apache / apache/airavata-mft

Provide authorization for Agents connecting to Consul

Open
#76 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
41
Forks
37
PR merge metrics
No merged PRs in 30d

Description

MFT Agents communicate with the controller through the consul key-value store. https://github.com/apache/airavata-mft/blob/master/common/common-clients/src/main/java/org/apache/airavata/mft/admin/MFTConsulClient.java Consul keys are represented through paths and each agent has its own path to access messages. Currently there is no mechanism to control access to those paths as anyone can read from it. We can use the Access Control setup provided through consul to enforce authorization for agent communication. https://developer.hashicorp.com/consul/tutorials/security/access-control-setup-production The idea is,

1. No open access to any consul path is provided. All communication should happen through Consul tokens.
2. When an agent needs to connect to consul, it is give a consul token and agent can only access a particular path using that token.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.