Examples with LdapAuthenticationConfig com.hazelcast.config.security.LdapAuthenticationConfig used on opensource projects

Example 1 with LdapAuthenticationConfig

use of com.hazelcast.config.security.LdapAuthenticationConfig in project hazelcast by hazelcast.

the class ConfigXmlGeneratorTest method testLdapConfig.

@Test
public void testLdapConfig() {
    Config cfg = new Config();
    RealmConfig realmConfig = new RealmConfig().setLdapAuthenticationConfig(new LdapAuthenticationConfig().setSkipIdentity(TRUE).setSkipEndpoint(FALSE).setSkipRole(TRUE).setParseDn(true).setPasswordAttribute("passwordAttribute").setRoleContext("roleContext").setRoleFilter("roleFilter").setRoleMappingAttribute("roleMappingAttribute").setRoleMappingMode(LdapRoleMappingMode.REVERSE).setRoleNameAttribute("roleNameAttribute").setRoleRecursionMaxDepth(25).setRoleSearchScope(LdapSearchScope.OBJECT).setSocketFactoryClassName("socketFactoryClassName").setSystemUserDn("systemUserDn").setSystemUserPassword("systemUserPassword").setSystemAuthentication("GSSAPI").setSecurityRealm("krb5Initiator").setUrl("url").setUserContext("userContext").setUserFilter("userFilter").setUserNameAttribute("userNameAttribute").setUserSearchScope(LdapSearchScope.ONE_LEVEL).setSkipAuthentication(TRUE));
    SecurityConfig expectedConfig = new SecurityConfig().setClientRealmConfig("ldapRealm", realmConfig);
    cfg.setSecurityConfig(expectedConfig);
    SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg).getSecurityConfig();
    assertEquals(expectedConfig, actualConfig);
}

Example 2 with LdapAuthenticationConfig

use of com.hazelcast.config.security.LdapAuthenticationConfig in project hazelcast by hazelcast.

the class YamlConfigBuilderTest method testSecurityConfig.

@Override
@Test
public void testSecurityConfig() {
    String yaml = "" + "hazelcast:\n" + "  security:\n" + "    enabled: true\n" + "    security-interceptors:\n" + "      - foo\n" + "      - bar\n" + "    client-block-unmapped-actions: false\n" + "    member-authentication:\n" + "      realm: mr\n" + "    client-authentication:\n" + "      realm: cr\n" + "    realms:\n" + "      - name: mr\n" + "        authentication:\n" + "          jaas:\n" + "            - class-name: MyRequiredLoginModule\n" + "              usage: REQUIRED\n" + "              properties:\n" + "                login-property: login-value\n" + "            - class-name: MyRequiredLoginModule2\n" + "              usage: SUFFICIENT\n" + "              properties:\n" + "                login-property2: login-value2\n" + "        identity:\n" + "          credentials-factory:\n" + "            class-name: MyCredentialsFactory\n" + "            properties:\n" + "              property: value\n" + "      - name: cr\n" + "        authentication:\n" + "          jaas:\n" + "            - class-name: MyOptionalLoginModule\n" + "              usage: OPTIONAL\n" + "              properties:\n" + "                client-property: client-value\n" + "            - class-name: MyRequiredLoginModule\n" + "              usage: REQUIRED\n" + "              properties:\n" + "                client-property2: client-value2\n" + "      - name: kerberos\n" + "        authentication:\n" + "          kerberos:\n" + "            skip-role: false\n" + "            relax-flags-check: true\n" + "            use-name-without-realm: true\n" + "            security-realm: krb5Acceptor\n" + "            principal: jduke@HAZELCAST.COM\n" + "            keytab-file: /opt/jduke.keytab\n" + "            ldap:\n" + "              url: ldap://127.0.0.1\n" + "        identity:\n" + "          kerberos:\n" + "            realm: HAZELCAST.COM\n" + "            security-realm: krb5Initializer\n" + "            principal: jduke@HAZELCAST.COM\n" + "            keytab-file: /opt/jduke.keytab\n" + "            use-canonical-hostname: true\n" + "      - name: simple\n" + "        authentication:\n" + "          simple:\n" + "            skip-role: true\n" + "            users:\n" + "              - username: test\n" + "                password: 'a1234'\n" + "                roles:\n" + "                  - monitor\n" + "                  - hazelcast\n" + "              - username: dev\n" + "                password: secret\n" + "                roles:\n" + "                  - root\n" + "    client-permission-policy:\n" + "      class-name: MyPermissionPolicy\n" + "      properties:\n" + "        permission-property: permission-value\n";
    Config config = buildConfig(yaml);
    SecurityConfig securityConfig = config.getSecurityConfig();
    List<SecurityInterceptorConfig> interceptorConfigs = securityConfig.getSecurityInterceptorConfigs();
    assertEquals(2, interceptorConfigs.size());
    assertEquals("foo", interceptorConfigs.get(0).className);
    assertEquals("bar", interceptorConfigs.get(1).className);
    assertFalse(securityConfig.getClientBlockUnmappedActions());
    RealmConfig memberRealm = securityConfig.getRealmConfig(securityConfig.getMemberRealm());
    CredentialsFactoryConfig memberCredentialsConfig = memberRealm.getCredentialsFactoryConfig();
    assertEquals("MyCredentialsFactory", memberCredentialsConfig.getClassName());
    assertEquals(1, memberCredentialsConfig.getProperties().size());
    assertEquals("value", memberCredentialsConfig.getProperties().getProperty("property"));
    List<LoginModuleConfig> memberLoginModuleConfigs = memberRealm.getJaasAuthenticationConfig().getLoginModuleConfigs();
    assertEquals(2, memberLoginModuleConfigs.size());
    Iterator<LoginModuleConfig> memberLoginIterator = memberLoginModuleConfigs.iterator();
    LoginModuleConfig memberLoginModuleCfg1 = memberLoginIterator.next();
    assertEquals("MyRequiredLoginModule", memberLoginModuleCfg1.getClassName());
    assertEquals(LoginModuleUsage.REQUIRED, memberLoginModuleCfg1.getUsage());
    assertEquals(1, memberLoginModuleCfg1.getProperties().size());
    assertEquals("login-value", memberLoginModuleCfg1.getProperties().getProperty("login-property"));
    LoginModuleConfig memberLoginModuleCfg2 = memberLoginIterator.next();
    assertEquals("MyRequiredLoginModule2", memberLoginModuleCfg2.getClassName());
    assertEquals(LoginModuleUsage.SUFFICIENT, memberLoginModuleCfg2.getUsage());
    assertEquals(1, memberLoginModuleCfg2.getProperties().size());
    assertEquals("login-value2", memberLoginModuleCfg2.getProperties().getProperty("login-property2"));
    RealmConfig clientRealm = securityConfig.getRealmConfig(securityConfig.getClientRealm());
    List<LoginModuleConfig> clientLoginModuleConfigs = clientRealm.getJaasAuthenticationConfig().getLoginModuleConfigs();
    assertEquals(2, clientLoginModuleConfigs.size());
    Iterator<LoginModuleConfig> clientLoginIterator = clientLoginModuleConfigs.iterator();
    LoginModuleConfig clientLoginModuleCfg1 = clientLoginIterator.next();
    assertEquals("MyOptionalLoginModule", clientLoginModuleCfg1.getClassName());
    assertEquals(LoginModuleUsage.OPTIONAL, clientLoginModuleCfg1.getUsage());
    assertEquals(1, clientLoginModuleCfg1.getProperties().size());
    assertEquals("client-value", clientLoginModuleCfg1.getProperties().getProperty("client-property"));
    LoginModuleConfig clientLoginModuleCfg2 = clientLoginIterator.next();
    assertEquals("MyRequiredLoginModule", clientLoginModuleCfg2.getClassName());
    assertEquals(LoginModuleUsage.REQUIRED, clientLoginModuleCfg2.getUsage());
    assertEquals(1, clientLoginModuleCfg2.getProperties().size());
    assertEquals("client-value2", clientLoginModuleCfg2.getProperties().getProperty("client-property2"));
    RealmConfig kerberosRealm = securityConfig.getRealmConfig("kerberos");
    assertNotNull(kerberosRealm);
    KerberosIdentityConfig kerbIdentity = kerberosRealm.getKerberosIdentityConfig();
    assertNotNull(kerbIdentity);
    assertEquals("HAZELCAST.COM", kerbIdentity.getRealm());
    assertEquals("krb5Initializer", kerbIdentity.getSecurityRealm());
    assertEquals("jduke@HAZELCAST.COM", kerbIdentity.getPrincipal());
    assertEquals("/opt/jduke.keytab", kerbIdentity.getKeytabFile());
    assertTrue(kerbIdentity.getUseCanonicalHostname());
    KerberosAuthenticationConfig kerbAuthentication = kerberosRealm.getKerberosAuthenticationConfig();
    assertNotNull(kerbAuthentication);
    assertEquals(Boolean.TRUE, kerbAuthentication.getRelaxFlagsCheck());
    assertEquals(Boolean.FALSE, kerbAuthentication.getSkipRole());
    assertNull(kerbAuthentication.getSkipIdentity());
    assertEquals("krb5Acceptor", kerbAuthentication.getSecurityRealm());
    assertEquals("jduke@HAZELCAST.COM", kerbAuthentication.getPrincipal());
    assertEquals("/opt/jduke.keytab", kerbAuthentication.getKeytabFile());
    assertTrue(kerbAuthentication.getUseNameWithoutRealm());
    LdapAuthenticationConfig kerbLdapAuthentication = kerbAuthentication.getLdapAuthenticationConfig();
    assertNotNull(kerbLdapAuthentication);
    assertEquals("ldap://127.0.0.1", kerbLdapAuthentication.getUrl());
    RealmConfig simpleRealm = securityConfig.getRealmConfig("simple");
    assertNotNull(simpleRealm);
    SimpleAuthenticationConfig simpleAuthnCfg = simpleRealm.getSimpleAuthenticationConfig();
    assertNotNull(simpleAuthnCfg);
    assertEquals(2, simpleAuthnCfg.getUsernames().size());
    assertTrue(simpleAuthnCfg.getUsernames().contains("test"));
    assertEquals("a1234", simpleAuthnCfg.getPassword("test"));
    Set<String> expectedRoles = new HashSet<>();
    expectedRoles.add("monitor");
    expectedRoles.add("hazelcast");
    assertEquals(expectedRoles, simpleAuthnCfg.getRoles("test"));
    assertEquals(Boolean.TRUE, simpleAuthnCfg.getSkipRole());
    // client-permission-policy
    PermissionPolicyConfig permissionPolicyConfig = securityConfig.getClientPolicyConfig();
    assertEquals("MyPermissionPolicy", permissionPolicyConfig.getClassName());
    assertEquals(1, permissionPolicyConfig.getProperties().size());
    assertEquals("permission-value", permissionPolicyConfig.getProperties().getProperty("permission-property"));
}

Example 3 with LdapAuthenticationConfig

use of com.hazelcast.config.security.LdapAuthenticationConfig in project hazelcast by hazelcast.

the class MemberDomConfigProcessor method createLdapAuthentication.

protected LdapAuthenticationConfig createLdapAuthentication(Node node) {
    LdapAuthenticationConfig ldapCfg = new LdapAuthenticationConfig();
    fillClusterLoginConfig(ldapCfg, node);
    for (Node child : childElements(node)) {
        String nodeName = cleanNodeName(child);
        if (matches("url", nodeName)) {
            ldapCfg.setUrl(getTextContent(child));
        } else if (matches("socket-factory-class-name", nodeName)) {
            ldapCfg.setSocketFactoryClassName(getTextContent(child));
        } else if (matches("parse-dn", nodeName)) {
            ldapCfg.setParseDn(getBooleanValue(getTextContent(child)));
        } else if (matches("role-context", nodeName)) {
            ldapCfg.setRoleContext(getTextContent(child));
        } else if (matches("role-filter", nodeName)) {
            ldapCfg.setRoleFilter(getTextContent(child));
        } else if (matches("role-mapping-attribute", nodeName)) {
            ldapCfg.setRoleMappingAttribute(getTextContent(child));
        } else if (matches("role-mapping-mode", nodeName)) {
            ldapCfg.setRoleMappingMode(getRoleMappingMode(getTextContent(child)));
        } else if (matches("role-name-attribute", nodeName)) {
            ldapCfg.setRoleNameAttribute(getTextContent(child));
        } else if (matches("role-recursion-max-depth", nodeName)) {
            ldapCfg.setRoleRecursionMaxDepth(getIntegerValue("role-recursion-max-depth", getTextContent(child)));
        } else if (matches("role-search-scope", nodeName)) {
            ldapCfg.setRoleSearchScope(getSearchScope(getTextContent(child)));
        } else if (matches("user-name-attribute", nodeName)) {
            ldapCfg.setUserNameAttribute(getTextContent(child));
        } else if (matches("system-user-dn", nodeName)) {
            ldapCfg.setSystemUserDn(getTextContent(child));
        } else if (matches("system-user-password", nodeName)) {
            ldapCfg.setSystemUserPassword(getTextContent(child));
        } else if (matches("system-authentication", nodeName)) {
            ldapCfg.setSystemAuthentication(getTextContent(child));
        } else if (matches("security-realm", nodeName)) {
            ldapCfg.setSecurityRealm(getTextContent(child));
        } else if (matches("password-attribute", nodeName)) {
            ldapCfg.setPasswordAttribute(getTextContent(child));
        } else if (matches("user-context", nodeName)) {
            ldapCfg.setUserContext(getTextContent(child));
        } else if (matches("user-filter", nodeName)) {
            ldapCfg.setUserFilter(getTextContent(child));
        } else if (matches("user-search-scope", nodeName)) {
            ldapCfg.setUserSearchScope(getSearchScope(getTextContent(child)));
        } else if (matches("skip-authentication", nodeName)) {
            ldapCfg.setSkipAuthentication(getBooleanValue(getTextContent(child)));
        }
    }
    return ldapCfg;
}

Example 4 with LdapAuthenticationConfig

use of com.hazelcast.config.security.LdapAuthenticationConfig in project hazelcast by hazelcast.

the class XMLConfigBuilderTest method testSecurityConfig.

@Override
@Test
public void testSecurityConfig() {
    String xml = HAZELCAST_START_TAG + "<security enabled=\"true\">" + "  <security-interceptors>" + "    <interceptor class-name=\"foo\"/>" + "    <interceptor class-name=\"bar\"/>" + "  </security-interceptors>" + "  <client-block-unmapped-actions>false</client-block-unmapped-actions>" + "  <realms>" + "    <realm name='mr'>" + "      <authentication>" + "        <jaas>" + "          <login-module class-name=\"MyRequiredLoginModule\" usage=\"REQUIRED\">\n" + "            <properties>\n" + "              <property name=\"login-property\">login-value</property>\n" + "            </properties>\n" + "          </login-module>\n" + "          <login-module class-name=\"MyRequiredLoginModule2\" usage=\"SUFFICIENT\">\n" + "            <properties>\n" + "              <property name=\"login-property2\">login-value2</property>\n" + "            </properties>\n" + "          </login-module>\n" + "        </jaas>" + "      </authentication>" + "      <identity>" + "        <credentials-factory class-name=\"MyCredentialsFactory\">\n" + "          <properties>\n" + "            <property name=\"property\">value</property>\n" + "          </properties>\n" + "        </credentials-factory>\n" + "      </identity>" + "    </realm>" + "    <realm name='cr'>" + "      <authentication>" + "        <jaas>" + "          <login-module class-name=\"MyOptionalLoginModule\" usage=\"OPTIONAL\">\n" + "            <properties>\n" + "              <property name=\"client-property\">client-value</property>\n" + "            </properties>\n" + "          </login-module>\n" + "          <login-module class-name=\"MyRequiredLoginModule\" usage=\"REQUIRED\">\n" + "            <properties>\n" + "              <property name=\"client-property2\">client-value2</property>\n" + "            </properties>\n" + "          </login-module>\n" + "        </jaas>" + "      </authentication>" + "      <identity>" + "        <token encoding=\"base64\">****</token>" + "      </identity>" + "    </realm>" + "    <realm name='kerberos'>" + "      <authentication>" + "        <kerberos>" + "          <skip-role>false</skip-role>" + "          <relax-flags-check>true</relax-flags-check>" + "          <use-name-without-realm>true</use-name-without-realm>" + "          <security-realm>krb5Acceptor</security-realm>" + "          <principal>jduke@HAZELCAST.COM</principal>" + "          <keytab-file>/opt/jduke.keytab</keytab-file>" + "          <ldap>" + "            <url>ldap://127.0.0.1</url>" + "          </ldap>" + "        </kerberos>" + "      </authentication>" + "      <identity>" + "        <kerberos>" + "          <realm>HAZELCAST.COM</realm>" + "          <security-realm>krb5Initializer</security-realm>" + "          <principal>jduke@HAZELCAST.COM</principal>" + "          <keytab-file>/opt/jduke.keytab</keytab-file>" + "          <use-canonical-hostname>true</use-canonical-hostname>" + "        </kerberos>" + "      </identity>" + "    </realm>" + "    <realm name='simple'>" + "      <authentication>" + "        <simple>" + "          <skip-role>true</skip-role>" + "          <role-separator>:</role-separator>" + "          <user username='test' password='a1234'>" + "            <role>monitor</role>" + "            <role>hazelcast</role>" + "          </user>" + "          <user username='dev' password='secret'>" + "            <role>root</role>" + "          </user>" + "        </simple>" + "      </authentication>" + "    </realm>" + "  </realms>" + "  <member-authentication realm='mr'/>\n" + "  <client-authentication realm='cr'/>\n" + "  <client-permission-policy class-name=\"MyPermissionPolicy\">\n" + "    <properties>\n" + "      <property name=\"permission-property\">permission-value</property>\n" + "    </properties>\n" + "  </client-permission-policy>" + "</security>" + HAZELCAST_END_TAG;
    Config config = buildConfig(xml);
    SecurityConfig securityConfig = config.getSecurityConfig();
    List<SecurityInterceptorConfig> interceptorConfigs = securityConfig.getSecurityInterceptorConfigs();
    assertEquals(2, interceptorConfigs.size());
    assertEquals("foo", interceptorConfigs.get(0).className);
    assertEquals("bar", interceptorConfigs.get(1).className);
    assertFalse(securityConfig.getClientBlockUnmappedActions());
    RealmConfig memberRealm = securityConfig.getRealmConfig(securityConfig.getMemberRealm());
    CredentialsFactoryConfig memberCredentialsConfig = memberRealm.getCredentialsFactoryConfig();
    assertEquals("MyCredentialsFactory", memberCredentialsConfig.getClassName());
    assertEquals(1, memberCredentialsConfig.getProperties().size());
    assertEquals("value", memberCredentialsConfig.getProperties().getProperty("property"));
    List<LoginModuleConfig> memberLoginModuleConfigs = memberRealm.getJaasAuthenticationConfig().getLoginModuleConfigs();
    assertEquals(2, memberLoginModuleConfigs.size());
    Iterator<LoginModuleConfig> memberLoginIterator = memberLoginModuleConfigs.iterator();
    LoginModuleConfig memberLoginModuleCfg1 = memberLoginIterator.next();
    assertEquals("MyRequiredLoginModule", memberLoginModuleCfg1.getClassName());
    assertEquals(LoginModuleUsage.REQUIRED, memberLoginModuleCfg1.getUsage());
    assertEquals(1, memberLoginModuleCfg1.getProperties().size());
    assertEquals("login-value", memberLoginModuleCfg1.getProperties().getProperty("login-property"));
    LoginModuleConfig memberLoginModuleCfg2 = memberLoginIterator.next();
    assertEquals("MyRequiredLoginModule2", memberLoginModuleCfg2.getClassName());
    assertEquals(LoginModuleUsage.SUFFICIENT, memberLoginModuleCfg2.getUsage());
    assertEquals(1, memberLoginModuleCfg2.getProperties().size());
    assertEquals("login-value2", memberLoginModuleCfg2.getProperties().getProperty("login-property2"));
    RealmConfig clientRealm = securityConfig.getRealmConfig(securityConfig.getClientRealm());
    List<LoginModuleConfig> clientLoginModuleConfigs = clientRealm.getJaasAuthenticationConfig().getLoginModuleConfigs();
    assertEquals(2, clientLoginModuleConfigs.size());
    Iterator<LoginModuleConfig> clientLoginIterator = clientLoginModuleConfigs.iterator();
    LoginModuleConfig clientLoginModuleCfg1 = clientLoginIterator.next();
    assertEquals("MyOptionalLoginModule", clientLoginModuleCfg1.getClassName());
    assertEquals(LoginModuleUsage.OPTIONAL, clientLoginModuleCfg1.getUsage());
    assertEquals(1, clientLoginModuleCfg1.getProperties().size());
    assertEquals("client-value", clientLoginModuleCfg1.getProperties().getProperty("client-property"));
    LoginModuleConfig clientLoginModuleCfg2 = clientLoginIterator.next();
    assertEquals("MyRequiredLoginModule", clientLoginModuleCfg2.getClassName());
    assertEquals(LoginModuleUsage.REQUIRED, clientLoginModuleCfg2.getUsage());
    assertEquals(1, clientLoginModuleCfg2.getProperties().size());
    assertEquals("client-value2", clientLoginModuleCfg2.getProperties().getProperty("client-property2"));
    TokenIdentityConfig tokenIdentityConfig = clientRealm.getTokenIdentityConfig();
    assertEquals(TokenEncoding.BASE64, tokenIdentityConfig.getEncoding());
    assertArrayEquals(ConfigXmlGenerator.MASK_FOR_SENSITIVE_DATA.getBytes(US_ASCII), tokenIdentityConfig.getToken());
    RealmConfig kerberosRealm = securityConfig.getRealmConfig("kerberos");
    assertNotNull(kerberosRealm);
    KerberosIdentityConfig kerbIdentity = kerberosRealm.getKerberosIdentityConfig();
    assertNotNull(kerbIdentity);
    assertEquals("HAZELCAST.COM", kerbIdentity.getRealm());
    assertEquals("krb5Initializer", kerbIdentity.getSecurityRealm());
    assertEquals("jduke@HAZELCAST.COM", kerbIdentity.getPrincipal());
    assertEquals("/opt/jduke.keytab", kerbIdentity.getKeytabFile());
    assertTrue(kerbIdentity.getUseCanonicalHostname());
    KerberosAuthenticationConfig kerbAuthentication = kerberosRealm.getKerberosAuthenticationConfig();
    assertNotNull(kerbAuthentication);
    assertEquals(Boolean.TRUE, kerbAuthentication.getRelaxFlagsCheck());
    assertEquals(Boolean.FALSE, kerbAuthentication.getSkipRole());
    assertNull(kerbAuthentication.getSkipIdentity());
    assertEquals("krb5Acceptor", kerbAuthentication.getSecurityRealm());
    assertEquals("jduke@HAZELCAST.COM", kerbAuthentication.getPrincipal());
    assertEquals("/opt/jduke.keytab", kerbAuthentication.getKeytabFile());
    assertTrue(kerbAuthentication.getUseNameWithoutRealm());
    LdapAuthenticationConfig kerbLdapAuthentication = kerbAuthentication.getLdapAuthenticationConfig();
    assertNotNull(kerbLdapAuthentication);
    assertEquals("ldap://127.0.0.1", kerbLdapAuthentication.getUrl());
    RealmConfig simpleRealm = securityConfig.getRealmConfig("simple");
    assertNotNull(simpleRealm);
    SimpleAuthenticationConfig simpleAuthnCfg = simpleRealm.getSimpleAuthenticationConfig();
    assertNotNull(simpleAuthnCfg);
    assertEquals(2, simpleAuthnCfg.getUsernames().size());
    assertTrue(simpleAuthnCfg.getUsernames().contains("test"));
    assertEquals("a1234", simpleAuthnCfg.getPassword("test"));
    assertEquals(":", simpleAuthnCfg.getRoleSeparator());
    Set<String> expectedRoles = new HashSet<>();
    expectedRoles.add("monitor");
    expectedRoles.add("hazelcast");
    assertEquals(expectedRoles, simpleAuthnCfg.getRoles("test"));
    assertEquals(Boolean.TRUE, simpleAuthnCfg.getSkipRole());
    // client-permission-policy
    PermissionPolicyConfig permissionPolicyConfig = securityConfig.getClientPolicyConfig();
    assertEquals("MyPermissionPolicy", permissionPolicyConfig.getClassName());
    assertEquals(1, permissionPolicyConfig.getProperties().size());
    assertEquals("permission-value", permissionPolicyConfig.getProperties().getProperty("permission-property"));
}

Example 5 with LdapAuthenticationConfig

use of com.hazelcast.config.security.LdapAuthenticationConfig in project hazelcast by hazelcast.

the class ConfigXmlGeneratorTest method testKerberosConfig.

@Test
public void testKerberosConfig() {
    Config cfg = new Config();
    RealmConfig realmConfig = new RealmConfig().setKerberosAuthenticationConfig(new KerberosAuthenticationConfig().setSkipIdentity(TRUE).setSkipEndpoint(FALSE).setSkipRole(TRUE).setRelaxFlagsCheck(TRUE).setUseNameWithoutRealm(TRUE).setSecurityRealm("jaasRealm").setKeytabFile("/opt/test.keytab").setPrincipal("testPrincipal").setLdapAuthenticationConfig(new LdapAuthenticationConfig().setUrl("url"))).setKerberosIdentityConfig(new KerberosIdentityConfig().setRealm("HAZELCAST.COM").setSecurityRealm("krb5Init").setKeytabFile("/opt/test.keytab").setPrincipal("testPrincipal").setServiceNamePrefix("hz/").setUseCanonicalHostname(TRUE).setSpn("spn@HAZELCAST.COM"));
    SecurityConfig expectedConfig = new SecurityConfig().setMemberRealmConfig("kerberosRealm", realmConfig);
    cfg.setSecurityConfig(expectedConfig);
    SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg).getSecurityConfig();
    assertEquals(expectedConfig, actualConfig);
}