2.6. Data Security for Remote Client Server Mode

Procedure 2.3. Secure Hot Rod Using SSL/TLS

1. Generate a Keystore

   Create a Java Keystore using the keytool application distributed with the JDK and add your certificate to it. The certificate can be either self signed, or obtained from a trusted CA depending on your security policy.

2. Place the Keystore in the Configuration Directory

   Put the keystore in the ~/JDG_HOME/standalone/configuration directory with the standalone-hotrod-ssl.xml file from the ~/JDG_HOME/docs/examples/configs directory.

3. Declare an SSL Server Identity

   Declare an SSL server identity within a security realm in the management section of the configuration file. The SSL server identity must specify the path to a keystore and its secret key.

   <server-identities>
     <ssl protocol="...">
       <keystore path="..." relative-to="..." keystore-password="${VAULT::VAULT_BLOCK::ATTRIBUTE_NAME::ENCRYPTED_VALUE}" />
     </ssl>
     <secret value="..." />
   </server-identities>

   See Section 2.6.7.4, “Configure Hot Rod Authentication (X.509)” for details about these parameters.

4. Add the Security Element

   Add the security element to the Hot Rod connector as follows:

   <hotrod-connector socket-binding="hotrod" cache-container="local">
       <encryption ssl="true" security-realm="ApplicationRealm" require-ssl-client-auth="false" />
   </hotrod-connector>

   1. Server Authentication of Certificate

      If you require the server to perform authentication of the client certificate, create a truststore that contains the valid client certificates and set the require-ssl-client-auth attribute to true.

5. Start the Server

   Start the server using the following:

   bin/standalone.sh -c standalone-hotrod-ssl.xml

   This will start a server with a Hot Rod endpoint on port 11222. This endpoint will only accept SSL connections.

Procedure 2.4. Configure SASL GSSAPI/Kerberos Authentication

1. Server-side Configuration

   The following steps must be configured on the server-side:
   1. Define a Kerberos security login module using the security domain subsystem:

      <system-properties>
          <property name="java.security.krb5.conf" value="/tmp/infinispan/krb5.conf"/>
          <property name="java.security.krb5.debug" value="true"/>
          <property name="jboss.security.disable.secdomain.option" value="true"/>
      </system-properties>
      
      <security-domain name="infinispan-server" cache-type="default">
          <authentication>
              <login-module code="Kerberos" flag="required">
                  <module-option name="debug" value="true"/>
                  <module-option name="storeKey" value="true"/>
                  <module-option name="refreshKrb5Config" value="true"/>
                  <module-option name="useKeyTab" value="true"/>
                  <module-option name="doNotPrompt" value="true"/>
                  <module-option name="keyTab" value="/tmp/infinispan/infinispan.keytab"/>
                  <module-option name="principal" value="HOTROD/localhost@INFINISPAN.ORG"/>
              </login-module>
          </authentication>
      </security-domain>

   2. Ensure that the cache-container has authorization roles defined, and these roles are applied in the cache's authorization block as seen in Section 2.4, “Configuring Red Hat JBoss Data Grid for Authorization”.
   3. Configure a Hot Rod connector as follows:

      <hotrod-connector socket-binding="hotrod" 
      		  cache-container="default">
      	<authentication security-realm="ApplicationRealm">
      		<sasl server-name="node0" 
      		      mechanisms="{mechanism_name}" 
      		      qop="{qop_name}" 
      		      strength="{value}">
      			<policy>
      				<no-anonymous value="true" />
      			</policy>
      			<property name="com.sun.security.sasl.digest.utf8">true</property>
      		</sasl>
        </authentication>
      </hotrod-connector>

      • The server-name attribute specifies the name that the server declares to incoming clients. The client configuration must also contain the same server name value.
      • The server-context-name attribute specifies the name of the login context used to retrieve a server subject for certain SASL mechanisms (for example, GSSAPI).
      • The mechanisms attribute specifies the authentication mechanism in use. See Section 2.6.7, “User Authentication over Hot Rod Using SASL” for a list of supported mechanisms.
      • The qop attribute specifies the SASL quality of protection value for the configuration. Supported values for this attribute are auth (authentication), auth-int (authentication and integrity, meaning that messages are verified against checksums to detect tampering), and auth-conf (authentication, integrity, and confidentiality, meaning that messages are also encrypted). Multiple values can be specified, for example, auth-int auth-conf. The ordering implies preference, so the first value which matches both the client and server's preference is chosen.
      • The strength attribute specifies the SASL cipher strength. Valid values are low, medium, and high.
      • The no-anonymous element within the policy element specifies whether mechanisms that accept anonymous login are permitted. Set this value to false to permit and true to deny.

2. Client-side Configuration

   The following steps must be configured on the client-side:
   1. Define a login module in a login configuration file (gss.conf) on the client side:

      GssExample {
          com.sun.security.auth.module.Krb5LoginModule required client=TRUE;
      };

   2. Set up the following system properties:

      java.security.auth.login.config=gss.conf
      java.security.krb5.conf=/etc/krb5.conf

      Note

      The krb5.conf file is dependent on the environment and must point to the Kerberos Key Distribution Center.
   3. Configure the Hot Rod Client:

      public class MyCallbackHandler implements CallbackHandler {
         final private String username;
         final private char[] password;
         final private String realm;
      
         public MyCallbackHandler() { }
      
         public MyCallbackHandler (String username, String realm, char[] password) {
            this.username = username;
            this.password = password;
            this.realm = realm;
         }
      
         @Override
         public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
            for (Callback callback : callbacks) {
               if (callback instanceof NameCallback) {
                  NameCallback nameCallback = (NameCallback) callback;
                  nameCallback.setName(username);
               } else if (callback instanceof PasswordCallback) {
                  PasswordCallback passwordCallback = (PasswordCallback) callback;
                  passwordCallback.setPassword(password);
               } else if (callback instanceof AuthorizeCallback) {
                  AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback;
                  authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
                        authorizeCallback.getAuthorizationID()));
               } else if (callback instanceof RealmCallback) {
                  RealmCallback realmCallback = (RealmCallback) callback;
                  realmCallback.setText(realm);
               } else {
                  throw new UnsupportedCallbackException(callback);
               }
            }
         }}
      LoginContext lc = new LoginContext("GssExample", new MyCallbackHandler("krb_user", "krb_password".toCharArra()));lc.login();Subject clientSubject = lc.getSubject();
      
      ConfigurationBuilder clientBuilder = new ConfigurationBuilder();clientBuilder
          .addServer()
              .host("127.0.0.1")
              .port(11222)
          .socketTimeout(1200000)
          .security()
              .authentication()
                  .enable()
                  .serverName("infinispan-server")
                  .saslMechanism("GSSAPI")
                  .clientSubject(clientSubject)
                  .callbackHandler(new MyCallbackHandler());remoteCacheManager = new RemoteCacheManager(clientBuilder.build());RemoteCache<String, String> cache = remoteCacheManager.getCache("secured");

Procedure 2.5. Configure Hot Rod Authentication (MD5)

1. Set up the Hot Rod Connector configuration by adding the sasl element to the authentication element (for details on the authentication element, see Section 2.6.4, “Configuring Security Realms Declaratively”) as follows:

   <hotrod-connector socket-binding="hotrod" 
                               cache-container="default">
       <authentication security-realm="ApplicationRealm">
           <sasl server-name="myhotrodserver" 
                    mechanisms="DIGEST-MD5" 
                    qop="auth" />
       </authentication>
   </hotrod-connector>

   • The server-name attribute specifies the name that the server declares to incoming clients. The client configuration must also contain the same server name value.
   • The mechanisms attribute specifies the authentication mechanism in use. See Section 2.6.7, “User Authentication over Hot Rod Using SASL” for a list of supported mechanisms.
   • The qop attribute specifies the SASL quality of production value for the configuration. Supported values for this attribute are auth, auth-int, and auth-conf.
2. Connect the client to the configured Hot Rod connector as follows:

   public class MyCallbackHandler implements CallbackHandler {
      final private String username;
      final private char[] password;
      final private String realm;
   
      public MyCallbackHandler (String username, String realm, char[] password) {
         this.username = username;
         this.password = password;
         this.realm = realm;
      }
   
      @Override
      public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
         for (Callback callback : callbacks) {
            if (callback instanceof NameCallback) {
               NameCallback nameCallback = (NameCallback) callback;
               nameCallback.setName(username);
            } else if (callback instanceof PasswordCallback) {
               PasswordCallback passwordCallback = (PasswordCallback) callback;
               passwordCallback.setPassword(password);
            } else if (callback instanceof AuthorizeCallback) {
               AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback;
               authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
                     authorizeCallback.getAuthorizationID()));
            } else if (callback instanceof RealmCallback) {
               RealmCallback realmCallback = (RealmCallback) callback;
               realmCallback.setText(realm);
            } else {
               throw new UnsupportedCallbackException(callback);
            }
         }
      }}
   ConfigurationBuilder clientBuilder = new ConfigurationBuilder();clientBuilder
       .addServer()
           .host("127.0.0.1")
           .port(11222)
       .socketTimeout(1200000)
       .security()
           .authentication()
               .enable()
               .serverName("myhotrodserver")
               .saslMechanism("DIGEST-MD5")
               .callbackHandler(new MyCallbackHandler("myuser", "ApplicationRealm", "qwer1234!".toCharArray()));remoteCacheManager = new RemoteCacheManager(clientBuilder.build());RemoteCache<String, String> cache = remoteCacheManager.getCache("secured");