Data Grid Security Guide

Procedure

1. Open your infinispan.xml configuration for editing.

2. If it is not already declared, add the <authorization /> tag inside the security elements for the cache-container.

   This enables authorization for the Cache Manager and provides a global set of roles and permissions that caches can inherit.

3. Add the <authorization /> tag to each cache for which Data Grid restricts access based on user roles.

Procedure

1. Open your infinispan.xml configuration for editing.
2. Configure authorization for the cache-container by declaring a role mapper and a set of roles and permissions.
3. Configure authorization for caches to restrict access based on user roles.

Procedure

1. Open your infinispan.xml configuration for editing.
2. Remove any authorization elements from the security configuration for the cache-container and each cache configuration.

Procedure

1. Enable the common-name-role-mapper in the security authorization configuration.

2. Assign the Common Name (CN) from the client certificate a role with the appropriate permissions.

   <cache-container name="certificate-authentication" statistics="true">
      <security>
        <authorization>
          <!-- Declare a role mapper that associates the common name (CN) field
               in client certificate trust stores with authorization roles. -->
          <common-name-role-mapper/>
          <!-- In this example, if a client certificate contains `CN=Client1` then
               clients with matching certificates get ALL permissions. -->
          <role name="Client1" permissions="ALL"/>
        </authorization>
      </security>
   </cache-container>

   Copy to Clipboard Toggle word wrap

Procedure

1. Construct a GlobalConfigurationBuilder that enables authorization, specifies a role mapper, and defines a set of roles and permissions.

   GlobalConfigurationBuilder global = new GlobalConfigurationBuilder();
   global
      .security()
         .authorization().enable() 

   1

   
            .principalRoleMapper(new IdentityRoleMapper()) 

   2

   
            .role("admin") 

   3

   
               .permission(AuthorizationPermission.ALL)
            .role("reader")
               .permission(AuthorizationPermission.READ)
            .role("writer")
               .permission(AuthorizationPermission.WRITE)
            .role("supervisor")
               .permission(AuthorizationPermission.READ)
               .permission(AuthorizationPermission.WRITE)
               .permission(AuthorizationPermission.EXEC);

   Copy to Clipboard Toggle word wrap

   1

   Enables Data Grid authorization for the Cache Manager.

   2

   Specifies an implementation of PrincipalRoleMapper that maps Principals to roles.

   3

   Defines roles and their associated permissions.

2. Enable authorization in the ConfigurationBuilder for caches to restrict access based on user roles.

   ConfigurationBuilder config = new ConfigurationBuilder();
   config
      .security()
         .authorization()
            .enable(); 

   1

   Copy to Clipboard Toggle word wrap

   1

   Implicitly adds all roles from the global configuration.

   If you do not want to apply all roles to a cache, explicitly define the roles that are authorized for caches as follows:

   ConfigurationBuilder config = new ConfigurationBuilder();
   config
      .security()
         .authorization()
            .enable()
            .role("admin") 

   1

   
            .role("supervisor")
            .role("reader");

   Copy to Clipboard Toggle word wrap

   1

   Defines authorized roles for the cache. In this example, users who have the writer role only are not authorized for the "secured" cache. Data Grid denies any access requests from those users.

1. The first node in the Data Grid cluster, the coordinator node, generates a secret key.
2. A joining node performs certificate authentication with the coordinator to mutually verify identity.
3. The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
4. The coordinator node encrypts the secret key with the public key and returns it to the joining node.
5. The joining node decrypts and installs the secret key.
6. The node joins the cluster, encrypting and decrypting messages with the secret key.

1. Nodes install the secret key from a keystore on the Data Grid classpath at startup.
2. Node join clusters, encrypting and decrypting messages with the secret key.

Procedure

1. Create a keystore with certificate chains that enables Data Grid to verify node identity.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SSL_KEY_EXCHANGE and ASYM_ENCRYPT protocols to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
     <jgroups>
       <!-- Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack. -->
       <stack name="encrypt-tcp" extends="tcp">
         <!-- Adds a keystore that nodes use to perform certificate authentication. -->
         <!-- Uses the stack.combine and stack.position attributes to insert SSL_KEY_EXCHANGE into the default TCP stack after VERIFY_SUSPECT. -->
         <SSL_KEY_EXCHANGE keystore_name="mykeystore.jks"
                           keystore_password="changeit"
                           stack.combine="INSERT_AFTER"
                           stack.position="VERIFY_SUSPECT"/>
         <!-- Configures ASYM_ENCRYPT -->
         <!-- Uses the stack.combine and stack.position attributes to insert ASYM_ENCRYPT into the default TCP stack before pbcast.NAKACK2. -->
         <!-- The use_external_key_exchange = "true" attribute configures nodes to use the `SSL_KEY_EXCHANGE` protocol for certificate authentication. -->
         <ASYM_ENCRYPT asym_keylength="2048"
                       asym_algorithm="RSA"
                       change_key_on_coord_leave = "false"
                       change_key_on_leave = "false"
                       use_external_key_exchange = "true"
                       stack.combine="INSERT_BEFORE"
                       stack.position="pbcast.NAKACK2"/>
       </stack>
     </jgroups>
     <cache-container name="default" statistics="true">
       <!-- Configures the cluster to use the JGroups stack. -->
       <transport cluster="${infinispan.cluster.name}"
                  stack="encrypt-tcp"
                  node-name="${infinispan.node.name:}"/>
     </cache-container>
   </infinispan>

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a keystore that contains a secret key.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration.