dcachesrm-gplazma.policy

# ######                   dcachesrm-gplazma.policy                         #######
# ######      gPLAZMA: grid-aware PLuggable AuthoriZation MAnagement.       #######
# ######      gPLAZMAlite Suite: Built-in light-weight services for         #######
# ######       grid legacy mapping & VO Role fine-grain security.           #######
# ######                        Version 0.1-1                               #######

# This file contains gPLAZMA module's policy configuration in dCache-SRM.
# Operational with: SRM, GridFTP.

# CAUTION: Commenting out a switch|priority|configuration line (with a # sign) in
# this file is equivalent to switching that plugin|service OFF. It is handled, but
# please exercise caution to maintain the marker intact for possible future use.
# Recommended way is to turn plugins|services OFF explicitly - using the switches.

# Assertion results in a Disallow|Allow decision.
# Authorization results in a Disallow|Allow decision with Authorization Record.

# Switches and Priorities for Loadable Assertion Plugins|Services - Not supported -
# #################################################################################
# #site-assertion=

# Switches and Priorities for Loadable Authorization Plugins|Services
# #################################################################################
# A valid switch is from { "OFF" | "ON" }.
# A priority (based on site|VO policies) is required if switch is ON.
# A valid priority is from { "1" | "2" | "3" | "4" } and must be unique.

# Please note -
# Each plugin returns a decision based on a different authorization repository|
# service. Priorities are translated into priority of access (as compared to priority
# of denial). A well-defined Over-riding Policy can be enforced while using multiple
# authorization services (multiple switches ON) by defining priorities differently.

# Turning all switches OFF leads the running system to a secure quasi-firewall mode.

# Switches
xacml-vo-mapping="OFF"
saml-vo-mapping="OFF"
kpwd="ON"
grid-mapfile="OFF"
# gplazmalite-vorole-mapping="OFF"  # 1.8 setting at PSI
gplazmalite-vorole-mapping="ON"

# Priorities
xacml-vo-mapping-priority="5"
saml-vo-mapping-priority="4"
kpwd-priority="2"
grid-mapfile-priority="3"
gplazmalite-vorole-mapping-priority="1"

# Configurable Options for Plugins|Services
# #################################################################################
# Path to local or remotely accessible authorization repositories|services.
# A valid path is required if corresponding switch is ON.

# dcache.kpwd
kpwdPath="/opt/d-cache/etc/dcache.kpwd"

# grid-mapfile
gridMapFilePath="/etc/grid-security/grid-mapfile"
storageAuthzPath="/etc/grid-security/storage-authzdb"

# XACML-based grid VO role mapping
XACMLmappingServiceUrl="https://fledgling09.fnal.gov:8443/gums/services/GUMSXACMLAuthorizationServicePort"
# Time in seconds to cache the mapping in memory
xacml-vo-mapping-cache-lifetime="180"

# SAML-based grid VO role mapping
mappingServiceUrl="https://fledgling09.fnal.gov:8443/gums/services/GUMSAuthorizationServicePort"
# Time in seconds to cache the mapping in memory
saml-vo-mapping-cache-lifetime="180"

# Built-in gPLAZMAlite grid VO role mapping
gridVoRolemapPath="/etc/grid-security/grid-vorolemap"
gridVoRoleStorageAuthzPath="/etc/grid-security/storage-authzdb"
# vomsValidation="false" # PSI 1.8 setting
vomsValidation="false"

# SAZ Settings
saz-client="OFF"
SAZ_SERVER_HOST="saz-server.oursite.edu"
SAZ_SERVER_PORT="8888"

# #################################################################################
# END