Chapter 1. Security authorization with role-based access control
Chapter 1. Security authorization with role-based access control Role-based access control (RBAC) capabilities use different permissions levels to restrict user interactions with Data Grid. Note For information on creating users and configuring authorization specific to remote or embedded caches, see: Configuring user roles and permissions with Data Grid Server Programmatically configuring user roles and permissions 1.1. Data Grid user roles and permissions Data Grid includes several roles that provide users with permissions to access caches and Data Grid resources. Role Permissions Description admin ALL Superuser with all permissions including control of the Cache Manager lifecycle. deployer ALL_READ, ALL_WRITE, LISTEN, EXEC, MONITOR, CREATE Can create and delete Data Grid resources in addition to application permissions. application ALL_READ, ALL_WRITE, LISTEN, EXEC, MONITOR Has read and write access to Data Grid resources in addition to observer permissions. Can also listen to events and execute server tasks and scripts. observer ALL_READ, MONITOR Has read access to Data Grid resources in addition to monitor permissions. monitor MONITOR Can view statistics via JMX and the metrics endpoint. Additional resources org.infinispan.security.AuthorizationPermission Enum Data Grid configuration schema reference 1.1.1. Permissions User roles are sets of permissions with different access levels. Table 1.1. Cache Manager permissions Permission Function Description CONFIGURATION defineConfiguration Defines new cache configurations. LISTEN addListener Registers listeners against a Cache Manager. LIFECYCLE stop Stops the Cache Manager. CREATE createCache , removeCache Create and remove container resources such as caches, counters, schemas, and scripts. MONITOR getStats Allows access to JMX statistics and the metrics endpoint. ALL - Includes all Cache Manager permissions. Table 1.2. Cache permissions Permission Function Description READ get , contains Retrieves entries from a cache. WRITE put , putIfAbsent , replace , remove , evict Writes, replaces, removes, evicts data in a cache. EXEC distexec , streams Allows code execution against a cache. LISTEN addListener Registers listeners against a cache. BULK_READ keySet , values , entrySet , query Executes bulk retrieve operations. BULK_WRITE clear , putAll Executes bulk write operations. LIFECYCLE start , stop Starts and stops a cache. ADMIN getVersion , addInterceptor* , removeInterceptor , getInterceptorChain , getEvictionManager , getComponentRegistry , getDistributionManager , getAuthorizationManager , evict , getRpcManager , getCacheConfiguration , getCacheManager , getInvocationContextContainer , setAvailability , getDataContainer , getStats , getXAResource Allows access to underlying components and internal structures. MONITOR getStats Allows access to JMX statistics and the metrics endpoint. ALL - Includes all cache permissions. ALL_READ - Combines the READ and BULK_READ permissions. ALL_WRITE - Combines the WRITE and BULK_WRITE permissions. Additional resources Data Grid Security API 1.1.2. Role and permission mappers Data Grid implements users as a collection of principals. Principals represent either an individual user identity, such as a username, or a group to which the users belong. Internally, these are implemented with the javax.security.auth.Subject class. To enable authorization, the principals must be mapped to role names, which are then expanded into a set of permissions. Data Grid includes the PrincipalRoleMapper API for associating security principals to roles, and the RolePermissionMapper API for associating roles with specific permissions. Data Grid provides the following role and permission mapper implementations: Cluster role mapper Stores principal to role mappings in the cluster registry. Cluster permission mapper Stores role to permission mappings in the cluster registry. Allows you to dynamically modify user roles and permissions. Identity role mapper Uses the principal name as the role name. The type or format of the principal name depends on the source. For example, in an LDAP directory the principal name could be a Distinguished Name (DN). Common name role mapper Uses the Common Name (CN) as the role name. You can use this role mapper with an LDAP directory or with client certificates that contain Distinguished Names (DN); for example cn=managers,ou=people,dc=example,dc=com maps to the managers role. Note By default, principal-to-role mapping is only applied to principals which represent groups. It is possible to configure Data Grid to also perform the mapping for user principals by setting the authorization.group-only-mapping configuration attribute to false . 1.1.2.1. Mapping users to roles and permissions in Data Grid Consider the following user retrieved from an LDAP server, as a collection of DNs: Using the Common name role mapper , the user would be mapped to the following roles: Data Grid has the following role definitions: The user would have the following permissions: Additional resources Data Grid Security API org.infinispan.security.PrincipalRoleMapper org.infinispan.security.RolePermissionMapper org.infinispan.security.mappers.IdentityRoleMapper org.infinispan.security.mappers.CommonNameRoleMapper 1.1.3. Configuring role mappers Data Grid enables the cluster role mapper and cluster permission mapper by default. To use a different implementation for role mapping, you must configure the role mappers. Procedure Open your Data Grid configuration for editing. Declare the role mapper as part of the security authorization in the Cache Manager configuration. Save the changes to your configuration. With embedded caches you can programmatically configure role and permission mappers with the principalRoleMapper() and rolePermissionMapper() methods. Role mapper configuration XML <cache-container> <security> <authorization> <common-name-role-mapper /> </authorization> </security> </cache-container> JSON { "infinispan" : { "cache-container" : { "security" : { "authorization" : { "common-name-role-mapper": {} } } } } } YAML infinispan: cacheContainer: security: authorization: commonNameRoleMapper: ~ Additional resources Data Grid configuration schema reference 1.1.4. Configuring the cluster role and permission mappers The cluster role mapper maintains a dynamic mapping between principals and roles. The cluster permission mapper maintains a dynamic set of role definitions. In both cases, the mappings are stored in the cluster registry and can be manipulated at runtime using either the CLI or the REST API. Prerequisites Have ADMIN permissions for Data Grid. Start the Data Grid CLI. Connect to a running Data Grid cluster. 1.1.4.1. Creating new roles Create new roles and set the permissions. Procedure Create roles with the user roles create command, for example: Verification List roles that you grant to users with the user roles ls command. Describe roles with the user roles describe command. 1.1.4.2. Granting roles to users Assign roles to users and grant them permissions to perform cache operations and interact with Data Grid resources. Tip Grant roles to groups instead of users if you want to assign the same role to multiple users and centrally maintain their permissions. Prerequisites Have ADMIN permissions for Data Grid. Create Data Grid users. Procedure Create a CLI connection to Data Grid. Assign roles to users with the user roles grant command, for example: Verification List roles that you grant to users with the user roles ls command. 1.1.4.3. Cluster role mapper name rewriters By default, the mapping is performed using a strict string equivalence between principal names and roles. It is possible to configure the cluster role mapper to apply transformation to the principal name before performing a lookup. Procedure Open your Data Grid configuration for editing. Specify a name rewriter for the cluster role mapper as part of the security authorization in the Cache Manager configuration. Save the changes to your configuration. Principal names may have different forms, depending on the security realm type: Properties and Token realms may return simple strings Trust and LDAP realms may return X.500-style distinguished names Kerberos realms may return user@domain -style names Names can be normalized to a common form using one of the following transformers: 1.1.4.3.1. Case Principal Transformer XML <cache-container> <security> <authorization> <cluster-role-mapper> <name-rewriter> <case-principal-transformer uppercase="false"/> </name-rewriter> </cluster-role-mapper> </authorization> </security> </cache-container> JSON { "cache-container": { "security": { "authorization": { "cluster-role-mapper": { "name-rewriter": { "case-principal-transformer": {} } } } } } } YAML cacheContainer: security: authorization: clusterRoleMapper: nameRewriter: casePrincipalTransformer: uppercase: false 1.1.4.3.2. Regex Principal Transformer XML <cache-container> <security> <authorization> <cluster-role-mapper> <name-rewriter> <regex-principal-transformer pattern="cn=([^,]+),.*" replacement="USD1"/> </name-rewriter> </cluster-role-mapper> </authorization> </security> </cache-container> JSON { "cache-container": { "security": { "authorization": { "cluster-role-mapper": { "name-rewriter": { "regex-principal-transformer": { "pattern": "cn=([^,]+),.*", "replacement": "USD1" } } } } } } } YAML cacheContainer: security: authorization: clusterRoleMapper: nameRewriter: regexPrincipalTransformer: pattern: "cn=([^,]+),.*" replacement: "USD1" Additional resources Data Grid configuration schema reference 1.2. Configuring caches with security authorization Add security authorization to caches to enforce role-based access control (RBAC). This requires Data Grid users to have a role with a sufficient level of permission to perform cache operations. Prerequisites Create Data Grid users and either grant them with roles or assign them to groups. Procedure Open your Data Grid configuration for editing. Add a security section to the configuration. Specify roles that users must have to perform cache operations with the authorization element. You can implicitly add all roles defined in the Cache Manager or explicitly define a subset of roles. Save the changes to your configuration. Implicit role configuration The following configuration implicitly adds every role defined in the Cache Manager: XML <distributed-cache> <security> <authorization/> </security> </distributed-cache> JSON { "distributed-cache": { "security": { "authorization": { "enabled": true } } } } YAML distributedCache: security: authorization: enabled: true Explicit role configuration The following configuration explicitly adds a subset of roles defined in the Cache Manager. In this case Data Grid denies cache operations for any users that do not have one of the configured roles. XML <distributed-cache> <security> <authorization roles="admin supervisor"/> </security> </distributed-cache> JSON { "distributed-cache": { "security": { "authorization": { "enabled": true, "roles": ["admin","supervisor"] } } } } YAML distributedCache: security: authorization: enabled: true roles: ["admin","supervisor"]
CN=myapplication,OU=applications,DC=mycompany CN=dataprocessors,OU=groups,DC=mycompany CN=finance,OU=groups,DC=mycompany dataprocessors finance dataprocessors: ALL_WRITE ALL_READ finance: LISTEN ALL_WRITE ALL_READ LISTEN <cache-container> <security> <authorization> <common-name-role-mapper /> </authorization> </security> </cache-container> { "infinispan" : { "cache-container" : { "security" : { "authorization" : { "common-name-role-mapper": {} } } } } } infinispan: cacheContainer: security: authorization: commonNameRoleMapper: ~ user roles create --permissions=ALL_READ,ALL_WRITE simple user roles ls ["observer","application","admin","monitor","simple","deployer"] user roles describe simple { "name" : "simple", "permissions" : [ "ALL_READ","ALL_WRITE" ] } user roles grant --roles=deployer katie user roles ls katie ["deployer"] <cache-container> <security> <authorization> <cluster-role-mapper> <name-rewriter> <case-principal-transformer uppercase="false"/> </name-rewriter> </cluster-role-mapper> </authorization> </security> </cache-container> { "cache-container": { "security": { "authorization": { "cluster-role-mapper": { "name-rewriter": { "case-principal-transformer": {} } } } } } } cacheContainer: security: authorization: clusterRoleMapper: nameRewriter: casePrincipalTransformer: uppercase: false <cache-container> <security> <authorization> <cluster-role-mapper> <name-rewriter> <regex-principal-transformer pattern="cn=([^,]+),.*" replacement="USD1"/> </name-rewriter> </cluster-role-mapper> </authorization> </security> </cache-container> { "cache-container": { "security": { "authorization": { "cluster-role-mapper": { "name-rewriter": { "regex-principal-transformer": { "pattern": "cn=([^,]+),.*", "replacement": "USD1" } } } } } } } cacheContainer: security: authorization: clusterRoleMapper: nameRewriter: regexPrincipalTransformer: pattern: "cn=([^,]+),.*" replacement: "USD1" <distributed-cache> <security> <authorization/> </security> </distributed-cache> { "distributed-cache": { "security": { "authorization": { "enabled": true } } } } distributedCache: security: authorization: enabled: true <distributed-cache> <security> <authorization roles="admin supervisor"/> </security> </distributed-cache> { "distributed-cache": { "security": { "authorization": { "enabled": true, "roles": ["admin","supervisor"] } } } } distributedCache: security: authorization: enabled: true roles: ["admin","supervisor"]