Configuring authentication

Guide
  • Red Hat Data Grid 8.3
  • Updated 08 February 2022
  • Published 02 December 2021

Configuring authentication

Guide
Red Hat Data Grid 8.3
  • Updated 08 February 2022
  • Published 02 December 2021

Application users need credentials to access Data Grid clusters. You can use default, generated credentials or add your own.

Default credentials

Data Grid Operator generates base64-encoded credentials for the following users:

User Secret name Description

developer

infinispan-generated-secret

Credentials for the default application user.

operator

infinispan-generated-operator-secret

Credentials that Data Grid Operator uses to interact with Data Grid resources.

Retrieving credentials

Get credentials from authentication secrets to access Data Grid clusters.

Procedure
  • Retrieve credentials from authentication secrets.

    $ oc get secret infinispan-generated-secret

    Base64-decode credentials.

    $ oc get secret infinispan-generated-secret \
    -o jsonpath="{.data.identities\.yaml}" | base64 --decode
    
    credentials:
    - username: developer
      password: dIRs5cAAsHIeeRIL

Adding custom user credentials

Configure access to Data Grid cluster endpoints with custom credentials.

Modifying spec.security.endpointSecretName triggers a cluster restart.

Procedure
  1. Create an identities.yaml file with the credentials that you want to add.

    credentials:
    - username: myfirstusername
      password: changeme-one
    - username: mysecondusername
      password: changeme-two
  2. Create an authentication secret from identities.yaml.

    $ oc create secret generic --from-file=identities.yaml connect-secret
  3. Specify the authentication secret with spec.security.endpointSecretName in your Infinispan CR and then apply the changes.

    spec:
      security:
        endpointSecretName: connect-secret

Changing the operator password

You can change the password for the operator user if you do not want to use the automatically generated password.

Procedure
  • Update the password key in the infinispan-generated-operator-secret secret as follows:

    oc patch secret infinispan-generated-operator-secret -p='{"stringData":{"password": "supersecretoperatorpassword"}}'

    You should update only the password key in the generated-operator-secret secret. When you update the password, Data Grid Operator automatically refreshes other keys in that secret.

Disabling user authentication

Allow users to access Data Grid clusters and manipulate data without providing credentials.

Do not disable authentication if endpoints are accessible from outside the OpenShift cluster via spec.expose.type. You should disable authentication for development environments only.

Procedure
  1. Set false as the value for the spec.security.endpointAuthentication field in your Infinispan CR.

    spec:
      security:
        endpointAuthentication: false
  2. Apply the changes.