Token/proxies rate

[arrabito]

Dear all,
Within CTAO we are moving away from VOMS to uniquely use IAM.
In this context, I've been asked by IAM admins an estimate for the rate of token/voms proxy requests to IAM.
In my understanding, DIRAC stores long-lived voms proxies delivered by IAM as it was the case for proxies delivered by VOMS, so that jobs just contact the ProxyManager and not IAM each time they need a proxy, right?
So I guess that the rate is not that high. Is that correct? Can you please tell me which other components request voms proxies directly to IAM?
As it concerns tokens used to submit pilots, can you please tell me if a new token is requested to IAM by each submitted pilot?
If this is the case, I could estimate the nb of token requests based on the average nb of submitted pilots.
Thank you in advance for your explanations.

[fstagni]

In my understanding, DIRAC stores long-lived voms proxies delivered by IAM as it was the case for proxies delivered by VOMS, so that jobs just contact the ProxyManager and not IAM each time they need a proxy, right?

Correct. And, also to answer your subsequent question: the "VOMS-based security model" does not change when moving VOMS inside IAM.

As it concerns tokens used to submit pilots, can you please tell me if a new token is requested to IAM by each submitted pilot? If this is the case, I could estimate the nb of token requests based on the average nb of submitted pilots. Thank you in advance for your explanations.

That would be the upper limit, but there is a caching of them anyway.

[arrabito]

Thanks a lot for your aswer.