Set up gLExec for Argus

Setting up gLExec on the worker node to query Argus for authorization decisions is preferably done through YAIM, but some set-ups require manual configuration.

Installation

For the installation and configuration of Argus, see the Argus documentation.

For the installation of gLExec on the worker node, see the release notes and the installation manual.

Typical gLite installation is done with

wget -O /etc/yum.repos.d/glite-GLEXEC_wn.repo http://grid-deployment.web.cern.ch/grid-deployment/glite/repos/3.2/glite-GLEXEC_wn.repo
yum install glite-GLEXEC_wn

Configuration with YAIM

Please see the YAIM guide for general instructions on using YAIM, and the list of variables that need to be set in site-info.def, or services/glexec-wn.

Noteworthy variables:

GLEXEC_WN_OPMODE=setuid
GLEXEC_WN_ARGUS_ENABLED=yes
ARGUS_PEPD_ENDPOINTS="https://argus1.example.com:8154/authz https://argus2.example.com:8145/authz"

In this example the site has two service endpoints; the quotes are necessary as this is interpreted shell code. Multiple endpoints may be defined for scale; the pep-c plug-in will randomly choose one endpoint to talk to, and automatically fail-over to the others. (?? Verify please)

After setting the variables, running YAIM is usually done as follows:

/opt/glite/yaim/bin/yaim -c -s site-info.def -n TORQUE_client -n WN -n GLEXEC_wn

Manual Configuration

Simple configuration. The following assumes you have pool accounts that are expected to use gLExec named pilota001, pilota002, etc. and pilotb001, etc.

Edit /opt/glite/etc/glexec.conf as follows. Make sure the file's mode is

-rw-r----- 1 root glexec  /opt/glite/etc/glexec.conf

[glexec]
silent_logging               = no
log_level                    = 0
user_white_list              = .pilota,.pilota
linger                       = yes
lcmaps_db_file               = /opt/glite/etc/lcmaps/lcmaps-glexec.db
lcmaps_log_file              = /var/log/glexec/lcas_lcmaps.log
lcmaps_debug_level           = 0
lcmaps_log_level             = 1
lcmaps_get_account_policy    = glexec_get_account
lcmaps_verify_account_policy = glexec_verify_account

lcas_db_file                 = /opt/glite/etc/lcas/lcas-glexec.db
lcas_log_file                = /var/log/glexec/lcas_lcmaps.log
lcas_debug_level             = 0
lcas_log_level               = 1
user_identity_switch_by      = lcmaps
preserve_env_variables       = no
log_destination              = file
log_file                     = /var/log/glexec/glexec_log

Place this in /opt/glite/etc/lcas/lcas-glexec.db:

pluginname=/opt/glite/lib64/modules/lcas_userban.mod,pluginargs=/opt/glite/etc/lcas/ban_users.db

Place this in /opt/glite/etc/lcmaps/lcmaps-glexec.db:

path = /opt/glite/lib64/modules
verify_proxy = "lcmaps_verify_proxy.mod" 
               " -certdir /etc/grid-security/certificates/"
               " --allow-limited-proxy"

posix_enf = "lcmaps_posix_enf.mod"
            " -maxuid 1"
            " -maxpgid 1"
            " -maxsgid 32"

pepc        = "lcmaps_c_pep.mod"
              "--pep-daemon-endpoint-url https://argus1.example.com:8154/authz"
              "--pep-daemon-endpoint-url https://argus2.example.com:8154/authz"
              "--resourceid http://authz-interop.org/xacml/resource/resource-type/wn"
              "--actionid http://glite.org/xacml/action/execute"
              "--capath /etc/grid-security/certificates/"
              "--pep-certificate-mode implicit"

glexec_get_account:
verify_proxy -> pepc
pepc -> posix_enf