use of com.hazelcast.config.security.TokenIdentityConfig in project hazelcast by hazelcast.
the class ConfigXmlGenerator method securityRealmGenerator.
protected void securityRealmGenerator(XmlGenerator gen, String name, RealmConfig c) {
gen.open("realm", "name", name);
if (c.isAuthenticationConfigured()) {
gen.open("authentication");
jaasAuthenticationGenerator(gen, c.getJaasAuthenticationConfig());
tlsAuthenticationGenerator(gen, c.getTlsAuthenticationConfig());
ldapAuthenticationGenerator(gen, c.getLdapAuthenticationConfig());
kerberosAuthenticationGenerator(gen, c.getKerberosAuthenticationConfig());
simpleAuthenticationGenerator(gen, c.getSimpleAuthenticationConfig());
gen.close();
}
if (c.isIdentityConfigured()) {
gen.open("identity");
CredentialsFactoryConfig cf = c.getCredentialsFactoryConfig();
if (cf != null) {
gen.open("credentials-factory", "class-name", cf.getClassName()).appendProperties(cf.getProperties()).close();
}
UsernamePasswordIdentityConfig upi = c.getUsernamePasswordIdentityConfig();
if (upi != null) {
gen.node("username-password", null, "username", upi.getUsername(), "password", getOrMaskValue(upi.getPassword()));
}
TokenIdentityConfig ti = c.getTokenIdentityConfig();
if (ti != null) {
gen.node("token", getOrMaskValue(ti.getTokenEncoded()), "encoding", ti.getEncoding().toString());
}
kerberosIdentityGenerator(gen, c.getKerberosIdentityConfig());
gen.close();
}
gen.close();
}
use of com.hazelcast.config.security.TokenIdentityConfig in project hazelcast by hazelcast.
the class MemberDomConfigProcessor method handleToken.
protected void handleToken(RealmConfig realmConfig, Node node) {
TokenEncoding encoding = TokenEncoding.getTokenEncoding(getAttribute(node, "encoding"));
TokenIdentityConfig tic = new TokenIdentityConfig(encoding, getTextContent(node));
realmConfig.setTokenIdentityConfig(tic);
}
use of com.hazelcast.config.security.TokenIdentityConfig in project hazelcast by hazelcast.
the class XMLConfigBuilderTest method testSecurityConfig.
@Override
@Test
public void testSecurityConfig() {
String xml = HAZELCAST_START_TAG + "<security enabled=\"true\">" + " <security-interceptors>" + " <interceptor class-name=\"foo\"/>" + " <interceptor class-name=\"bar\"/>" + " </security-interceptors>" + " <client-block-unmapped-actions>false</client-block-unmapped-actions>" + " <realms>" + " <realm name='mr'>" + " <authentication>" + " <jaas>" + " <login-module class-name=\"MyRequiredLoginModule\" usage=\"REQUIRED\">\n" + " <properties>\n" + " <property name=\"login-property\">login-value</property>\n" + " </properties>\n" + " </login-module>\n" + " <login-module class-name=\"MyRequiredLoginModule2\" usage=\"SUFFICIENT\">\n" + " <properties>\n" + " <property name=\"login-property2\">login-value2</property>\n" + " </properties>\n" + " </login-module>\n" + " </jaas>" + " </authentication>" + " <identity>" + " <credentials-factory class-name=\"MyCredentialsFactory\">\n" + " <properties>\n" + " <property name=\"property\">value</property>\n" + " </properties>\n" + " </credentials-factory>\n" + " </identity>" + " </realm>" + " <realm name='cr'>" + " <authentication>" + " <jaas>" + " <login-module class-name=\"MyOptionalLoginModule\" usage=\"OPTIONAL\">\n" + " <properties>\n" + " <property name=\"client-property\">client-value</property>\n" + " </properties>\n" + " </login-module>\n" + " <login-module class-name=\"MyRequiredLoginModule\" usage=\"REQUIRED\">\n" + " <properties>\n" + " <property name=\"client-property2\">client-value2</property>\n" + " </properties>\n" + " </login-module>\n" + " </jaas>" + " </authentication>" + " <identity>" + " <token encoding=\"base64\">****</token>" + " </identity>" + " </realm>" + " <realm name='kerberos'>" + " <authentication>" + " <kerberos>" + " <skip-role>false</skip-role>" + " <relax-flags-check>true</relax-flags-check>" + " <use-name-without-realm>true</use-name-without-realm>" + " <security-realm>krb5Acceptor</security-realm>" + " <principal>jduke@HAZELCAST.COM</principal>" + " <keytab-file>/opt/jduke.keytab</keytab-file>" + " <ldap>" + " <url>ldap://127.0.0.1</url>" + " </ldap>" + " </kerberos>" + " </authentication>" + " <identity>" + " <kerberos>" + " <realm>HAZELCAST.COM</realm>" + " <security-realm>krb5Initializer</security-realm>" + " <principal>jduke@HAZELCAST.COM</principal>" + " <keytab-file>/opt/jduke.keytab</keytab-file>" + " <use-canonical-hostname>true</use-canonical-hostname>" + " </kerberos>" + " </identity>" + " </realm>" + " <realm name='simple'>" + " <authentication>" + " <simple>" + " <skip-role>true</skip-role>" + " <role-separator>:</role-separator>" + " <user username='test' password='a1234'>" + " <role>monitor</role>" + " <role>hazelcast</role>" + " </user>" + " <user username='dev' password='secret'>" + " <role>root</role>" + " </user>" + " </simple>" + " </authentication>" + " </realm>" + " </realms>" + " <member-authentication realm='mr'/>\n" + " <client-authentication realm='cr'/>\n" + " <client-permission-policy class-name=\"MyPermissionPolicy\">\n" + " <properties>\n" + " <property name=\"permission-property\">permission-value</property>\n" + " </properties>\n" + " </client-permission-policy>" + "</security>" + HAZELCAST_END_TAG;
Config config = buildConfig(xml);
SecurityConfig securityConfig = config.getSecurityConfig();
List<SecurityInterceptorConfig> interceptorConfigs = securityConfig.getSecurityInterceptorConfigs();
assertEquals(2, interceptorConfigs.size());
assertEquals("foo", interceptorConfigs.get(0).className);
assertEquals("bar", interceptorConfigs.get(1).className);
assertFalse(securityConfig.getClientBlockUnmappedActions());
RealmConfig memberRealm = securityConfig.getRealmConfig(securityConfig.getMemberRealm());
CredentialsFactoryConfig memberCredentialsConfig = memberRealm.getCredentialsFactoryConfig();
assertEquals("MyCredentialsFactory", memberCredentialsConfig.getClassName());
assertEquals(1, memberCredentialsConfig.getProperties().size());
assertEquals("value", memberCredentialsConfig.getProperties().getProperty("property"));
List<LoginModuleConfig> memberLoginModuleConfigs = memberRealm.getJaasAuthenticationConfig().getLoginModuleConfigs();
assertEquals(2, memberLoginModuleConfigs.size());
Iterator<LoginModuleConfig> memberLoginIterator = memberLoginModuleConfigs.iterator();
LoginModuleConfig memberLoginModuleCfg1 = memberLoginIterator.next();
assertEquals("MyRequiredLoginModule", memberLoginModuleCfg1.getClassName());
assertEquals(LoginModuleUsage.REQUIRED, memberLoginModuleCfg1.getUsage());
assertEquals(1, memberLoginModuleCfg1.getProperties().size());
assertEquals("login-value", memberLoginModuleCfg1.getProperties().getProperty("login-property"));
LoginModuleConfig memberLoginModuleCfg2 = memberLoginIterator.next();
assertEquals("MyRequiredLoginModule2", memberLoginModuleCfg2.getClassName());
assertEquals(LoginModuleUsage.SUFFICIENT, memberLoginModuleCfg2.getUsage());
assertEquals(1, memberLoginModuleCfg2.getProperties().size());
assertEquals("login-value2", memberLoginModuleCfg2.getProperties().getProperty("login-property2"));
RealmConfig clientRealm = securityConfig.getRealmConfig(securityConfig.getClientRealm());
List<LoginModuleConfig> clientLoginModuleConfigs = clientRealm.getJaasAuthenticationConfig().getLoginModuleConfigs();
assertEquals(2, clientLoginModuleConfigs.size());
Iterator<LoginModuleConfig> clientLoginIterator = clientLoginModuleConfigs.iterator();
LoginModuleConfig clientLoginModuleCfg1 = clientLoginIterator.next();
assertEquals("MyOptionalLoginModule", clientLoginModuleCfg1.getClassName());
assertEquals(LoginModuleUsage.OPTIONAL, clientLoginModuleCfg1.getUsage());
assertEquals(1, clientLoginModuleCfg1.getProperties().size());
assertEquals("client-value", clientLoginModuleCfg1.getProperties().getProperty("client-property"));
LoginModuleConfig clientLoginModuleCfg2 = clientLoginIterator.next();
assertEquals("MyRequiredLoginModule", clientLoginModuleCfg2.getClassName());
assertEquals(LoginModuleUsage.REQUIRED, clientLoginModuleCfg2.getUsage());
assertEquals(1, clientLoginModuleCfg2.getProperties().size());
assertEquals("client-value2", clientLoginModuleCfg2.getProperties().getProperty("client-property2"));
TokenIdentityConfig tokenIdentityConfig = clientRealm.getTokenIdentityConfig();
assertEquals(TokenEncoding.BASE64, tokenIdentityConfig.getEncoding());
assertArrayEquals(ConfigXmlGenerator.MASK_FOR_SENSITIVE_DATA.getBytes(US_ASCII), tokenIdentityConfig.getToken());
RealmConfig kerberosRealm = securityConfig.getRealmConfig("kerberos");
assertNotNull(kerberosRealm);
KerberosIdentityConfig kerbIdentity = kerberosRealm.getKerberosIdentityConfig();
assertNotNull(kerbIdentity);
assertEquals("HAZELCAST.COM", kerbIdentity.getRealm());
assertEquals("krb5Initializer", kerbIdentity.getSecurityRealm());
assertEquals("jduke@HAZELCAST.COM", kerbIdentity.getPrincipal());
assertEquals("/opt/jduke.keytab", kerbIdentity.getKeytabFile());
assertTrue(kerbIdentity.getUseCanonicalHostname());
KerberosAuthenticationConfig kerbAuthentication = kerberosRealm.getKerberosAuthenticationConfig();
assertNotNull(kerbAuthentication);
assertEquals(Boolean.TRUE, kerbAuthentication.getRelaxFlagsCheck());
assertEquals(Boolean.FALSE, kerbAuthentication.getSkipRole());
assertNull(kerbAuthentication.getSkipIdentity());
assertEquals("krb5Acceptor", kerbAuthentication.getSecurityRealm());
assertEquals("jduke@HAZELCAST.COM", kerbAuthentication.getPrincipal());
assertEquals("/opt/jduke.keytab", kerbAuthentication.getKeytabFile());
assertTrue(kerbAuthentication.getUseNameWithoutRealm());
LdapAuthenticationConfig kerbLdapAuthentication = kerbAuthentication.getLdapAuthenticationConfig();
assertNotNull(kerbLdapAuthentication);
assertEquals("ldap://127.0.0.1", kerbLdapAuthentication.getUrl());
RealmConfig simpleRealm = securityConfig.getRealmConfig("simple");
assertNotNull(simpleRealm);
SimpleAuthenticationConfig simpleAuthnCfg = simpleRealm.getSimpleAuthenticationConfig();
assertNotNull(simpleAuthnCfg);
assertEquals(2, simpleAuthnCfg.getUsernames().size());
assertTrue(simpleAuthnCfg.getUsernames().contains("test"));
assertEquals("a1234", simpleAuthnCfg.getPassword("test"));
assertEquals(":", simpleAuthnCfg.getRoleSeparator());
Set<String> expectedRoles = new HashSet<>();
expectedRoles.add("monitor");
expectedRoles.add("hazelcast");
assertEquals(expectedRoles, simpleAuthnCfg.getRoles("test"));
assertEquals(Boolean.TRUE, simpleAuthnCfg.getSkipRole());
// client-permission-policy
PermissionPolicyConfig permissionPolicyConfig = securityConfig.getClientPolicyConfig();
assertEquals("MyPermissionPolicy", permissionPolicyConfig.getClassName());
assertEquals(1, permissionPolicyConfig.getProperties().size());
assertEquals("permission-value", permissionPolicyConfig.getProperties().getProperty("permission-property"));
}
use of com.hazelcast.config.security.TokenIdentityConfig in project hazelcast by hazelcast.
the class ConfigXmlGeneratorTest method testTokenAuthenticationConfig.
@Test
public void testTokenAuthenticationConfig() {
Config cfg = new Config();
SecurityConfig expectedConfig = new SecurityConfig().setClientRealmConfig("cRealm", new RealmConfig().setTokenIdentityConfig(new TokenIdentityConfig(TokenEncoding.NONE, "ahoj"))).setMemberRealmConfig("mRealm", new RealmConfig().setTokenIdentityConfig(new TokenIdentityConfig(TokenEncoding.BASE64, "bmF6ZGFy")));
cfg.setSecurityConfig(expectedConfig);
SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg, false).getSecurityConfig();
assertEquals(expectedConfig, actualConfig);
}
Aggregations