Class IgniteAuthenticationProcessor
- java.lang.Object
-
- org.apache.ignite.internal.processors.GridProcessorAdapter
-
- org.apache.ignite.internal.processors.authentication.IgniteAuthenticationProcessor
-
- All Implemented Interfaces:
GridComponent,PartitionsExchangeAware,MetastorageLifecycleListener,GridProcessor,GridSecurityProcessor
public class IgniteAuthenticationProcessor extends GridProcessorAdapter implements GridSecurityProcessor, MetastorageLifecycleListener, PartitionsExchangeAware
-
-
Nested Class Summary
-
Nested classes/interfaces inherited from interface org.apache.ignite.internal.GridComponent
GridComponent.DiscoveryDataExchangeType
-
-
Field Summary
-
Fields inherited from class org.apache.ignite.internal.processors.GridProcessorAdapter
ctx, diagnosticLog, log
-
-
Constructor Summary
Constructors Constructor Description IgniteAuthenticationProcessor(GridKernalContext ctx)
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description voidalterUser(String login, char[] passwd)Alters password of user with the specified login.SecurityContextauthenticate(AuthenticationContext authCtx)Authenticates subject via underlying Authenticator.SecuritySubjectauthenticatedSubject(UUID subjId)Gets authenticated node subject.Collection<SecuritySubject>authenticatedSubjects()Gets collection of authenticated nodes.SecurityContextauthenticateNode(ClusterNode node, SecurityCredentials cred)Authenticates grid node with it's attributes via underlying Authenticator.voidauthorize(String name, SecurityPermission perm, SecurityContext securityCtx)Authorizes grid operation.voidcheckUserOperation(UserManagementOperation op)voidcollectGridNodeData(DiscoveryDataBag dataBag)Collects discovery data on nodes already in grid on receivingTcpDiscoveryNodeAddedMessage.voidcreateUser(String login, char[] passwd)Creates user with the specified login and password.@Nullable GridComponent.DiscoveryDataExchangeTypediscoveryDataType()Gets unique component type to distinguish components providing discovery data.voiddropUser(String login)Drops user with the specified login.booleanenabled()booleanisGlobalNodeAuthentication()Gets flag indicating whether all nodes or coordinator only should run the authentication for joining node.voidonDisconnected(IgniteFuture reconnectFut)Client disconnected callback.voidonDoneBeforeTopologyUnlock(GridDhtPartitionsExchangeFuture fut)Callback from exchange process completion; called before topology is unlocked.voidonGridDataReceived(DiscoveryDataBag.GridDiscoveryData data)Receives discovery data object from remote nodes (called on new node during discovery process).voidonKernalStop(boolean cancel)Callback to notify that kernal is about to stop.voidonReadyForRead(ReadOnlyMetastorage metastorage)Is called when metastorage is made ready for read-only operations very early on node startup phase.voidonReadyForReadWrite(ReadWriteMetastorage metastorage)Fully functional metastore capable of performing reading and writing operations.IgniteInternalFuture<?>onReconnected(boolean active)Client reconnected callback.voidonSessionExpired(UUID subjId)Callback invoked when subject session got expired.SecurityContextsecurityContext(UUID subjId)Gets security context for authenticated nodes and thin clients.voidstartProcessor()Starts processor.voidstop(boolean cancel)Stops grid component.static voidvalidate(String login, char[] passwd)-
Methods inherited from class org.apache.ignite.internal.processors.GridProcessorAdapter
assertParameter, collectJoiningNodeData, onJoiningNodeDataReceived, onKernalStart, printMemoryStats, start, toString, validateNode, validateNode
-
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
-
Methods inherited from interface org.apache.ignite.internal.GridComponent
collectJoiningNodeData, onJoiningNodeDataReceived, onKernalStart, printMemoryStats, start, validateNode, validateNode
-
Methods inherited from interface org.apache.ignite.internal.processors.security.GridSecurityProcessor
isSystemType, sandboxEnabled
-
Methods inherited from interface org.apache.ignite.internal.processors.cache.distributed.dht.preloader.PartitionsExchangeAware
onDoneAfterTopologyUnlock, onInitAfterTopologyLock, onInitBeforeTopologyLock
-
-
-
-
Constructor Detail
-
IgniteAuthenticationProcessor
public IgniteAuthenticationProcessor(GridKernalContext ctx)
- Parameters:
ctx- Kernal context.
-
-
Method Detail
-
startProcessor
public void startProcessor() throws IgniteCheckedExceptionStarts processor.- Throws:
IgniteCheckedException
-
stop
public void stop(boolean cancel) throws IgniteCheckedExceptionStops grid component.- Specified by:
stopin interfaceGridComponent- Overrides:
stopin classGridProcessorAdapter- Parameters:
cancel- Iftrue, then all ongoing tasks or jobs for relevant components need to be cancelled.- Throws:
IgniteCheckedException- Thrown in case of any errors.
-
onKernalStop
public void onKernalStop(boolean cancel)
Callback to notify that kernal is about to stop.- Specified by:
onKernalStopin interfaceGridComponent- Overrides:
onKernalStopin classGridProcessorAdapter- Parameters:
cancel- Flag indicating whether jobs should be canceled.
-
onDisconnected
public void onDisconnected(IgniteFuture reconnectFut)
Client disconnected callback.- Specified by:
onDisconnectedin interfaceGridComponent- Overrides:
onDisconnectedin classGridProcessorAdapter- Parameters:
reconnectFut- Reconnect future.
-
onReconnected
public IgniteInternalFuture<?> onReconnected(boolean active)
Client reconnected callback.- Specified by:
onReconnectedin interfaceGridComponent- Overrides:
onReconnectedin classGridProcessorAdapter- Parameters:
active- Cluster restarted flag.- Returns:
- Future to wait before completing reconnect future.
-
authenticate
public SecurityContext authenticate(AuthenticationContext authCtx) throws IgniteCheckedException
Authenticates subject via underlying Authenticator.- Specified by:
authenticatein interfaceGridSecurityProcessor- Parameters:
authCtx- Authentication context.- Returns:
Trueif succeeded,falseotherwise.- Throws:
IgniteCheckedException- If error occurred.
-
validate
public static void validate(String login, char[] passwd) throws UserManagementException
- Parameters:
login- User's login.passwd- Password.- Throws:
UserManagementException- On error.
-
createUser
public void createUser(String login, char[] passwd) throws IgniteCheckedException
Creates user with the specified login and password.- Specified by:
createUserin interfaceGridSecurityProcessor- Parameters:
login- Login of the user to be created.passwd- User password.- Throws:
IgniteCheckedException- If error occurred.
-
dropUser
public void dropUser(String login) throws IgniteCheckedException
Drops user with the specified login.- Specified by:
dropUserin interfaceGridSecurityProcessor- Parameters:
login- Login of the user to be dropped.- Throws:
IgniteCheckedException- If error occurred.
-
alterUser
public void alterUser(String login, char[] passwd) throws IgniteCheckedException
Alters password of user with the specified login.- Specified by:
alterUserin interfaceGridSecurityProcessor- Parameters:
login- Login of the user which password should be altered.passwd- User password to alter.- Throws:
IgniteCheckedException- If error occurred.
-
onReadyForRead
public void onReadyForRead(ReadOnlyMetastorage metastorage) throws IgniteCheckedException
Is called when metastorage is made ready for read-only operations very early on node startup phase. Reference for read-only metastorage should be used only within this method and shouldn't be stored to any field.- Specified by:
onReadyForReadin interfaceMetastorageLifecycleListener- Parameters:
metastorage- Read-only meta storage.- Throws:
IgniteCheckedException
-
onReadyForReadWrite
public void onReadyForReadWrite(ReadWriteMetastorage metastorage)
Fully functional metastore capable of performing reading and writing operations. Components interested in using metastore are allowed to keep reference passed into the method in their fields.- Specified by:
onReadyForReadWritein interfaceMetastorageLifecycleListener- Parameters:
metastorage- Fully functional meta storage.
-
discoveryDataType
@Nullable public @Nullable GridComponent.DiscoveryDataExchangeType discoveryDataType()
Gets unique component type to distinguish components providing discovery data. Must return non-null value if component implements any of methodsGridComponent.collectJoiningNodeData(DiscoveryDataBag)orGridComponent.collectGridNodeData(DiscoveryDataBag).- Specified by:
discoveryDataTypein interfaceGridComponent- Overrides:
discoveryDataTypein classGridProcessorAdapter- Returns:
- Unique component type for discovery data exchange.
-
collectGridNodeData
public void collectGridNodeData(DiscoveryDataBag dataBag)
Collects discovery data on nodes already in grid on receivingTcpDiscoveryNodeAddedMessage.- Specified by:
collectGridNodeDatain interfaceGridComponent- Overrides:
collectGridNodeDatain classGridProcessorAdapter- Parameters:
dataBag- container object to store discovery data in.
-
onGridDataReceived
public void onGridDataReceived(DiscoveryDataBag.GridDiscoveryData data)
Receives discovery data object from remote nodes (called on new node during discovery process).- Specified by:
onGridDataReceivedin interfaceGridComponent- Overrides:
onGridDataReceivedin classGridProcessorAdapter- Parameters:
data-DiscoveryDataBag.GridDiscoveryDatainterface to retrieve discovery data collected on remote nodes (data common for all nodes in grid and specific for each node).
-
enabled
public boolean enabled()
- Specified by:
enabledin interfaceGridSecurityProcessor- Returns:
- GridSecurityProcessor is enable.
-
onDoneBeforeTopologyUnlock
public void onDoneBeforeTopologyUnlock(GridDhtPartitionsExchangeFuture fut)
Callback from exchange process completion; called before topology is unlocked. Guarantees that no updates were performed on local node since exchange process started.- Specified by:
onDoneBeforeTopologyUnlockin interfacePartitionsExchangeAware- Parameters:
fut- Partition map exchange future.
-
authenticateNode
public SecurityContext authenticateNode(ClusterNode node, SecurityCredentials cred) throws IgniteCheckedException
Authenticates grid node with it's attributes via underlying Authenticator. The current implementation ofGridSecurityProcessorallows any Ignite node to join the Ignite cluster without authentication check.- Specified by:
authenticateNodein interfaceGridSecurityProcessor- Parameters:
node- Node id to authenticate.cred- Security credentials.- Returns:
Trueif succeeded,falseotherwise.- Throws:
IgniteCheckedException- If error occurred.
-
authenticatedSubject
public SecuritySubject authenticatedSubject(UUID subjId) throws IgniteCheckedException
Gets authenticated node subject.- Specified by:
authenticatedSubjectin interfaceGridSecurityProcessor- Parameters:
subjId- Subject ID.- Returns:
- Security subject.
- Throws:
IgniteCheckedException- If error occurred.
-
authenticatedSubjects
public Collection<SecuritySubject> authenticatedSubjects() throws IgniteCheckedException
Gets collection of authenticated nodes.- Specified by:
authenticatedSubjectsin interfaceGridSecurityProcessor- Returns:
- Collection of authenticated nodes.
- Throws:
IgniteCheckedException- If error occurred.
-
isGlobalNodeAuthentication
public boolean isGlobalNodeAuthentication()
Gets flag indicating whether all nodes or coordinator only should run the authentication for joining node.- Specified by:
isGlobalNodeAuthenticationin interfaceGridSecurityProcessor- Returns:
Trueif all nodes should run authentication process,falseotherwise.
-
authorize
public void authorize(String name, SecurityPermission perm, SecurityContext securityCtx) throws SecurityException
Authorizes grid operation.- Specified by:
authorizein interfaceGridSecurityProcessor- Parameters:
name- Cache name or task class name.perm- Permission to authorize.securityCtx- Optional security context.- Throws:
SecurityException- If security check failed.
-
onSessionExpired
public void onSessionExpired(UUID subjId)
Callback invoked when subject session got expired.- Specified by:
onSessionExpiredin interfaceGridSecurityProcessor- Parameters:
subjId- Subject ID.
-
securityContext
public SecurityContext securityContext(UUID subjId)
Gets security context for authenticated nodes and thin clients. This method works with the assumption thatSecurityContextassociated with the Ignite node is stored in node attributes and is obtained automatically by the Ignite using the node ID (seeIgniteSecurityProcessor.withContext(java.util.UUID)). Since we use the node ID as the subject ID during node authentication, this method is used for obtaining security context for thin clients only. Note, that the returned security context does not contain the address of the security subject. Since the client node does not store user data, theSecurityContextreturned by the client node does not contain any user information, address, or username.- Specified by:
securityContextin interfaceGridSecurityProcessor- Parameters:
subjId- Security subject id.- Returns:
- Security context or null if not found.
-
checkUserOperation
public void checkUserOperation(UserManagementOperation op) throws IgniteAccessControlException
- Parameters:
op- User operation to check.- Throws:
IgniteAccessControlException- If operation check fails: user hasn't permissions for user management or try to remove default user.
-
-