主页
产品
Red Hat Data Grid
8.3
Data Grid Server 指南
6.4. 使用客户端证书配置授权

6.4. 使用客户端证书配置授权

启用客户端证书身份验证意味着您无需在客户端配置中指定 Data Grid 用户凭证，这意味着您必须将角色与客户端证书中的通用名称(CN)字段关联。

先决条件

为客户端提供包含其公共证书或证书链的一部分（通常是公共 CA 证书）的 Java 密钥存储。
配置 Data Grid Server 以执行客户端证书身份验证。

流程

打开 Data Grid Server 配置进行编辑。
在安全授权配置中启用 common-name-role-mapper。
为客户端证书中的通用名称(CN)分配一个具有适当权限的角色。
保存对您的配置的更改。

客户端证书授权配置

XML

<infinispan>
  <cache-container name="certificate-authentication" statistics="true">
    <security>
      <authorization>
        <!-- Declare a role mapper that associates the common name (CN) field in client certificate trust stores with authorization roles. -->
        <common-name-role-mapper/>
        <!-- In this example, if a client certificate contains `CN=Client1` then clients with matching certificates get ALL permissions. -->
        <role name="Client1" permissions="ALL"/>
      </authorization>
    </security>
  </cache-container>
</infinispan>

<infinispan>
  <cache-container name="certificate-authentication" statistics="true">
    <security>
      <authorization>
        <!-- Declare a role mapper that associates the common name (CN) field in client certificate trust stores with authorization roles. -->
        <common-name-role-mapper/>
        <!-- In this example, if a client certificate contains `CN=Client1` then clients with matching certificates get ALL permissions. -->
        <role name="Client1" permissions="ALL"/>
      </authorization>
    </security>
  </cache-container>
</infinispan>

Copy to Clipboard

Toggle word wrap

JSON

{
  "infinispan": {
    "cache-container": {
      "name": "certificate-authentication",
      "security": {
        "authorization": {
          "common-name-role-mapper": null,
          "roles": {
            "Client1": {
              "role": {
                "permissions": "ALL"
              }
            }
          }
        }
      }
    }
  }
}

{
  "infinispan": {
    "cache-container": {
      "name": "certificate-authentication",
      "security": {
        "authorization": {
          "common-name-role-mapper": null,
          "roles": {
            "Client1": {
              "role": {
                "permissions": "ALL"
              }
            }
          }
        }
      }
    }
  }
}

Copy to Clipboard

Toggle word wrap

YAML

infinispan:
  cacheContainer:
    name: "certificate-authentication"
    security:
      authorization:
        commonNameRoleMapper: ~
        roles:
          Client1:
            role:
              permissions:
                - "ALL"

infinispan:
  cacheContainer:
    name: "certificate-authentication"
    security:
      authorization:
        commonNameRoleMapper: ~
        roles:
          Client1:
            role:
              permissions:
                - "ALL"

Copy to Clipboard

Toggle word wrap

返回顶部

6.4. 使用客户端证书配置授权

客户端证书授权配置

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links