Argus Policy Decision Point (PDP): Configuration¶
The PDP is configured through the use of the
There is also an environment file,
that contains environment variables used by the init script that manage the
Configuration File Syntax¶
pdp.ini file is a standard INI file with three defined sections.
SERVICE section contains properties related the PDP service as a
whole and how it listens for incoming requests. The
contains properties for the retrieval of policies from the Policy
Administration Point (PAP). The final section,
properties that related to various security aspects of the service, the
services private key and certificate, for example.
Basic Configuration Options¶
|entityID||This is a unique identifier for the PDP. It must be a URI (URL or URN) and the same entity ID should be used for all PDP instances that make up a single logical PDP. If a URL is used it need not resolve to any specific webpage.||Y||None. Recommended value is a URL corresponding to the logical PDP service (e.g.
|hostname||This is the hostname or IP address to which the service will bind.||Y||None.|
|port||This is the port to which the service will bind.||N||8152|
|adminHost||The hostname upon which the service will listen for admin commands.||N||127.0.0.1|
|adminPort||This is the port upon which the service will listen for admin command.||N||8153|
|adminPassword||This is the password required to accompany admin commands. If unspecified than no password is required to run admin commands.||N||None|
|paps||A space separated list of PAP endpoint URLs. Endpoints will be tried in turn until one returns a successful response. This provides limited failover support. If more intelligent failover is necessary or load balancing is required, a dedicated load-balancer/failover appliance should be used.||Y||None|
|retentionInterval||The number of minutes the PDP will retain (cache) a policy retrieved from the PAP. After this time is passed the PDP will again call out to the PAP and retrieve the policy.||N||240 (4 hours)|
|servicePrivateKey||An absolute path to the file containing the unencrypted, PEM-encoded, private key used by this service. All PDPs instances within a single logical PDP should use the same key||Yes||None|
|serviceCertificate||An absolute path to the file containing the unencrypted, PEM-encoded, certificate used by this service. All PDPs instances within a single logical PDP should use the same key||Yes||None|
|trustInfoDir||An absolute path to the directory that contains standard X.509 trust information, such as the IGTF Trust Anchor Distribution||Yes||None|
|enableSSL||Indicates whether the service port should use SSL/TLS or not||No||false|
|requireClientCertAuthentication||Indicates whether the client must use a valid client certificate to authenticate to the PDP||No||false|
Example pdp.ini files¶
The following example file contain the bare minimum required for a valid PDP configuration file.
[SERVER] entityID = http://argus.example.org/pdp hostname = argus.example.org [POLICY] paps = https://argus.example.org:8150/pap/services/ProvisioningService [SECURITY] servicePrivateKey = /etc/grid-security/hostkey.pem serviceCertificate = /etc/grid-security/hostcert.pem trustInfoDir = /etc/grid-security/certificates # HTTPS enabled enableSSL = true
Advanced Configuration Options¶
The following advanced options are available but are unlikely to ever be used by deployers. They are mostly for performing very fine-grained tuning of request/response handling parameters. Incorrectly configuring these can have a very negative impact on performance so deployers should not change these unless they are very sure they understand what the impact will be.
|maximumRequests||The maximum number of requests that will be processed simultaneously. Additional requests will be queued.||N||200|
|requestQueueSize||The maximum number of requests that will be queued up when all the processing threads are busy. Incoming requests received when all processing threads are busy and the queue is full will receive an HTTP 503 error.||N||500|
|connectionTimeout||This is the length of time, in seconds, the service will wait for the client to send information before it considers the request timed out.||N||30 seconds|
|receiveBufferSize||This is the size, in bytes, that will be allocated to the HTTP request buffer.||N||16384 (16kb)|
|sendBufferSize||This is the size, in bytes, that will be allocated to the HTTP response buffer.||N||16384 (16kb)|
|policySetId||The ID of the policy to fetch from the PAP||No||-1|
|connectionTimeout||This is the length of time, in seconds, the PAP client will wait for the PAP to send information before it considers the request timed out||None||30|
|receiveBufferSize||This is the size, in bytes, that will be allocated to the PAP client send buffer||No||16384 (16KB)|
|sendBufferSize||This is the size, in bytes, that will be allocated to the PAP client request buffer||No||16384 (16KB)|
|trustInfoRefresh||The frequency, in minutes, that the trust material specified by
||N||60 (1 hour)|
|messageValidityPeriod||The number of seconds, from the time a message is issued, until it is considered expired.||N||300s (5 minutes)|
|clockSkew||The allowance, in seconds, used when computing validity periods.||N||30s|
/etc/sysconfig/argus-pdp file are defined Argus PDP environment variables,
described in the table below.
Variable Default value Meaning
Absolute path of the JVM executable.
Optional parameters to pass to the JVM when PDP is started/stopped
empty Optional parameters to pass to the JVM only when PDP is started; useful to enable JMX or remote debug
Absolute path of PDP installation directory
Absolute path of PDP configuration file.
Absolute path of PDP configuration directory.
Absolute path of PDP logs directory.
Absolute path of PDP libraries.
Absolute path of PDP endorsed libraries.
Absolute path of PDP provided libraries.
Absolute path of PDP PID file.
-Djdk.tls.trustNameService=trueis mandatory in Argus version 1.7 with TLS turned on.
/etc/sysconfig/argus-pdp.rpmnewwill be created.