This Confluence has been LDAP enabled, if you are an ASF Committer, please use your LDAP Credentials to login. Any problems file an INFRA jira ticket please.

Page tree
Skip to end of metadata
Go to start of metadata

Integrated Security allows you to control the authentication/authorization of all Geode entities within one implementation. When Integrated Security is turned on, all client/server communications, peer to peer, gateway authentication, jmx operations, gfsh commands and Pulse are protected with this single security mechanism.

1. No changes for legacy implementations of Authentication/Authorization for client-server security

The API for Authenticator and AccessControl has not changed. Your implementations of those are still honored in client/server communication if you choose not to implement the new security interface. However, these two are deprecated now and will be removed in the future.

2. Introduction of security-manager configuration and SecurityManager interface for Integrated Security

To turn on integrated security, start your servers/locators with the security-manager property set in your gemfire.properties file:

security-manager = com.example.security.MySecurityManager

The security-manager property identifies the class name of the SecurityManager interface implementation. SecurityManager is the interface you implement for both authentication and authorization. Make sure your class has a zero argument constructor so that Geode can instantiate the object. See the SecurityManager javadoc for details. There is an ExampleSecurityManager in the geode-core/src/main/java/org/apache/geode/examples/security directory that you can use as an example to write your own implementation.

3. Introduction of ResourcePermission

In SecurityManager, you will see that a ResourcePermission is passed in the authorization call. ResourcePermission is an object that defines the nature of the operation the Principal is trying to perform.

ResourcePermission is in one of those forms:

Resource:Operation
Resource:Operation:RegionName
Resource:Operation:RegionName:Key

All Resources are enumerated via the enum ResourcePermission.Resource, currently CLUSTER and DATA.

All Operations are enumerated via the enum ResourcePermission.Operation, which are MANAGE, READ, and WRITE. Note that MANAGE does not imply WRITE, and WRITE does not imply READ.

RegionName and Key are provided for those operations that are to be authorized based upon a region key access as well. For example, you can see a ResourcePermission defined as CLUSTER:READ, CLUSTER:MANAGE, DATA:READ, DATA:READ:regionA, or DATA:READ:regionA:key1.

Note that a ResourcePermission is hierarchical. If a principal has permission for DATA:READ, it automatically has data read permission on all regions and all keys. That is, it has permission for DATA:READ:regionA. Given permission for DATA:READ:regionA, the principal automatically has data read permission on all keys in regionA. That is, it has permission for DATA:READ:regionA:key1.

4. Introduction of PostProcessor

Before a value is returned, it gets a pass through the post processor, if there is one. Specify your post processor with this line in your gemfire.properties file:

security-post-processor = com.example.security.MyPostProcessor

where the value is the name of the class that implements the PostProcessor interface. Make sure your class has a zero argument constructor so that Geode can instantiate the object. See the PostProcessor javadoc for details. You can use SamplePostProcessor as an example to write your own implementation.

Note regarding legacy implementations: We completely redo the way we call post processing; the interface is a lot simpler.

5. Operations and their corresponding ResourcePermission

Below is the list of operations with their corresponding ResourcePermission:

Client-Server Operations

Client OperationsRequired ResourcePermission
get function attributeCLUSTER:READ
create regionDATA:MANAGE
destroy regionDATA:MANAGE
get keysetDATA:READ:regionName
queryDATA:READ:regionName
region.getAllDATA:READ:regionName
region.getEntryDATA:READ:regionName
getAll (list of keys)DATA:READ:regionName:key
region.containsKeyOnServer(key)DATA:READ:regionName:key
region.get(key)DATA:READ:regionName:key
registerInterestDATA:READ:regionName:key if key is specified, otherwise DATA:READ:regionName
unregister interestDATA:READ:regionName:key if key is specified, otherwise DATA:READ:regionName
execute functionDATA:WRITE
clear regionDATA:WRITE:regionName
putAllDATA:WRITE:regionName
region.clearDATA:WRITE:regionName
region.removeAllDATA:WRITE:regionName
destroy keyDATA:WRITE:regionName:key
invalidate keyDATA:WRITE:regionName:key
region.destroy(key)DATA:WRITE:regionName:key
region.invalidate(key)DATA:WRITE:regionName:key
region.put(key, value)DATA:WRITE:regionName:key
region.replaceDATA:WRITE:regionName:key

GFSH Commands

CommandsRequired ResourcePermission
alter runtimeCLUSTER:MANAGE
gcCLUSTER:MANAGE
shutdownCLUSTER:MANAGE
startManagerCLUSTER:MANAGE
stop locator --name=locator1CLUSTER:MANAGE
stop server --name=server1CLUSTER:MANAGE
describe client --clientID=172.16.196.144CLUSTER:READ
describe config --member=Member1CLUSTER:READ
describe disk-store --name=foo --member=bazCLUSTER:READ
describe member --name=server1CLUSTER:READ
describe offline-disk-store --name=foo --disk-dirs=barCLUSTER:READ
describe region --name=valueCLUSTER:READ
export cluster-configuration --zip-file-name=mySharedConfig.zipCLUSTER:READ
export config --member=member1CLUSTER:READ
export logs --dir=data/logsCLUSTER:READ
export stack-traces --file=stack.txtCLUSTER:READ
exportLogsCLUSTER:READ
exportStackTraceCLUSTER:READ
list async-event-queuesCLUSTER:READ
list clientsCLUSTER:READ
list deployedCLUSTER:READ
list disk-storesCLUSTER:READ
list durable-cqs --durable-client-id=client1CLUSTER:READ
list functionsCLUSTER:READ
list gatewaysCLUSTER:READ
list indexesCLUSTER:READ
list membersCLUSTER:READ
list regionsDATA:READ
netstat --member=server1CLUSTER:READ
show dead-locks --file=deadlocks.txtCLUSTER:READ
show log --member=locator1 --lines=5CLUSTER:READ
show metricsCLUSTER:READ
show missing-disk-storesCLUSTER:READ
show subscription-queue-size --durable-client-id=client1CLUSTER:READ
show logCLUSTER:READ
status cluster-config-serviceCLUSTER:READ
status gateway-receiverCLUSTER:READ
status gateway-senderCLUSTER:READ
change loglevel --loglevel=severe --member=server1CLUSTER:WRITE
alter disk-store --name=foo --region=xyz --disk-dirs=barDATA:MANAGE
alter region --name=region1 --eviction-max=5000DATA:MANAGE:REGIONNAME
clear defined indexesDATA:MANAGE
close durable-client --durable-client-id=client1DATA:MANAGE
close durable-cq --durable-client-id=client1 --durable-cq-name=cq1DATA:MANAGE
compact disk-store --name=fooDATA:MANAGE
compact offline-disk-store --name=foo --disk-dirs=barDATA:MANAGE
configure pdx --read-serialized=trueDATA:MANAGE
create async-event-queue --id=myAEQ --listener=myApp.myListenerDATA:MANAGE
create defined indexesDATA:MANAGE
create disk-store --name=foo --dir=barDATA:MANAGE
create gateway-receiverDATA:MANAGE
create gateway-sender --id=sender1 --remote-distributed-system-id=2DATA:MANAGE
create index --name=myKeyIndex --expression=region1.Id --region=region1 --type=keyDATA:MANAGE:regionName
create region --name=region12DATA:MANAGE
define index --name=myIndex1 --expression=exp1 --region=/exampleRegionDATA:MANAGE:regionName
deploy --jar=group1_functions.jar --group=Group1DATA:MANAGE
destroy disk-store --name=fooDATA:MANAGE
destroy function --id=InterestCalculationsDATA:MANAGE
destroy index --member=server2DATA:MANAGE:regionName if regionName is specified, otherwise DATA:MANAGE
destroy region --name=valueDATA:MANAGE
import cluster-configuration --zip-file-name=valueDATA:MANAGE
load-balance gateway-sender --id=sender1DATA:MANAGE
pause gateway-sender --id=sender1DATA:MANAGE
pdx rename --old=com.gemstone --new=com.pivotal --disk-store=ds1 --disk-dirs=/diskDir1DATA:MANAGE
rebalance --include-region=region1DATA:MANAGE
resume gateway-sender --id=sender1DATA:MANAGE
revoke missing-disk-store --id=fooDATA:MANAGE
start gateway-receiverDATA:MANAGE
start gateway-sender --id=sender1DATA:MANAGE
stop gateway-receiverDATA:MANAGE
stop gateway-sender --id=sender1DATA:MANAGE
undeploy --group=Group1DATA:MANAGE
backup disk-store --dir=fooDATA:READ
export data --region=region1 --file=foo.txt --member=valueDATA:READ:regionName
get --key=key1 --region=region1DATA:READ:regionName:key
locateEntryDATA:READ:regionName:key
query --query='SELECT * FROM /region1'DATA:READ:REGIONNAME
execute function --id=InterestCalculations --group=Group1DATA:WRITE
import data --region=region1 --file=foo.txt --member=valueDATA:WRITE:regionName
put --key=key1 --value=value1 --region=region1DATA:WRITE:regionName:key
remove --region=region1

DATA:WRITE:regionName, if key is specified, then DATA:WRITE:regionName:key

alter jdbc-connection

CLUSTER:MANAGE

alter jdbc-mapping
CLUSTER:MANAGE
create jdbc-connection
CLUSTER:MANAGE
create jdbc-mapping
CLUSTER:MANAGE
describe jdbc-connection
CLUSTER:MANAGE
describe jdbc-mapping
CLUSTER:MANAGE
destroy jdbc-connection
CLUSTER:MANAGE
destroy jdbc-mapping
CLUSTER:MANAGE
list jdbc-connections
CLUSTER:MANAGE
list jdbc-mappings
CLUSTER:MANAGE
create jndi-binding
CLUSTER:MANAGE
describe jndi-binding
CLUSTER:READ
destroy jndi-binding
CLUSTER:MANAGE
list jndi-binding
CLUSTER:READ

Pulse

Pulse access is divided into two main categories: access to the Data Browser page and everything else.

The Data Browser page requires the permissions CLUSTER:READ and DATA:READ. Access to all other pages requires only CLUSTER:READ permission.

JMX Operations

Bean OperationsPermission
DistributedSystemMXBean.shutdownAllMembersCLUSTER:MANAGE
ManagerMXBean.startCLUSTER:MANAGE
ManagerMXBean.stopCLUSTER:MANAGE
MemberMXBean.createManager())CLUSTER:MANAGE
MemberMXBean.shutDownMemberCLUSTER:MANAGE
Mbeans get attributesCLUSTER:READ
MemberMXBean.showLogCLUSTER:READ
DistributedSystemMXBean.changeAlertLevelCLUSTER:WRITE
ManagerMXBean.setPulseURLCLUSTER:WRITE
ManagerMXBean.setStatusMessageCLUSTER:WRITE
CacheServerMXBean.closeAllContinuousQueryDATA:MANAGE
CacheServerMXBean.closeContinuousQueryDATA:MANAGE
CacheServerMXBean.removeIndex("foo"))DATA:MANAGE
CacheServerMXBean.stopContinuousQuery("bar"))DATA:MANAGE
DiskStoreMXBean.flush())DATA:MANAGE
DiskStoreMXBean.forceCompaction())DATA:MANAGE
DiskStoreMXBean.forceRoll())DATA:MANAGE
DiskStoreMXBean.setDiskUsageCriticalPercentage(0DATA:MANAGE
DiskStoreMXBean.setDiskUsageWarningPercentage(0DATA:MANAGE
DistributedSystemMXBean.revokeMissingDiskStoresDATA:MANAGE
DistributedSystemMXBean.setQueryCollectionsDepthDATA:MANAGE
DistributedSystemMXBean.setQueryResultSetLimitDATA:MANAGE
GatewayReceiverMXBean.pause())DATA:MANAGE
GatewayReceiverMXBean.rebalance())DATA:MANAGE
GatewayReceiverMXBean.resume())DATA:MANAGE
GatewayReceiverMXBean.startDATA:MANAGE
GatewayReceiverMXBean.stopDATA:MANAGE
GatewaySenderMXBean.pauseDATA:MANAGE
GatewaySenderMXBean.rebalanceDATA:MANAGE
GatewaySenderMXBean.resumeDATA:MANAGE
GatewaySenderMXBean.startDATA:MANAGE
GatewaySenderMXBean.stopDATA:MANAGE
LockServiceMBean.becomeLockGrantor())DATA:MANAGE
MemberMXBean.compactAllDiskStoresDATA:MANAGE
CacheServerMXBean.executeContinuousQuery("bar"))DATA:READ
DistributedSystemMXBean.backupAllMembersDATA:READ
DistributedSystemMXBean.queryDataDATA:READ
DistributedSystemMXBean.queryDataForCompressedResultDATA:READ

 

1 Comment

  1. For sake of completeness, following gfsh commands are missing from the second table:

    CommandPermission
    export offline-disk-store 
    upgrade offline-disk-store 
    validate offline-disk-store 
    start locator 

    start server

     
    status locator 
    status server 

    Also, I could not find showLog and startManager commands in GFSH. Do those commands belong to a different interface (table)?