Question

我刚刚在IgniteDB（特定服务器，而不是localhost）中配置了身份验证 https://apacheignite.readme.io/docs/advanced-security

但是，尝试连接时遇到了一些问题。我应该在哪里提供证书？

TcpDiscoverySpi spi = new TcpDiscoverySpi();
TcpDiscoveryVmIpFinder ipFinder = new TcpDiscoveryMulticastIpFinder();
String ipList = appConfig.getIgniteIPAddressList();
List<String> addressList= Arrays.asList(ipList.split(";"));
ipFinder.setAddresses(addressList);
spi.setIpFinder(ipFinder);
IgniteConfiguration cfg = new IgniteConfiguration();
cfg.setIgniteInstanceName("IgnitePod");
cfg.setClientMode(true);
cfg.setDiscoverySpi(spi);
Ignite ignite =  Ignition.start(cfg);

有人有实现的想法吗？

Answer 1

https://apacheignite.readme.io/docs/advanced-security

描述如何仅通过THIN连接（JDBC，ODBC）通过用户名和密码配置身份验证。

您可以使用如下所示的SQL命令创建用户：

https://apacheignite-sql.readme.io/docs/create-user

您可以使用其属性为瘦客户端连接字符串提供凭据：

https://apacheignite-sql.readme.io/docs/connection-string-and-dsn#section-supported-arguments https://apacheignite-sql.readme.io/docs/jdbc-driver#section-additional-connection-string-examples

还请检查是否已配置了Ignite持久性。

Answer 2

Apache Ignite的开源版本不提供此类安全功能。既可以自己实现它，也可以使用商业Gridgain发行版。

以下是实现自定义安全插件的步骤。

需要实现GridSecurityProcessor，该身份将用于验证加入节点。

在GridSecurityProcessor中，您必须按以下方式实现authenticateNode() API

public SecurityContext authenticateNode(ClusterNode node, SecurityCredentials cred) throws IgniteCheckedException {

        SecurityCredentials userSecurityCredentials;

        if (securityPluginConfiguration != null) {
            if ((userSecurityCredentials = securityPluginConfiguration.getSecurityCredentials()) != null) {
                return userSecurityCredentials.equals(cred) ? new SecurityContextImpl() : null;
            }
            if (cred == null && userSecurityCredentials == null) {
                return new SecurityContextImpl();
            }
        }

        if (cred == null)
            return new SecurityContextImpl();

        return null;

    }

此外，您需要扩展TcpDiscoverySpi，以便在initLocalNode()期间传递用户凭据，如下所示：

@Override
    protected void initLocalNode(int srvPort, boolean addExtAddrAttr) {
        try {
            super.initLocalNode(srvPort, addExtAddrAttr);
            this.setSecurityCredentials();
        } catch (Exception e) {
            e.printStackTrace();
        }

    }
private void setSecurityCredentials() {
        if (securityCredentials != null) {

            Map<String,Object> attributes = new HashMap<>(locNode.getAttributes());
            attributes.put(IgniteNodeAttributes.ATTR_SECURITY_CREDENTIALS, securityCredentials);
            this.locNode.setAttributes(attributes);
        }
    }

您可以通过下面的链接获得详细的步骤，可以遵循这些步骤来编写自定义安全性插件及其用法。

https://www.bugdbug.com/post/how-to-secure-apache-ignite-cluster

Answer 3

在原始Apache Ignite中可用的用于对等身份验证服务器节点的唯一选项是SSL +证书。

Answer 4

能够通过创建自己的CustomTCPDiscoveryAPI解决我自己的问题。首先，创建此类：

import org.apache.ignite.IgniteException;
import org.apache.ignite.cluster.ClusterNode;
import org.apache.ignite.internal.IgniteNodeAttributes;
import org.apache.ignite.internal.processors.security.SecurityContext;
import org.apache.ignite.lang.IgniteProductVersion;
import org.apache.ignite.plugin.security.SecurityCredentials;
import org.apache.ignite.spi.discovery.DiscoverySpiNodeAuthenticator;
import org.apache.ignite.spi.discovery.tcp.TcpDiscoverySpi;

import java.util.Map;

public class CustomTcpDiscoverySpi extends TcpDiscoverySpi implements DiscoverySpiNodeAuthenticator {
    SecurityCredentials securityCredentials;
    public CustomTcpDiscoverySpi(final SecurityCredentials securityCredentials) {
        this.securityCredentials = securityCredentials;
        this.setAuthenticator(this);
    }

    @Override
    public SecurityContext authenticateNode(ClusterNode clusterNode, SecurityCredentials securityCredentials) throws IgniteException {
        return null;
    }

    @Override
    public boolean isGlobalNodeAuthentication() {
        return true;
    }

    @Override
    public void setNodeAttributes(final Map<String, Object> attrs, final IgniteProductVersion ver) {
        attrs.put(IgniteNodeAttributes.ATTR_SECURITY_CREDENTIALS, this.securityCredentials);
        super.setNodeAttributes(attrs, ver);
    }
}

然后，按如下所示使用它：

    SecurityCredentials cred = new SecurityCredentials();
    cred.setLogin(appConfig.getIgniteUser());
    cred.setPassword(appConfig.getIgnitePassword());
    CustomTcpDiscoverySpi spi =  new CustomTcpDiscoverySpi(cred);
    //TcpDiscoverySpi spi = new TcpDiscoverySpi(); - > removed to use the CustomTCPDiscovery
    TcpDiscoveryVmIpFinder ipFinder = new TcpDiscoveryMulticastIpFinder();
    String ipList = appConfig.getIgniteIPAddressList();
    List<String> addressList= Arrays.asList(ipList.split(";"));
    ipFinder.setAddresses(addressList);
    spi.setIpFinder(ipFinder);
    IgniteConfiguration cfg = new IgniteConfiguration();
    cfg.setIgniteInstanceName("IgnitePod");
    cfg.setClientMode(true);
    cfg.setAuthenticationEnabled(true);
    // Ignite persistence configuration.
    DataStorageConfiguration storageCfg = new DataStorageConfiguration();
    // Enabling the persistence.
    storageCfg.getDefaultDataRegionConfiguration().setPersistenceEnabled(true);
    // Applying settings.
    // tests
    cfg.setDataStorageConfiguration(storageCfg);
    cfg.setDiscoverySpi(spi);
    Ignite ignite =  Ignition.start(cfg);

希望这可以帮助遇到相同问题的其他人。

在IgniteDB中实施身份验证

4 个答案: