org.gridgain.grid.security

Interface GridSecurity

All Known Implementing Classes:

GridSecurityImpl

public interface GridSecurity

Grid security facade. This facade contains information about authenticated subjects currently logged in to grid together with their permission sets.

You can get an instance of security facade from Grid.security() method.

Grid Nodes vs Remote Clients

When security is enabled, both grid nodes and remote clients must be authenticated. For grid nodes, authentication parameters are specified in grid configuration via GridConfiguration.getSecurityCredentialsProvider() provider. Here is an example of how a simple user name and password may be provided:

     GridConfiguration cfg = new GridConfiguration();

     GridSecurityCredentials creds = new GridSecurityCredentials("username", "password");

     cfg.setSecurityCredentialsProvider(new GridSecurityCredentialsBasicProvider(creds));

     Grid grid = GridGain.start(cfg);
 

For remote Java client, configuration is provided in a similar way by specifying GridClientConfiguration.setSecurityCredentialsProvider(...) property.

For remote C++ and .NET clients, security credentials are provided in configuration as well in the form of "username:password" string.

Authentication And Authorization

Node or client authentication happens in GridAuthenticationSpi. Upon successful authentication, the SPI will return list of permissions for authenticated subject.

GridGain ships with following authentication SPIs out of the box:

• GridJaasAuthenticationSpi - provides authentication based on JAAS standard.
• GridPasscodeAuthenticationSpi - basic username and password authentication.

All permissions supported by GridGain are provided in GridSecurityPermission enum. Permissions are specified on per-cache or per-task level (wildcards are allowed). Authentication SPIs should usually (although not required) specify security permissions in the following JSON format:

 {
     {
         "cache":"partitioned",
         "permissions":["CACHE_PUT", "CACHE_REMOVE", "CACHE_READ"]
     },
     {
         "cache":"*",
         "permissions":["CACHE_READ"]
     },
     {
         "task":"org.mytasks.*",
         "permissions":["TASK_EXECUTE"]
     },
     {
         "system":["EVENTS_ENABLE", "ADMIN_VIEW"]
     }
     "defaultAllow":"false"
 }
 

Refer to documentation of available authentication SPIs for more information.

Method Summary

Methods

Modifier and Type	Method and Description
GridSecuritySubject	authenticatedSubject(UUID subjId) Gets security subject based on subject ID.
Collection<GridSecuritySubject>	authenticatedSubjects() Gets collection of authenticated subjects together with their permissions.

Method Detail

authenticatedSubjects

Collection<GridSecuritySubject> authenticatedSubjects()
                                                      throws GridException

Gets collection of authenticated subjects together with their permissions.

Returns:

Collection of authenticated subjects.

Throws:

GridException

authenticatedSubject

GridSecuritySubject authenticatedSubject(UUID subjId)
                                         throws GridException

Gets security subject based on subject ID.

Parameters:

subjId - Subject ID.

Returns:

Authorized security subject.

Throws:

GridException