20.7. Securing Interfaces

Procedure 20.1. Configure SASL GSSAPI/Kerberos Authentication - Client-side Configuration

1. Ensure that the Server-Side configuration has been completed. As this is configured declaratively this configuration is found in the JBoss Data Grid Administration and Configuration Guide.
2. Define a login module in a login configuration file (gss.conf) on the client side:

   GssExample {
       com.sun.security.auth.module.Krb5LoginModule required client=TRUE;
   };

3. Set up the following system properties:

   java.security.auth.login.config=gss.conf
   java.security.krb5.conf=/etc/krb5.conf

   Note

   The krb5.conf file is dependent on the environment and must point to the Kerberos Key Distribution Center.
4. Implement the CallbackHandler:

   public class MyCallbackHandler implements CallbackHandler {
       final private String username;
       final private char[] password;
       final private String realm;
   
       public MyCallbackHandler() { }
   
       public MyCallbackHandler (String username, String realm, char[] password) {
           this.username = username;
           this.password = password;
           this.realm = realm;
       }
   
       @Override
       public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
           for (Callback callback : callbacks) {
               if (callback instanceof NameCallback) {
                   NameCallback nameCallback = (NameCallback) callback;
                   nameCallback.setName(username);
               } else if (callback instanceof PasswordCallback) {
                   PasswordCallback passwordCallback = (PasswordCallback) callback;
                   passwordCallback.setPassword(password);
               } else if (callback instanceof AuthorizeCallback) {
                   AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback;
                   authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
                       authorizeCallback.getAuthorizationID()));
               } else if (callback instanceof RealmCallback) {
                   RealmCallback realmCallback = (RealmCallback) callback;
                   realmCallback.setText(realm);
               } else {
                   throw new UnsupportedCallbackException(callback);
               }
           }
       }
   }

5. Configure the Hot Rod Client, as seen in the below snippet:

   LoginContext lc = new LoginContext("GssExample", new MyCallbackHandler("krb_user", "krb_password".toCharArra()));
   lc.login();
   Subject clientSubject = lc.getSubject();
   
   ConfigurationBuilder clientBuilder = new ConfigurationBuilder();
   clientBuilder.addServer()
           .host("127.0.0.1")
           .port(11222)
       .socketTimeout(1200000)
       .security()
           .authentication()
               .enable()
               .serverName("infinispan-server")
               .saslMechanism("GSSAPI")
               .clientSubject(clientSubject)
               .callbackHandler(new MyCallbackHandler());
   remoteCacheManager = new RemoteCacheManager(clientBuilder.build());
   RemoteCache<String, String> cache = remoteCacheManager.getCache("secured");

1. Ensure that the server has been configured for MD5 Authentication. Instructions for performing this configuration on the server are found in JBoss Data Grid's Administration and Configuration Guide.
2. Implement the CallbackHandler:

   public class MyCallbackHandler implements CallbackHandler {
      final private String username;
      final private char[] password;
      final private String realm;
   
      public MyCallbackHandler (String username, String realm, char[] password) {
         this.username = username;
         this.password = password;
         this.realm = realm;
      }
   
      @Override
      public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
         for (Callback callback : callbacks) {
            if (callback instanceof NameCallback) {
               NameCallback nameCallback = (NameCallback) callback;
               nameCallback.setName(username);
            } else if (callback instanceof PasswordCallback) {
               PasswordCallback passwordCallback = (PasswordCallback) callback;
               passwordCallback.setPassword(password);
            } else if (callback instanceof AuthorizeCallback) {
               AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback;
               authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
                     authorizeCallback.getAuthorizationID()));
            } else if (callback instanceof RealmCallback) {
               RealmCallback realmCallback = (RealmCallback) callback;
               realmCallback.setText(realm);
            } else {
               throw new UnsupportedCallbackException(callback);
            }
         }
      }
   }

3. Connect the client to the configured Hot Rod connector as seen below:

   ConfigurationBuilder clientBuilder = new ConfigurationBuilder();
   clientBuilder.addServer()
           .host("127.0.0.1")
           .port(11222)
       .socketTimeout(1200000)
       .security()
           .authentication()
               .enable()
               .serverName("myhotrodserver")
               .saslMechanism("DIGEST-MD5")
               .callbackHandler(new MyCallbackHandler("myuser", "ApplicationRealm", "qwer1234!".toCharArray()));
   remoteCacheManager = new RemoteCacheManager(clientBuilder.build());
   RemoteCache<String, String> cache = remoteCacheManager.getCache("secured");