org.gridgain.grid

Interface GridSecurity

public interface GridSecurity

Grid security facade.

Description

This facade contains information about authenticated subjects currently logged in to grid together with their permission sets.

You can get an instance of security facade from GridGain.security() method.

Grid Nodes vs Remote Clients

When security is enabled, both grid nodes and remote clients must be authenticated. For grid nodes, authentication parameters are specified in grid configuration via GridGainConfiguration.getSecurityCredentialsProvider() provider. Here is an example of how a simple user name and password may be provided:

     GridConfiguration cfg = new GridConfiguration();

     GridSecurityCredentials creds = new GridSecurityCredentials("username", "password");

     cfg.setSecurityCredentialsProvider(new GridSecurityCredentialsBasicProvider(creds));

     Grid grid = Ignition.start(cfg);
 

For remote Java client, configuration is provided in a similar way by specifying GridClientConfiguration.setSecurityCredentialsProvider(...) property.

For remote C++ and .NET clients, security credentials are provided in configuration as well in the form of "username:password" string.

Authentication And Authorization

Node or client authentication happens in Authenticator. Upon successful authentication, the Authentication will return list of permissions for authenticated subject.

Ignite ships with following authentication out of the box:

• GridJaasAuthentication - provides authentication based on JAAS standard.
• GridPasscodeAuthentication - basic username and password authentication.

All permissions supported by Ignite are provided in SecurityPermission enum. Permissions are specified on per-cache or per-task level (wildcards are allowed). Authentication should usually (although not required) specify security permissions in the following JSON format:

 {
     {
         "cache":"partitioned",
         "permissions":["CACHE_PUT", "CACHE_REMOVE", "CACHE_READ"]
     },
     {
         "cache":"*",
         "permissions":["CACHE_READ"]
     },
     {
         "task":"org.mytasks.*",
         "permissions":["TASK_EXECUTE"]
     },
     {
         "system":["EVENTS_ENABLE", "ADMIN_VIEW"]
     }
     "defaultAllow":"false"
 }
 

Refer to documentation of available authentication for more information.

Method Summary

Modifier and Type	Method and Description
SecuritySubject	authenticatedSubject(UUID subjId) Gets security subject based on subject ID.
Collection<SecuritySubject>	authenticatedSubjects() Gets collection of authenticated subjects together with their permissions.

Method Detail

authenticatedSubjects

Collection<SecuritySubject> authenticatedSubjects()
                                           throws IgniteException

Gets collection of authenticated subjects together with their permissions.

Returns:

Collection of authenticated subjects.

Throws:

IgniteException

authenticatedSubject

SecuritySubject authenticatedSubject(UUID subjId)
                              throws IgniteException

Gets security subject based on subject ID.

Parameters:

subjId - Subject ID.

Returns:

Authorized security subject.

Throws:

IgniteException