20.7. Securing Interfaces

Procedure 20.1. Configure SASL GSSAPI/Kerberos Authentication - Client-side Configuration

1. Ensure that the Server-Side configuration has been completed. As this is configured declaratively this configuration is found in the JBoss Data Grid Administration and Configuration Guide.
2. Define a login module in a login configuration file (gss.conf) on the client side:

   GssExample {
       com.sun.security.auth.module.Krb5LoginModule required client=TRUE;
   };

   Copy to Clipboard Toggle word wrap
3. Set up the following system properties:

   java.security.auth.login.config=gss.conf
   java.security.krb5.conf=/etc/krb5.conf

   Copy to Clipboard Toggle word wrap

   Note

   The krb5.conf file is dependent on the environment and must point to the Kerberos Key Distribution Center.
4. Implement the CallbackHandler:

   public class MyCallbackHandler implements CallbackHandler {
       final private String username;
       final private char[] password;
       final private String realm;
   
       public MyCallbackHandler() { }
   
       public MyCallbackHandler (String username, String realm, char[] password) {
           this.username = username;
           this.password = password;
           this.realm = realm;
       }
   
       @Override
       public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
           for (Callback callback : callbacks) {
               if (callback instanceof NameCallback) {
                   NameCallback nameCallback = (NameCallback) callback;
                   nameCallback.setName(username);
               } else if (callback instanceof PasswordCallback) {
                   PasswordCallback passwordCallback = (PasswordCallback) callback;
                   passwordCallback.setPassword(password);
               } else if (callback instanceof AuthorizeCallback) {
                   AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback;
                   authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
                       authorizeCallback.getAuthorizationID()));
               } else if (callback instanceof RealmCallback) {
                   RealmCallback realmCallback = (RealmCallback) callback;
                   realmCallback.setText(realm);
               } else {
                   throw new UnsupportedCallbackException(callback);
               }
           }
       }
   }

   Copy to Clipboard Toggle word wrap
5. Configure the Hot Rod Client, as seen in the below snippet:

   LoginContext lc = new LoginContext("GssExample", new MyCallbackHandler("krb_user", "krb_password".toCharArra()));
   lc.login();
   Subject clientSubject = lc.getSubject();
   
   ConfigurationBuilder clientBuilder = new ConfigurationBuilder();
   clientBuilder.addServer()
           .host("127.0.0.1")
           .port(11222)
       .socketTimeout(1200000)
       .security()
           .authentication()
               .enable()
               .serverName("infinispan-server")
               .saslMechanism("GSSAPI")
               .clientSubject(clientSubject)
               .callbackHandler(new MyCallbackHandler());
   remoteCacheManager = new RemoteCacheManager(clientBuilder.build());
   RemoteCache<String, String> cache = remoteCacheManager.getCache("secured");

   Copy to Clipboard Toggle word wrap

1. Ensure that the server has been configured for MD5 Authentication. Instructions for performing this configuration on the server are found in JBoss Data Grid's Administration and Configuration Guide.
2. Implement the CallbackHandler:

   public class MyCallbackHandler implements CallbackHandler {
      final private String username;
      final private char[] password;
      final private String realm;
   
      public MyCallbackHandler (String username, String realm, char[] password) {
         this.username = username;
         this.password = password;
         this.realm = realm;
      }
   
      @Override
      public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
         for (Callback callback : callbacks) {
            if (callback instanceof NameCallback) {
               NameCallback nameCallback = (NameCallback) callback;
               nameCallback.setName(username);
            } else if (callback instanceof PasswordCallback) {
               PasswordCallback passwordCallback = (PasswordCallback) callback;
               passwordCallback.setPassword(password);
            } else if (callback instanceof AuthorizeCallback) {
               AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback;
               authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
                     authorizeCallback.getAuthorizationID()));
            } else if (callback instanceof RealmCallback) {
               RealmCallback realmCallback = (RealmCallback) callback;
               realmCallback.setText(realm);
            } else {
               throw new UnsupportedCallbackException(callback);
            }
         }
      }
   }

   Copy to Clipboard Toggle word wrap
3. Connect the client to the configured Hot Rod connector as seen below:

   ConfigurationBuilder clientBuilder = new ConfigurationBuilder();
   clientBuilder.addServer()
           .host("127.0.0.1")
           .port(11222)
       .socketTimeout(1200000)
       .security()
           .authentication()
               .enable()
               .serverName("myhotrodserver")
               .saslMechanism("DIGEST-MD5")
               .callbackHandler(new MyCallbackHandler("myuser", "ApplicationRealm", "qwer1234!".toCharArray()));
   remoteCacheManager = new RemoteCacheManager(clientBuilder.build());
   RemoteCache<String, String> cache = remoteCacheManager.getCache("secured");
   

   Copy to Clipboard Toggle word wrap