apache / airavata-mft

Apache Airavata Managed File Transfer Services
https://airavata.apache.org
Apache License 2.0
32 stars 39 forks source link

Provide authorization for Agents connecting to Consul #76

Open DImuthuUpe opened 1 year ago

DImuthuUpe commented 1 year ago

MFT Agents communicate with the controller through the consul key-value store. https://github.com/apache/airavata-mft/blob/master/common/common-clients/src/main/java/org/apache/airavata/mft/admin/MFTConsulClient.java Consul keys are represented through paths and each agent has its own path to access messages. Currently there is no mechanism to control access to those paths as anyone can read from it. We can use the Access Control setup provided through consul to enforce authorization for agent communication. https://developer.hashicorp.com/consul/tutorials/security/access-control-setup-production The idea is,

  1. No open access to any consul path is provided. All communication should happen through Consul tokens.
  2. When an agent needs to connect to consul, it is give a consul token and agent can only access a particular path using that token.