_t timeout_val)
 	msg_arg->step_id  = step_ptr->step_id;
 	msg_arg->timeout  = timeout_val;
 	_srun_agent_launch(addr, step_ptr->host, SRUN_TIMEOUT, msg_arg,
+			   step_ptr->job_ptr->user_id,
 			   step_ptr->start_protocol_ver);
 }
 
@@ -309,7 +314,8 @@ extern void srun_timeout (struct job_record *job_ptr)
 		msg_arg->step_id  = NO_VAL;
 		msg_arg->timeout  = job_ptr->end_time;
 		_srun_agent_launch(addr, job_ptr->alloc_node, SRUN_TIMEOUT,
-				   msg_arg, job_ptr->start_protocol_ver);
+				   msg_arg, job_ptr->user_id,
+				   job_ptr->start_protocol_ver);
 	}
 
 
@@ -339,7 +345,8 @@ extern int srun_user_message(struct job_record *job_ptr, char *msg)
 		msg_arg->job_id = job_ptr->job_id;
 		msg_arg->msg    = xstrdup(msg);
 		_srun_agent_launch(addr, job_ptr->resp_host, SRUN_USER_MSG,
-				   msg_arg, job_ptr->start_protocol_ver);
+				   msg_arg, job_ptr->user_id,
+				   job_ptr->start_protocol_ver);
 		return SLURM_SUCCESS;
 	} else if (job_ptr->batch_flag && IS_JOB_RUNNING(job_ptr)) {
 #ifndef HAVE_FRONT_END
@@ -378,6 +385,7 @@ extern int srun_user_message(struct job_record *job_ptr, char *msg)
 		agent_arg_ptr->msg_type = REQUEST_JOB_NOTIFY;
 		agent_arg_ptr->msg_args = (void *) notify_msg_ptr;
 		/* Launch the RPC via agent */
+		set_agent_arg_r_uid(agent_arg_ptr, SLURM_AUTH_UID_ANY);
 		agent_queue_request(agent_arg_ptr);
 		return SLURM_SUCCESS;
 	}
@@ -405,6 +413,7 @@ extern void srun_job_complete (struct job_record *job_ptr)
 		msg_arg->step_id  = NO_VAL;
 		_srun_agent_launch(addr, job_ptr->alloc_node,
 				   SRUN_JOB_COMPLETE, msg_arg,
+				   job_ptr->user_id,
 				   job_ptr->start_protocol_ver);
 	}
 
@@ -439,6 +448,7 @@ extern bool srun_job_suspend (struct job_record *job_ptr, uint16_t op)
 		msg_arg->op     = op;
 		_srun_agent_launch(addr, job_ptr->alloc_node,
 				   SRUN_REQUEST_SUSPEND, msg_arg,
+				   job_ptr->user_id,
 				   job_ptr->start_protocol_ver);
 		msg_sent = true;
 	}
@@ -462,7 +472,8 @@ extern void srun_step_complete (struct step_record *step_ptr)
 		msg_arg->job_id   = step_ptr->job_ptr->job_id;
 		msg_arg->step_id  = step_ptr->step_id;
 		_srun_agent_launch(addr, step_ptr->host, SRUN_JOB_COMPLETE,
-				   msg_arg, step_ptr->start_protocol_ver);
+				   msg_arg, step_ptr->job_ptr->user_id,
+				   step_ptr->start_protocol_ver);
 	}
 }
 
@@ -487,7 +498,8 @@ extern void srun_step_missing (struct step_record *step_ptr,
 		msg_arg->step_id  = step_ptr->step_id;
 		msg_arg->nodelist = xstrdup(node_list);
 		_srun_agent_launch(addr, step_ptr->host, SRUN_STEP_MISSING,
-				   msg_arg, step_ptr->start_protocol_ver);
+				   msg_arg, step_ptr->job_ptr->user_id,
+				   step_ptr->start_protocol_ver);
 	}
 }
 
@@ -511,7 +523,8 @@ extern void srun_step_signal (struct step_record *step_ptr, uint16_t signal)
 		msg_arg->job_step_id = step_ptr->step_id;
 		msg_arg->signal      = signal;
 		_srun_agent_launch(addr, step_ptr->host, SRUN_STEP_SIGNAL,
-				   msg_arg, step_ptr->start_protocol_ver);
+				   msg_arg, step_ptr->job_ptr->user_id,
+				   step_ptr->start_protocol_ver);
 	}
 }
 
@@ -542,7 +555,8 @@ extern void srun_exec(struct step_record *step_ptr, char **argv)
 		for (i=0; i<cnt ; i++)
 			msg_arg->argv[i] = xstrdup(argv[i]);
 		_srun_agent_launch(addr, step_ptr->host, SRUN_EXEC,
-				   msg_arg, step_ptr->start_protocol_ver);
+				   msg_arg, step_ptr->job_ptr->user_id,
+				   step_ptr->start_protocol_ver);
 	} else {
 		error("srun_exec %u.%u lacks communication channel",
 			step_ptr->job_ptr->job_id, step_ptr->step_id);
diff --git a/src/slurmctld/step_mgr.c b/src/slurmctld/step_mgr.c
index b534b6f8c8..10c3eb24df 100644
--- a/src/slurmctld/step_mgr.c
+++ b/src/slurmctld/step_mgr.c
@@ -645,6 +645,7 @@ void signal_step_tasks(struct step_record *step_ptr, uint16_t signal,
 	}
 
 	agent_args->msg_args = kill_tasks_msg;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -690,6 +691,7 @@ void signal_step_tasks_on_node(char* node_name, struct step_record *step_ptr,
 	kill_tasks_msg->job_step_id = step_ptr->step_id;
 	kill_tasks_msg->signal      = signal;
 	agent_args->msg_args = kill_tasks_msg;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
@@ -4311,6 +4313,7 @@ static void _signal_step_timelimit(struct job_record *job_ptr,
 	}
 
 	agent_args->msg_args = kill_step;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
diff --git a/src/slurmd/slurmd/req.c b/src/slurmd/slurmd/req.c
index 37fdc89fca..ec095290f6 100644
--- a/src/slurmd/slurmd/req.c
+++ b/src/slurmd/slurmd/req.c
@@ -486,7 +486,7 @@ static int _send_slurmd_conf_lite (int fd, slurmd_conf_t *cf)
 
 static int
 _send_slurmstepd_init(int fd, int type, void *req,
-		      slurm_addr_t *cli, slurm_addr_t *self,
+		      slurm_addr_t *cli, uid_t cli_uid, slurm_addr_t *self,
 		      hostset_t step_hset, uint16_t protocol_version)
 {
 	int len = 0;
@@ -598,6 +598,7 @@ _send_slurmstepd_init(int fd, int type, void *req,
 	safe_write(fd, get_buf_data(buffer), len);
 	free_buf(buffer);
 	buffer = NULL;
+	safe_write(fd, &cli_uid, sizeof(uid_t));
 
 	/* send self address over to slurmstepd */
 	if (self) {
@@ -691,7 +692,7 @@ rwfail:
  */
 static int
 _forkexec_slurmstepd(uint16_t type, void *req,
-		     slurm_addr_t *cli, slurm_addr_t *self,
+		     slurm_addr_t *cli, uid_t cli_uid, slurm_addr_t *self,
 		     const hostset_t step_hset, uint16_t protocol_version)
 {
 	pid_t pid;
@@ -733,7 +734,7 @@ _forkexec_slurmstepd(uint16_t type, void *req,
 			error("Unable to close write to_slurmd in parent: %m");
 
 		if ((rc = _send_slurmstepd_init(to_stepd[1], type,
-						req, cli, self,
+						req, cli, cli_uid, self,
 						step_hset,
 						protocol_version)) != 0) {
 			error("Unable to init slurmstepd");
@@ -1516,8 +1517,9 @@ _rpc_launch_tasks(slurm_msg_t *msg)
 	slurm_get_stream_addr(msg->conn_fd, &self);
 
 	debug3("_rpc_launch_tasks: call to _forkexec_slurmstepd");
-	errnum = _forkexec_slurmstepd(LAUNCH_TASKS, (void *)req, cli, &self,
-				      step_hset, msg->protocol_version);
+	errnum = _forkexec_slurmstepd(LAUNCH_TASKS, (void *)req, cli,
+				      msg->auth_uid, &self, step_hset,
+				      msg->protocol_version);
 	debug3("_rpc_launch_tasks: return from _forkexec_slurmstepd");
 	_launch_complete_add(req->job_id);
 
@@ -2124,7 +2126,7 @@ static void _spawn_prolog_stepd(slurm_msg_t *msg)
 
 		debug3("%s: call to _forkexec_slurmstepd", __func__);
 		rc = _forkexec_slurmstepd(
-			LAUNCH_TASKS, (void *)launch_req, cli,
+			LAUNCH_TASKS, (void *)launch_req, cli, msg->auth_uid,
 			&self, step_hset, msg->protocol_version);
 		debug3("%s: return from _forkexec_slurmstepd %d", __func__, rc);
 
@@ -2387,8 +2389,9 @@ _rpc_batch_job(slurm_msg_t *msg, bool new_msg)
 		     req->job_id, req->step_id, req->uid);
 
 	debug3("_rpc_batch_job: call to _forkexec_slurmstepd");
-	rc = _forkexec_slurmstepd(LAUNCH_BATCH_JOB, (void *)req, cli, NULL,
-				  (hostset_t)NULL, SLURM_PROTOCOL_VERSION);
+	rc = _forkexec_slurmstepd(LAUNCH_BATCH_JOB, (void *)req, cli,
+				  msg->auth_uid, NULL, (hostset_t)NULL,
+				  SLURM_PROTOCOL_VERSION);
 	debug3("_rpc_batch_job: return from _forkexec_slurmstepd: %d", rc);
 
 	slurm_mutex_unlock(&launch_mutex);
@@ -4414,7 +4417,7 @@ _rpc_reattach_tasks(slurm_msg_t *msg)
 
 	/* Following call fills in gtids and local_pids when successful. */
 	rc = stepd_attach(fd, protocol_version, &ioaddr,
-			  &resp_msg.address, job_cred_sig, resp);
+			  &resp_msg.address, job_cred_sig, msg->auth_uid, resp);
 	if (rc != SLURM_SUCCESS) {
 		debug2("stepd_attach call failed");
 		goto done2;
diff --git a/src/slurmd/slurmd/slurmd.c b/src/slurmd/slurmd/slurmd.c
index 04fed637c1..67260193f4 100644
--- a/src/slurmd/slurmd/slurmd.c
+++ b/src/slurmd/slurmd/slurmd.c
@@ -589,7 +589,11 @@ _service_connection(void *arg)
 		/* if this fails we need to make sure the nodes we forward
 		   to are taken care of and sent back. This way the control
 		   also has a better idea what happened to us */
-		slurm_send_rc_msg(msg, rc);
+		if (msg->auth_uid_set)
+			slurm_send_rc_msg(msg, rc);
+		else
+			debug("%s: incomplete message", __func__);
+
 		goto cleanup;
 	}
 	debug2("got this type of message %d", msg->msg_type);
diff --git a/src/slurmd/slurmstepd/io.c b/src/slurmd/slurmstepd/io.c
index 15dde6f694..329af0ca53 100644
--- a/src/slurmd/slurmstepd/io.c
+++ b/src/slurmd/slurmstepd/io.c
@@ -1960,6 +1960,7 @@ _user_managed_io_connect(srun_info_t *srun, uint32_t gtid)
 	slurm_msg_t_init(&msg);
 	msg.protocol_version = srun->protocol_version;
 	msg.msg_type = TASK_USER_MANAGED_IO_STREAM;
+	slurm_msg_set_r_uid(&msg, srun->uid);
 	msg.data = &user_io_msg;
 	user_io_msg.task_id = gtid;
 
diff --git a/src/slurmd/slurmstepd/mgr.c b/src/slurmd/slurmstepd/mgr.c
index 61da928dff..b964a0ba51 100644
--- a/src/slurmd/slurmstepd/mgr.c
+++ b/src/slurmd/slurmstepd/mgr.c
@@ -166,7 +166,7 @@ typedef struct kill_thread {
  */
 static int  _access(const char *path, int modes, uid_t uid, gid_t gid);
 static void _send_launch_failure(launch_tasks_request_msg_t *,
-				 slurm_addr_t *, int, uint16_t);
+				 slurm_addr_t *, uid_t, int, uint16_t);
 static int  _drain_node(char *reason);
 static int  _fork_all_tasks(stepd_step_rec_t *job, bool *io_initialized);
 static int  _become_user(stepd_step_rec_t *job, struct priv_state *ps);
@@ -218,7 +218,8 @@ static stepd_step_rec_t *reattach_job;
  */
 extern stepd_step_rec_t *
 mgr_launch_tasks_setup(launch_tasks_request_msg_t *msg, slurm_addr_t *cli,
-		       slurm_addr_t *self, uint16_t protocol_version)
+		       uid_t cli_uid, slurm_addr_t *self,
+		       uint16_t protocol_version)
 {
 	stepd_step_rec_t *job = NULL;
 
@@ -228,7 +229,8 @@ mgr_launch_tasks_setup(launch_tasks_request_msg_t *msg, slurm_addr_t *cli,
 		   reset in _send_launch_failure.
 		*/
 		int fail = errno;
-		_send_launch_failure(msg, cli, errno, protocol_version);
+		_send_launch_failure(msg, cli, cli_uid, errno,
+				     protocol_version);
 		errno = fail;
 		return NULL;
 	}
@@ -722,6 +724,7 @@ _send_exit_msg(stepd_step_rec_t *job, uint32_t *tid, int n, int status)
 		/* This should always be set to something else we have a bug. */
 		xassert(srun->protocol_version);
 		resp.protocol_version = srun->protocol_version;
+		slurm_msg_set_r_uid(&resp, srun->uid);
 
 		if (_send_srun_resp_msg(&resp, job->nnodes) != SLURM_SUCCESS)
 			error("Failed to send MESSAGE_TASK_EXIT: %m");
@@ -815,6 +818,7 @@ _one_step_complete_msg(stepd_step_rec_t *job, int first, int last)
 	}
 	/*********************************************/
 	slurm_msg_t_init(&req);
+	slurm_msg_set_r_uid(&req, slurm_conf.slurmd_user_id);
 	req.msg_type = REQUEST_STEP_COMPLETE;
 	req.data = &msg;
 	req.address = step_complete.parent_addr;
@@ -2293,8 +2297,8 @@ static int _drain_node(char *reason)
 }
 
 static void
-_send_launch_failure(launch_tasks_request_msg_t *msg, slurm_addr_t *cli, int rc,
-		     uint16_t protocol_version)
+_send_launch_failure(launch_tasks_request_msg_t *msg, slurm_addr_t *cli,
+		     uid_t cli_uid, int rc, uint16_t protocol_version)
 {
 	slurm_msg_t resp_msg;
 	launch_tasks_response_msg_t resp;
@@ -2330,6 +2334,7 @@ _send_launch_failure(launch_tasks_request_msg_t *msg, slurm_addr_t *cli, int rc,
 	resp_msg.data = &resp;
 	resp_msg.msg_type = RESPONSE_LAUNCH_TASKS;
 	resp_msg.protocol_version = protocol_version;
+	slurm_msg_set_r_uid(&resp_msg, cli_uid);
 
 	resp.node_name     = name;
 	resp.return_code   = rc ? rc : -1;
@@ -2356,6 +2361,7 @@ _send_launch_resp(stepd_step_rec_t *job, int rc)
 
 	slurm_msg_t_init(&resp_msg);
 	resp_msg.address	= srun->resp_addr;
+	slurm_msg_set_r_uid(&resp_msg, srun->uid);
 	resp_msg.protocol_version = srun->protocol_version;
 	resp_msg.data		= &resp;
 	resp_msg.msg_type	= RESPONSE_LAUNCH_TASKS;
diff --git a/src/slurmd/slurmstepd/mgr.h b/src/slurmd/slurmstepd/mgr.h
index 645d5aea20..a5f81106d5 100644
--- a/src/slurmd/slurmstepd/mgr.h
+++ b/src/slurmd/slurmstepd/mgr.h
@@ -53,7 +53,7 @@ void batch_finish(stepd_step_rec_t *job, int rc);
  * Initialize a stepd_step_rec_t structure for a launch tasks
  */
 stepd_step_rec_t *mgr_launch_tasks_setup(launch_tasks_request_msg_t *msg,
-					 slurm_addr_t *client,
+					 slurm_addr_t *cli, uid_t cli_uid,
 					 slurm_addr_t *self,
 					 uint16_t protocol_version);
 
diff --git a/src/slurmd/slurmstepd/req.c b/src/slurmd/slurmstepd/req.c
index d134656600..bb91307a36 100644
--- a/src/slurmd/slurmstepd/req.c
+++ b/src/slurmd/slurmstepd/req.c
@@ -1137,6 +1137,7 @@ _handle_attach(int fd, stepd_step_rec_t *job, uid_t uid)
 	safe_read(fd, &srun->ioaddr, sizeof(slurm_addr_t));
 	safe_read(fd, &srun->resp_addr, sizeof(slurm_addr_t));
 	safe_read(fd, srun->key, SLURM_IO_KEY_SIZE);
+	safe_read(fd, &srun->uid, sizeof(uid_t));
 	safe_read(fd, &srun->protocol_version, sizeof(int));
 
 	if (!srun->protocol_version)
diff --git a/src/slurmd/slurmstepd/slurmstepd.c b/src/slurmd/slurmstepd/slurmstepd.c
index f6c147048a..cf80b203b1 100644
--- a/src/slurmd/slurmstepd/slurmstepd.c
+++ b/src/slurmd/slurmstepd/slurmstepd.c
@@ -72,6 +72,7 @@
 #include "src/slurmd/slurmstepd/slurmstepd_job.h"
 
 static int _init_from_slurmd(int sock, char **argv, slurm_addr_t **_cli,
+			     uid_t *_cli_uid,
 			     slurm_addr_t **_self, slurm_msg_t **_msg,
 			     int *_ngids, gid_t **_gids);
 
@@ -79,8 +80,8 @@ static void _dump_user_env(void);
 static void _send_ok_to_slurmd(int sock);
 static void _send_fail_to_slurmd(int sock);
 static void _got_ack_from_slurmd(int);
-static stepd_step_rec_t *_step_setup(slurm_addr_t *cli, slurm_addr_t *self,
-				     slurm_msg_t *msg);
+static stepd_step_rec_t *_step_setup(slurm_addr_t *cli, uid_t cli_uid,
+				     slurm_addr_t *self, slurm_msg_t *msg);
 #ifdef MEMORY_LEAK_DEBUG
 static void _step_cleanup(stepd_step_rec_t *job, slurm_msg_t *msg, int rc);
 #endif
@@ -98,6 +99,7 @@ int
 main (int argc, char **argv)
 {
 	slurm_addr_t *cli;
+	uid_t cli_uid;
 	slurm_addr_t *self;
 	slurm_msg_t *msg;
 	stepd_step_rec_t *job;
@@ -120,12 +122,12 @@ main (int argc, char **argv)
 		fatal( "failed to initialize authentication plugin" );
 
 	/* Receive job parameters from the slurmd */
-	_init_from_slurmd(STDIN_FILENO, argv, &cli, &self, &msg,
+	_init_from_slurmd(STDIN_FILENO, argv, &cli, &cli_uid, &self, &msg,
 			  &ngids, &gids);
 
 	/* Create the stepd_step_rec_t, mostly from info in a
 	 * launch_tasks_request_msg_t or a batch_job_launch_msg_t */
-	if (!(job = _step_setup(cli, self, msg))) {
+	if (!(job = _step_setup(cli, cli_uid, self, msg))) {
 		_send_fail_to_slurmd(STDOUT_FILENO);
 		rc = SLURM_FAILURE;
 		goto ending;
@@ -433,7 +435,8 @@ rwfail:
  */
 static int
 _init_from_slurmd(int sock, char **argv,
-		  slurm_addr_t **_cli, slurm_addr_t **_self, slurm_msg_t **_msg,
+		  slurm_addr_t **_cli, uid_t *_cli_uid,
+		  slurm_addr_t **_self, slurm_msg_t **_msg,
 		  int *_ngids, gid_t **_gids)
 {
 	char *incoming_buffer = NULL;
@@ -441,6 +444,7 @@ _init_from_slurmd(int sock, char **argv,
 	int step_type;
 	int len, proto;
 	slurm_addr_t *cli = NULL;
+	uid_t cli_uid;
 	slurm_addr_t *self = NULL;
 	slurm_msg_t *msg = NULL;
 	int ngids = 0;
@@ -491,6 +495,7 @@ _init_from_slurmd(int sock, char **argv,
 	if (slurm_unpack_slurm_addr_no_alloc(cli, buffer) == SLURM_ERROR)
 		fatal("slurmstepd: problem with unpack of slurmd_conf");
 	free_buf(buffer);
+	safe_read(sock, &cli_uid, sizeof(uid_t));
 
 	/* receive self from slurmd */
 	safe_read(sock, &len, sizeof(int));
@@ -560,6 +565,7 @@ _init_from_slurmd(int sock, char **argv,
 	}
 
 	*_cli = cli;
+	*_cli_uid = cli_uid;
 	*_self = self;
 	*_msg = msg;
 	*_ngids = ngids;
@@ -573,7 +579,8 @@ rwfail:
 }
 
 static stepd_step_rec_t *
-_step_setup(slurm_addr_t *cli, slurm_addr_t *self, slurm_msg_t *msg)
+_step_setup(slurm_addr_t *cli, uid_t cli_uid, slurm_addr_t *self,
+	    slurm_msg_t *msg)
 {
 	stepd_step_rec_t *job = NULL;
 
@@ -584,7 +591,7 @@ _step_setup(slurm_addr_t *cli, slurm_addr_t *self, slurm_msg_t *msg)
 		break;
 	case REQUEST_LAUNCH_TASKS:
 		debug2("setup for a launch_task");
-		job = mgr_launch_tasks_setup(msg->data, cli, self,
+		job = mgr_launch_tasks_setup(msg->data, cli, cli_uid, self,
 					     msg->protocol_version);
 		break;
 	default:
diff --git a/src/slurmd/slurmstepd/slurmstepd_job.c b/src/slurmd/slurmstepd/slurmstepd_job.c
index f83980a666..ca3c2e5a42 100644
--- a/src/slurmd/slurmstepd/slurmstepd_job.c
+++ b/src/slurmd/slurmstepd/slurmstepd_job.c
@@ -346,7 +346,7 @@ stepd_step_rec_create(launch_tasks_request_msg_t *msg, uint16_t protocol_version
 		memset(&io_addr, 0, sizeof(slurm_addr_t));
 	}
 
-	srun = srun_info_create(msg->cred, &resp_addr, &io_addr,
+	srun = srun_info_create(msg->cred, &resp_addr, &io_addr, job->uid,
 				protocol_version);
 
 	job->profile     = msg->profile;
@@ -504,7 +504,7 @@ batch_stepd_step_rec_create(batch_job_launch_msg_t *msg)
 	get_cred_gres(msg->cred, conf->node_name,
 		      &job->job_gres_list, &job->step_gres_list);
 
-	srun = srun_info_create(NULL, NULL, NULL, (uint16_t)NO_VAL);
+	srun = srun_info_create(NULL, NULL, NULL, job->uid, (uint16_t)NO_VAL);
 
 	list_append(job->sruns, (void *) srun);
 
@@ -578,7 +578,7 @@ stepd_step_rec_destroy(stepd_step_rec_t *job)
 
 extern srun_info_t *
 srun_info_create(slurm_cred_t *cred, slurm_addr_t *resp_addr,
-		 slurm_addr_t *ioaddr, uint16_t protocol_version)
+		 slurm_addr_t *ioaddr, uid_t uid, uint16_t protocol_version)
 {
 	char             *data = NULL;
 	uint32_t          len  = 0;
@@ -589,6 +589,7 @@ srun_info_create(slurm_cred_t *cred, slurm_addr_t *resp_addr,
 	if (!protocol_version || (protocol_version == (uint16_t)NO_VAL))
 		protocol_version = SLURM_PROTOCOL_VERSION;
 	srun->protocol_version = protocol_version;
+	srun->uid = uid;
 	/*
 	 * If no credential was provided, return the empty
 	 * srun info object. (This is used, for example, when
diff --git a/src/slurmd/slurmstepd/slurmstepd_job.h b/src/slurmd/slurmstepd/slurmstepd_job.h
index c6875a54e9..75d89d64f0 100644
--- a/src/slurmd/slurmstepd/slurmstepd_job.h
+++ b/src/slurmd/slurmstepd/slurmstepd_job.h
@@ -68,6 +68,7 @@ typedef struct {
 	slurm_addr_t ioaddr;       /* Address to connect on for normal I/O.
 				      Spawn IO uses messages to the normal
 				      resp_addr. */
+	uid_t uid;		   /* user id for job */
 	uint16_t protocol_version; /* protocol_version of the srun */
 } srun_info_t;
 
@@ -239,7 +240,8 @@ stepd_step_rec_t * batch_stepd_step_rec_create(batch_job_launch_msg_t *msg);
 void stepd_step_rec_destroy(stepd_step_rec_t *job);
 
 srun_info_t * srun_info_create(slurm_cred_t *cred, slurm_addr_t *respaddr,
-			       slurm_addr_t *ioaddr, uint16_t protocol_version);
+			       slurm_addr_t *ioaddr, uid_t uid,
+			       uint16_t protocol_version);
 
 void  srun_info_destroy(srun_info_t *srun);
 
diff --git a/src/slurmdbd/read_config.c b/src/slurmdbd/read_config.c
index af78611aad..9baadc307c 100644
--- a/src/slurmdbd/read_config.c
+++ b/src/slurmdbd/read_config.c
@@ -596,6 +596,7 @@ extern int read_slurmdbd_conf(void)
 	if (!slurmdbd_conf->purge_usage)
 		slurmdbd_conf->purge_usage = NO_VAL;
 
+	slurm_conf.last_update = time(NULL);
 	slurm_mutex_unlock(&conf_mutex);
 	return SLURM_SUCCESS;
 }
diff --git a/src/slurmdbd/slurmdbd.c b/src/slurmdbd/slurmdbd.c
index 232b0016bd..3360327363 100644
--- a/src/slurmdbd/slurmdbd.c
+++ b/src/slurmdbd/slurmdbd.c
@@ -826,6 +826,7 @@ static int _send_slurmctld_register_req(slurmdb_cluster_rec_t *cluster_rec)
 	} else {
 		slurm_msg_t out_msg;
 		slurm_msg_t_init(&out_msg);
+		slurm_msg_set_r_uid(&out_msg, SLURM_AUTH_UID_ANY);
 		out_msg.msg_type = ACCOUNTING_REGISTER_CTLD;
 		out_msg.flags = SLURM_GLOBAL_AUTH_KEY;
 		out_msg.protocol_version = cluster_rec->rpc_version;
-- 
2.35.3


From 6421b17cf850cbbb7d23cd0d9a3a41d1a8397cb2 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 30 May 2022 11:04:17 +0200
Subject: [PATCH 02/34] Convert slurm_conf.slurmd_user_id ->
 slurm_get_slurmd_user_id()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/api/signal.c                   | 4 ++--
 src/plugins/mpi/pmix/pmixp_utils.c | 2 +-
 src/slurmd/slurmstepd/mgr.c        | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/api/signal.c b/src/api/signal.c
index c4932a477b..f48fb1686d 100644
--- a/src/api/signal.c
+++ b/src/api/signal.c
@@ -100,7 +100,7 @@ static int _signal_batch_script_step(const resource_allocation_response_msg_t
 	rpc.signal = signal;
 
 	slurm_msg_t_init(&msg);
-	slurm_msg_set_r_uid(&msg, slurm_conf.slurmd_user_id);
+	slurm_msg_set_r_uid(&msg, slurm_get_slurmd_user_id());
 	msg.msg_type = REQUEST_SIGNAL_TASKS;
 	msg.data = &rpc;
 	if (slurm_conf_get_addr(name, &msg.address) == SLURM_ERROR) {
@@ -155,7 +155,7 @@ static int _terminate_batch_script_step(const resource_allocation_response_msg_t
 
 	slurm_msg_t_init(&msg);
 	msg.msg_type = REQUEST_TERMINATE_TASKS;
-	slurm_msg_set_r_uid(&msg, slurm_conf.slurmd_user_id);
+	slurm_msg_set_r_uid(&msg, slurm_get_slurmd_user_id());
 	msg.data = &rpc;
 
 	if (slurm_conf_get_addr(name, &msg.address) == SLURM_ERROR) {
diff --git a/src/plugins/mpi/pmix/pmixp_utils.c b/src/plugins/mpi/pmix/pmixp_utils.c
index 04d958f82e..c260b3d7bd 100644
--- a/src/plugins/mpi/pmix/pmixp_utils.c
+++ b/src/plugins/mpi/pmix/pmixp_utils.c
@@ -338,7 +338,7 @@ static int _pmix_p2p_send_core(char *nodename, const char *address, char *data,
 	msg.forward.timeout = timeout;
 	msg.forward.cnt = 0;
 	msg.forward.nodelist = NULL;
-	slurm_msg_set_r_uid(&msg, slurm_conf.slurmd_user_id);
+	slurm_msg_set_r_uid(&msg, slurm_get_slurmd_user_id());
 	ret_list = slurm_send_addr_recv_msgs(&msg, nodename, timeout);
 	if (!ret_list) {
 		/* This should never happen (when this was
diff --git a/src/slurmd/slurmstepd/mgr.c b/src/slurmd/slurmstepd/mgr.c
index b964a0ba51..0200237437 100644
--- a/src/slurmd/slurmstepd/mgr.c
+++ b/src/slurmd/slurmstepd/mgr.c
@@ -818,7 +818,7 @@ _one_step_complete_msg(stepd_step_rec_t *job, int first, int last)
 	}
 	/*********************************************/
 	slurm_msg_t_init(&req);
-	slurm_msg_set_r_uid(&req, slurm_conf.slurmd_user_id);
+	slurm_msg_set_r_uid(&req, slurm_get_slurmd_user_id());
 	req.msg_type = REQUEST_STEP_COMPLETE;
 	req.data = &msg;
 	req.address = step_complete.parent_addr;
-- 
2.35.3


From 0f246d7540a1558bb29abed6693f82fd0a2a2753 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Tue, 10 May 2022 21:44:04 +0200
Subject: [PATCH 03/34] Convert slurm_conf.slurm_user_id ->
 slurm_get_slurm_user_id()

Signed-off-by: Egbert Eich <eich@suse.com>

# Conflicts:
#	src/common/slurm_protocol_api.c
#	src/slurmctld/backup.c
#	src/slurmctld/controller.c
---
 src/api/reconfigure.c           | 2 +-
 src/common/slurm_protocol_api.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/api/reconfigure.c b/src/api/reconfigure.c
index 85adfbe50a..bfc7ef5724 100644
--- a/src/api/reconfigure.c
+++ b/src/api/reconfigure.c
@@ -159,7 +159,7 @@ _send_message_controller (enum controller_id dest, slurm_msg_t *req)
 	if ((fd = slurm_open_controller_conn_spec(dest)) < 0)
 		slurm_seterrno_ret(SLURMCTLD_COMMUNICATIONS_CONNECTION_ERROR);
 
-	slurm_msg_set_r_uid(req, slurm_conf.slurm_user_id);
+	slurm_msg_set_r_uid(req, slurm_get_slurm_user_id());
 	if (slurm_send_node_msg(fd, req) < 0) {
 		slurm_shutdown_msg_conn(fd);
 		slurm_seterrno_ret(SLURMCTLD_COMMUNICATIONS_SEND_ERROR);
diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index f97b6be357..936670b5b2 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -4620,7 +4620,7 @@ int slurm_send_only_controller_msg(slurm_msg_t *req)
 		goto cleanup;
 	}
 
-	slurm_msg_set_r_uid(req, slurm_conf.slurm_user_id);
+	slurm_msg_set_r_uid(req, slurm_get_slurm_user_id());
 
 	if ((rc = slurm_send_node_msg(fd, req)) < 0) {
 		rc = SLURM_ERROR;
-- 
2.35.3


From 926219577ac460be3291cc4b21d8ee7c50b71236 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Tue, 10 May 2022 21:46:37 +0200
Subject: [PATCH 04/34] Convert slurm_conf.last_update ->
 slurmctld_conf.last_update

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 4 ++--
 src/slurmdbd/read_config.c      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 936670b5b2..1dfb4759f1 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -878,10 +878,10 @@ static int _check_hash(buf_t *buffer, header_t *header, slurm_msg_t *msg,
 	static time_t config_update = (time_t) -1;
 	static bool block_null_hash = true;
 
-	if (config_update != slurm_conf.last_update) {
+	if (config_update != slurmctld_conf.last_update) {
 		block_null_hash = (xstrcasestr(slurm_conf.comm_params,
 					       "block_null_hash"));
-		config_update = slurm_conf.last_update;
+		config_update = slurmctld_conf.last_update;
 	}
 
 	rc = auth_g_get_data(cred, &cred_hash, &cred_hash_len);
diff --git a/src/slurmdbd/read_config.c b/src/slurmdbd/read_config.c
index 9baadc307c..cd956255f0 100644
--- a/src/slurmdbd/read_config.c
+++ b/src/slurmdbd/read_config.c
@@ -596,7 +596,7 @@ extern int read_slurmdbd_conf(void)
 	if (!slurmdbd_conf->purge_usage)
 		slurmdbd_conf->purge_usage = NO_VAL;
 
-	slurm_conf.last_update = time(NULL);
+	slurmctld_conf.last_update = time(NULL);
 	slurm_mutex_unlock(&conf_mutex);
 	return SLURM_SUCCESS;
 }
-- 
2.35.3


From 3e8d825c10c9e946793a15f18a28a2351505e453 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Tue, 10 May 2022 21:54:56 +0200
Subject: [PATCH 05/34] Convert log_flag_hex() to local _print_data()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 1dfb4759f1..0238090482 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -3611,7 +3611,9 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 		goto total_return;
 	}
 
-	log_flag_hex(NET_RAW, buf, buflen, "%s: read", __func__);
+#if     _DEBUG
+        _print_data (buf, buflen);
+#endif
 	buffer = create_buf(buf, buflen);
 
 	if (unpack_header(&header, buffer) == SLURM_ERROR) {
-- 
2.35.3


From b6dd42e7985b91a701ed69348a0b8f66c397a0ef Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Tue, 10 May 2022 21:57:09 +0200
Subject: [PATCH 06/34] Convert slurm_conf.comm_params ->
 slurm_get_comm_parameters()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 0238090482..9af1a4ed7d 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -879,8 +879,10 @@ static int _check_hash(buf_t *buffer, header_t *header, slurm_msg_t *msg,
 	static bool block_null_hash = true;
 
 	if (config_update != slurmctld_conf.last_update) {
-		block_null_hash = (xstrcasestr(slurm_conf.comm_params,
+	        char * comm_parameters = slurm_get_comm_parameters();
+		block_null_hash = (xstrcasestr(comm_parameters,
 					       "block_null_hash"));
+		xfree(comm_parameters);
 		config_update = slurmctld_conf.last_update;
 	}
 
-- 
2.35.3


From 03f22271c78f963046e13ef723e8ba6d2785263a Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Tue, 10 May 2022 21:58:46 +0200
Subject: [PATCH 07/34] Convert slurm_conf.msg_timeout no ->
 slurm_get_msg_timeout()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 9af1a4ed7d..c3ee239858 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -3576,12 +3576,12 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 
 	if (timeout <= 0) {
 		/* convert secs to msec */
-		timeout = slurm_conf.msg_timeout * 1000;
+		timeout = slurm_get_msg_timeout() * 1000;
 		orig_timeout = timeout;
 	}
 	if (steps) {
 		if (message_timeout < 0)
-			message_timeout = slurm_conf.msg_timeout * 1000;
+			message_timeout = slurm_get_msg_timeout() * 1000;
 		orig_timeout = (timeout -
 				(message_timeout*(steps-1)))/steps;
 		steps--;
@@ -3592,9 +3592,9 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 	/* we compare to the orig_timeout here because that is really
 	 *  what we are going to wait for each step
 	 */
-	if (orig_timeout >= (slurm_conf.msg_timeout * 10000)) {
+	if (orig_timeout >= (slurm_get_msg_timeout() * 10000)) {
 		log_flag(NET, "%s: Sending a message with timeout's greater than %d seconds, requested timeout is %d seconds",
-			 __func__, (slurm_conf.msg_timeout * 10),
+			 __func__, (slurm_get_msg_timeout() * 10),
 			 (timeout/1000));
 	} else if (orig_timeout < 1000) {
 		log_flag(NET, "%s: Sending a message with a very short timeout of %d milliseconds each step in the tree has %d milliseconds",
-- 
2.35.3


From ec886af102dc7911fccaf24c06ba775f2fb01674 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Wed, 11 May 2022 08:36:38 +0200
Subject: [PATCH 08/34] Fix g_slurm_auth_create in _pack_composite_msg

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_pack.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_pack.c b/src/common/slurm_protocol_pack.c
index 0c7cdbcb5b..da7304362c 100644
--- a/src/common/slurm_protocol_pack.c
+++ b/src/common/slurm_protocol_pack.c
@@ -5201,7 +5201,8 @@ _pack_composite_msg(composite_msg_t *msg, Buf buffer, uint16_t protocol_version)
 				/* FIXME: this should handle the
 				 * _global_auth_key() as well. */
 				tmp_info->auth_cred =
-					g_slurm_auth_create(auth_info);
+				        g_slurm_auth_create(auth_info,
+					tmp_info->restrict_uid, NULL, 0);
 				xfree(auth_info);
 			}
 
-- 
2.35.3


From 1caae44524c437809cfd0fc9a955eb9330803805 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Wed, 11 May 2022 17:49:40 +0200
Subject: [PATCH 09/34] Add to set_agent_arg_r_uid() call to
 _xmit_new_end_time()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/job_mgr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/slurmctld/job_mgr.c b/src/slurmctld/job_mgr.c
index 6d8f00162b..60b1c2b310 100644
--- a/src/slurmctld/job_mgr.c
+++ b/src/slurmctld/job_mgr.c
@@ -13291,6 +13291,7 @@ _xmit_new_end_time(struct job_record *job_ptr)
 #endif
 
 	agent_args->msg_args = job_time_msg_ptr;
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 	return;
 }
-- 
2.35.3


From 0031048230d57d91e9fb3aecc0bf863b92858f1c Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Wed, 11 May 2022 19:41:13 +0200
Subject: [PATCH 10/34] Disable Message Aggregation

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmd/slurmd/slurmd.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/slurmd/slurmd/slurmd.c b/src/slurmd/slurmd/slurmd.c
index 67260193f4..0f1a15cc65 100644
--- a/src/slurmd/slurmd/slurmd.c
+++ b/src/slurmd/slurmd/slurmd.c
@@ -168,7 +168,9 @@ static void      _decrement_thd_count(void);
 static void      _destroy_conf(void);
 static int       _drain_node(char *reason);
 static void      _fill_registration_msg(slurm_node_registration_status_msg_t *);
+#if 0
 static uint64_t  _get_int(const char *my_str);
+#endif
 static void      _handle_connection(int fd, slurm_addr_t *client);
 static void      _hup_handler(int);
 static void      _increment_thd_count(void);
@@ -2011,6 +2013,7 @@ static int _set_topo_info(void)
 	return rc;
 }
 
+#if 0
 static uint64_t _get_int(const char *my_str)
 {
 	char *end = NULL;
@@ -2023,23 +2026,33 @@ static uint64_t _get_int(const char *my_str)
 		return NO_VAL;
 	return value;
 }
+#endif
 
 static uint64_t _parse_msg_aggr_params(int type, char *params)
 {
 	uint64_t value = NO_VAL;
+#if 0
 	char *sub_str = NULL;
-
+#endif
 	if (!params)
 		return NO_VAL;
 
 	switch (type) {
 	case WINDOW_TIME:
+	  info("Message aggregation has been disabled, "
+	       "please check SLE release notes!");
+#if 0
 		if ((sub_str = xstrcasestr(params, "WindowTime=")))
 			value = _get_int(sub_str + 11);
+#endif
 		break;
 	case WINDOW_MSGS:
+	  info("Message aggregation has been disabled, "
+	       "please check SLE release notes!");
+#if 0
 		if ((sub_str = xstrcasestr(params, "WindowMsgs=")))
 			value = _get_int(sub_str + 11);
+#endif
 		break;
 	default:
 		fatal("invalid message aggregation parameters: %s", params);
-- 
2.35.3


From 796def45daa1997bb5f41f191b1ee9663dfb116c Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Fri, 13 May 2022 09:01:15 +0200
Subject: [PATCH 11/34] Add missing slurm_msg_set_r_uid()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmd/slurmstepd/mgr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/slurmd/slurmstepd/mgr.c b/src/slurmd/slurmstepd/mgr.c
index 0200237437..4fba18f390 100644
--- a/src/slurmd/slurmstepd/mgr.c
+++ b/src/slurmd/slurmstepd/mgr.c
@@ -2428,6 +2428,7 @@ _send_complete_batch_script_msg(stepd_step_rec_t *job, int err, int status)
 				slurm_set_addr_char(&req_msg.address,
 						    conf->port, conf->hostname);
 			}
+			slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 			msg_rc = slurm_send_recv_rc_msg_only_one(&req_msg,
 								 &rc, 0);
 		}
-- 
2.35.3


From b4eb75cfdb7afcba91370fe60f81b0fa4fd2369d Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Fri, 13 May 2022 20:16:05 +0200
Subject: [PATCH 12/34] Fix g_slurm_auth_create in _stepd_connect_legacy

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/stepd_api.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/common/stepd_api.c b/src/common/stepd_api.c
index 4fb3a7c497..f7c64bfd6f 100644
--- a/src/common/stepd_api.c
+++ b/src/common/stepd_api.c
@@ -247,7 +247,8 @@ stepd_connect(const char *directory, const char *nodename,
 	buffer = init_buf(0);
 	/* Create an auth credential */
 	auth_info = slurm_get_auth_info();
-	auth_cred = g_slurm_auth_create(auth_info);
+	auth_cred = g_slurm_auth_create(auth_info,
+					slurm_get_slurmd_user_id(), NULL, 0);
 	xfree(auth_info);
 	if (auth_cred == NULL) {
 		error("Creating authentication credential: %s",
-- 
2.35.3


From e4ad1a5530e08ef3eae976a78a3589d52c9cad3b Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Sat, 14 May 2022 09:23:17 +0200
Subject: [PATCH 13/34] Add missing auth_info arguments

Signed-off-by: Egbert Eich <eich@suse.com>

# Conflicts:
#	src/common/slurm_protocol_api.c
---
 src/common/slurm_protocol_api.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index c3ee239858..14e33bdeb7 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -869,7 +869,7 @@ char *slurm_get_priority_weight_tres(void)
 	return weights;
 }
 
-static int _check_hash(buf_t *buffer, header_t *header, slurm_msg_t *msg,
+static int _check_hash(struct slurm_buf *buffer, header_t *header, slurm_msg_t *msg,
 		       void *cred)
 {
 	char *cred_hash = NULL;
@@ -3158,6 +3158,7 @@ extern int slurm_unpack_received_msg(slurm_msg_t *msg, int fd, Buf buffer)
 	header_t header;
 	int rc;
 	void *auth_cred = NULL;
+	char *auth_info;
 	uint32_t body_offset = 0;
 
 	if (unpack_header(&header, buffer) == SLURM_ERROR) {
@@ -3208,7 +3209,7 @@ extern int slurm_unpack_received_msg(slurm_msg_t *msg, int fd, Buf buffer)
 	if (header.flags & SLURM_GLOBAL_AUTH_KEY) {
 		rc = g_slurm_auth_verify(auth_cred, _global_auth_key());
 	} else {
-		char *auth_info = slurm_get_auth_info();
+		auth_info = slurm_get_auth_info();
 		rc = g_slurm_auth_verify(auth_cred, auth_info);
 		xfree(auth_info);
 	}
@@ -3222,7 +3223,9 @@ extern int slurm_unpack_received_msg(slurm_msg_t *msg, int fd, Buf buffer)
 		goto total_return;
 	}
 
-	msg->auth_uid = g_slurm_auth_get_uid(auth_cred);
+	auth_info = slurm_get_auth_info();
+	msg->auth_uid = g_slurm_auth_get_uid(auth_cred, auth_info);
+	xfree(auth_info);
 	msg->auth_uid_set = true;
 
 	/*
@@ -3385,6 +3388,7 @@ List slurm_receive_msgs(int fd, int steps, int timeout)
 	ret_data_info_t *ret_data_info = NULL;
 	List ret_list = NULL;
 	int orig_timeout = timeout;
+	char *auth_info;
 
 	xassert(fd >= 0);
 
@@ -3490,7 +3494,7 @@ List slurm_receive_msgs(int fd, int steps, int timeout)
 	if (header.flags & SLURM_GLOBAL_AUTH_KEY) {
 		rc = g_slurm_auth_verify(auth_cred, _global_auth_key());
 	} else {
-		char *auth_info = slurm_get_auth_info();
+		auth_info = slurm_get_auth_info();
 		rc = g_slurm_auth_verify(auth_cred, auth_info);
 		xfree(auth_info);
 	}
@@ -3504,7 +3508,9 @@ List slurm_receive_msgs(int fd, int steps, int timeout)
 		goto total_return;
 	}
 
-	msg.auth_uid = g_slurm_auth_get_uid(auth_cred);
+	auth_info = slurm_get_auth_info();
+	msg.auth_uid = g_slurm_auth_get_uid(auth_cred, auth_info);
+	xfree(auth_info);
 	msg.auth_uid_set = true;
 	/*
 	 * Unpack message body
@@ -3743,6 +3749,7 @@ int slurm_receive_msg_and_forward(int fd, slurm_addr_t *orig_addr,
 	int rc;
 	void *auth_cred = NULL;
 	Buf buffer;
+	char *auth_info;
 
 	xassert(fd >= 0);
 
@@ -3878,7 +3885,7 @@ int slurm_receive_msg_and_forward(int fd, slurm_addr_t *orig_addr,
 	if (header.flags & SLURM_GLOBAL_AUTH_KEY) {
 		rc = g_slurm_auth_verify(auth_cred, _global_auth_key());
 	} else {
-		char *auth_info = slurm_get_auth_info();
+		auth_info = slurm_get_auth_info();
 		rc = g_slurm_auth_verify(auth_cred, auth_info);
 		xfree(auth_info);
 	}
@@ -3892,7 +3899,9 @@ int slurm_receive_msg_and_forward(int fd, slurm_addr_t *orig_addr,
 		goto total_return;
 	}
 
-	msg->auth_uid = g_slurm_auth_get_uid(auth_cred);
+	auth_info = slurm_get_auth_info();
+	msg->auth_uid = g_slurm_auth_get_uid(auth_cred, auth_info);
+	xfree(auth_info);
 	msg->auth_uid_set = true;
 
 	/*
-- 
2.35.3


From c2db3dec906d1e4139a24c90574e4f3e5462aec4 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 08:04:00 +0200
Subject: [PATCH 14/34] Fix argument in call to slurm_get_plugin_hash_enable

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_auth.c         | 4 ++--
 src/common/slurm_auth.h         | 2 +-
 src/common/slurm_protocol_api.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/common/slurm_auth.c b/src/common/slurm_auth.c
index 7ce0887ead..a423ad98a4 100644
--- a/src/common/slurm_auth.c
+++ b/src/common/slurm_auth.c
@@ -131,12 +131,12 @@ slurm_auth_generic_errstr( int slurm_errno )
         }
 }
 
-extern bool slurm_get_plugin_hash_enable(int index)
+extern bool slurm_get_plugin_hash_enable()
 {
        if (slurm_auth_init(NULL) < 0)
                return true;
 
-       return *(ops[index].hash_enable);
+       return *(ops.hash_enable);
 
 }
 
diff --git a/src/common/slurm_auth.h b/src/common/slurm_auth.h
index f7ab7ac68e..1be28f3aa9 100644
--- a/src/common/slurm_auth.h
+++ b/src/common/slurm_auth.h
@@ -138,7 +138,7 @@ extern int slurm_auth_fini( void );
  * Check if plugin type corresponding to the authentication
  * plugin index supports hash.
  */
-extern bool slurm_get_plugin_hash_enable(int index);
+extern bool slurm_get_plugin_hash_enable();
 
 /*
  * Static bindings for the global authentication context.
diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 14e33bdeb7..eb61f3c7db 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -894,7 +894,7 @@ static int _check_hash(struct slurm_buf *buffer, header_t *header, slurm_msg_t *
 			   &msg->msg_type, sizeof(msg->msg_type)))
 			rc = SLURM_ERROR;
 	} else if (block_null_hash &&
-		   slurm_get_plugin_hash_enable(msg->auth_index))
+		   slurm_get_plugin_hash_enable())
 		rc = SLURM_ERROR;
 
 	xfree(cred_hash);
-- 
2.35.3


From 5a95f85a58d88a2cb28c464ce2f3a32f089f18a5 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 08:04:48 +0200
Subject: [PATCH 15/34] Fix buffer type

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index eb61f3c7db..edab9edd46 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -3570,7 +3570,7 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 	int rc;
 	void *auth_cred = NULL;
 	slurm_msg_t msg;
-	buf_t *buffer;
+	Buf buffer;
 	ret_data_info_t *ret_data_info = NULL;
 	List ret_list = NULL;
 	int orig_timeout = timeout;
-- 
2.35.3


From 68103d2bda6d889613bb51a87e529b5223bed384 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 08:06:49 +0200
Subject: [PATCH 16/34] Fix arguments to forward_init()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index edab9edd46..6c554f5882 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -3614,7 +3614,7 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 	 *  the message.
 	 */
 	if (slurm_msg_recvfrom_timeout(fd, &buf, &buflen, 0, timeout) < 0) {
-		forward_init(&header.forward);
+	        forward_init(&header.forward, NULL);
 		rc = errno;
 		goto total_return;
 	}
-- 
2.35.3


From ab0eb3e04760095395289f5fbe16d089f57bc714 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 08:07:20 +0200
Subject: [PATCH 17/34] Fix log message function

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 6c554f5882..745d477cd2 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -3593,17 +3593,17 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 		steps--;
 	}
 
-	log_flag(NET, "%s: orig_timeout was %d we have %d steps and a timeout of %d",
+	debug("%s: orig_timeout was %d we have %d steps and a timeout of %d",
 		 __func__, orig_timeout, steps, timeout);
 	/* we compare to the orig_timeout here because that is really
 	 *  what we are going to wait for each step
 	 */
 	if (orig_timeout >= (slurm_get_msg_timeout() * 10000)) {
-		log_flag(NET, "%s: Sending a message with timeout's greater than %d seconds, requested timeout is %d seconds",
+		debug("%s: Sending a message with timeout's greater than %d seconds, requested timeout is %d seconds",
 			 __func__, (slurm_get_msg_timeout() * 10),
 			 (timeout/1000));
 	} else if (orig_timeout < 1000) {
-		log_flag(NET, "%s: Sending a message with a very short timeout of %d milliseconds each step in the tree has %d milliseconds",
+		debug("%s: Sending a message with a very short timeout of %d milliseconds each step in the tree has %d milliseconds",
 			 __func__, timeout, orig_timeout);
 	}
 
-- 
2.35.3


From 6729c867eb08771a7c352b4bc7fb3091c1dec748 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 08:26:13 +0200
Subject: [PATCH 18/34] Fix aruments in g_slurm_auth_unpack()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 745d477cd2..bccdfec29a 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -3660,7 +3660,7 @@ List slurm_receive_resp_msgs(int fd, int steps, int timeout)
 		      __func__);
 	}
 
-	if (!(auth_cred = g_slurm_auth_unpack(buffer, header.version))) {
+	if (!(auth_cred = g_slurm_auth_unpack(buffer))) {
 		error("%s: auth_g_unpack: %m", __func__);
 		free_buf(buffer);
 		rc = ESLURM_PROTOCOL_INCOMPLETE_PACKET;
-- 
2.35.3


From 263dc606e14d809643ceced043cb5f985a9dc469 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 10:12:08 +0200
Subject: [PATCH 19/34] Fix auth_g_get_data()

Remove not existing wrapper.

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_auth.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/common/slurm_auth.c b/src/common/slurm_auth.c
index a423ad98a4..7b8a3ff61b 100644
--- a/src/common/slurm_auth.c
+++ b/src/common/slurm_auth.c
@@ -224,12 +224,10 @@ int g_slurm_auth_verify(void *cred, char *auth_info)
 
 int auth_g_get_data(void *cred, char **data, uint32_t *len)
 {
-	cred_wrapper_t *wrap = (cred_wrapper_t *) cred;
-
-	if (!wrap || slurm_auth_init(NULL) < 0)
+	if (slurm_auth_init(NULL) < 0)
 		return SLURM_ERROR;
 
-	return (*(ops[wrap->index].get_data))(cred, data, len);
+	return (*(ops.get_data))(cred, data, len);
 }
 
 uid_t g_slurm_auth_get_uid(void *cred, char *auth_info)
-- 
2.35.3


From f144e5f46c84f52f1cee18fac898b48899b15946 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 10:18:26 +0200
Subject: [PATCH 20/34] Add support for ESLURM_AUTH_BADARG

Signed-off-by: Egbert Eich <eich@suse.com>
---
 slurm/slurm_errno.h      | 1 +
 src/common/slurm_errno.c | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/slurm/slurm_errno.h b/slurm/slurm_errno.h
index e7c8deae3a..1814b30dfc 100644
--- a/slurm/slurm_errno.h
+++ b/slurm/slurm_errno.h
@@ -255,6 +255,7 @@ enum {
 	ESLURM_AUTH_FOPEN_ERROR,
 	ESLURM_AUTH_NET_ERROR,
 	ESLURM_AUTH_UNABLE_TO_SIGN,
+	ESLURM_AUTH_BADARG,
 
 	/* accounting errors */
 	ESLURM_DB_CONNECTION            = 7000,
diff --git a/src/common/slurm_errno.c b/src/common/slurm_errno.c
index 6276168ec5..9c42f7383a 100644
--- a/src/common/slurm_errno.c
+++ b/src/common/slurm_errno.c
@@ -428,7 +428,8 @@ static slurm_errtab_t slurm_errtab[] = {
 	  "Failed to open authentication public key"		},
 	{ ESLURM_AUTH_NET_ERROR,
 	  "Failed to connect to authentication agent"		},
-
+	{ ESLURM_AUTH_BADARG,
+          "Bad argument to plugin function"                     },
 	/* accounting errors */
 	{ ESLURM_DB_CONNECTION,
 	  "Unable to connect to database"			},
-- 
2.35.3


From c4e85d8e2e64eb98d40f71551d1a2050fbd556a6 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 10:41:08 +0200
Subject: [PATCH 21/34] Replace response_init() by slurm_msg_t_init()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/job_mgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/slurmctld/job_mgr.c b/src/slurmctld/job_mgr.c
index 60b1c2b310..28c87d0c80 100644
--- a/src/slurmctld/job_mgr.c
+++ b/src/slurmctld/job_mgr.c
@@ -12490,7 +12490,7 @@ extern int update_job_str(slurm_msg_t *msg, uid_t uid)
 
 reply:
 	if ((rc != ESLURM_JOB_SETTING_DB_INX) && (msg->conn_fd >= 0)) {
-		response_init(&resp_msg, msg);
+	        slurm_msg_t_init(&resp_msg);
 		if (resp_array) {
 			resp_array_msg = _resp_array_xlate(resp_array, job_id);
 			resp_msg.msg_type  = RESPONSE_JOB_ARRAY_ERRORS;
-- 
2.35.3


From f066c0e32271856fbe22edbff2bf88e4630f1748 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 14:33:14 +0200
Subject: [PATCH 22/34] Replace response_init()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/job_mgr.c  |  4 +++
 src/slurmctld/proc_req.c | 68 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)

diff --git a/src/slurmctld/job_mgr.c b/src/slurmctld/job_mgr.c
index 28c87d0c80..500c3b868f 100644
--- a/src/slurmctld/job_mgr.c
+++ b/src/slurmctld/job_mgr.c
@@ -12491,6 +12491,8 @@ extern int update_job_str(slurm_msg_t *msg, uid_t uid)
 reply:
 	if ((rc != ESLURM_JOB_SETTING_DB_INX) && (msg->conn_fd >= 0)) {
 	        slurm_msg_t_init(&resp_msg);
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&resp_msg, msg->auth_uid);
 		if (resp_array) {
 			resp_array_msg = _resp_array_xlate(resp_array, job_id);
 			resp_msg.msg_type  = RESPONSE_JOB_ARRAY_ERRORS;
@@ -14847,6 +14849,8 @@ extern int job_requeue2(uid_t uid, requeue_msg_t *req_ptr, slurm_msg_t *msg,
     reply:
 	if (msg) {
 		slurm_msg_t_init(&resp_msg);
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&resp_msg, msg->auth_uid);
 		resp_msg.protocol_version = msg->protocol_version;
 		resp_msg.conn             = msg->conn;
 		if (resp_array) {
diff --git a/src/slurmctld/proc_req.c b/src/slurmctld/proc_req.c
index 1158f2739c..04bf9d3c88 100644
--- a/src/slurmctld/proc_req.c
+++ b/src/slurmctld/proc_req.c
@@ -1257,6 +1257,8 @@ static void _slurm_rpc_allocate_resources(slurm_msg_t * msg)
 		response_msg.conn = msg->conn;
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		     slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.msg_type = RESPONSE_RESOURCE_ALLOCATION;
 		response_msg.data = &alloc_msg;
 
@@ -1317,6 +1319,8 @@ static void _slurm_rpc_dump_conf(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_BUILD_INFO;
@@ -1365,6 +1369,8 @@ static void _slurm_rpc_dump_jobs(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_JOB_INFO;
@@ -1407,6 +1413,8 @@ static void _slurm_rpc_dump_jobs_user(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_JOB_INFO;
@@ -1451,6 +1459,8 @@ static void _slurm_rpc_dump_job_single(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_JOB_INFO;
@@ -1480,6 +1490,8 @@ static void  _slurm_rpc_get_shares(slurm_msg_t *msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address  = msg->address;
 	response_msg.conn     = msg->conn;
 	response_msg.msg_type = RESPONSE_SHARE_INFO;
@@ -1509,6 +1521,8 @@ static void  _slurm_rpc_get_priority_factors(slurm_msg_t *msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address  = msg->address;
 	response_msg.conn     = msg->conn;
 	response_msg.msg_type = RESPONSE_PRIORITY_FACTORS;
@@ -1547,6 +1561,8 @@ static void _slurm_rpc_end_time(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address  = msg->address;
 		response_msg.conn     = msg->conn;
 		response_msg.msg_type = SRUN_TIMEOUT;
@@ -1575,6 +1591,8 @@ static void _slurm_rpc_get_fed(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_FED_INFO;
@@ -1623,6 +1641,8 @@ static void _slurm_rpc_dump_front_end(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_FRONT_END_INFO;
@@ -1683,6 +1703,8 @@ static void _slurm_rpc_dump_nodes(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_NODE_INFO;
@@ -1741,6 +1763,8 @@ static void _slurm_rpc_dump_node_single(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_NODE_INFO;
@@ -1794,6 +1818,8 @@ static void _slurm_rpc_dump_partitions(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_PARTITION_INFO;
@@ -2465,6 +2491,8 @@ static void _slurm_rpc_job_step_create(slurm_msg_t * msg)
 		slurm_msg_t_init(&resp);
 		resp.flags = msg->flags;
 		resp.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&resp, msg->auth_uid);
 		resp.address = msg->address;
 		resp.conn = msg->conn;
 		resp.msg_type = RESPONSE_JOB_STEP_CREATE;
@@ -2534,6 +2562,8 @@ static void _slurm_rpc_job_step_get_info(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_JOB_STEP_INFO;
@@ -2660,6 +2690,8 @@ static void _slurm_rpc_job_will_run(slurm_msg_t * msg, bool allow_sibs)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_JOB_WILL_RUN;
@@ -2853,6 +2885,8 @@ static void _slurm_rpc_job_alloc_info(slurm_msg_t * msg)
 		response_msg.protocol_version = msg->protocol_version;
 		response_msg.msg_type    = RESPONSE_JOB_ALLOCATION_INFO;
 		response_msg.data        = &job_info_resp_msg;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 
 		slurm_send_node_msg(msg->conn_fd, &response_msg);
 		select_g_select_jobinfo_free(job_info_resp_msg.select_jobinfo);
@@ -3123,6 +3157,8 @@ static void _slurm_rpc_job_sbcast_cred(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.msg_type    = RESPONSE_JOB_SBCAST_CRED;
 		response_msg.data        = &job_info_resp_msg;
 
@@ -3490,6 +3526,8 @@ static void _slurm_rpc_step_layout(slurm_msg_t *msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.msg_type    = RESPONSE_STEP_LAYOUT;
 	response_msg.data        = step_layout;
 
@@ -3718,6 +3756,8 @@ send_msg:
 		submit_msg.job_id     = job_id;
 		submit_msg.step_id    = step_id;
 		submit_msg.error_code = error_code;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.msg_type = RESPONSE_SUBMIT_BATCH_JOB;
 		response_msg.data = &submit_msg;
 		slurm_send_node_msg(msg->conn_fd, &response_msg);
@@ -4222,6 +4262,8 @@ static void _slurm_rpc_resv_create(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		resv_resp_msg.name    = resv_desc_ptr->name;
 		response_msg.msg_type = RESPONSE_CREATE_RESERVATION;
 		response_msg.data     = &resv_resp_msg;
@@ -4352,6 +4394,8 @@ static void _slurm_rpc_resv_show(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_RESERVATION_INFO;
@@ -4408,6 +4452,8 @@ static void _slurm_rpc_layout_show(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_LAYOUT_INFO;
@@ -4500,6 +4546,8 @@ static void _slurm_rpc_job_ready(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		rc_msg.return_code = result;
@@ -4615,6 +4663,8 @@ static void  _slurm_rpc_burst_buffer_info(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
 		response_msg.msg_type = RESPONSE_BURST_BUFFER_INFO;
@@ -5178,6 +5228,8 @@ inline static void  _slurm_rpc_trigger_get(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address  = msg->address;
 	response_msg.conn     = msg->conn;
 	response_msg.msg_type = RESPONSE_TRIGGER_GET;
@@ -5265,6 +5317,8 @@ inline static void  _slurm_rpc_get_topo(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address  = msg->address;
 	response_msg.conn     = msg->conn;
 	response_msg.msg_type = RESPONSE_TOPO_INFO;
@@ -5297,6 +5351,8 @@ inline static void  _slurm_rpc_get_powercap(slurm_msg_t * msg)
 	slurm_msg_t_init(&response_msg);
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address  = msg->address;
 	response_msg.conn     = msg->conn;
 	response_msg.msg_type = RESPONSE_POWERCAP_INFO;
@@ -5743,6 +5799,8 @@ inline static void _slurm_rpc_dump_spank(slurm_msg_t * msg)
 		slurm_msg_t_init(&response_msg);
 		response_msg.flags = msg->flags;
 		response_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.address  = msg->address;
 		response_msg.conn     = msg->conn;
 		response_msg.msg_type = RESPONCE_SPANK_ENVIRONMENT;
@@ -5829,6 +5887,8 @@ inline static void _slurm_rpc_dump_stats(slurm_msg_t * msg)
 
 	slurm_msg_t_init(&response_msg);
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_STATS_INFO;
@@ -5892,6 +5952,8 @@ _slurm_rpc_dump_licenses(slurm_msg_t * msg)
 
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_LICENSE_INFO;
@@ -6051,6 +6113,8 @@ static void  _slurm_rpc_composite_msg(slurm_msg_t *msg)
 		slurm_msg_t_init(&resp_msg);
 		resp_msg.flags    = msg->flags;
 		resp_msg.protocol_version = msg->protocol_version;
+		if (msg->auth_uid_set)
+		  slurm_msg_set_r_uid(&resp_msg, msg->auth_uid);
 		memcpy(&resp_msg.address, &comp_msg->sender,
 		       sizeof(slurm_addr_t));
 		resp_msg.msg_type = RESPONSE_MESSAGE_COMPOSITE;
@@ -6135,6 +6199,8 @@ static void  _slurm_rpc_comp_msg_list(composite_msg_t * comp_msg,
 				resp_msg->flags = next_msg->flags;
 				resp_msg->protocol_version =
 					next_msg->protocol_version;
+				if (next_msg->auth_uid_set)
+				  slurm_msg_set_r_uid(resp_msg, next_msg->auth_uid);
 				resp_msg->msg_type = RESPONSE_MESSAGE_COMPOSITE;
 				/* You can't just set the
 				 * resp_msg->address here, it won't
@@ -6210,6 +6276,8 @@ static void _slurm_rpc_assoc_mgr_info(slurm_msg_t * msg)
 
 	response_msg.flags = msg->flags;
 	response_msg.protocol_version = msg->protocol_version;
+	if (msg->auth_uid_set)
+	  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 	response_msg.address = msg->address;
 	response_msg.conn = msg->conn;
 	response_msg.msg_type = RESPONSE_ASSOC_MGR_INFO;
-- 
2.35.3


From 4ad4accf05024e927c053b892fd5bbc40c444acf Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 16 May 2022 14:33:47 +0200
Subject: [PATCH 23/34] Add missing auth_uid init setting

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/proc_req.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/slurmctld/proc_req.c b/src/slurmctld/proc_req.c
index 04bf9d3c88..0c025b95b3 100644
--- a/src/slurmctld/proc_req.c
+++ b/src/slurmctld/proc_req.c
@@ -6308,6 +6308,9 @@ static int _process_persist_conn(void *arg,
 	slurm_msg_t_init(&msg);
 
 	msg.auth_cred = persist_conn->auth_cred;
+	msg.auth_uid = *uid;
+	msg.auth_uid_set = true;
+
 	msg.conn = persist_conn;
 	msg.conn_fd = persist_conn->fd;
 
-- 
2.35.3


From 824a1c64c1bfa373b1b2b7a2cfd3792cef6a665c Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Wed, 18 May 2022 15:09:34 +0200
Subject: [PATCH 24/34] Add missing set_agent_arg_r_uid()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/plugins/checkpoint/blcr/checkpoint_blcr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/plugins/checkpoint/blcr/checkpoint_blcr.c b/src/plugins/checkpoint/blcr/checkpoint_blcr.c
index 32c3263d96..9659aede6f 100644
--- a/src/plugins/checkpoint/blcr/checkpoint_blcr.c
+++ b/src/plugins/checkpoint/blcr/checkpoint_blcr.c
@@ -603,6 +603,7 @@ static void _send_sig(uint32_t job_id, uint32_t step_id, uint16_t signal,
 	}
 	hostlist_iterator_destroy(hi);
 
+	set_agent_arg_r_uid(agent_args, SLURM_AUTH_UID_ANY);
 	agent_queue_request(agent_args);
 }
 
-- 
2.35.3


From f45cce985ba08558af7da354ec0178c01cd2c6a2 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Wed, 18 May 2022 20:35:02 +0200
Subject: [PATCH 25/34] Add slurm_msg_set_r_uid() to
 _persist_fed_job_lock_bool() and _agent_thread()

This seems to be missing from upstream as well.

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/fed_mgr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/slurmctld/fed_mgr.c b/src/slurmctld/fed_mgr.c
index 49234972d0..d2e37bdb92 100644
--- a/src/slurmctld/fed_mgr.c
+++ b/src/slurmctld/fed_mgr.c
@@ -537,6 +537,7 @@ static int _persist_job_will_run(slurmdb_cluster_rec_t *conn,
 	req_msg.msg_type = REQUEST_SIB_JOB_WILL_RUN;
 	req_msg.data     = sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -663,6 +664,7 @@ static int _persist_update_job(slurmdb_cluster_rec_t *conn,
 	req_msg.msg_type = REQUEST_UPDATE_JOB;
 	req_msg.data     = data;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
-- 
2.35.3


From 2f9edb2061220cb1b8a78e3b3790d7f9c1bd1fd5 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Wed, 18 May 2022 20:52:16 +0200
Subject: [PATCH 26/34] Fix slurm_msg_set_r_uid() settings for checkpointing

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/checkpoint.c  | 1 +
 src/slurmctld/job_mgr.c  | 2 ++
 src/slurmctld/step_mgr.c | 3 +++
 3 files changed, 6 insertions(+)

diff --git a/src/common/checkpoint.c b/src/common/checkpoint.c
index 2f4ce092ab..4df2235314 100644
--- a/src/common/checkpoint.c
+++ b/src/common/checkpoint.c
@@ -359,6 +359,7 @@ extern int checkpoint_tasks (uint32_t job_id, uint32_t step_id,
 	ckpt_req.image_dir	= image_dir;
 	req_msg.msg_type	= REQUEST_CHECKPOINT_TASKS;
 	req_msg.data		= &ckpt_req;
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	if ((ret_list = slurm_send_recv_msgs(nodelist, &req_msg, (wait*1000),
 					     false))) {
diff --git a/src/slurmctld/job_mgr.c b/src/slurmctld/job_mgr.c
index 500c3b868f..8085116f44 100644
--- a/src/slurmctld/job_mgr.c
+++ b/src/slurmctld/job_mgr.c
@@ -15504,6 +15504,7 @@ extern int job_checkpoint(checkpoint_msg_t *ckpt_ptr, uid_t uid,
 	if (conn_fd < 0)	/* periodic checkpoint */
 		return rc;
 
+	slurm_msg_set_r_uid(&resp_msg, uid);
 	if ((rc == SLURM_SUCCESS) &&
 	    ((ckpt_ptr->op == CHECK_ABLE) || (ckpt_ptr->op == CHECK_ERROR))) {
 		resp_msg.msg_type = RESPONSE_CHECKPOINT;
@@ -15944,6 +15945,7 @@ extern int job_restart(checkpoint_msg_t *ckpt_ptr, uid_t uid, int conn_fd,
 	rc_msg.return_code = rc;
 	resp_msg.msg_type  = RESPONSE_SLURM_RC;
 	resp_msg.data      = &rc_msg;
+	slurm_msg_set_r_uid(&resp_msg, uid);
 	(void) slurm_send_node_msg(conn_fd, &resp_msg);
 
 	return rc;
diff --git a/src/slurmctld/step_mgr.c b/src/slurmctld/step_mgr.c
index 10c3eb24df..7d4cb40f61 100644
--- a/src/slurmctld/step_mgr.c
+++ b/src/slurmctld/step_mgr.c
@@ -3250,6 +3250,7 @@ extern int job_step_checkpoint(checkpoint_msg_t *ckpt_ptr,
 	}
 
     reply:
+	slurm_msg_set_r_uid(&resp_msg, uid);
 	if ((rc == SLURM_SUCCESS) &&
 	    ((ckpt_ptr->op == CHECK_ABLE) || (ckpt_ptr->op == CHECK_ERROR))) {
 		resp_msg.msg_type = RESPONSE_CHECKPOINT;
@@ -3319,6 +3320,7 @@ extern int job_step_checkpoint_comp(checkpoint_comp_msg_t *ckpt_ptr,
 	rc_msg.return_code = rc;
 	resp_msg.msg_type  = RESPONSE_SLURM_RC;
 	resp_msg.data      = &rc_msg;
+	slurm_msg_set_r_uid(&resp_msg, uid);
 	(void) slurm_send_node_msg(conn_fd, &resp_msg);
 	return rc;
 }
@@ -3378,6 +3380,7 @@ extern int job_step_checkpoint_task_comp(checkpoint_task_comp_msg_t *ckpt_ptr,
 	rc_msg.return_code = rc;
 	resp_msg.msg_type  = RESPONSE_SLURM_RC;
 	resp_msg.data      = &rc_msg;
+	slurm_msg_set_r_uid(&resp_msg, uid);
 	(void) slurm_send_node_msg(conn_fd, &resp_msg);
 	return rc;
 }
-- 
2.35.3


From 8c4c7492a4440b7530bb992c2761008069cbfd6a Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Thu, 19 May 2022 09:48:08 +0200
Subject: [PATCH 27/34] Add missing calls to slurm_msg_set_r_uid()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index bccdfec29a..600f87390c 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -4376,7 +4376,14 @@ int slurm_send_rc_err_msg(slurm_msg_t *msg, int rc, char *err_msg)
 	resp_msg.forward_struct = msg->forward_struct;
 	resp_msg.ret_list = msg->ret_list;
 	resp_msg.orig_addr = msg->orig_addr;
-
+	/* like _resp_msg_setup() */
+	if (!msg->auth_uid_set)
+                slurm_msg_set_r_uid(&resp_msg, SLURM_AUTH_NOBODY);
+        else if ((msg->auth_uid != slurm_get_slurm_user_id()) &&
+                 (msg->auth_uid != slurm_get_slurmd_user_id()))
+                slurm_msg_set_r_uid(&resp_msg, msg->auth_uid);
+        else
+                slurm_msg_set_r_uid(&resp_msg, SLURM_AUTH_UID_ANY);
 	/* send message */
 	return slurm_send_node_msg(msg->conn_fd, &resp_msg);
 }
-- 
2.35.3


From 46b1673ae53157e9a1a600bfa398e7fb4e4952f9 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Thu, 19 May 2022 22:13:56 +0200
Subject: [PATCH 28/34] Add slurm_msg_set_r_uid() for replace_batch_job() which
 as been deleted since

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/job_scheduler.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/slurmctld/job_scheduler.c b/src/slurmctld/job_scheduler.c
index 410a7257f8..1866dbcb2b 100644
--- a/src/slurmctld/job_scheduler.c
+++ b/src/slurmctld/job_scheduler.c
@@ -951,6 +951,7 @@ send_reply:
 			resp_msg->address = msg->address;
 			resp_msg->msg_type = REQUEST_BATCH_JOB_LAUNCH;
 			resp_msg->data = launch_msg;
+			slurm_msg_set_r_uid(resp_msg, msg->auth_uid);
 			list_append(msg->ret_list, resp_msg);
 		} else {
 			slurm_msg_t response_msg;
@@ -960,6 +961,7 @@ send_reply:
 			response_msg.address = msg->address;
 			response_msg.msg_type = REQUEST_BATCH_JOB_LAUNCH;
 			response_msg.data = launch_msg;
+			slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 			slurm_send_node_msg(msg->conn_fd, &response_msg);
 			slurmctld_free_batch_job_launch_msg(launch_msg);
 		}
-- 
2.35.3


From 9db8b80227b517c0516d51e653debcb94537bb31 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 23 May 2022 09:31:38 +0200
Subject: [PATCH 29/34] Add type bool to proc_req.c

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmdbd/proc_req.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/slurmdbd/proc_req.c b/src/slurmdbd/proc_req.c
index c84d60686b..a85ff8450d 100644
--- a/src/slurmdbd/proc_req.c
+++ b/src/slurmdbd/proc_req.c
@@ -44,6 +44,7 @@
   #include <sys/prctl.h>
 #endif
 
+#include <stdbool.h>
 #include "src/common/slurm_auth.h"
 #include "src/common/gres.h"
 #include "src/common/macros.h"
-- 
2.35.3


From 663d44316ca81b36dea65e97dfd6d154cf545adf Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 23 May 2022 09:33:49 +0200
Subject: [PATCH 30/34] Add config CommunicationParameters for
 'block_null_hash' option

Signed-off-by: Egbert Eich <eich@suse.com>
---
 slurm/slurm.h.in                |  1 +
 src/common/read_config.c        |  6 ++++++
 src/common/slurm_protocol_api.c | 18 ++++++++++++++++++
 src/common/slurm_protocol_api.h |  6 ++++++
 4 files changed, 31 insertions(+)

diff --git a/slurm/slurm.h.in b/slurm/slurm.h.in
index 639a65a836..2b9fa1a9b9 100644
--- a/slurm/slurm.h.in
+++ b/slurm/slurm.h.in
@@ -2832,6 +2832,7 @@ typedef struct slurm_ctl_conf {
 	char *version;		/* version of slurmctld */
 	uint16_t vsize_factor;	/* virtual memory limit size factor */
 	uint16_t wait_time;	/* default job --wait time */
+        char *comm_params;      /* Communication parameters */
 	uint16_t z_16;		/* reserved for future use */
 	uint32_t z_32;		/* reserved for future use */
 	char *z_char;		/* reserved for future use */
diff --git a/src/common/read_config.c b/src/common/read_config.c
index ff494ef410..57c17a707d 100644
--- a/src/common/read_config.c
+++ b/src/common/read_config.c
@@ -186,6 +186,7 @@ s_p_options_t slurm_conf_options[] = {
 	{"ChosLoc", S_P_STRING},
 	{"CoreSpecPlugin", S_P_STRING},
 	{"ClusterName", S_P_STRING},
+	{"CommunicationParameters", S_P_STRING},
 	{"CompleteWait", S_P_UINT16},
 	{"ControlAddr", S_P_STRING},
 	{"ControlMachine", S_P_STRING},
@@ -2346,6 +2347,7 @@ free_slurm_conf (slurm_ctl_conf_t *ctl_conf_ptr, bool purge_node_hash)
 	xfree (ctl_conf_ptr->checkpoint_type);
 	xfree (ctl_conf_ptr->chos_loc);
 	xfree (ctl_conf_ptr->cluster_name);
+	xfree (ctl_conf_ptr->comm_params);
 	xfree (ctl_conf_ptr->control_addr);
 	xfree (ctl_conf_ptr->control_machine);
 	xfree (ctl_conf_ptr->core_spec_plugin);
@@ -2470,6 +2472,7 @@ init_slurm_conf (slurm_ctl_conf_t *ctl_conf_ptr)
 	xfree (ctl_conf_ptr->checkpoint_type);
 	xfree (ctl_conf_ptr->chos_loc);
 	xfree (ctl_conf_ptr->cluster_name);
+	xfree (ctl_conf_ptr->comm_params);
 	ctl_conf_ptr->complete_wait		= (uint16_t) NO_VAL;
 	xfree (ctl_conf_ptr->control_addr);
 	xfree (ctl_conf_ptr->control_machine);
@@ -3091,6 +3094,9 @@ _validate_and_set_defaults(slurm_ctl_conf_t *conf, s_p_hashtbl_t *hashtbl)
 	if (s_p_get_uint16(&uint16_tmp, "CacheGroups", hashtbl) && uint16_tmp)
 		conf->group_info |= GROUP_CACHE;
 
+	(void) s_p_get_string(&conf->comm_params, "CommunicationParameters",
+                              hashtbl);
+
 	if (!s_p_get_string(&conf->core_spec_plugin, "CoreSpecPlugin",
 	    hashtbl)) {
 		conf->core_spec_plugin =
diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 600f87390c..1f4ccbacfa 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -1160,6 +1160,24 @@ char *slurm_get_cluster_name(void)
 	return name;
 }
 
+/* slurm_get_comm_parameters
+ * returns the value of comm_param in slurmctld_conf object
+ * RET char *    - comm parameters, MUST be xfreed by caller
+ */
+extern char *slurm_get_comm_parameters(void)
+{
+	char *comm_params = NULL;
+        slurm_ctl_conf_t *conf;
+
+        if (slurmdbd_conf) {
+        } else {
+                conf = slurm_conf_lock();
+                comm_params = xstrdup(conf->comm_params);
+                slurm_conf_unlock();
+        }
+        return comm_params;
+}
+
 /* slurm_get_crypto_type
  * returns the crypto_type from slurmctld_conf object
  * RET char *    - crypto type, MUST be xfreed by caller
diff --git a/src/common/slurm_protocol_api.h b/src/common/slurm_protocol_api.h
index 4fa8ed6ec2..aab1b2d9f6 100644
--- a/src/common/slurm_protocol_api.h
+++ b/src/common/slurm_protocol_api.h
@@ -470,6 +470,12 @@ extern char *slurm_get_checkpoint_dir(void);
  */
 char *slurm_get_cluster_name(void);
 
+/* slurm_get_comm_parameters
+ * returns the value of comm_param in slurmctld_conf object
+ * RET char *    - comm parameters, MUST be xfreed by caller
+ */
+extern char *slurm_get_comm_parameters(void);
+
 /* slurm_get_crypto_type
  * returns the crypto_type from slurmctld_conf object
  * RET char *    - crypto type, MUST be xfreed by caller
-- 
2.35.3


From 1aeff92a1013f57f6c226cdb86210d583f4248ad Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Tue, 24 May 2022 08:27:27 +0200
Subject: [PATCH 31/34] Add missing calls to slurm_msg_set_r_uid()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/common/slurm_protocol_api.c | 8 ++++++++
 src/slurmctld/backup.c          | 2 ++
 src/slurmctld/controller.c      | 2 ++
 src/slurmctld/proc_req.c        | 2 ++
 4 files changed, 14 insertions(+)

diff --git a/src/common/slurm_protocol_api.c b/src/common/slurm_protocol_api.c
index 1f4ccbacfa..23bc63f267 100644
--- a/src/common/slurm_protocol_api.c
+++ b/src/common/slurm_protocol_api.c
@@ -4317,6 +4317,14 @@ static void _rc_msg_setup(slurm_msg_t *msg, slurm_msg_t *resp_msg,
 	resp_msg->forward_struct = msg->forward_struct;
 	resp_msg->ret_list = msg->ret_list;
 	resp_msg->orig_addr = msg->orig_addr;
+	/* like _resp_msg_setup() */
+	if (!msg->auth_uid_set)
+                slurm_msg_set_r_uid(resp_msg, SLURM_AUTH_NOBODY);
+        else if ((msg->auth_uid != slurm_get_slurm_user_id()) &&
+                 (msg->auth_uid != slurm_get_slurmd_user_id()))
+                slurm_msg_set_r_uid(resp_msg, msg->auth_uid);
+        else
+                slurm_msg_set_r_uid(resp_msg, SLURM_AUTH_UID_ANY);
 }
 
 
diff --git a/src/slurmctld/backup.c b/src/slurmctld/backup.c
index 67d33dacc9..0c23b36e97 100644
--- a/src/slurmctld/backup.c
+++ b/src/slurmctld/backup.c
@@ -446,6 +446,7 @@ static int _ping_controller(void)
 	unlock_slurmctld(config_read_lock);
 
 	req.msg_type = REQUEST_PING;
+	slurm_msg_set_r_uid(&req, SLURM_AUTH_UID_ANY);
 
 	if (slurm_send_recv_rc_msg_only_one(&req, &rc, 0) < 0) {
 		error("_ping_controller/slurm_send_node_msg error: %m");
@@ -501,6 +502,7 @@ static int _shutdown_primary_controller(int wait_time)
 
 	/* send request message */
 	req.msg_type = REQUEST_CONTROL;
+	slurm_msg_set_r_uid(&req, SLURM_AUTH_UID_ANY);
 
 	if (slurm_send_recv_rc_msg_only_one(&req, &rc,
 				(CONTROL_TIMEOUT * 1000)) < 0) {
diff --git a/src/slurmctld/controller.c b/src/slurmctld/controller.c
index fa06e52005..391d1bff09 100644
--- a/src/slurmctld/controller.c
+++ b/src/slurmctld/controller.c
@@ -2489,6 +2489,7 @@ static int _shutdown_backup_controller(int wait_time)
 
 	/* send request message */
 	req.msg_type = REQUEST_CONTROL;
+	slurm_msg_set_r_uid(&req, SLURM_AUTH_UID_ANY);
 
 	if (slurm_send_recv_rc_msg_only_one(&req, &rc,
 				(CONTROL_TIMEOUT * 1000)) < 0) {
@@ -2999,6 +3000,7 @@ static int _ping_backup_controller(void)
 	unlock_slurmctld(config_read_lock);
 
 	req.msg_type = REQUEST_PING;
+	slurm_msg_set_r_uid(&req, SLURM_AUTH_UID_ANY);
 
 	if (slurm_send_recv_rc_msg_only_one(&req, &rc, 0) < 0) {
 		debug2("_ping_backup_controller/slurm_send_node_msg error: %m");
diff --git a/src/slurmctld/proc_req.c b/src/slurmctld/proc_req.c
index 0c025b95b3..20cfffd764 100644
--- a/src/slurmctld/proc_req.c
+++ b/src/slurmctld/proc_req.c
@@ -4620,6 +4620,8 @@ static void  _slurm_rpc_block_info(slurm_msg_t * msg)
 		response_msg.protocol_version = msg->protocol_version;
 		response_msg.address = msg->address;
 		response_msg.conn = msg->conn;
+		if (msg->auth_uid_set)
+                  slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		response_msg.msg_type = RESPONSE_BLOCK_INFO;
 		response_msg.data = get_buf_data(buffer);
 		response_msg.data_size = get_buf_offset(buffer);
-- 
2.35.3


From 71a3e81646d5877fec45279cfc55f55204e27662 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 30 May 2022 14:26:25 +0200
Subject: [PATCH 32/34] Add missing set_agent_arg_r_uid() to
 _launch_batch_step()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/proc_req.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/slurmctld/proc_req.c b/src/slurmctld/proc_req.c
index 20cfffd764..e4edbb796c 100644
--- a/src/slurmctld/proc_req.c
+++ b/src/slurmctld/proc_req.c
@@ -5187,6 +5187,7 @@ static int _launch_batch_step(job_desc_msg_t *job_desc_msg, uid_t uid,
 		fatal("Invalid batch host: %s", job_ptr->batch_host);
 	agent_arg_ptr->msg_type = REQUEST_BATCH_JOB_LAUNCH;
 	agent_arg_ptr->msg_args = (void *) launch_msg_ptr;
+	set_agent_arg_r_uid(agent_arg_ptr, SLURM_AUTH_UID_ANY);
 
 	/* Launch the RPC via agent */
 	agent_queue_request(agent_arg_ptr);
-- 
2.35.3


From 3a25bb5bd2c3f75e9d190ea68a613846898ef008 Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 30 May 2022 14:54:27 +0200
Subject: [PATCH 33/34] Add missing calls to slurm_msg_set_r_uid()

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/proc_req.c | 3 ++-
 src/slurmdbd/proc_req.c  | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/slurmctld/proc_req.c b/src/slurmctld/proc_req.c
index e4edbb796c..4c8b9a18a2 100644
--- a/src/slurmctld/proc_req.c
+++ b/src/slurmctld/proc_req.c
@@ -3037,7 +3037,8 @@ static void _slurm_rpc_job_alloc_info_lite(slurm_msg_t * msg)
 		response_msg.protocol_version = msg->protocol_version;
 		response_msg.msg_type    = RESPONSE_JOB_ALLOCATION_INFO_LITE;
 		response_msg.data        = &job_info_resp_msg;
-
+		if (msg->auth_uid_set)
+                     slurm_msg_set_r_uid(&response_msg, msg->auth_uid);
 		slurm_send_node_msg(msg->conn_fd, &response_msg);
 
 		slurm_free_resource_allocation_response_msg_members(
diff --git a/src/slurmdbd/proc_req.c b/src/slurmdbd/proc_req.c
index a85ff8450d..6c271f8297 100644
--- a/src/slurmdbd/proc_req.c
+++ b/src/slurmdbd/proc_req.c
@@ -2711,6 +2711,7 @@ static int   _register_ctld(slurmdbd_conn_t *slurmdbd_conn,
 			slurm_msg_t_init(&out_msg);
 			out_msg.msg_type = REQUEST_PING;
 			out_msg.flags = SLURM_GLOBAL_AUTH_KEY;
+			slurm_msg_set_r_uid(&out_msg, SLURM_AUTH_UID_ANY);
 			slurm_send_node_msg(slurmdbd_conn->conn->version,
 					    fd, &out_msg);
 			/* We probably need to add matching recv_msg function
-- 
2.35.3


From 5753f088cdd647fd936bbc90ae5374271aaa12dc Mon Sep 17 00:00:00 2001
From: Egbert Eich <eich@suse.com>
Date: Mon, 30 May 2022 15:36:33 +0200
Subject: [PATCH 34/34] Add missing slurm_msg_set_r_uid() to fed_mgr.c

Signed-off-by: Egbert Eich <eich@suse.com>
---
 src/slurmctld/fed_mgr.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/slurmctld/fed_mgr.c b/src/slurmctld/fed_mgr.c
index d2e37bdb92..64c9f5ccd2 100644
--- a/src/slurmctld/fed_mgr.c
+++ b/src/slurmctld/fed_mgr.c
@@ -268,6 +268,7 @@ static int _ping_controller(slurmdb_cluster_rec_t *cluster)
 
 	slurm_msg_t_init(&req_msg);
 	req_msg.msg_type = REQUEST_PING;
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 
 	slurm_mutex_lock(&cluster->lock);
 
@@ -582,6 +583,7 @@ static int _persist_submit_batch_job(slurmdb_cluster_rec_t *conn,
 	req_msg.msg_type = REQUEST_SIB_SUBMIT_BATCH_JOB;
 	req_msg.data     = sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -624,6 +626,7 @@ static int _persist_allocte_resources(slurmdb_cluster_rec_t *conn,
 	req_msg.msg_type = REQUEST_SIB_RESOURCE_ALLOCATION;
 	req_msg.data     = sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -717,6 +720,7 @@ static int _persist_fed_job_revoke(slurmdb_cluster_rec_t *conn, uint32_t job_id,
 	req_msg.msg_type = REQUEST_SIB_JOB_COMPLETE;
 	req_msg.data	 = &sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -770,6 +774,7 @@ static int _persist_fed_job_lock(slurmdb_cluster_rec_t *conn, uint32_t job_id,
 
 	req_msg.data     = &sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -822,6 +827,7 @@ static int _persist_fed_job_start(slurmdb_cluster_rec_t *conn,
 	req_msg.msg_type = REQUEST_SIB_JOB_START;
 	req_msg.data     = &sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -892,6 +898,7 @@ static int _persist_fed_job_cancel(slurmdb_cluster_rec_t *conn, uint32_t job_id,
 	req_msg.msg_type = REQUEST_SIB_JOB_CANCEL;
 	req_msg.data     = &sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
@@ -959,6 +966,7 @@ static int _persist_fed_job_requeue(slurmdb_cluster_rec_t *conn,
 	req_msg.msg_type    = REQUEST_SIB_JOB_REQUEUE;
 	req_msg.data        = &sib_msg;
 
+	slurm_msg_set_r_uid(&req_msg, SLURM_AUTH_UID_ANY);
 	if (_send_recv_msg(conn, &req_msg, &resp_msg, false)) {
 		rc = SLURM_PROTOCOL_ERROR;
 		goto end_it;
-- 
2.35.3

