How to Secure Apache Ignite cluster?
Apache Ignite is primarily an in-memory distributed caching and data processing framework. In the last article, we discussed how we can handle network segmentation in Apache Ignite. In this article, we will discuss how to secure Apache Ignite cluster using Ignite security plugin.
This article was originally published at https://www.bugdbug.com/post/how-to-secure-apache-ignite-cluster
Authentication and authorization are two important aspects of system security. Since Apache Ignite is a data processing and caching framework, both these aspects become widely important.
Security Risks
If we are working on an Apache Ignite cluster which can dynamically be scaled depending on the load, which is the most common case, we cannot go with non-shared discovery configuration. In such a case, if cluster security is not in place, any unauthenticated node can join the cluster, become part of cluster topology and access the sensitive information. In a static cluster also, any unauthenticated Ignite Client can access the cluster data in the absence of cluster security. Thus, an Apache Ignite cluster in the production environment needs to be secured.
Ignite Security
Apache Ignite provides authentication capabilities but it can only be used when native persistence is enabled. It can be configured by using IgniteConfiguration.setAuthenticationEnabled(boolean).
As we have already discussed in the last article, we can define a custom plugin by following these guidelines. We can secure Apache Ignite cluster using a custom security plugin by implementing GridSecurityProcessor which can be used for authentication and authorization both.
Custom Security Plugin
Now, let’s see how we can define a custom security plugin for Apache Ignite.
- Every plugin must implement PluginConfiguration and register it using IgniteConfiguration.setPluginConfigurations.
2. PluginProvider implementation creates a plugin instance at node startup. As per the documentation, name() and plugin() methods need to be implemented, which return name and plugin instance respectively, other methods can be null.
3. createComponent() creates an instance of GridSecurityProcessorwhich handles authentication and authorization.
The authenticateNode() method is used to authenticate the new node requests while the authorize() method gets called before every action like reading, writing, etc. to check the authorization.
4. Ignite plugins are loaded using ServiceLoader. We need to create a file with org.apache.ignite.plugin.PluginProvider name in the META-INF/services folder with the name of the implementation in it.
5. Apache Ignite finds custom plugins at the startup and initializes them. After the node startup, before sending a join request to the cluster, local node credentials are checked using the localAuthentication(). Also, the coordinator node checks the requested node’s credentials before joining them in.
The tricky part here is to pass SecurityCredentials. One way is to extend TcpDiscoverySpi to pass on security credentials which could be set to the local node through initLocalNode().
This plugin can directly be used by adding it in the classpath and defining SecurityCredentials and passing them through SecurityPluginConfiguration.
Source code for the custom IgniteSecurityPlugin can be found here.
If you like this article, check out similar articles here https://www.bugdbug.com/
Feel free to share your thoughts, comments.
If you find this article helpful, share it with a friend!
#ApacheIgnite #DistributedSystem #SecurityPlugin
This article was originally published at https://www.bugdbug.com/post/how-to-secure-apache-ignite-cluster
