org.apache.geode.security

Class TestSecurityManager

java.lang.Object

org.apache.geode.security.TestSecurityManager

All Implemented Interfaces:

SecurityManager

public class TestSecurityManager
extends java.lang.Object
implements SecurityManager

This class provides a sample implementation of SecurityManager for authentication and authorization initialized from data provided as JSON.

A Geode member must be configured with the following:

security-manager = org.apache.geode.security.examples.TestSecurityManager

The class can be initialized with from a JSON resource called security.json. This file must exist on the classpath, so members should be started with an appropriate --classpath option.

The format of the JSON for configuration is as follows:

 
 {
   "roles": [
     {
       "name": "admin",
       "operationsAllowed": [
         "CLUSTER:MANAGE",
         "DATA:MANAGE"
       ]
     },
     {
       "name": "readRegionA",
       "operationsAllowed": [
         "DATA:READ"
       ],
       "regions": ["RegionA", "RegionB"]
     }
   ],
   "users": [
     {
       "name": "admin",
       "password": "secret",
       "roles": ["admin"]
     },
     {
       "name": "guest",
       "password": "guest",
       "roles": ["readRegionA"]
     }
   ]
 }
 
 

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	TestSecurityManager.Role
static class	TestSecurityManager.User

Field Summary

Fields

Modifier and Type	Field and Description
protected static java.lang.String	DEFAULT_JSON_FILE_NAME
static java.lang.String	SECURITY_JSON

Constructor Summary

Constructors

Constructor and Description
TestSecurityManager()

Method Summary

Modifier and Type	Method and Description
java.lang.Object	authenticate(java.util.Properties credentials) Verify the credentials provided in the properties Your security manager needs to validate credentials coming from all communication channels.
boolean	authorize(java.lang.Object principal, ResourcePermission context) Authorize the ResourcePermission for a given Principal
TestSecurityManager.User	getUser(java.lang.String user)
void	init(java.util.Properties securityProperties) Initialize the SecurityManager.
boolean	initializeFromJsonResource(java.lang.String jsonResource)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.geode.security.SecurityManager

close

Field Detail

SECURITY_JSON

public static final java.lang.String SECURITY_JSON

See Also:

Constant Field Values

DEFAULT_JSON_FILE_NAME

protected static final java.lang.String DEFAULT_JSON_FILE_NAME

See Also:

Constant Field Values

Constructor Detail

TestSecurityManager

public TestSecurityManager()

Method Detail

authorize

public boolean authorize(java.lang.Object principal,
                         ResourcePermission context)

Description copied from interface: SecurityManager

Authorize the ResourcePermission for a given Principal

Specified by:

authorize in interface SecurityManager

Parameters:

principal - The principal that's requesting the permission

context - The permission requested

Returns:

true if authorized, false if not

init

public void init(java.util.Properties securityProperties)
          throws NotAuthorizedException

Description copied from interface: SecurityManager

Initialize the SecurityManager. This is invoked when a cache is created

Specified by:

init in interface SecurityManager

Parameters:

securityProperties - the security properties obtained using a call to DistributedSystem.getSecurityProperties()

Throws:

NotAuthorizedException

authenticate

public java.lang.Object authenticate(java.util.Properties credentials)
                              throws AuthenticationFailedException

Description copied from interface: SecurityManager

Verify the credentials provided in the properties Your security manager needs to validate credentials coming from all communication channels. If you use AuthInitialize to generate your client/peer credentials, then the input of this method is the output of your AuthInitialize.getCredentials method. But remember that this method will also need to validate credentials coming from gfsh/jmx/rest client, the framework is putting the username/password under security-username and security-password keys in the property, so your securityManager implementation needs to validate these kind of properties as well.

Specified by:

authenticate in interface SecurityManager

Parameters:

credentials - it contains the security-username and security-password as keys of the properties, also the properties generated by your AuthInitialize interface

Returns:

a serializable principal object

Throws:

AuthenticationFailedException

initializeFromJsonResource

public boolean initializeFromJsonResource(java.lang.String jsonResource)

getUser

public TestSecurityManager.User getUser(java.lang.String user)