Argus Authorization Service

Summary

The Argus Authorization Service renders consistent authorization decisions for distributed services (e.g., user interfaces, portals, computing elements, storage elements). The service is based on the XACML standard, and uses authorization policies to determine if a user is allowed or denied to perform a certain action on a particular service.

The Argus Authorization Service is composed of three main components:

  • The Policy Administration Point (PAP) provides the tools to author authorization policies, organize them in the local repository and configure policy distribution among remote PAPs.
  • The Policy Decision Point (PDP) implements the authorization engine, and is responsible for the evaluation of the authorization requests against the XACML policies retrieved from the PAP.
  • The Policy Enforcement Point Server (PEP Server) ensures the integrity and consistency of the authorization requests received from the PEP clients. Lightweight PEP client libraries are also provided to ease the integration and interoperability with other EMI services or components.

The following graphic shows the interaction between the components of the service:

_images/ARGUS_components.png

Argus service components

Note: In Argus, the PEP is separated in a client/server architecture. The PEP Server handles the lightweight PEP client requests, and runs on the Argus node.

Argus Service Installation

The following section provides instructions for setting up an Argus environment quickly. It does not provide an exhaustive description of every possible deployment model or configuration option, that can be found in the following Service Components and Enabled Applications sections.

Before you continue it is recommend that you read this introduction to the Argus system. This will provide you with a better understanding of how the components work together, what information passes between the components and how policies are formed.

Argus Deployment

The Argus Service is installed with YUM. For the version 1.7, there isn’t an automatic configuration tool. Older version are configured with YAIM.

Please follow the Argus Deployment for version 1.7 documentation.

gLExec Worker Node with Argus Deployment

To install and configure an Argus compatible gLExec worker node, follow these GLExec Argus Quick Installation Guide

Service Components

If you are beginning to install the authorization service from scratch, you should install the components in the order listed here; PAP, then PDP, then PEPd. You don’t have to, but it makes the most sense for most use cases.

PAP: Policy Administration Point

The Policy Administration Point (PAP) provides three major functions:

  • Provide the tools for authoring policies
  • Store and manage authored policies
  • Provide managed policies to other authorization service components
Installation Configuration Operation

PDP: Policy Decision Point

The Policy Decision Point (PDP) is a policy evaluation engine. The PDP receives authorization requests from Policy Enforcement Points and evaluates these requests against authorization policies retrieved from the PAP.

Installation Configuration Operation Troubleshooting

PEP: Policy Enforcement Point

The Policy Enforcement Point (PEP) is the client to the authorization service. It gathers information relevant to an authorization request (e.g. who the user, what action they are attempting to perform, which service they are attempting to perform the action on, etc.) and sends the request to the PDP for evaluation. The PEP then acts upon returned result by allowing the request to proceed (in the case a positive authorization decision) or by denying the action (in the event of a negative decision).

In Argus, the PEP itself has a client/server architecture

  • The PEP Server handles the lightweight PEP client requests, and runs on the Argus node.
  • Lightweight PEP client libraries are available to authorize requests from the application side, and to enforce decision locally. There are two variants available:
Installation Configuration Operation Troubleshooting

PEP command-line clients are also available

Enabled Applications

The following applications contain an Argus PEP client and can make authorization requests to the Argus service.

Argus-enabled Applications
GSI PEP Callout Introduction Installation Configuration Troubleshooting
gLExec with PEP Plugin Introduction Installation Configuration Troubleshooting

Support and Monitoring

GGUS Support

General support (installation, site administrator) for Argus is available through GGUS

Argus Support Mailing List

Argus specific (developer, site administrator) questions can be sent directly to the argus-support@googlegroups.com mailing list. You don’t need a Google email address or a Google account to send or receive emails from this mailing list.

NOTE: The mailing list was previously argus-support@cern.ch, but it have been migrated to argus-support@googlegroups.com at the end of the EMI project (April 2013).

Nagios Monitoring

Nagios plugins are available to monitor an Argus server.

Development Information

Argus is an open-source product hosted on GitHub. In addition to this user-oriented documentation, you can find a description of Argus architecture and main components at Argus main site.

Requirements

Presentations

Souce Code Information

The Argus source code is on GitHub.

Development Tools

The Argus PT uses the following development tools.

For performance and load testing we use the following testing suite.

Argus Production Settings and Optimization

Production sites can optimize the Argus Service settings to their specific needs. Please have a look at the Argus Service Fine Tuning documentation.

Perfomance and Load Testing

Argus provides a load testsuite, based on Grinder framework.

More information can be found on Argus load testsuite.

Additional Support

  • HERAS-AF project has supported the project by providing a good XACML policy engine and excellent, ongoing, support of their code.
  • YourKit is kindly supporting this open source projects with its full-featured Java Profiler. YourKit, LLC is the creator of innovative and intelligent tools for profiling Java and .NET applications. Take a look at YourKit’s leading software products: YourKit Java Profiler and YourKit .NET Profiler.
  • This product includes software developed by the Caucho Technology.

About the name Argus

In Greek mythology Argus was a 100-eyed giant that was meant to watch and protect various things and people including the Goddess Io. He was slain by Hermes but the gods chose to preserve his hundred eyes and affix them to the tail-feathers of a brilliantly colored bird, the peacock, in homage. The peacock logo is provided by the royalty free clip art site clker.com.