Chapter 9. Configuring User Authorization
Authorization is a security feature that requires users to have certain permissions before they can access caches or interact with Data Grid resources. You assign roles to users that provide different levels of permissions, from read-only access to full, super user privileges.
9.1. Enabling Authorization in Cache Configuration
Use authorization in your cache configuration to restrict user access. Before they can read or write cache entries, or create and delete caches, users must have a role with a sufficient level of permission.
Procedure
-
Open your
infinispan.xml
configuration for editing. If it is not already declared, add the
<authorization />
tag inside thesecurity
elements for thecache-container
.This enables authorization for the Cache Manager and provides a global set of roles and permissions that caches can inherit.
-
Add the
<authorization />
tag to each cache for which Data Grid restricts access based on user roles.
The following configuration example shows how to use implicit authorization configuration with default roles and permissions:
<infinispan> <cache-container default-cache="rbac-cache" name="restricted"> <security> <!-- Enable authorization with the default roles and permissions. --> <authorization /> </security> <local-cache name="rbac-cache"> <security> <!-- Inherit authorization settings from the cache-container. --> <authorization/> </security> </local-cache> </cache-container> </infinispan>
9.2. User Roles and Permissions
Data Grid includes a default set of roles that grant users with permissions to access data and interact with Data Grid resources.
ClusterRoleMapper
is the default mechanism that Data Grid uses to associate security principals to authorization roles.
ClusterRoleMapper
matches principal names to role names. A user named admin
gets admin
permissions automatically, a user named deployer
gets deployer
permissions, and so on.
Role | Permissions | Description |
---|---|---|
| ALL | Superuser with all permissions including control of the Cache Manager lifecycle. |
| ALL_READ, ALL_WRITE, LISTEN, EXEC, MONITOR, CREATE |
Can create and delete Data Grid resources in addition to |
| ALL_READ, ALL_WRITE, LISTEN, EXEC, MONITOR |
Has read and write access to Data Grid resources in addition to |
| ALL_READ, MONITOR |
Has read access to Data Grid resources in addition to |
| MONITOR |
Can view statistics via JMX and the |
9.3. How Security Authorization Works
Data Grid authorization secures your installation by restricting user access.
User applications or clients must belong to a role that is assigned with sufficient permissions before they can perform operations on Cache Managers or caches.
For example, you configure authorization on a specific cache instance so that invoking Cache.get()
requires an identity to be assigned a role with read permission while Cache.put()
requires a role with write permission.
In this scenario, if a user application or client with the io
role attempts to write an entry, Data Grid denies the request and throws a security exception. If a user application or client with the writer
role sends a write request, Data Grid validates authorization and issues a token for subsequent operations.
Identities
Identities are security Principals of type java.security.Principal
. Subjects, implemented with the javax.security.auth.Subject
class, represent a group of security Principals. In other words, a Subject represents a user and all groups to which it belongs.
Identities to roles
Data Grid uses role mappers so that security principals correspond to roles, which you assign one or more permissions.
The following image illustrates how security principals correspond to roles:
9.3.1. Permissions
Authorization roles have different permissions with varying levels of access to Data Grid. Permissions let you restrict user access to both Cache Managers and caches.
9.3.1.1. Cache Manager permissions
Permission | Function | Description |
---|---|---|
CONFIGURATION |
| Defines new cache configurations. |
LISTEN |
| Registers listeners against a Cache Manager. |
LIFECYCLE |
| Stops the Cache Manager. |
CREATE |
| Create and remove container resources such as caches, counters, schemas, and scripts. |
MONITOR |
|
Allows access to JMX statistics and the |
ALL | - | Includes all Cache Manager permissions. |
9.3.1.2. Cache permissions
Permission | Function | Description |
---|---|---|
READ |
| Retrieves entries from a cache. |
WRITE |
| Writes, replaces, removes, evicts data in a cache. |
EXEC |
| Allows code execution against a cache. |
LISTEN |
| Registers listeners against a cache. |
BULK_READ |
| Executes bulk retrieve operations. |
BULK_WRITE |
| Executes bulk write operations. |
LIFECYCLE |
| Starts and stops a cache. |
ADMIN |
| Allows access to underlying components and internal structures. |
MONITOR |
|
Allows access to JMX statistics and the |
ALL | - | Includes all cache permissions. |
ALL_READ | - | Combines the READ and BULK_READ permissions. |
ALL_WRITE | - | Combines the WRITE and BULK_WRITE permissions. |
Reference
9.3.2. Role Mappers
Data Grid includes a PrincipalRoleMapper
API that maps security Principals in a Subject to authorization roles that you can assign to users.
9.3.2.1. Cluster role mappers
ClusterRoleMapper
uses a persistent replicated cache to dynamically store principal-to-role mappings for the default roles and permissions.
By default uses the Principal name as the role name and implements org.infinispan.security.MutableRoleMapper
which exposes methods to change role mappings at runtime.
-
Java class:
org.infinispan.security.mappers.ClusterRoleMapper
-
Declarative configuration:
<cluster-role-mapper />
9.3.2.2. Identity role mappers
IdentityRoleMapper
uses the Principal name as the role name.
-
Java class:
org.infinispan.security.mappers.IdentityRoleMapper
-
Declarative configuration:
<identity-role-mapper />
9.3.2.3. CommonName role mappers
CommonNameRoleMapper
uses the Common Name (CN) as the role name if the Principal name is a Distinguished Name (DN).
For example this DN, cn=managers,ou=people,dc=example,dc=com
, maps to the managers
role.
-
Java class:
org.infinispan.security.mappers.CommonRoleMapper
-
Declarative configuration:
<common-name-role-mapper />
9.3.2.4. Custom role mappers
Custom role mappers are implementations of org.infinispan.security.PrincipalRoleMapper
.
-
Declarative configuration:
<custom-role-mapper class="my.custom.RoleMapper" />
9.4. Access Control List (ACL) Cache
Data Grid caches roles that you grant to users internally for optimal performance. Whenever you grant or deny roles to users, Data Grid flushes the ACL cache to ensure user permissions are applied correctly.
If necessary, you can disable the ACL cache or configure it with the cache-size
and cache-timeout
attributes.
<security cache-size="1000" cache-timeout="300000"> <authorization /> </security>
Reference
9.5. Customizing Roles and Permissions
You can customize authorization settings in your Data Grid configuration to use role mappers with different combinations of roles and permissions.
Procedure
-
Open your
infinispan.xml
configuration for editing. -
Configure authorization for the
cache-container
by declaring a role mapper and a set of roles and permissions. - Configure authorization for caches to restrict access based on user roles.
The following configuration example shows how to configure security authorization with roles and permissions:
<infinispan> <cache-container default-cache="restricted" name="custom-authorization"> <security> <authorization> <!-- Declare a role mapper that associates a security principal to each role. --> <identity-role-mapper /> <!-- Specify user roles and corresponding permissions. --> <role name="admin" permissions="ALL" /> <role name="reader" permissions="READ" /> <role name="writer" permissions="WRITE" /> <role name="supervisor" permissions="READ WRITE EXEC"/> </authorization> </security> <local-cache name="implicit-authorization"> <security> <!-- Inherit roles and permissions from the cache-container. --> <authorization/> </security> </local-cache> <local-cache name="restricted"> <security> <!-- Explicitly define which roles can access the cache. --> <authorization roles="admin supervisor"/> </security> </local-cache> </cache-container> </infinispan>
9.6. Disabling Security Authorization
In local development environments you can disable authorization so that users do not need roles and permissions. Disabling security authorization means that any user can access data and interact with Data Grid resources.
Procedure
-
Open your
infinispan.xml
configuration for editing. -
Remove any
authorization
elements from thesecurity
configuration for thecache-container
and each cache configuration.
9.7. Configuring Authorization with Client Certificates
Enabling client certificate authentication means you do not need to specify Data Grid user credentials in client configuration, which means you must associate roles with the Common Name (CN) field in the client certificate(s).
Prerequisites
- Provide clients with a Java keystore that contains either their public certificates or part of the certificate chain, typically a public CA certificate.
- Configure Data Grid Server to perform client certificate authentication.
Procedure
-
Enable the
common-name-role-mapper
in the security authorization configuration. Assign the Common Name (
CN
) from the client certificate a role with the appropriate permissions.<cache-container name="certificate-authentication" statistics="true"> <security> <authorization> <!-- Declare a role mapper that associates the common name (CN) field in client certificate trust stores with authorization roles. --> <common-name-role-mapper/> <!-- In this example, if a client certificate contains `CN=Client1` then clients with matching certificates get ALL permissions. --> <role name="Client1" permissions="ALL"/> </authorization> </security> </cache-container>