arlas-iam-api

ARLAS-IAM

ARLAS Identity and Access Management allows to manage organisations, users, roles, groups and permissions for ARLAS.

This project contains the back end, while ARLAS-wui-iam is the front end.

This project is not aimed at being used alone. It belongs to the ARLAS Exploration Stack.

Concepts:

ARLAS IAM manipulates the following concepts:

• organisation: ARLAS is multi-organisations: it partitions collections and users within organisations. A user can belong to multiple organisations. Similarly, a collection can be shared with multiple organisations. Only one organisation is the owner of the collection.
• user: a user account, linked to a unique email. A user can belong to multiple organisation. By default, a user has its own private organisation. User gain access to functions and data by belonging to organisations, groups and roles.
• role: an application role, within an organisation:
  • user for accessing ARLAS IAM
  • dataset for managing ARLAS collections
  • owner for managing the organisation
  • builderfor building ARLAS dashboards
  • tagger for tagging hits from collections
  • downloader for accessing download functions from ARLAS AIAS
• group: set of permissions over collections and hits: allow to specify the visibility of collections and of their content
• permission: expression that delivers permissions.

ARLAS IAM also manages the user authentication with a login/password.

Getting started

ARLAS-IAM SSL Keystore Configuration

ARLAS-IAM requires an RSA PKCS#12 keystore to start.

You can generate a PKCS#12 keystore file using the provided script:

scripts/security/generate_pkcs12.sh

---

Security Notice

• Keep the keystore file and its password secure. Do not commit them to your version control system.

• Avoid using plaintext system properties in production. Use a secret manager or protected environment variables to manage sensitive values safely.

---

JVM Configuration

To configure the JVM with the keystore, add the following options at startup:

-Darlas.iam.trustStore=/path/to/keystore.p12 \
-Darlas.iam.trustStorePassword=changeit \
-Dtoken.keyAlias=changeit

You can include these options using the JDK_JAVA_OPTIONS environment variable:

JDK_JAVA_OPTIONS="-Xmx512m -XX:+ExitOnOutOfMemoryError \
  -Darlas.iam.trustStore=/path/to/keystore.p12 \
  -arlas.iam.trustStorePassword=changeit \
  -Dtoken.keyAlias=changeit"

Replace /path/to/keystore.p12, changeit, and other placeholder values with your actual configuration values.

---

License

This project is licensed under the Apache License, Version 2.0 - see the LICENSE.txt file for details.