org.apache.ignite.internal.processors.security

Class IgniteSecurityProcessor

java.lang.Object

org.apache.ignite.internal.processors.security.IgniteSecurityProcessor

All Implemented Interfaces:

GridComponent, GridProcessor, IgniteSecurity

public class IgniteSecurityProcessor
extends Object
implements IgniteSecurity, GridProcessor

Default IgniteSecurity implementation.

IgniteSecurityProcessor serves here as a facade with is exposed to Ignite internal code, while GridSecurityProcessor is hidden and managed from IgniteSecurityProcessor.

This implementation of IgniteSecurity is responsible for:

• Keeping and propagating authenticated security contexts for cluster nodes;
• Delegating calls for all actions to GridSecurityProcessor;
• Managing sandbox and proving point of entry to the internal sandbox API.

Nested Class Summary

Nested classes/interfaces inherited from interface org.apache.ignite.internal.GridComponent

GridComponent.DiscoveryDataExchangeType

Field Summary

Fields

Modifier and Type	Field and Description
static String	ATTR_GRID_SEC_PROC_CLASS Internal attribute name constant.

Constructor Summary

Constructors

Constructor and Description
IgniteSecurityProcessor(GridKernalContext ctx, GridSecurityProcessor secPrc)

Method Summary

Modifier and Type	Method and Description
SecurityContext	authenticate(AuthenticationContext ctx) Delegates call to GridSecurityProcessor.authenticate(AuthenticationContext)
SecuritySubject	authenticatedSubject(UUID subjId) Delegates call to GridSecurityProcessor.authenticatedSubject(UUID)
Collection<SecuritySubject>	authenticatedSubjects() Delegates call to GridSecurityProcessor.authenticatedSubjects()
SecurityContext	authenticateNode(ClusterNode node, SecurityCredentials cred) Delegates call to GridSecurityProcessor.authenticateNode(org.apache.ignite.cluster.ClusterNode, org.apache.ignite.plugin.security.SecurityCredentials)
void	authorize(String name, SecurityPermission perm) Authorizes grid operation.
void	collectGridNodeData(DiscoveryDataBag dataBag) Collects discovery data on nodes already in grid on receiving TcpDiscoveryNodeAddedMessage.
void	collectJoiningNodeData(DiscoveryDataBag dataBag) Collects discovery data on joining node before sending TcpDiscoveryJoinRequestMessage request.
@Nullable GridComponent.DiscoveryDataExchangeType	discoveryDataType() Gets unique component type to distinguish components providing discovery data.
boolean	enabled()
boolean	isGlobalNodeAuthentication() Delegates call to GridSecurityProcessor.isGlobalNodeAuthentication()
void	onDisconnected(IgniteFuture<?> reconnectFut) Client disconnected callback.
void	onGridDataReceived(DiscoveryDataBag.GridDiscoveryData data) Receives discovery data object from remote nodes (called on new node during discovery process).
void	onJoiningNodeDataReceived(DiscoveryDataBag.JoiningNodeDiscoveryData data) Method is called on nodes that are already in grid (not on joining node).
void	onKernalStart(boolean active) Callback that notifies that kernal has successfully started, including all managers and processors.
void	onKernalStop(boolean cancel) Callback to notify that kernal is about to stop.
@Nullable IgniteInternalFuture<?>	onReconnected(boolean clusterRestarted) Client reconnected callback.
void	onSessionExpired(UUID subjId) Delegates call to GridSecurityProcessor.onSessionExpired(UUID)
void	printMemoryStats() Prints memory statistics (sizes of internal structures, etc.).
IgniteSandbox	sandbox()
SecurityContext	securityContext()
void	start() Starts grid component.
void	stop(boolean cancel) Stops grid component.
@Nullable IgniteNodeValidationResult	validateNode(ClusterNode node) Validates that new node can join grid topology, this method is called on coordinator node before new node joins topology.
@Nullable IgniteNodeValidationResult	validateNode(ClusterNode node, DiscoveryDataBag.JoiningNodeDiscoveryData discoData) Validates that new node can join grid topology, this method is called on coordinator node before new node joins topology.
OperationSecurityContext	withContext(SecurityContext secCtx) Creates OperationSecurityContext.
OperationSecurityContext	withContext(UUID subjId) Creates OperationSecurityContext.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.ignite.internal.processors.security.IgniteSecurity

authorize

Field Detail

ATTR_GRID_SEC_PROC_CLASS

public static final String ATTR_GRID_SEC_PROC_CLASS

Internal attribute name constant.

See Also:

Constant Field Values

Constructor Detail

IgniteSecurityProcessor

public IgniteSecurityProcessor(GridKernalContext ctx,
                               GridSecurityProcessor secPrc)

Parameters:

ctx - Grid kernal context.

secPrc - Security processor.

Method Detail

withContext

public OperationSecurityContext withContext(SecurityContext secCtx)

Creates OperationSecurityContext. All calls of methods IgniteSecurity.authorize(String, SecurityPermission) or IgniteSecurity.authorize(SecurityPermission) will be processed into the context of passed SecurityContext until holder OperationSecurityContext will be closed.

Specified by:

withContext in interface IgniteSecurity

Parameters:

secCtx - Security Context.

Returns:

Security context holder.

withContext

public OperationSecurityContext withContext(UUID subjId)

Creates OperationSecurityContext. All calls of methods IgniteSecurity.authorize(String, SecurityPermission) or IgniteSecurity.authorize(SecurityPermission) will be processed into the context of SecurityContext that is owned by the node with given nodeId until holder OperationSecurityContext will be closed.

Specified by:

withContext in interface IgniteSecurity

Parameters:

subjId - Node id.

Returns:

Security context holder.

securityContext

public SecurityContext securityContext()

Specified by:

securityContext in interface IgniteSecurity

Returns:

SecurityContext of holder OperationSecurityContext.

authenticateNode

public SecurityContext authenticateNode(ClusterNode node,
                                        SecurityCredentials cred)
                                 throws IgniteCheckedException

Delegates call to GridSecurityProcessor.authenticateNode(org.apache.ignite.cluster.ClusterNode, org.apache.ignite.plugin.security.SecurityCredentials)

Specified by:

authenticateNode in interface IgniteSecurity

Throws:

IgniteCheckedException

isGlobalNodeAuthentication

public boolean isGlobalNodeAuthentication()

Delegates call to GridSecurityProcessor.isGlobalNodeAuthentication()

Specified by:

isGlobalNodeAuthentication in interface IgniteSecurity

authenticate

public SecurityContext authenticate(AuthenticationContext ctx)
                             throws IgniteCheckedException

Delegates call to GridSecurityProcessor.authenticate(AuthenticationContext)

Specified by:

authenticate in interface IgniteSecurity

Throws:

IgniteCheckedException

authenticatedSubjects

public Collection<SecuritySubject> authenticatedSubjects()
                                                  throws IgniteCheckedException

Delegates call to GridSecurityProcessor.authenticatedSubjects()

Specified by:

authenticatedSubjects in interface IgniteSecurity

Throws:

IgniteCheckedException

authenticatedSubject

public SecuritySubject authenticatedSubject(UUID subjId)
                                     throws IgniteCheckedException

Delegates call to GridSecurityProcessor.authenticatedSubject(UUID)

Specified by:

authenticatedSubject in interface IgniteSecurity

Throws:

IgniteCheckedException

onSessionExpired

public void onSessionExpired(UUID subjId)

Delegates call to GridSecurityProcessor.onSessionExpired(UUID)

Specified by:

onSessionExpired in interface IgniteSecurity

authorize

public void authorize(String name,
                      SecurityPermission perm)
               throws SecurityException

Authorizes grid operation.

Specified by:

authorize in interface IgniteSecurity

Parameters:

name - Cache name or task class name.

perm - Permission to authorize.

Throws:

SecurityException - If security check failed.

sandbox

public IgniteSandbox sandbox()

Specified by:

sandbox in interface IgniteSecurity

Returns:

Instance of IgniteSandbox.

enabled

public boolean enabled()

Specified by:

enabled in interface IgniteSecurity

Returns:

True if IgniteSecurity is a plugin implementation, false if it's used a default NoOp implementation.

start

public void start()
           throws IgniteCheckedException

Starts grid component.

Specified by:

start in interface GridComponent

Throws:

IgniteCheckedException - Throws in case of any errors.

stop

public void stop(boolean cancel)
          throws IgniteCheckedException

Stops grid component.

Specified by:

stop in interface GridComponent

Parameters:

cancel - If true, then all ongoing tasks or jobs for relevant components need to be cancelled.

Throws:

IgniteCheckedException - Thrown in case of any errors.

onKernalStart

public void onKernalStart(boolean active)
                   throws IgniteCheckedException

Callback that notifies that kernal has successfully started, including all managers and processors.

Specified by:

onKernalStart in interface GridComponent

Parameters:

active - Cluster active flag (note: should be used carefully since state can change concurrently).

Throws:

IgniteCheckedException - Thrown in case of any errors.

onKernalStop

public void onKernalStop(boolean cancel)

Callback to notify that kernal is about to stop.

Specified by:

onKernalStop in interface GridComponent

Parameters:

cancel - Flag indicating whether jobs should be canceled.

collectJoiningNodeData

public void collectJoiningNodeData(DiscoveryDataBag dataBag)

Collects discovery data on joining node before sending TcpDiscoveryJoinRequestMessage request.

Specified by:

collectJoiningNodeData in interface GridComponent

Parameters:

dataBag - container object to store discovery data in.

collectGridNodeData

public void collectGridNodeData(DiscoveryDataBag dataBag)

Collects discovery data on nodes already in grid on receiving TcpDiscoveryNodeAddedMessage.

Specified by:

collectGridNodeData in interface GridComponent

Parameters:

dataBag - container object to store discovery data in.

onGridDataReceived

public void onGridDataReceived(DiscoveryDataBag.GridDiscoveryData data)

Receives discovery data object from remote nodes (called on new node during discovery process).

Specified by:

onGridDataReceived in interface GridComponent

Parameters:

data - DiscoveryDataBag.GridDiscoveryData interface to retrieve discovery data collected on remote nodes (data common for all nodes in grid and specific for each node).

onJoiningNodeDataReceived

public void onJoiningNodeDataReceived(DiscoveryDataBag.JoiningNodeDiscoveryData data)

Method is called on nodes that are already in grid (not on joining node). It receives discovery data from joining node.

Specified by:

onJoiningNodeDataReceived in interface GridComponent

Parameters:

data - DiscoveryDataBag.JoiningNodeDiscoveryData interface to retrieve discovery data of joining node.

printMemoryStats

public void printMemoryStats()

Prints memory statistics (sizes of internal structures, etc.). NOTE: this method is for testing and profiling purposes only.

Specified by:

printMemoryStats in interface GridComponent

validateNode

@Nullable
public @Nullable IgniteNodeValidationResult validateNode(ClusterNode node)

Validates that new node can join grid topology, this method is called on coordinator node before new node joins topology.

Specified by:

validateNode in interface GridComponent

Parameters:

node - Joining node.

Returns:

Validation result or null in case of success.

validateNode

@Nullable
public @Nullable IgniteNodeValidationResult validateNode(ClusterNode node,
                                                                   DiscoveryDataBag.JoiningNodeDiscoveryData discoData)

Validates that new node can join grid topology, this method is called on coordinator node before new node joins topology.

Specified by:

validateNode in interface GridComponent

Parameters:

node - Joining node.

discoData - Joining node discovery data.

Returns:

Validation result or null in case of success.

discoveryDataType

@Nullable
public @Nullable GridComponent.DiscoveryDataExchangeType discoveryDataType()

Gets unique component type to distinguish components providing discovery data. Must return non-null value if component implements any of methods GridComponent.collectJoiningNodeData(DiscoveryDataBag) or GridComponent.collectGridNodeData(DiscoveryDataBag).

Specified by:

discoveryDataType in interface GridComponent

Returns:

Unique component type for discovery data exchange.

onDisconnected

public void onDisconnected(IgniteFuture<?> reconnectFut)
                    throws IgniteCheckedException

Client disconnected callback.

Specified by:

onDisconnected in interface GridComponent

Parameters:

reconnectFut - Reconnect future.

Throws:

IgniteCheckedException - If failed.

onReconnected

@Nullable
public @Nullable IgniteInternalFuture<?> onReconnected(boolean clusterRestarted)
                                                          throws IgniteCheckedException

Client reconnected callback.

Specified by:

onReconnected in interface GridComponent

Parameters:

clusterRestarted - Cluster restarted flag.

Returns:

Future to wait before completing reconnect future.

Throws:

IgniteCheckedException - If failed.