Argus Authorization Service - documentation archive
Note: this is no longer maintained, please refer to AuthorizationFramework instead
Summary
The Argus Authorization Service renders consistent authorization decisions for distributed services (e.g., user interfaces, portals, computing elements, storage elements). The service is based on the XACML standard, and uses authorization policies to determine if a user is allowed or denied to perform a certain action on a particular service.
The Argus Authorization Service is composed of three main components:
- The Policy Administration Point (PAP) provides the tools to author authorization policies, organize them in the local repository and configure policy distribution among remote PAPs.
- The Policy Decision Point (PDP) implements the authorization engine, and is responsible for the evaluation of the authorization requests against the XACML policies retrieved from the PAP.
- The Policy Enforcement Point Server (PEP Server) ensures the integrity and consistency of the authorization requests received from the PEP clients. Lightweight PEP client libraries are also provided to ease the integration and interoperability with other EMI services or components.
The following graphic shows the interaction between the components of the service:
Note: In Argus, the PEP is separated in a client/server architecture. The PEP Server handles the lightweight PEP client requests, and runs on the Argus node.
Argus Service Installation
The following section provides instructions for setting up an Argus environment quickly. It does not provide an exhaustive description of every possible deployment model or configuration option, that can be found in the following
Service Components and
Enabled Applications sections.
Before you continue it is recommend that you read this
introduction to the Argus system. This will provide you with a better understanding of how the components work together, what information passes between the components and how policies are formed.
Argus EMI Deployment
For EMI, the Argus Service is installed with YUM, and configured with YAIM. Please follow the
Argus Deployment for EMI documentation
gLExec Worker Node with Argus Deployment
To install and configure an Argus compatible gLExec worker node, follow these
GLExec Argus Quick Installation Guide
Service Components
If you are beginning to install the authorization service from scratch, you should install the components in the order listed here; PAP, then PDP, then PEPd. You don't have to, but it makes the most sense for most use cases.
PAP: Policy Administration Point
The Policy Administration Point (PAP) provides three major functions:
- Provide the tools for authoring policies
- Store and manage authored policies
- Provide managed policies to other authorization service components
PDP: Policy Decision Point
The Policy Decision Point (PDP) is a policy evaluation engine. The PDP receives authorization requests from Policy Enforcement Points and evaluates these requests against authorization policies retrieved from the PAP.
PEP: Policy Enforcement Point
The Policy Enforcement Point (PEP) is the client to the authorization service. It gathers information relevant to an authorization request (e.g. who the user, what action they are attempting to perform, which service they are attempting to perform the action on, etc.) and sends the request to the PDP for evaluation. The PEP then acts upon returned result by allowing the request to proceed (in the case a positive authorization decision) or by denying the action (in the event of a negative decision).
In Argus, the PEP is separated in a client/server architecture. The PEP Server handles the lightweight PEP client requests, and runs on the Argus node. Lightweight PEP client libraries are available to authorize requests from the application side, and to enforce decision locally.
Enabled Applications
The following application contain an Argus PEP client and can make authorization requests to the Argus service.
Support and Monitoring
GGUS Support
General support (installation, site administrator) for Argus is available through
GGUS
Argus Support Mailing List
Argus specific (developer, site administrator) questions can be sent directly to the
argus-support@googlegroupsNOSPAMPLEASE.com mailing list. You don't need a Google email address or a Google account to send or receive emails from this mailing list.
NOTE: The mailing list was previously
argus-support@cernNOSPAMPLEASE.ch, but it have been migrated to
argus-support@googlegroupsNOSPAMPLEASE.com at the end of the EMI project (April 2013).
Nagios Monitoring
Nagios plugins are available to monitor an Argus server.
Development Information
Argus Product Team
Since the beginning of EMI the Argus development is led by the
Argus PT.
Security Assessment
In June 2011, the Universitat Autònoma de Barcelona (Manuel Brugnoli and Elisa Heymann, CAOS - UAB) have finished the vulnerabitlity assessment of the Argus services. The document is available here:
Specifications
Requirements
Presentations
Souce Code Information
We have migrated the Argus source code to
GitHub.
The source code was previousely stored in the CERN subversion server.
Please do not use the SVN repository anymore
Development Tools
The Argus PT uses the following
development tools.
For performance and load testing we use the following
testing suite.
Argus Production Settings and Optimization
Production sites can optimize the Argus Service settings to their specific needs. Please have a look at the
Argus Fine Tuning documentation.
Perfomance and Load Testing
Results and metrics of the performance and load testing can be found here:
- For a physical machine:
- For a virtual machine:
Additional Support
- HERAS-AF project has supported the project by providing a good XACML policy engine and excellent, ongoing, support of their code.
- YourKit is kindly supporting this open source projects with its full-featured Java Profiler. YourKit, LLC is the creator of innovative and intelligent tools for profiling Java and .NET applications. Take a look at YourKit's leading software products: YourKit Java Profiler and YourKit .NET Profiler.
- This product includes software developed by the Caucho Technology.
About the name Argus
In Greek mythology Argus was a 100-eyed giant that was meant to watch and protect various things and people including the Goddess Io. He was slain by Hermes but the gods chose to preserve his hundred eyes and affix them to the tail-feathers of a brilliantly colored bird, the peacock, in homage. The peacock logo is provided by the royalty free clip art site
clker.com.
Twiki Related Links
ppt 
pdf 
png 
jpg 
Copyright &© by the contributing authors. All material on this collaboration platform is the property of the contributing authors.