Chapter 1. Installing and configuring Hot Rod JS clients

When you set up Data Grid clusters in separate data centers to perform cross-site replication, you can add connection details for the different sites to the client configuration.

Change the Data Grid cluster to which the Hot Rod JS client is connectioned.

Hot Rod JS clients can use the following SASL authentication mechanisms to connect to Data Grid Server.

PLAIN

Sends credentials in plain text (unencrypted) over the wire in a way that is similar to HTTP BASIC authentication.

var connected = infinispan.client(
  {port: 11222, host: '127.0.0.1'},
  {
    authentication: {
      enabled: true,
      saslMechanism: 'PLAIN',
      userName: 'username',
      password: 'changeme'
    }
  }
);

DIGEST-MD5

Uses the MD5 hashing algorithm in addition to nonces to encrypt credentials.

var connected = infinispan.client(
  {port: 11222, host: '127.0.0.1'},
  {
    authentication: {
      enabled: true,
      saslMechanism: 'DIGEST-MD5',
      userName: 'username',
      password: 'changeme',
      serverName: 'infinispan'
    }
  }
);

SCRAM

Uses salt values in addition to hashing algorithms and nonce values to encrypt credentials. Hot Rod endpoints support SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-384, SCRAM-SHA-512 hashing algorithms, in order of strength.

var connected = infinispan.client(
  {port: 11222, host: '127.0.0.1'},
  {
    authentication: {
      enabled: true,
      saslMechanism: 'SCRAM-SHA-1',
      userName: 'username',
      password: 'changeme'
    }
  }
);

Hot Rod JS clients can use different types of encryption to negotiate secure connections with Data Grid Server.

Data Grid Server identities

For basic encryption, you can add the signing certificate, or CA bundle, for Data Grid Server certificates to your configuration as follows:

var connected = infinispan.client({port: 11222, host: '127.0.0.1'},
  {
    ssl: {
      enabled: true,
      trustCerts: ['my-root-ca.crt.pem']
    }
  }
);

Trust stores

You can add trust stores in PKCS12 or PFX format as follows:

var connected = infinispan.client({port: 11222, host: '127.0.0.1'},
  {
    ssl: {
      enabled: true,
      cryptoStore: {
        path: 'my-truststore.p12',
        passphrase: 'secret'
      }
    }
  }
);

Client certificate authentication

If you enable client certificate authentication in Data Grid Server configuration, add a keystore as in the following example:

var connected = infinispan.client({port: 11222, host: '127.0.0.1'},
  {
    ssl: {
      enabled: true,
      trustCerts: ['my-root-ca.crt.pem'],
      clientAuth: {
        key: 'privkey.pem',
        passphrase: 'secret',
        cert:ssl 'cert.pem'
      }
    }
  }
);

Server Name Indication (SNI)

If you use SNI to allow Hot Rod JS clients to request Data Grid Server hostnames, set a value for the sniHostName parameter that matches a hostname in the Data Grid Server configuration.

var connected = infinispan.client({port: 11222, host: '127.0.0.1'},
  {
    ssl: {
      enabled: true,
      trustCerts: ['my-root-ca.crt.pem']
      sniHostName: 'example.com'
    }
  }
);