Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.
Chapter 4. Securing Access to Data Grid Servers
Configure authentication and encryption mechanisms to secure access to Data Grid servers and protect your data.
4.1. Defining Data Grid Server Security Realms Link kopierenLink in die Zwischenablage kopiert!
Security realms provide identity, encryption, authentication, and authorization information to Data Grid server endpoints.
4.1.1. Property Realms Link kopierenLink in die Zwischenablage kopiert!
Property realms use property files to define users and groups.
users.properties
maps usernames to passwords in plain-text format. Passwords can also be pre-digested if you use the DIGEST-MD5
SASL mechanism or Digest
HTTP mechanism.
myuser=a_password user2=another_password
myuser=a_password
user2=another_password
groups.properties
maps users to roles.
myuser=supervisor,reader,writer user2=supervisor
myuser=supervisor,reader,writer
user2=supervisor
Property realm configuration
Supported authentication mechanisms
Property realms support the following authentication mechanisms:
-
SASL:
PLAIN
,DIGEST-*
, andSCRAM-*
-
HTTP (REST):
Basic
andDigest
4.1.1.1. Creating and Modifying Users Link kopierenLink in die Zwischenablage kopiert!
Data Grid Server requires users to authenticate against a default property realm. Before you can access Data Grid Server, you must add credentials by creating at least one user and a password. You can also add and modify the security authorization groups to which users belong.
Procedure
-
Open a terminal in
$RHDG_HOME
. -
Create and modify Data Grid users with the
user
command.
Run help user
for more details about using the command.
Creating users and passwords
Linux
bin/cli.sh user create myuser -p "qwer1234!"
$ bin/cli.sh user create myuser -p "qwer1234!"
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Microsoft Windows
bin\cli.bat user create myuser -p "qwer1234!"
$ bin\cli.bat user create myuser -p "qwer1234!"
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Creating users with group membership
Linux
bin/cli.sh user create myuser -p "qwer1234!" -g supervisor,reader,writer
$ bin/cli.sh user create myuser -p "qwer1234!" -g supervisor,reader,writer
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Microsoft Windows
bin\cli.bat user create myuser -p "qwer1234!" -g supervisor,reader,writer
$ bin\cli.bat user create myuser -p "qwer1234!" -g supervisor,reader,writer
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
4.1.2. LDAP Realms Link kopierenLink in die Zwischenablage kopiert!
LDAP realms connect to LDAP servers, such as OpenLDAP, Red Hat Directory Server, Apache Directory Server, or Microsoft Active Directory, to authenticate users and obtain membership information.
LDAP servers can have different entry layouts, depending on the type of server and deployment. For this reason, LDAP realm configuration is complex. It is beyond the scope of this document to provide examples for all possibile configurations.
LDAP realm configuration
- 1
- Names the LDAP realm.
- 2
- Specifies the LDAP server connection URL.
- 3
- Specifies a principal and credentials to connect to the LDAP server.Important
The principal for LDAP connections must have necessary privileges to perform LDAP queries and access specific attributes.
- 4
- Optionally tunes LDAP server connections by specifying connection timeouts and so on.
- 5
- Verifies user credentials. Data Grid attempts to connect to the LDAP server using the configured credentials. Alternatively, you can use the
user-password-mapper
element that specifies a password. - 6
- Maps LDAP entries to identities. The
rdn-identifier
specifies an LDAP attribute that finds the user entry based on a provided identifier, which is typically a username; for example, theuid
orsAMAccountName
attribute. - 7
- Defines a starting context that limits searches to the LDAP subtree that contains the user entries.
- 8
- Retrieves all the groups of which the user is a member. There are typically two ways in which membership information is stored:
-
Under group entries that usually have class
groupOfNames
in themember
attribute. In this case, you can use an attribute filter as in the preceding example configuration. This filter searches for entries that match the supplied filter, which locates groups with amember
attribute equal to the user’s DN. The filter then extracts the group entry’s CN as specified byfrom
, and adds it to the user’sRoles
. In the user entry in the
memberOf
attribute. In this case you should use an attribute reference such as the following:<attribute-reference reference="memberOf" from="cn" to="Roles" />
This reference gets all
memberOf
attributes from the user’s entry, extracts the CN as specified byfrom
, and adds them to the user’sRoles
.
-
Under group entries that usually have class
Supported authentication mechanisms
LDAP realms support the following authentication mechanisms directly:
-
SASL:
PLAIN
,DIGEST-*
, andSCRAM-*
-
HTTP (REST):
Basic
andDigest
4.1.2.1. LDAP Realm Principal Rewriting Link kopierenLink in die Zwischenablage kopiert!
Some SASL authentication mechanisms, such as GSSAPI
, GS2-KRB5
and Negotiate
, supply a username that needs to be cleaned up before you can use it to search LDAP servers.
- 1
- Defines a rewriter that extracts the username from the principal using a regular expression.
4.1.3. Trust Store Realms Link kopierenLink in die Zwischenablage kopiert!
Trust store realms use keystores that contain the public certificates of all clients that are allowed to connect to Data Grid server.
Supported authentication mechanisms
Trust store realms work with client-certificate authentication mechanisms:
-
SASL:
EXTERNAL
-
HTTP (REST):
CLIENT_CERT
4.1.4. Token Realms Link kopierenLink in die Zwischenablage kopiert!
Token realms use external services to validate tokens and require providers that are compatible with RFC-7662 (OAuth2 Token Introspection), such as Red Hat SSO.
Supported authentication mechanisms
Token realms support the following authentication mechanisms:
-
SASL:
OAUTHBEARER
-
HTTP (REST):
Bearer
4.2. Creating Data Grid Server Identities Link kopierenLink in die Zwischenablage kopiert!
Server identities are defined within security realms and enable Data Grid servers to prove their identity to clients.
4.2.1. Setting Up SSL Identities Link kopierenLink in die Zwischenablage kopiert!
SSL identities use keystores that contain either a certificate or chain of certificates.
If security realms contain SSL identities, Data Grid servers automatically enable encryption for the endpoints that use those security realms.
Procedure
Create a keystore for Data Grid server.
ImportantData Grid server supports the following keystore formats: JKS, JCEKS, PKCS12, BKS, BCFKS and UBER.
In production environments, server certificates should be signed by a trusted Certificate Authority, either Root or Intermediate CA.
-
Add the keystore to the
$ISPN_HOME/server/conf
directory. -
Add a
server-identities
definition to the Data Grid server security realm. - Specify the name of the keystore along with the password and alias.
4.2.1.1. SSL Identity Configuration Link kopierenLink in die Zwischenablage kopiert!
The following example configures an SSL identity for Data Grid server:
- 1
- Defines identities for Data Grid server.
- 2
- Configures an SSL identity for Data Grid server.
- 3
- Names a keystore that contains Data Grid server SSL certificates.
- 4
- Specifies that the keystore is relative to the
server/conf
directory in$ISPN_HOME
. - 5
- Specifies a keystore password.
- 6
- Specifies a keystore alias.
4.2.1.2. Automatically Generating Keystores Link kopierenLink in die Zwischenablage kopiert!
Configure Data Grid servers to automatically generate keystores at startup.
Automatically generated keystores:
- Should not be used in production environments.
- Are generated whenever necessary; for example, while obtaining the first connection from a client.
- Contain certificates that you can use directly in Hot Rod clients.
Procedure
-
Include the
generate-self-signed-certificate-host
attribute for thekeystore
element in the server configuration. - Specify a hostname for the server certificate as the value.
SSL server identity with a generated keystore
- 1
- generates a keystore using
localhost
4.2.1.3. Tuning SSL Protocols and Cipher Suites Link kopierenLink in die Zwischenablage kopiert!
You can configure the SSL engine, via the Data Grid server SSL identity, to use specific protocols and ciphers.
You must ensure that you set the correct ciphers for the protocol features you want to use; for example HTTP/2 ALPN.
Procedure
-
Add the
engine
element to your Data Grid server SSL identity. -
Configure the SSL engine with the
enabled-protocols
andenabled-ciphersuites
attributes.
SSL engine configuration
4.2.2. Setting Up Kerberos Identities Link kopierenLink in die Zwischenablage kopiert!
Kerberos identities use keytab files that contain service principal names and encrypted keys, derived from Kerberos passwords.
keytab files can contain both user and service account principals. However, Data Grid servers use service account principals only. As a result, Data Grid servers can provide identity to clients and allow clients to authenticate with Kerberos servers.
In most cases, you create unique principals for the Hot Rod and REST connectors. For example, you have a "datagrid" server in the "INFINISPAN.ORG" domain. In this case you should create the following service principals:
-
hotrod/datagrid@INFINISPAN.ORG
identifies the Hot Rod service. -
HTTP/datagrid@INFINISPAN.ORG
identifies the REST service.
Procedure
Create keytab files for the Hot Rod and REST services.
- Linux
ktutil
$ ktutil ktutil: addent -password -p datagrid@INFINISPAN.ORG -k 1 -e aes256-cts Password for datagrid@INFINISPAN.ORG: [enter your password] ktutil: wkt http.keytab ktutil: quit
Copy to Clipboard Copied! Toggle word wrap Toggle overflow - Microsoft Windows
ktpass -princ HTTP/datagrid@INFINISPAN.ORG -pass * -mapuser INFINISPAN\USER_NAME ktab -k http.keytab -a HTTP/datagrid@INFINISPAN.ORG
$ ktpass -princ HTTP/datagrid@INFINISPAN.ORG -pass * -mapuser INFINISPAN\USER_NAME $ ktab -k http.keytab -a HTTP/datagrid@INFINISPAN.ORG
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Copy the keytab files to the
$ISPN_HOME/server/conf
directory. -
Add a
server-identities
definition to the Data Grid server security realm. - Specify the location of keytab files that provide service principals to Hot Rod and REST connectors.
- Name the Kerberos service principals.
4.2.2.1. Kerberos Identity Configuration Link kopierenLink in die Zwischenablage kopiert!
The following example configures Kerberos identities for Data Grid server:
- 1
- Defines identities for Data Grid server.
- 2
- Specifies a keytab file that provides a Kerberos identity for the Hot Rod connector.
- 3
- Names the Kerberos service principal for the Hot Rod connector.
- 4
- Specifies that the keytab file must exist when Data Grid server starts.
- 5
- Specifies a keytab file that provides a Kerberos identity for the REST connector.
- 6
- Names the Kerberos service principal for the REST connector.
4.3. Configuring Endpoint Authentication Mechanisms Link kopierenLink in die Zwischenablage kopiert!
Configure Hot Rod and REST connectors with SASL or HTTP authentication mechanisms to authenticate with clients.
Data Grid servers require user authentication to access the command line interface (CLI) and console as well as the Hot Rod and REST endpoints. Data Grid servers also automatically configure authentication mechanisms based on the security realms that you define.
4.3.1. Data Grid Server Authentication Link kopierenLink in die Zwischenablage kopiert!
Data Grid servers automatically configure authentication mechanisms based on the security realm that you assign to endpoints.
SASL Authentication Mechanisms
The following SASL authentication mechanisms apply to Hot Rod endpoints:
Security Realm | SASL Authentication Mechanism |
---|---|
Property Realms and LDAP Realms | SCRAM-*, DIGEST-*, CRAM-MD5 |
Token Realms | OAUTHBEARER |
Trust Realms | EXTERNAL |
Kerberos Identities | GSSAPI, GS2-KRB5 |
SSL/TLS Identities | PLAIN |
HTTP Authentication Mechanisms
The following HTTP authentication mechanisms apply to REST endpoints:
Security Realm | HTTP Authentication Mechanism |
---|---|
Property Realms and LDAP Realms | DIGEST |
Token Realms | BEARER_TOKEN |
Trust Realms | CLIENT_CERT |
Kerberos Identities | SPNEGO |
SSL/TLS Identities | BASIC |
Default Configuration
Data Grid servers provide a security realm named "default" that uses a property realm with plain text credentials defined in $RHDG_HOME/server/ conf/users.properties
, as shown in the following snippet:
The endpoints
configuration assigns the "default" security realm to the Hot Rod and REST connectors, as follows:
<endpoints socket-binding="default" security-realm="default"> <hotrod-connector name="hotrod"/> <rest-connector name="rest"/> </endpoints>
<endpoints socket-binding="default" security-realm="default">
<hotrod-connector name="hotrod"/>
<rest-connector name="rest"/>
</endpoints>
As a result of the preceding configuration, Data Grid servers require authentication with a mechanism that the property realm supports.
4.3.2. Manually Configuring Hot Rod Authentication Link kopierenLink in die Zwischenablage kopiert!
Explicitly configure Hot Rod connector authentication to override the default SASL authentication mechanisms that Data Grid servers use for security realms.
Procedure
-
Add an
authentication
definition to the Hot Rod connector configuration. - Specify which Data Grid security realm the Hot Rod connector uses for authentication.
- Specify the SASL authentication mechanisms for the Hot Rod endpoint to use.
- Configure SASL authentication properties as appropriate.
4.3.2.1. Hot Rod Authentication Configuration Link kopierenLink in die Zwischenablage kopiert!
Hot Rod connector with SCRAM, DIGEST, and PLAIN authentication
Hot Rod connector with Kerberos authentication
4.3.2.2. Hot Rod Endpoint Authentication Mechanisms Link kopierenLink in die Zwischenablage kopiert!
Data Grid supports the following SASL authentications mechanisms with the Hot Rod connector:
Authentication mechanism | Description | Related details |
---|---|---|
|
Uses credentials in plain-text format. You should use |
Similar to the |
|
Uses hashing algorithms and nonce values. Hot Rod connectors support |
Similar to the |
|
Uses salt values in addition to hashing algorithms and nonce values. Hot Rod connectors support |
Similar to the |
|
Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding |
Similar to the |
|
Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding |
Similar to the |
| Uses client certificates. |
Similar to the |
|
Uses OAuth tokens and requires a |
Similar to the |
4.3.2.3. SASL Quality of Protection (QoP) Link kopierenLink in die Zwischenablage kopiert!
If SASL mechanisms support integrity and privacy protection settings, you can add them to your Hot Rod connector configuration with the qop
attribute.
QoP setting | Description |
---|---|
| Authentication only. |
| Authentication with integrity protection. |
| Authentication with integrity and privacy protection. |
4.3.2.4. SASL Policies Link kopierenLink in die Zwischenablage kopiert!
SASL policies let you control which authentication mechanisms Hot Rod connectors can use.
Policy | Description | Default value |
---|---|---|
| Use only SASL mechanisms that support forward secrecy between sessions. This means that breaking into one session does not automatically provide information for breaking into future sessions. | false |
| Use only SASL mechanisms that require client credentials. | false |
| Do not use SASL mechanisms that are susceptible to simple plain passive attacks. | false |
| Do not use SASL mechanisms that are susceptible to active, non-dictionary, attacks. | false |
| Do not use SASL mechanisms that are susceptible to passive dictionary attacks. | false |
| Do not use SASL mechanisms that accept anonymous logins. | true |
Data Grid cache authorization restricts access to caches based on roles and permissions. If you configure cache authorization, you can then set <no-anonymous value=false />
to allow anonymous login and delegate access logic to cache authorization.
Hot Rod connector with SASL policy configuration
As a result of the preceding configuration, the Hot Rod connector uses the GSSAPI
mechanism because it is the only mechanism that complies with all policies.
4.3.3. Manually Configuring REST Authentication Link kopierenLink in die Zwischenablage kopiert!
Explicitly configure REST connector authentication to override the default HTTP authentication mechanisms that Data Grid servers use for security realms.
Procedure
-
Add an
authentication
definition to the REST connector configuration. - Specify which Data Grid security realm the REST connector uses for authentication.
- Specify the authentication mechanisms for the REST endpoint to use.
4.3.3.1. REST Authentication Configuration Link kopierenLink in die Zwischenablage kopiert!
REST connector with BASIC and DIGEST authentication
REST connector with Kerberos authentication
4.3.3.2. REST Endpoint Authentication Mechanisms Link kopierenLink in die Zwischenablage kopiert!
Data Grid supports the following authentications mechanisms with the REST connector:
Authentication mechanism | Description | Related details |
---|---|---|
|
Uses credentials in plain-text format. You should use |
Corresponds to the |
|
Uses hashing algorithms and nonce values. REST connectors support |
Corresponds to the |
|
Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding |
Corresponds to the |
|
Uses OAuth tokens and requires a |
Corresponds to the |
| Uses client certificates. |
Similar to the |
4.4. Disabling Data Grid Server Authentication Link kopierenLink in die Zwischenablage kopiert!
In local development environments or on isolated networks you can configure Data Grid servers to allow unauthenticated client requests.
Procedure
-
Remove any
security-realm
attributes from theendpoints
configuration. -
Ensure that the Hot Rod and REST connectors do not include any
authentication
definitions.
For example, the following configuration allows unauthenticated access to Data Grid:
<endpoints socket-binding="default"> <hotrod-connector name="hotrod"/> <rest-connector name="rest"/> </endpoints>
<endpoints socket-binding="default">
<hotrod-connector name="hotrod"/>
<rest-connector name="rest"/>
</endpoints>
4.5. Configuring Data Grid Authorization Link kopierenLink in die Zwischenablage kopiert!
Authorization restricts the ability to perform operations with Data Grid and access data. You assign users with roles that have different permission levels.
4.5.1. Data Grid Authorization Link kopierenLink in die Zwischenablage kopiert!
Data Grid lets you configure authorization to secure Cache Managers and cache instances. When user applications or clients attempt to perform an operation on secured Cached Managers and caches, they must provide an identity with a role that has sufficient permissions to perform that operation.
For example, you configure authorization on a specific cache instance so that invoking Cache.get()
requires an identity to be assigned a role with read permission while Cache.put()
requires a role with write permission.
In this scenario, if a user application or client with the reader
role attempts to write an entry, Data Grid denies the request and throws a security exception. If a user application or client with the writer
role sends a write request, Data Grid validates authorization and issues a token for subsequent operations.
Identity to Role Mapping
Identities are security Principals of type java.security.Principal
. Subjects, implemented with the javax.security.auth.Subject
class, represent a group of security Principals. In other words, a Subject represents a user and all groups to which it belongs.
Data Grid uses role mappers so that security principals correspond to roles, which represent one or more permissions.
The following image illustrates how security principals map to roles:
4.5.1.1. Permissions Link kopierenLink in die Zwischenablage kopiert!
Permissions control access to Cache Managers and caches by restricting the actions that you can perform. Permissions can also apply to specific entities such as named caches.
Permission | Function | Description |
---|---|---|
CONFIGURATION |
| Defines new cache configurations. |
LISTEN |
| Registers listeners against a Cache Manager. |
LIFECYCLE |
| Stops the Cache Manager. |
ALL | - | Includes all Cache Manager permissions. |
Permission | Function | Description |
---|---|---|
|
| Retrieves entries from a cache. |
WRITE |
| Writes, replaces, removes, evicts data in a cache. |
EXEC |
| Allows code execution against a cache. |
LISTEN |
| Registers listeners against a cache. |
BULK_READ |
| Executes bulk retrieve operations. |
BULK_WRITE |
| Executes bulk write operations. |
LIFECYCLE |
| Starts and stops a cache. |
ADMIN |
| Allows access to underlying components and internal structures. |
ALL | - | Includes all cache permissions. |
ALL_READ | - | Combines the READ and BULK_READ permissions. |
ALL_WRITE | - | Combines the WRITE and BULK_WRITE permissions. |
Combining permissions
You might need to combine permissions so that they are useful. For example, to allow "supervisors" to run stream operations but restrict "standard" users to puts and gets only, you can define the following mappings:
<role name="standard" permission="READ WRITE" /> <role name="supervisors" permission="READ WRITE EXEC BULK"/>
<role name="standard" permission="READ WRITE" />
<role name="supervisors" permission="READ WRITE EXEC BULK"/>
Reference
4.5.1.2. Role Mappers Link kopierenLink in die Zwischenablage kopiert!
Data Grid includes a PrincipalRoleMapper
API that maps security Principals in a Subject to authorization roles. There are two role mappers available by default:
- IdentityRoleMapper
Uses the Principal name as the role name.
-
Java class:
org.infinispan.security.mappers.IdentityRoleMapper
-
Declarative configuration:
<identity-role-mapper />
-
Java class:
- CommonNameRoleMapper
Uses the Common Name (CN) as the role name if the Principal name is a Distinguished Name (DN). For example the
cn=managers,ou=people,dc=example,dc=com
DN maps to themanagers
role.-
Java class:
org.infinispan.security.mappers.CommonRoleMapper
-
Declarative configuration:
<common-name-role-mapper />
-
Java class:
You can also use custom role mappers that implement the org.infinispan.security.PrincipalRoleMapper
interface. To configure custom role mappers declaratively, use: <custom-role-mapper class="my.custom.RoleMapper" />
4.5.2. Declaratively Configuring Authorization Link kopierenLink in die Zwischenablage kopiert!
Configure authorization in your infinispan.xml
file.
Procedure
-
Configure the global authorization settings in the
cache-container
that specify a role mapper, and define a set of roles and permissions. Configure authorization for caches to restrict access based on user roles.
Copy to Clipboard Copied! Toggle word wrap Toggle overflow If you do not want to apply all roles to a cache, explicitly define the roles that are authorized for caches as follows:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Defines authorized roles for the cache. In this example, users who have the
writer
role only are not authorized for the "secured" cache. Data Grid denies any access requests from those users.
Reference