Procedure

1. Construct a GlobalConfigurationBuilder that enables authorization, specifies a role mapper, and defines a set of roles and permissions.

   GlobalConfigurationBuilder global = new GlobalConfigurationBuilder();
   global
      .security()
         .authorization().enable() 1
            .principalRoleMapper(new IdentityRoleMapper()) 2
            .role("admin") 3
               .permission(AuthorizationPermission.ALL)
            .role("reader")
               .permission(AuthorizationPermission.READ)
            .role("writer")
               .permission(AuthorizationPermission.WRITE)
            .role("supervisor")
               .permission(AuthorizationPermission.READ)
               .permission(AuthorizationPermission.WRITE)
               .permission(AuthorizationPermission.EXEC);

   1

   Enables Data Grid authorization for the Cache Manager.

   2

   Specifies an implementation of PrincipalRoleMapper that maps Principals to roles.

   3

   Defines roles and their associated permissions.

2. Enable authorization in the ConfigurationBuilder for caches to restrict access based on user roles.

   ConfigurationBuilder config = new ConfigurationBuilder();
   config
      .security()
         .authorization()
            .enable(); 1

   1

   Implicitly adds all roles from the global configuration.

   If you do not want to apply all roles to a cache, explicitly define the roles that are authorized for caches as follows:

   ConfigurationBuilder config = new ConfigurationBuilder();
   config
      .security()
         .authorization()
            .enable()
            .role("admin") 1
            .role("supervisor")
            .role("reader");

   1

   Defines authorized roles for the cache. In this example, users who have the writer role only are not authorized for the "secured" cache. Data Grid denies any access requests from those users.

Procedure

1. Configure the global authorization settings in the cache-container that specify a role mapper, and define a set of roles and permissions.

2. Configure authorization for caches to restrict access based on user roles.

   <infinispan>
      <cache-container default-cache="secured" name="secured">
         <security>
            <authorization> 1
               <identity-role-mapper /> 2
               <role name="admin" permissions="ALL" /> 3
               <role name="reader" permissions="READ" />
               <role name="writer" permissions="WRITE" />
               <role name="supervisor" permissions="READ WRITE EXEC"/>
            </authorization>
         </security>
         <local-cache name="secured">
            <security>
               <authorization/> 4
            </security>
         </local-cache>
      </cache-container>
   </infinispan>

   1

   Enables Data Grid authorization for the Cache Manager.

   2

   Specifies an implementation of PrincipalRoleMapper that maps Principals to roles.

   3

   Defines roles and their associated permissions.

   4

   Implicitly adds all roles from the global configuration.

   If you do not want to apply all roles to a cache, explicitly define the roles that are authorized for caches as follows:

   <infinispan>
      <cache-container default-cache="secured" name="secured">
         <security>
            <authorization>
               <identity-role-mapper />
               <role name="admin" permissions="ALL" />
               <role name="reader" permissions="READ" />
               <role name="writer" permissions="WRITE" />
               <role name="supervisor" permissions="READ WRITE EXEC"/>
            </authorization>
         </security>
         <local-cache name="secured">
            <security>
               <authorization roles="admin supervisor reader"/> 1
            </security>
         </local-cache>
      </cache-container>
   
   </infinispan>

   1

   Defines authorized roles for the cache. In this example, users who have the writer role only are not authorized for the "secured" cache. Data Grid denies any access requests from those users.

1. The first node in the Data Grid cluster, the coordinator node, generates a secret key.
2. A joining node performs certificate authentication with the coordinator to mutually verify identity.
3. The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
4. The coordinator node encrypts the secret key with the public key and returns it to the joining node.
5. The joining node decrypts and installs the secret key.
6. The node joins the cluster, encrypting and decrypting messages with the secret key.

1. Nodes install the secret key from a keystore on the Data Grid classpath at startup.
2. Node join clusters, encrypting and decrypting messages with the secret key.

Procedure

1. Create a keystore with certificate chains that enables Data Grid to verify node identity.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SSL_KEY_EXCHANGE and ASYM_ENCRYPT protocols to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
       <jgroups>
            <stack name="encrypt-tcp" extends="tcp"> 1
              <SSL_KEY_EXCHANGE keystore_name="mykeystore.jks" 2
                                keystore_password="changeit" 3
                                stack.combine="INSERT_AFTER"
                                stack.position="VERIFY_SUSPECT"/> 4
              <ASYM_ENCRYPT asym_keylength="2048" 5
                       asym_algorithm="RSA" 6
                       change_key_on_coord_leave = "false" 7
                       change_key_on_leave = "false" 8
                       use_external_key_exchange = "true" 9
                       stack.combine="INSERT_AFTER"
                       stack.position="SSL_KEY_EXCHANGE"/> 10
            </stack>
       </jgroups>
       <cache-container name="default" statistics="true">
         <transport cluster="${infinispan.cluster.name}"
                    stack="encrypt-tcp" 11
                    node-name="${infinispan.node.name:}"/>
      </cache-container>
   </infinispan>

   1

   Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.

   2

   Names the keystore that nodes use to perform certificate authentication.

   3

   Specifies the keystore password.

   4

   Uses the stack.combine and stack.position attributes to insert SSL_KEY_EXCHANGE into the default TCP stack after the VERIFY_SUSPECT protocol.

   5

   Specifies the length of the secret key that the coordinator node generates. The default value is 2048.

   6

   Specifies the cipher engine the coordinator node uses to generate secret keys. The default value is RSA.

   7

   Configures Data Grid to generate and distribute a new secret key when the coordinator node changes.

   8

   Configures Data Grid to generate and distribute a new secret key when nodes leave.

   9

   Configures Data Grid nodes to use the SSL_KEY_EXCHANGE protocol for certificate authentication.

   10

   Uses the stack.combine and stack.position attributes to insert ASYM_ENCRYPT into the default TCP stack after the SSL_KEY_EXCHANGE protocol.

   11

   Configures the Data Grid cluster to use the secure JGroups stack.

Procedure

1. Create a keystore that contains a secret key.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
       <jgroups>
            <stack name="encrypt-tcp" extends="tcp"> 1
              <SYM_ENCRYPT keystore_name="myKeystore.p12" 2
                           keystore_type="PKCS12" 3
                           store_password="changeit" 4
                           key_password="changeit" 5
                           alias="myKey" 6
                           stack.combine="INSERT_AFTER"
                           stack.position="VERIFY_SUSPECT"/> 7
            </stack>
       </jgroups>
       <cache-container name="default" statistics="true">
         <transport cluster="${infinispan.cluster.name}"
                    stack="encrypt-tcp" 8
                    node-name="${infinispan.node.name:}"/>
      </cache-container>
   </infinispan>

   1

   Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack for Data Grid.

   2

   Names the keystore from which nodes obtain secret keys.

   3

   Specifies the keystore type. JGroups uses JCEKS by default.

   4

   Specifies the keystore password.

   5

   Specifies the secret key password.

   6

   Specifies the secret key alias.

   7

   Uses the stack.combine and stack.position attributes to insert SYM_ENCRYPT into the default TCP stack after the VERIFY_SUSPECT protocol.

   8

   Configures the Data Grid cluster to use the secure JGroups stack.