25.9. Securing Interfaces

Procedure 25.4. Configure SASL GSSAPI/Kerberos Authentication - Server-side Configuration

1. Define a Kerberos security login module using the security domain subsystem:

   <system-properties>
       <property name="java.security.krb5.conf" value="/tmp/infinispan/krb5.conf"/>
       <property name="java.security.krb5.debug" value="true"/>
       <property name="jboss.security.disable.secdomain.option" value="true"/>
   </system-properties>
   
   <security-domain name="infinispan-server" cache-type="default">
       <authentication>
           <login-module code="Kerberos" flag="required">
               <module-option name="debug" value="true"/>
               <module-option name="storeKey" value="true"/>
               <module-option name="refreshKrb5Config" value="true"/>
               <module-option name="useKeyTab" value="true"/>
               <module-option name="doNotPrompt" value="true"/>
               <module-option name="keyTab" value="/tmp/infinispan/infinispan.keytab"/>
               <module-option name="principal" value="HOTROD/localhost@INFINISPAN.ORG"/>
           </login-module>
       </authentication>
   </security-domain>

2. Ensure that the cache-container has authorization roles defined, and these roles are applied in the cache's authorization block as seen in Section 25.5, “Configuring Red Hat JBoss Data Grid for Authorization”.
3. Configure a Hot Rod connector as follows:

   <hotrod-connector socket-binding="hotrod" 
   		  cache-container="default">
   	<authentication security-realm="ApplicationRealm">
   		<sasl server-name="node0" 
   		      mechanisms="{mechanism_name}" 
   		      qop="{qop_name}" 
   		      strength="{value}">
   			<policy>
   				<no-anonymous value="true" />
   			</policy>
   			<property name="com.sun.security.sasl.digest.utf8">true</property>
   		</sasl>
     </authentication>
   </hotrod-connector>

   • The server-name attribute specifies the name that the server declares to incoming clients. The client configuration must also contain the same server name value.
   • The server-context-name attribute specifies the name of the login context used to retrieve a server subject for certain SASL mechanisms (for example, GSSAPI).
   • The mechanisms attribute specifies the authentication mechanism in use. See Section 25.9.1.4, “User Authentication over Hot Rod Using SASL” for a list of supported mechanisms.
   • The qop attribute specifies the SASL quality of protection value for the configuration. Supported values for this attribute are auth (authentication), auth-int (authentication and integrity, meaning that messages are verified against checksums to detect tampering), and auth-conf (authentication, integrity, and confidentiality, meaning that messages are also encrypted). Multiple values can be specified, for example, auth-int auth-conf. The ordering implies preference, so the first value which matches both the client and server's preference is chosen.
   • The strength attribute specifies the SASL cipher strength. Valid values are low, medium, and high.
   • The no-anonymous element within the policy element specifies whether mechanisms that accept anonymous login are permitted. Set this value to false to permit and true to deny.
4. Perform the Client-Side configuration on each client. As the Hot Rod client is configured programmatically information on this configuration is found in the JBoss Data Grid Developer Guide.

Procedure 25.5. Configure Hot Rod Authentication (MD5)

1. Set up the Hot Rod Connector configuration by adding the sasl element to the authentication element (for details on the authentication element, see Section 25.8.4, “Configuring Security Realms Declaratively”) as follows:

   <hotrod-connector socket-binding="hotrod" 
                               cache-container="default">
       <authentication security-realm="ApplicationRealm">
           <sasl server-name="myhotrodserver" 
                    mechanisms="DIGEST-MD5" 
                    qop="auth" />
       </authentication>
   </hotrod-connector>

   • The server-name attribute specifies the name that the server declares to incoming clients. The client configuration must also contain the same server name value.
   • The mechanisms attribute specifies the authentication mechanism in use. See Section 25.9.1.4, “User Authentication over Hot Rod Using SASL” for a list of supported mechanisms.
   • The qop attribute specifies the SASL quality of production value for the configuration. Supported values for this attribute are auth, auth-int, and auth-conf.
2. Configure each client to be connected to the Hot Rod connector. As this step is performed programmatically instructions are found in JBoss Data Grid's Developer Guide.