Chapter 2. Red Hat JBoss Data Grid Security: Authorization and Authentication Red Hat JBoss Data Grid is able to perform authorization on CacheManagers and Caches. JBoss Data Grid authorization is built on standard security features available in a JDK, such as JAAS and the SecurityManager. If an application attempts to interact with a secured CacheManager and Cache, it must provide an identity which JBoss Data Grid's security layer can validate against a set of required roles and permissions. Once validated, the client is issued a token for subsequent operations. Where access is denied, an exception indicating a security violation is thrown. When a cache has been configured for with authorization, retrieving it returns an instance of SecureCache . SecureCache is a simple wrapper around a cache, which checks whether the "current user" has the permissions required to perform an operation. The "current user" is a Subject associated with the AccessControlContext . JBoss Data Grid maps Principals names to roles, which in turn, represent one or more permissions. The following diagram represents these relationships: Figure 2.1. Roles and Permissions Mapping Report a bug 2.1. Permissions Access to a CacheManager or a Cache is controlled using a set of required permissions. Permissions control the type of action that is performed on the CacheManager or Cache, rather than the type of data being manipulated. Some of these permissions can apply to specifically name entities, such as a named cache. Different types of permissions are available depending on the entity. Table 2.1. CacheManager Permissions Permission Function Description CONFIGURATION defineConfiguration Whether a new cache configuration can be defined. LISTEN addListener Whether listeners can be registered against a cache manager. LIFECYCLE stop, start Whether the cache manager can be stopped or started respectively. ALL A convenience permission which includes all of the above. Table 2.2. Cache Permissions Permission Function Description READ get, contains Whether entries can be retrieved from the cache. WRITE put, putIfAbsent, replace, remove, evict Whether data can be written/replaced/removed/evicted from the cache. EXEC distexec, mapreduce Whether code execution can be run against the cache. LISTEN addListener Whether listeners can be registered against a cache. BULK_READ keySet, values, entrySet,query Whether bulk retrieve operations can be executed. BULK_WRITE clear, putAll Whether bulk write operations can be executed. LIFECYCLE start, stop Whether a cache can be started / stopped. ADMIN getVersion, addInterceptor*, removeInterceptor, getInterceptorChain, getEvictionManager, getComponentRegistry, getDistributionManager, getAuthorizationManager, evict, getRpcManager, getCacheConfiguration, getCacheManager, getInvocationContextContainer, setAvailability, getDataContainer, getStats, getXAResource Whether access to the underlying components/internal structures is allowed. ALL A convenience permission which includes all of the above. ALL_READ Combines READ and BULK_READ. ALL_WRITE Combines WRITE and BULK_WRITE. Note Some permissions may need to be combined with others in order to be useful. For example, EXEC with READ or with WRITE. Report a bug

Commands: