In testing we are seeing that for groups which have two credentials defined
(a scitoken and a grid_proxy) then two glide client classads are created for the group (which serves only one entry).
one of them has both a scitoken and an encoded proxy, the other one has only a scitoken.
If there are a low number of submitted jobs, then the DE can round in such a way that only one of them is used and it
has one chance in two of being the wrong one and not being able to contact the remote htcondor-ce.
This can be mitigated by submitting a lot of jobs and getting glidein requests on both.
In testing we are seeing that for groups which have two credentials defined
(a scitoken and a grid_proxy) then two glide client classads are created for the group (which serves only one entry).
one of them has both a scitoken and an encoded proxy, the other one has only a scitoken.
If there are a low number of submitted jobs, then the DE can round in such a way that only one of them is used and it
has one chance in two of being the wrong one and not being able to contact the remote htcondor-ce.
This can be mitigated by submitting a lot of jobs and getting glidein requests on both.