LCMAPS C PEP plugin
The LCMAPS C PEP plugin is the LCMAPS plugin to interact with the Argus PEPd server.
Description
The LCMAPS C PEP plugin is typically used in the gLExec-on-workernode scenario. It utilizes the Argus PEP-C library to contact the PEP daemon, sending the user credentials and, if applicable, the pilot job credentials and extra information to the PEP daemon.
The PEP daemon will process the request and query the PDP, PAP, EES chain for a policy decision. The PEP daemon will return a Permit statement with a Unix account. The Unix account must be composed of a Unix User ID and Unix Group ID. Optionally Unix Secondary GIDs may be returned. All of these IDs must be returned in numerical form. The results will then be published in the LCMAPS framework.
The plug-in will use the credentials loaded in the LCMAPS framework for the primary authorization decision. The returned Unix account will reflect this identity . Additionally to this identity, in a multi-user pilot job scenario, the X509_US ER_PROXY environment variable is read to add information about the identity that executes the pilot job framework and triggered the execution of this plug-in. This probably with the use of gLExec.
Options
| Option | Description | Mandatory? | Valid Input | Example |
|---|---|---|---|---|
| pep-daemon-endpoint-url | The endpoint URL of the PEP daemon. This directive can be used multiple times for failover (in order) | Yes | An URL (max. 256 chars) | --pep-daemon-endpoint-url https://pepd.example.org:8154/authz |
| resourceid | XACML request resource-id value* | Yes, XOR(1) | An URI (max 512 chars) | --resourceid http://authz-interop.org/xacml/resource/resource-type/wn |
| resourcetype | XACML request resource-id value (short notation). Set the XACML request resource-id value to http://authz-interop.org/xacml/resource/resource-type/<value> | Yes, XOR(1) | se, ce, rb, wn | --resourcetype wn |
| actionid | XACML request action-id value* | Yes, XOR(2) | An URI (max 512 chars) | --actionid http://glite.org/xacml/action/execute |
| actiontype | XACML request action-id value (short notation). Set the XACML request action-id value to http://authz-interop.org/xacml/action/action-type/<value> | Yes, XOR(2) | execute-now, queue, access | --actiontype execute-now |
| check-certificates | force the PEP-C library to do SSL validation checks, regardless of its default setting | No | n/a | --check-certificates |
| no-check-certificates | force the PEP-C library to ignore SSL validation checks | No | n/a | --no-check-certificates |
| capath | Sets the CA path to the directory with CA certificates and CRL files | No | A path, it's max. length is equal to the system limit | --capath /etc/grid-security/certificates/ |
| cafile | A file with a CA certificate or set of certificates | No | A file path, it's max. length is equal to the system limit | --cafile /etc/grid-security/certificate/123dasd.0 |
| pep-certificate-mode | Use implicit user proxy, explicit file or no client certificate at all | No | implicit, explicit, none | --pep-certificate-mode implicit |
| certificate | Certificate to use to contact PEPd | No | A file path, it's max. length is equal to the system limit | --certificate /etc/grid-security/hostcert.pem |
| key | Private key file used to contact PEPd | No | A file path, it's max. length is equal to the system limit | --key /etc/grid-security/hostkey.pem |
| pass | Password for the certificate's private key file | No | A password string | --pass supersecretpassword |
| passfile | Password file for the certificate private key | No | A file path, it's max. length is equal to the system limit | --passfile /root/secretpassfile |
| pep-c-debug | Enable verbose logging in the libpepc library | No | n/a | --pep-c-debug |
| profile | Selects the attribute profile in which the attributes are sent (both can be received and processed) | No | http://authz-interop.org/profile/1.1 or http://glite.org/xacml/profile/grid-wn/1.0 | --profile http://authz-interop.org/profile/1.1 or --profile http://glite.org/xacml/profile/grid-wn/1.0 |
| ssl-cipher-list | Specify the cipher list to be used for the SSL session. This is required on systems that use libcurl build against libnss such as RH 6 and derivatives when talking to older Argus servers. | No | String containg SSL ciphers to use | --ssl-cipher-list "DEFAULT:-ECDH" |
| use-pilot-proxy-as-cafile | Use the pilot proxy also as --cafile option, necessary for NSS based SSL (RH6 and alike). | No | n/a | --use-pilot-proxy-as-cafile |
The valid XACML values for the resourceid and actionid are defined in the document XACML Grid Worker Node Authorization Profile, Version 1.0 for the new default profile. The previously used profile is defined in the document An XACML Attribute and Obligation Profile for Authorization Interoperability in Grids.
When an https end point is used for the PEP daemon, client-side authentication can be enabled by specifying a file with a certificate chain and a file with the associated private key. If an https end point is specified but no certificate or key is provided, an anonymous secure connection is established. The server identity is always verified using the trust anchor repository specified by the --capath or --cafile options. If neither of these is specified, the plugin will use the directory referred to by the X509_CERT_DIR environment variable, or fall back to /etc/grid-security/certificates. If neither directory can be found, the system default trust anchor store is used.
Notes
Environment
| X509_USER_PROXY | The value of the X509_USER_PROXY environment holds the path to the proxy certificate. This is not the primary identity on which the authorization decision is based on. This proxy certificate identifies the Pilot Job executor. This identity is responsible for pulling a pilot job payload associated with a proxy onto a Worker Node during a job execution. |
| X509_CERT_DIR | Used to look for trust anchors in case of using https to connect to the Argus PEPd server. |
Further reading
See the man page lcmaps_plugins_c_pep(8) for more information on the supported profiles.
