Geode is introducing additional security features which allow finer grained control for JMX operations as well as GFSH commands and Pulse. Additional information can be found here: Geode Integrated Security.
To quickly get started using permissions for JMX and GFSH a sample implementation of org.apache.geode.security.SecurityManager is provided by the class org.apache.geode.security.templates.SampleSecurityManager
. This implementation requires a JSON file which defines the allowed users and their corresponding permissions. For example:
{ "roles": [ { "name": "cluster", "operationsAllowed": [ "CLUSTER:MANAGE", "CLUSTER:WRITE", "CLUSTER:READ" ] }, { "name": "data", "operationsAllowed": [ "DATA:MANAGE", "DATA:WRITE", "DATA:READ" ], "regions": ["region1", "region2"] } ], "users": [ { "name": "super-user", "password": "1234567", "roles": [ "cluster", "data" ] }, { "name": "joebloggs", "password": "1234567", "roles": [ "data" ] } ] }
In this sample "security.json" file, we have two roles defined: cluster and data. The cluster role can perform cluster level operations like list members, whereas the data role can access/store data in Regions. The data role only has access to two regions: region1 and region2.
To start using this sample perform the following steps:
Copy the above "security.json" file into locator's directory (locator1 in the example below) or make it available on the classpath using the --classpath option while starting the locator.
Using gfsh, start a locator with security activated.
gfsh> start locator --name=locator1 \ --J=-Dgemfire.security-manager=org.apache.geode.security.templates.SampleSecurityManager
Similarly, start a server
gfsh> start server --name=server1 --locators=localhost[10334] --J=-Dgemfire.security-manager=org.apache.geode.security.templates.SampleSecurityManager
Start a new instance of gfsh and connect with one of the users defined in your JSON file. The super-user should be allowed to do everything in gfsh.
gfsh> connect --locators=localhost[10334] --user=super-user --password=1234567
Disconnect and reconnect with a user with lesser privileges:
gfsh> disconnect gfsh> connect --locators=localhost[10334] --user=joebloggs --password=1234567 gfsh> stop server --name=server1 An error occurred while attempting to stop a Cache Server: Subject does not have permission [CLUSTER:READ]
- Currently, changes to the security.json file require the locator to be restarted.