-
Language:
English
-
Language:
English
Chapter 21. Security for Cluster Traffic
21.1. Configure Node Security in Library Mode
In Library mode, node authentication is configured directly in the JGroups configuration. JGroups can be configured so that nodes must authenticate each other when joining or merging with a cluster. The authentication uses SASL and is enabled by adding the
SASL
protocol to your JGroups XML configuration.
SASL relies on JAAS notions, such as
CallbackHandlers
, to obtain certain information necessary for the authentication handshake. Users must supply their own CallbackHandlers
on both client and server sides.
Important
The
JAAS
API is only available when configuring user authentication and authorization, and is not available for node security.
The following example demonstrates how to implement a
CallbackHandler
class. In this example, login and password are checked against values provided via Java properties when JBoss Data Grid is started, and authorization is checked against role
which is defined in the class ("test_user"
).
Example 21.1. Callback Handler Class
public class SaslPropAuthUserCallbackHandler implements CallbackHandler { private static final String APPROVED_USER = "test_user"; private final String name; private final char[] password; private final String realm; public SaslPropAuthUserCallbackHandler() { this.name = System.getProperty("sasl.username"); this.password = System.getProperty("sasl.password").toCharArray(); this.realm = System.getProperty("sasl.realm"); } @Override public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { for (Callback callback : callbacks) { if (callback instanceof PasswordCallback) { ((PasswordCallback) callback).setPassword(password); } else if (callback instanceof NameCallback) { ((NameCallback) callback).setName(name); } else if (callback instanceof AuthorizeCallback) { AuthorizeCallback authorizeCallback = (AuthorizeCallback) callback; if (APPROVED_USER.equals(authorizeCallback.getAuthorizationID())) { authorizeCallback.setAuthorized(true); } else { authorizeCallback.setAuthorized(false); } } else if (callback instanceof RealmCallback) { RealmCallback realmCallback = (RealmCallback) callback; realmCallback.setText(realm); } else { throw new UnsupportedCallbackException(callback); } } } }
For authentication, specify the
javax.security.auth.callback.NameCallback
and javax.security.auth.callback.PasswordCallback
callbacks
For authorization, specify the callbacks required for authentication, as well as specifying the
javax.security.sasl.AuthorizeCallback
callback.