Apache Geode

Implementing Authorization

How Authorization Works

When a component requests an operation, the SecurityManager.authorize method is invoked. It is passed the principal of the operation’s requester and a ResourcePermission, which describes the operation requested.

The implementation of the SecurityManager.authorize method makes a decision as to whether or not the principal will be granted permission to carry out the operation. It returns a boolean in which a return value of true permits the operation, and a return value of false prevents the operation.

A well-designed authorize method will have or will have a way of obtaining a mapping of principals to the operations (in the form of resource permissions) that they are permitted to do.

Resource Permissions

All operations are described by an instance of the ResourcePermission class. A permission contains the Resource data member, which classifies whether the operation as working on

• cache data; value is DATA
• the cluster; value is CLUSTER

A permission also contains the Operation data member, which classifies whether the operation as

• reading; value is READ
• changing information; value is WRITE
• making administrative changes; value is MANAGE

The operations are not hierarchical; MANAGE does not imply WRITE, and WRITE does not imply READ.

Some DATA operations further specify a region name in the permission. This permits restricting operations on that region to only those authorized principals. And within a region, some operations may specify a key. This permits restricting operations on that key within that region to only those authorized principals.

Some CLUSTER operations further specify a finer-grained target for the operation. Specify the target with a string value of:

• DISK to target operations that write to a disk store
• GATEWAY to target operations that manage gateway senders and receivers
• QUERY to target operations that manage both indexes and continuous queries
• DEPLOY to target operations that deploy code to servers
• LUCENE to target Lucene index operations

This table classifies the permissions assigned for operations common to a Client-Server interaction.

This table classifies the permissions assigned for gfsh operations.

The gfsh connect does not have a permission, as it is the operation that invokes authentication. These gfsh commands do not have permission defined, as they do not interact with the cluster:

• gfsh describe connection, which describes the gfsh end of the connection
• gfsh debug, which toggles the mode within gfsh
• gfsh exit
• gfsh help
• gfsh hint
• gfsh history
• gfsh run, although individual commands within the script will go through authorization
• gfsh set variable
• gfsh sh
• gfsh sleep
• validate offline-disk-store
• gfsh version

This table classifies the permissions assigned for JMX operations.

Implement Authorization

Complete these items to implement authorization.

• Decide upon an authorization algorithm. The Authorization Example stores a mapping of which principals (users) are permitted to do which operations. The algorithm bases its decision on a look up of the permissions granted to the principal attempting the operation.
• Define the security-manager property. See Enable Security with Property Definitions for details about this property.
• Implement the authorize method of the SecurityManager interface.
• Define any extra resources that the implemented authorization algorithm needs in order to make a decision.

Authorization of Function Execution

By default, a function executed on servers requires that the entity invoking the function have DATA:WRITE permission on the region(s) involved. Since the default permission may not be appropriate for all functions, the permissions required may be altered.

To implement a different set of permissions, override the Function.getRequiredPermissions() method in the function’s class. The method should return a Collection of the permissions required of the entity that invokes an execution of the function.

Authorization of Methods Invoked from Queries

Enabling the SecurityManager affects queries by restricting the methods that a running query may invoke. See Method Invocations and Method Invocation Authorizers for details.