Issue with Authentication using JAAS for coherence

Question

Hi,
I have configured security frame work using JAAS for storage enabled node,
I am using keystore for authenticating the users, Below is the code used for authentication,
    Subject subject;
        try{ subject = Security.login(sUsername, sPassword.toCharArray()); }
        catch (Throwable t){
            subject = null;
            log("Authentication error:");
            log(t); }
        if (subject != null)
            for (Iterator iter = subject.getPrincipals().iterator(); iter.hasNext(); )
                Principal principal = (Principal) iter.next();
                log("Principal: " + principal.getName());
        Security.runAs(subject, new PrivilegedAction()
            public Object run()
                NamedCache cache = CacheFactory.getCache(CACHE_NAME);
                boolean flag = true;
                while (flag) {}
                return null;
            });and i am calling the above class in the callback handler which is defined in coherence operation descriptor.
        <security-config>
                <enabled system-property="tangosol.coherence.security">true</enabled>
                <login-module-name>TestCoherence</login-module-name>
                 <access-controller>
                <class-name>com.tangosol.net.security.DefaultController</class-name>
                        <init-params>
                        <init-param id="1">
                        <param-type>java.io.File</param-type>
                        <param-value>config/keystore.jks</param-value>
                        </init-param>
                        <init-param id="2">
                        <param-type>java.io.File</param-type>
                        <param-value>config/permissions.xml</param-value>
                        </init-param>
                        </init-params>
                 </access-controller>
                 <callback-handler>
                        <class-name>Test</class-name>
                 </callback-handler>
         </security-config>I am using the following command line parameters for bringing up the storage enabled node.
-Dtangosol.coherence.security.permissions="$CONFIG_PATH/permissions.xml" 
-Dtangosol.coherence.security.keystore="$CONFIG_PATH/keystore.jks" 
-Djava.security.auth.login.config="$CONFIG_PATH/login.config" 
-Dtangosol.coherence.security=trueNow till the callback handler thread is alive, storage enabled node will be up. As soon as the call back handler thread dies. Storage enabled node stops with the following error,
Exception in thread "main" java.lang.SecurityException: Authentication failed: Error initializing keystore
at com.tangosol.coherence.component.net.security.Standard.loginSecure(Standard.CDB:36)
at com.tangosol.coherence.component.net.security.Standard.getTempSubject(Standard.CDB:11)
at com.tangosol.coherence.component.net.security.Standard.checkPermission(Standard.CDB:18)
at com.tangosol.coherence.component.net.Security.checkPermission(Security.CDB:11)
at com.tangosol.coherence.component.util.SafeCluster.ensureService(SafeCluster.CDB:6)
at com.tangosol.coherence.component.net.management.Connector.startService(Connector.CDB:25)
at com.tangosol.coherence.component.net.management.gateway.Remote.registerLocalModel(Remote.CDB:8)
at com.tangosol.coherence.component.net.management.gateway.Local.registerLocalModel(Local.CDB:8)
at com.tangosol.coherence.component.net.management.Gateway.register(Gateway.CDB:1)
at com.tangosol.coherence.component.util.SafeCluster.ensureRunningCluster(SafeCluster.CDB:50)
at com.tangosol.coherence.component.util.SafeCluster.start(SafeCluster.CDB:2)
at com.tangosol.net.CacheFactory.ensureCluster(CacheFactory.java:948)
at com.tangosol.net.DefaultConfigurableCacheFactory.ensureService(DefaultConfigurableCacheFactory.java:748)
at com.tangosol.net.DefaultCacheServer.start(DefaultCacheServer.java:140)
at com.tangosol.net.DefaultCacheServer.main(DefaultCacheServer.java:61)
Please let me know where should i pass the credentials to the default cache server for authentication or should i change the any implementation of authentication here.
Thanks in advance,
Bhargav

Answer 1

Bhargav,
Rather than trying to loop forever in a callback handler try this
import com.tangosol.net.CacheFactory;
import com.tangosol.net.DefaultCacheServer;
import com.tangosol.net.security.Security;
import javax.security.auth.Subject;
import java.security.PrivilegedExceptionAction;
public class SecureCacheServer {
    public static void main(final String[] args) throws Exception {
        LoginContext lc = new LoginContext("Coherence");
        lc.login();      
        Subject subject = lc.getSubject();
        Security.runAs(subject, new PrivilegedExceptionAction() {
            public Object run() throws Exception {
                DefaultCacheServer.main(args);
                return null;
}Then when you start your cache server just use the SecureCacheServer class above rather than DefaultCacheServer
As the main method of DefaultCacheServer is running in a PrivilegedExceptionAction Coherence will use this identity anywhere it needs to do anything secured.
I hope the code above compiles OK as it is a modified version of the code I really use.
Hope this helps
JK