org.gridgain.grid.security.certificate

Class CertificateAuthenticator

java.lang.Object

org.gridgain.grid.security.certificate.CertificateAuthenticator

All Implemented Interfaces:

LifecycleAware, SecurityCredentialsProvider, Authenticator

public class CertificateAuthenticator
extends Object
implements Authenticator, SecurityCredentialsProvider, LifecycleAware

Authorizes thin clients based on their SSL certificates.

Applies to subjects that connect through the client connector or the REST interface, such as thin clients, JDBC and ODBC. Their certificate is matched against the predicates of setPermissions(Map) and the permission set of the first matching predicate is granted.

Node subjects are never matched against a certificate. While setAlwaysAcceptServerNodes(boolean) is true, which is the default, every joining node is accepted and granted all permissions.

Set that flag to false to decline node subjects. This authenticator then has to be combined through a CompositeAuthenticator with one that authenticates nodes, such as JaasAuthenticator.

Constructor Summary

Constructors

Constructor and Description
CertificateAuthenticator()

Method Summary

Modifier and Type	Method and Description
SecuritySubject	authenticate(AuthenticationContext authCtx) Authenticates a given subject (either node or remote client).
SecurityCredentials	credentials() Unless setAlwaysAcceptServerNodes(boolean) is set to false, returns empty SecurityCredentials to be used as credentials of local node.
boolean	isGlobalNodeAuthentication() Flag indicating whether node authentication should be run on coordinator only or on all nodes in current topology.
void	setAlwaysAcceptServerNodes(boolean alwaysAcceptServerNodes) Sets whether every remote node is accepted without any check, true by default.
void	setPermissions(Map<? extends IgnitePredicate<Certificate[]>,SecurityPermissionSet> permsMap) Sets mapping of certificate predicates to permissions.
<P extends IgnitePredicate<Certificate[]>> void	setPermissionsJson(Map<P,String> permsMapJson) Sets mapping of certificate predicates to permissions.
void	start() Starts grid component, called on grid start.
void	stop() Stops grid component, called on grid shutdown.
boolean	supported(SecuritySubjectType subjType) Checks if given subject is supported by this authenticator.
String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

CertificateAuthenticator

public CertificateAuthenticator()

Method Detail

setPermissions

public void setPermissions(Map<? extends IgnitePredicate<Certificate[]>,SecurityPermissionSet> permsMap)

Sets mapping of certificate predicates to permissions. If multiple predicates may accept a single certificate, it is advised to use LinkedHashMap to make sure authorization results are consistent.

Parameters:

permsMap - Map of certificate matchers to permissions.

setPermissionsJson

public <P extends IgnitePredicate<Certificate[]>> void setPermissionsJson(Map<P,String> permsMapJson)
                                                                   throws IgniteCheckedException

Sets mapping of certificate predicates to permissions. If multiple predicates may accept a single certificate, it is advised to use LinkedHashMap to make sure authorization results are consistent. Permissions are passed in JSON form, please refer to AuthenticationAclBasicProvider for details.

Parameters:

permsMapJson - Map of certificate matchers to permissions in JSON format.

Throws:

IgniteCheckedException

setAlwaysAcceptServerNodes

public void setAlwaysAcceptServerNodes(boolean alwaysAcceptServerNodes)

Sets whether every remote node is accepted without any check, true by default.

Set to false to decline node subjects and combine this authenticator with one that handles them, such as JaasAuthenticator.

Parameters:

alwaysAcceptServerNodes - Whether to accept every remote node.

start

public void start()

Starts grid component, called on grid start.

Specified by:

start in interface LifecycleAware

stop

public void stop()

Stops grid component, called on grid shutdown.

Specified by:

stop in interface LifecycleAware

supported

public boolean supported(SecuritySubjectType subjType)

Checks if given subject is supported by this authenticator. If not, then next authentication in the list will be checked.

Specified by:

supported in interface Authenticator

Parameters:

subjType - Subject type.

Returns:

True if subject type is supported, false otherwise.

authenticate

public SecuritySubject authenticate(AuthenticationContext authCtx)
                             throws IgniteCheckedException

Authenticates a given subject (either node or remote client).

Specified by:

authenticate in interface Authenticator

Parameters:

authCtx - Authentication context. Contains all necessary information required to authenticate the subject.

Returns:

Authenticated subject context or null if authentication did not pass.

Throws:

IgniteCheckedException - If authentication resulted in system error. Note that bad credentials should not cause this exception.

isGlobalNodeAuthentication

public boolean isGlobalNodeAuthentication()

Flag indicating whether node authentication should be run on coordinator only or on all nodes in current topology.

Specified by:

isGlobalNodeAuthentication in interface Authenticator

Returns:

True if all nodes in topology should authenticate joining node. In this case security permissions will be validated to be the same on all nodes. In case if permissions differ, node will not be able to join the topology. If this method returns false, only coordinator node will authenticate joining node.

toString

public String toString()

Overrides:

toString in class Object

credentials

public SecurityCredentials credentials()

Unless setAlwaysAcceptServerNodes(boolean) is set to false, returns empty SecurityCredentials to be used as credentials of local node.

Specified by:

credentials in interface SecurityCredentialsProvider

Returns:

Empty security credentials or null.