airavata-mft icon indicating copy to clipboard operation
airavata-mft copied to clipboard

Provide authorization for Agents connecting to Consul

Open DImuthuUpe opened this issue 2 years ago • 0 comments

MFT Agents communicate with the controller through the consul key-value store. https://github.com/apache/airavata-mft/blob/master/common/common-clients/src/main/java/org/apache/airavata/mft/admin/MFTConsulClient.java Consul keys are represented through paths and each agent has its own path to access messages. Currently there is no mechanism to control access to those paths as anyone can read from it. We can use the Access Control setup provided through consul to enforce authorization for agent communication. https://developer.hashicorp.com/consul/tutorials/security/access-control-setup-production The idea is,

  1. No open access to any consul path is provided. All communication should happen through Consul tokens.
  2. When an agent needs to connect to consul, it is give a consul token and agent can only access a particular path using that token.

DImuthuUpe avatar Jan 25 '23 16:01 DImuthuUpe