Argus GSI PEP Callout Configuration

Manual Configuration

To configure the GSI PEP Callout module, you first have to configure the Globus Authorization Callouts framework to use the GSI PEP Callout library to do the authorization and mapping. Then the GSI PEP Callout module must be configured.

Globus Authorization Callouts Configuration

Configuration file and configuration directives for the Globus Authorization Callouts to enable the GSI PEP Callout module.

Configuration File

The Globus Authorization Callouts framework uses the following locations (in order) for the callout configurations file:

• $GSI_AUTHZ_CONF (Environment variable)
• /etc/grid-security/gsi-authz.conf
• $GLOBUS_LOCATION/etc/gsi-authz.conf
• $HOME/.gsi-authz.conf

EMI-1 Configuration Directives

Content of the Globus Authorization Callouts configuration file to enable the GSI Argus PEP Callout function argus_pep_callout for EMI:

# Globus authorization and mapping callout to the ARGUS GSI PEP Callout module
# format: globus_mapping <library_path> <function_name>
globus_mapping /usr/lib64/libgsi_pep_callout.so argus_pep_callout

For EMI the Argus PEP GSI callout library is installed in the /usr/lib64 directory.

gLite 3.2 Configuration Directives

Content of the Globus Authorization Callouts configuration file to enable the GSI PEP Callout function authz_pep_callout for gLite:

# Globus authorization and mapping callout to the ARGUS GSI PEP Callout module
# format: globus_mapping <library_path> <function_name>
globus_mapping /opt/glite/lib/libgsi_pep_callout_gcc32dbg.so authz_pep_callout

For gLite .32, nn x86_64 architecture like SL4 and SL5 the library path is /opt/glite/lib64/libgsi_pep_callout_gcc64dbg.so

GSI PEP Callout Configuration

Configuration file and configuration directives for the GSI PEP Callout module.

Configuration File

The GSI PEP Callout module uses the following locations (in order) for the configurations file:

• $GSI_PEP_CALLOUT_CONF (Environment variable)
• /etc/grid-security/gsi-pep-callout.conf

Configuration Directives

The configuration directives for the GSI PEP Callout are single name value lines. Lines with comments # are allowed.

Directive	Description	Mandatory?	Default Value	Example	Since
pep_url	The endpoint URL of the PEP daemon.	Yes		pep_url https://pepd.example.org:8154/authz	1.0
xacml_resourceid	XACML request resource-id value	Yes		xacml_resourceid x-urn:example.org:resource:ce:gridftp	1.0
xacml_actionid	XACML request action-id value. Define this parameter to overwrite the service name passed to the module by the application	No		xacml_actionid http://glite.org/xacml/action/access	1.0
xacml_profileid	XACML request profile-id value. Define this parameter to overwrite the default profile id	No	http://glite.org/xacml/profile/grid-wn/1.0	xacml_profileid http://glite.org/xacml/profile/grid-ce/1.0	1.2
pep_timeout	Connection timeout in seconds	No	30	pep_timeout 60	1.0
pep_ssl_validation	Enable SSL validation of the PEP daemon endpoint URL (HTTPS)	No	true	pep_ssl_validation false	1.0
pep_ssl_server_capath	CA directory path for the HTTPS validation of the PEP daemon endpoint URL	No	/etc/grid-security/certificates	pep_ssl_server_capath /etc/grid-security/certificates	1.0
pep_ssl_server_cert	Certificate file for the HTTPS validation of the PEP daemon endpoint URL	No		pep_ssl_server_cert /etc/grid-security/pepdcert.pem	1.0
pep_ssl_client_cert	Client certificate file for the TLS client authentication on the PEP daemon endpoint URL	No	/etc/grid-security/hostcert.pem	pep_ssl_client_cert /etc/ssl/mycert.pem	1.0
pep_ssl_client_key	Client private key file for the TLS client authentication on the PEP daemon endpoint URL	No	/etc/grid-security/hostkey.pem	pep_ssl_server_key /etc/ssl/mykey.pem	1.0
pep_ssl_client_keypasswd	Client private key password	Only if pep_ssl_client_key is encrypted		pep_ssl_server_keypasswd mykeypassword	1.0

Configuration Example

Example of a valid configuration file for the GSI PEP Callout module:

#
# GSI PEP Callout configuration example
#
pep_url   https://chaos.switch.ch:8154/authz
xacml_resourceid http://ce.example.org/cream/gridftp

YAIM Configuration

The yaim-core (>= 4.0.12) the function config_lcas_lcmaps_gt4 is now able to configure the Argus GSI PEP callout module.

In your site-info.def set the following variables:

USE_ARGUS=yes
ARGUS_PEPD_ENDPOINTS="<Argus_URL> ..."
CREAM_PEPC_RESOURCEID=<CreamCE_XACML_resouce_id>

where Argus_URL is the Argus PEP daemon endpoint URL. e.g. ARGUS_PEPD_ENDPOINTS=https://argus.example.org:8154/authz

where CreamCE_XACML_resouce_id is the XACML resource identifier for this cream CE. e.g. CREAM_PEPC_RESOURCEID=http://glite.org/xacml/resource/cream-ce