org.gridgain.grid.security

Interface Authenticator

All Known Implementing Classes:

CertificateAuthenticator, IgniteAuthenticator, JaasAuthenticator, PasscodeAuthenticator

public interface Authenticator

Authenticator used for authenticating grid nodes. It supports only authentication and does not provide any authorization functionality.

Ignite provides the following GridAuthenticator implementations:

• PasscodeAuthenticator - validates authentication with passcode phrase.
• JaasAuthenticator - validates authentication with JAAS Java extension.

NOTE: this authenticator (i.e. methods in this interface) should never be used directly. Authenticator provide internal view on the subsystem and is used internally by Ignite kernal. In rare use cases when access to a specific implementation of this authenticator is required - an instance can be obtained via () method to check its configuration properties. Note again that calling methods from this interface on the obtained instance can lead to undefined behavior and explicitly not supported.

Authenticator can be configured via GridGainConfiguration.setAuthenticator(Authenticator).

Authenticator configuration validation

• GridGain always checks that all server nodes are configured with the same authenticator implemetation class.
• GridGain also supports an authentication validation by custom token. To enable this validation, an authenticator implementation class should also implement AuthenticationValidator interface. GridGain will check that all nodes in cluster have an equal validation tokens.

See Also:

GridGainConfiguration.setAuthenticator(Authenticator), PasscodeAuthenticator, JaasAuthenticator, AuthenticationValidator

Method Summary

Modifier and Type	Method and Description
SecuritySubject	authenticate(AuthenticationContext authCtx) Authenticates a given subject (either node or remote client).
boolean	isGlobalNodeAuthentication() Flag indicating whether node authentication should be run on coordinator only or on all nodes in current topology.
boolean	supported(SecuritySubjectType subjType) Checks if given subject is supported by this authenticator.

Method Detail

supported

boolean supported(SecuritySubjectType subjType)

Checks if given subject is supported by this authenticator. If not, then next authentication in the list will be checked.

Parameters:

subjType - Subject type.

Returns:

True if subject type is supported, false otherwise.

authenticate

SecuritySubject authenticate(AuthenticationContext authCtx)
                      throws IgniteCheckedException

Authenticates a given subject (either node or remote client).

Parameters:

authCtx - Authentication context. Contains all necessary information required to authenticate the subject.

Returns:

Authenticated subject context or null if authentication did not pass.

Throws:

IgniteCheckedException - If authentication resulted in system error. Note that bad credentials should not cause this exception.

isGlobalNodeAuthentication

boolean isGlobalNodeAuthentication()

Flag indicating whether node authentication should be run on coordinator only or on all nodes in current topology.

Returns:

True if all nodes in topology should authenticate joining node. In this case security permissions will be validated to be the same on all nodes. In case if permissions differ, node will not be able to join the topology. If this method returns false, only coordinator node will authenticate joining node.