Extends security

Question

Hi folks,
I'm trying to get a reasonable cluster security solution working using Kerberos. I want to be able to secure nodes joining the cluster and secure things
like Extends connections via the proxies. So far the cluster node security piece seems to be working fine (using the standard Coherence security).
To secure the Extends connection I've tried using the Oracle example solution from here [http://wiki.tangosol.com/pages/viewpage.action?pageId=1343626 |http://wiki.tangosol.com/pages/viewpage.action?pageId=1343626 ]
(even though it doesn't seem ideal due to the number of security checks) but it causes a problem when the Extends proxy node itself is
authenticated with the cluster. The example solution uses an EntitledNamedCache class that calls checkAccess() in every method. In this
checkAccess() method the code fetches the current subject from what it says is the "calling thread". The problem is that it actually returns the subject
that the Extends node used to authenticate against the rest of the cluster - not the subject associated with the Extends call. Has anyone tried something
similar and got it to work? Like I say - this only seems to be a problem if you have your Extends node authenticating with the rest of the cluster. I guess all it needs is a successful way to get the subject details from the Extends call.
Another interesting issue is that if you obtain a Subject from the Coherence Security.login(..) call and then call Security.runAs(..) the subject
is POF serialized and sent over the wire. If you obtain the same subject by using standard JAAS login, and call Security.runAs(..) it's not serialized. Odd.
I'm using Java 1.6 and Coherence 3.5.1b461. Any help/comments would be much appreciated. Many Thanks,
Reon Campbell.

Answer 1

Hi Reon,
The root problem seems to be that somehow the Subject is not being passed by Extend for you.
Extend will always run in the context of a Subject if one is available. The security framework (standard Coherence security) will only log in if there is no current Subject. So, if the Subject is passed by Extend, the proxy will execute the message in a Subject.doAs(). The security framework checks to see if there is a current Subject and, if so, it will use it. Otherwise it will call the configured callback handler to log in. If in EntitledNamedCache you are seeing the security framework Subject, it means no Subject was passed and the security framework called the callback handler.
Also, it shouldn't matter whether you use standard JAAS or not because the implementation of Security.login and Security.runAs just use JAAS.
Extend only passes the Subject when a Channel is created, which is the first time a cache reference is retrieved. After that, the Subject associated with the Channel will always be used. My guess, is that you are not running in the context of a Subject when you get that first cache reference. Here is some sample code:
        Subject subject = Security.login("manager", "password".toCharArray());
        NamedCache cache   = null;
        try
            cache = (NamedCache) Security.runAs(subject, new PrivilegedAction()
                public Object run()
                    NamedCache cache = getNamedCache("dist-test");
                    return cache;
        catch (Exception e)
            // failed if security exception
            e.printStackTrace();
        cache.put("key", "value");The final issue for you is that the built in SubjectPofSerializer does not serialize public or private credentials and PrincipalPofSerializer only serializes principal name, so the built in serializers will not serialize a Kerberos ticket. The only solution currently is to write a custom serializer.
Regards,
David
Coherence Development