Argus Authorization Service¶
The Argus Authorization Service renders consistent authorization decisions for distributed services (e.g., user interfaces, portals, computing elements, storage elements). The service is based on the XACML standard, and uses authorization policies to determine if a user is allowed or denied to perform a certain action on a particular service.
The Argus Authorization Service is composed of three main components:
- The Policy Administration Point (PAP) provides the tools to author authorization policies, organize them in the local repository and configure policy distribution among remote PAPs.
- The Policy Decision Point (PDP) implements the authorization engine, and is responsible for the evaluation of the authorization requests against the XACML policies retrieved from the PAP.
- The Policy Enforcement Point Server (PEP Server) ensures the integrity and consistency of the authorization requests received from the PEP clients. Lightweight PEP client libraries are also provided to ease the integration and interoperability with other EMI services or components.
The following graphic shows the interaction between the components of the service:
Note: In Argus, the PEP is separated in a client/server architecture. The PEP Server handles the lightweight PEP client requests, and runs on the Argus node.
Argus Service Installation¶
The following section provides instructions for setting up an Argus environment quickly. It does not provide an exhaustive description of every possible deployment model or configuration option, that can be found in the following Service Components and Enabled Applications sections.
Before you continue it is recommend that you read this introduction to the Argus system. This will provide you with a better understanding of how the components work together, what information passes between the components and how policies are formed.
Argus EMI Deployment¶
For EMI, the Argus Service is installed with YUM, and configured with YAIM. Please follow the Argus Deployment for EMI documentation.
If you are beginning to install the authorization service from scratch, you should install the components in the order listed here; PAP, then PDP, then PEPd. You don’t have to, but it makes the most sense for most use cases.
PAP: Policy Administration Point¶
The Policy Administration Point (PAP) provides three major functions:
- Provide the tools for authoring policies
- Store and manage authored policies
- Provide managed policies to other authorization service components
PDP: Policy Decision Point¶
The Policy Decision Point (PDP) is a policy evaluation engine. The PDP receives authorization requests from Policy Enforcement Points and evaluates these requests against authorization policies retrieved from the PAP.
PEP: Policy Enforcement Point¶
The Policy Enforcement Point (PEP) is the client to the authorization service. It gathers information relevant to an authorization request (e.g. who the user, what action they are attempting to perform, which service they are attempting to perform the action on, etc.) and sends the request to the PDP for evaluation. The PEP then acts upon returned result by allowing the request to proceed (in the case a positive authorization decision) or by denying the action (in the event of a negative decision).
In Argus, the PEP itself has a client/server architecture
- The PEP Server handles the lightweight PEP client requests, and runs on the Argus node. See the following links for more information on the PEP Server: Installation, Configuration, Operation, Troubleshooting
- Lightweight PEP client libraries are available to authorize requests from the application side, and to enforce decision locally. There are two variants available:
PEP command-line clients are also available
The following applications contain an Argus PEP client and can make authorization requests to the Argus service.
|GSI PEP Callout||Introduction||Installation||Configuration||Troubleshooting|
|gLExec with PEP Plugin||Introduction||Installation||Configuration||Troubleshooting|
Support and Monitoring¶
General support (installation, site administrator) for Argus is available through GGUS
Argus Support Mailing List¶
Argus specific (developer, site administrator) questions can be sent directly to the firstname.lastname@example.org mailing list. You don’t need a Google email address or a Google account to send or receive emails from this mailing list.
- Subscription: To subscribe to the support mailing list, simply send an email to: email@example.com
- Unsubscribe: You can unsubscribe from the list at anytime by sending an email to: firstname.lastname@example.org
- XACML 2.0 Specifications eXtensible Access Control Markup Language (XACML) Version 2.0
- SAML 2.0 Profile of XACML, Version 2 (Working Draft 5)
- XACML Profile for the gLite WN XACML Grid Worker Node Authorization Profile (v. 1.0)
- XACML Profile for the gLite CE XACML Grid Computing Element Authorization Profile (v. 1.0)
- XACML Authorization Profile for EMI Common XACML Authorization Profile (v. 1.1)
- 20110531-EMI_AllHands_2011-Argus_Integration.ppt: Argus - EMI Authorization Integration (EMI AH 2011, 31 May 2011, Lund)
- 20110412-EGI_UF_2011-Argus.ppt: Argus - EMI Authorization Service (EGI UF 2011, 12 April 2011, Vilnus)
- 20100917_EGI-TF_ArgusSecurity.ppt: Argus Security (EGI TF 2010 Security Session, 17 Sept. 2010, Amsterdam)
- introduction_authz_service.ppt: General introduction to the authorization service
- 100602_argus_intro_rod.ppt: Introduction to Argus for ROD (EGI ROD Workshop, 2 June 2010, Amsterdam)
Souce Code Information¶
We have migrated the Argus source code to GitHub.
- Argus Authorization Service: https://github.com/argus-authz
The source code was previousely stored in the CERN subversion server. Please do not use the SVN repository anymore
- WebSVN View: https://svnweb.cern.ch/world/wsvn/glxa
The Argus PT uses the following development tools.
For performance and load testing we use the following testing suite.
Argus Production Settings and Optimization¶
Production sites can optimize the Argus Service settings to their specific needs. Please have a look at the Argus Fine Tuning documentation.
- HERAS-AF project has supported the project by providing a good XACML policy engine and excellent, ongoing, support of their code.
- YourKit is kindly supporting this open source projects with its full-featured Java Profiler. YourKit, LLC is the creator of innovative and intelligent tools for profiling Java and .NET applications. Take a look at YourKit’s leading software products: YourKit Java Profiler and YourKit .NET Profiler.
- This product includes software developed by the Caucho Technology.
About the name Argus¶
In Greek mythology Argus was a 100-eyed giant that was meant to watch and protect various things and people including the Goddess Io. He was slain by Hermes but the gods chose to preserve his hundred eyes and affix them to the tail-feathers of a brilliantly colored bird, the peacock, in homage. The peacock logo is provided by the royalty free clip art site clker.com.