Security at the Data Source Level

In some use cases, the user might need to pass-in different credentials to their data sources based on the logged in user rather than using the shared credentials for all the logged users. To support this feature, WildFly and Teiid provide multiple different login modules to be used in conjunction with Teiid’s main security domain. See this document for details on configuration. Note that the below directions need to be used in conjunction with this document.

CallerIdentity

If client wants to pass in simple text password or a certificate or a custom serialized object as token credential to the data source, user can configure "CallerIdentity" login module. Using this login module, user can pass-in same credential that user logged into Teiid security domain to the data source. Here is a sample configuration:

standalone-teiid.xml
<subsystem xmlns="urn:jboss:domain:security:1.1">
    <security-domains>
        <security-domain name="my-security-domain">
            <authentication>
                <login-module code="RealmDirect" flag="required">
                    <module-option name="password-stacking" value="useFirstPass"/>
                </login-module>

                <login-module code="org.picketbox.datasource.security.CallerIdentityLoginModule" flag="required">
                    <module-option name="password-stacking" value="useFirstPass"/>
                </login-module>

            </authentication>
        </security-domain>
    </security-domains>
</subsystem>
Note
 "applicability" - CallerIdentity Login module is only applicable when logged in subject contains the text based credentials, where this login module retrieves and uses the username and password for the data source authentication purposes. When working with non character based passwords use Passthough Identity defined below.

In the datasource configuration, instead of supplying the userid/pasword you need to add the following element

In JDBC Datasource
<datasource jndi-name="java:/mysql-ds" pool-name="mysql-ds" enabled="true">
    <connection-url>jdbc:mysql://localhost:3306/txns</connection-url>
    <driver>mysql</driver>
     <pool><allow-multiple-users/></pool>
     <security>
          <security-domain>my-security-domain</security-domain>
     </security>
</datasource>
Note
 This security domain only should be used as data source security domains, not as generic purpose security domain.
In a connection factory ex:ldap
        <resource-adapter>
            <archive>teiid-connector-ldap.rar</archive>
            <transaction-support>NoTransaction</transaction-support>
            <connection-definitions>
                <connection-definition class-name="org.teiid.resource.adapter.ldap.LDAPManagedConnectionFactory"
                        jndi-name="java:/ldapDS"
                        enabled="true"
                        use-java-context="true"
                        pool-name="ldap-ds">

                  <config-property name="LdapUrl">ldap://ldapServer:389</config-property>
                  <config-property name="LdapAdminUserDN">cn=???,ou=???,dc=???</config-property>
                  <config-property name="LdapAdminUserPassword">pass</config-property>
                  <config-property name="LdapTxnTimeoutInMillis">-1</config-property>

                  <security>
                     <security-domain>my-security-domain</security-domain>
                 </security>
                </connection-definition>
            </connection-definitions>
        </resource-adapter>

In the above configuration example, in the primary login module “UsersRoles” is setup to hold the passwords in the file, and when user logs in with password, the same userid and password will be also set on the logged in Subject after authentication. These credentials can be extracted by the data source by asking for Subject’s private credentials.

Please note that encoding and decoding of this object is strictly up to the user as WildFly and Teiid will only act as a carrier of the information from login module to connection factory. Using this CallerIdentity module, the connection pool for data source is segmented by Subject.

Pass Through Identity

This one is similar to Caller Identity login module, where the calling user’s credentials and roles are passed as is. This is especially useful when dealing with non-text based credentials where you want to pass down the payload as is. The example is when kerberos login is used the logged in subject contains GSSCredential object that contains the GSS token.

standalone-teiid.xml
<subsystem xmlns="urn:jboss:domain:security:1.1">
    <security-domains>
        <security-domain name="passthrough-security">
            <authentication>
                <login-module code="org.teiid.jboss.PassthroughIdentityLoginModule" flag="required" module="org.jboss.teiid">
                    <module-option name="username" value="guest"/>
                    <module-option name="password" value="guest"/>
                </login-module>
            </authentication>
        </security-domain>
    </security-domains>
</subsystem>

In the datasource configuration, instead of supplying the userid/pasword you need to add the following element

In JDBC Datasource
<datasource jndi-name="java:/mysql-ds" pool-name="mysql-ds" enabled="true">
    <connection-url>jdbc:mysql://localhost:3306/txns</connection-url>
    <driver>mysql</driver>
     <pool><allow-multiple-users/></pool>
     <security>
          <security-domain>passthrough-security</security-domain>
     </security>
</datasource>
Note
 This security domain only should be used as data source security domains in pass-through scenarios, not as generic purpose security domain.
Tip
 When working with Kerberos/GSS security token (GssCredential), some JDBC drivers (MS-SQLServer) upon close of the connection they invalidate the GssCredential security token, to avoid accidental invalidation, add an option to above security-domain’s login-module configuration to wrap the passed in security token by adding below configuration 
<module-option name="wrapGSSCredential" value="true"/>

Translator Customization

Teiid’s extensible Translator framework also provides hooks for securing access at the DataSource level. The ExecutionFactory.getConnection may be overridden to initialize the source connection in any number of ways, such as re-authentication, based upon the Teiid Subject, execution payload, session variables, and any of the other relevant information accessible via the ExecutionContext and the CommandContext. You may even also modify the generated source SQL in any way that is seen fit in the relevant Execution.

results matching ""

    No results matching ""