Client Authentication and Authorization

Use the Hazelcast Platform Operator to configure Client Authentication and Client Authorization.

Simple Authentication

You can easily use Hazelcast Simple Authentication by making minimal changes in the original configuration.

For example:

yaml

security:
  enabled: true
  realms:
    - name: simpleRealm-clients
      authentication:
        simple:
          users:
          - secretName: user1-secret
            roles:
              - admin
          - secretName: user2-secret
            roles:
              - monitor
              - application
  client-authentication:
    realm: simpleRealm-clients
  client-permissions:
    all:
      principal: admin
      endpoints:
        - 127.0.0.1
    map:
      - name: playground
        actions:
          - all
      - name: accounts
        principal: monitor
        actions:
          - read
      - name: accounts
        principal: application
        endpoints:
          - 192.168.1.*
          - 192.168.2.*
        actions:
          - create
          - destroy
          - put
          - read
          - remove
          - lock

This can be converted as:

yaml

apiVersion: hazelcast.com/v1alpha1
kind: Hazelcast
metadata:
  name: hazelcast
spec:
    security:
        operatorClientSecretName: user1-secret
        realms:
          - name: simpleRealm-clients
            authentication:
              simple:
                users:
                - secretName: user1-secret
                  roles:
                    - admin
                - secretName: user2-secret
                  roles:
                    - monitor
                    - application
        clientAuthentication:
          realm: simpleRealm-clients
        clientPermissions:
          all:
            principal: admin
            endpoints:
              - 127.0.0.1
          permissions:
            map:
              - name: playground
                actions:
                  - all
              - name: accounts
                principal: monitor
                actions:
                  - read
              - name: accounts
                principal: application
                endpoints:
                  - 192.168.1.*
                  - 192.168.2.*
                actions:
                  - create
                  - destroy
                  - put
                  - read
                  - remove
                  - lock

Required Changes:

• security.enabled should be removed.

• convert kebab cases to camel cases:

  • client-authentication → clientAuthentication
  • client-permissions → clientPermissions

• add permissions node to clientPermissions to wrap permissions other than all.

note

operatorClientSecretName is mandatory whenever spec.security is configured. Operator uses this Secret to authenticate to the cluster as a client.

For simple authentication, the user in that Secret must also be listed under realms.authentication.simple.users and must have a role that matches clientPermissions.all.principal. Otherwise Operator fails validation.

Management Center Configuration

As the Management Center serves as a client of the Hazelcast cluster, it must be properly configured to connect to the cluster. The security.clientSecretName field in the hazelcastClusters section is utilized for this configuration.

Management Center Simple Authentication Example

yaml

apiVersion: hazelcast.com/v1alpha1
kind: ManagementCenter
metadata:
  name: managementcenter-sample
spec:
  repository: 'hazelcast/management-center'
  version: '5.9.0'
  hazelcastClusters:
    - address: hazelcast-sample
      name: dev
      security:
        clientSecretName: user1-secret

note

The given user in the clientSecretName field have a role that has all the client permissions.