Default Security Modul for Hedeby

All network communication in the Hedeby project run on top of SSL socket connections. The security module uses the Java Secure Socket Extension(see [JSSE]).

Each daemon has a keystore. It contains the private key of the daemon. It is created during the installation of a component. It is only accessable for a privileged user. The keystore also contains a certificate which is singed by the certificate authority.

Each component has access to the certificate of the certificate authority. With this certificate it is validated if the component is trusted or not (see javadoc of class com.sun.grid.grm.security.ca.GrmCATrustManager).

In future releases it should be possible to use a other software components for key and certificate management (LDAP, Active Directory, Identify Server). For the current version uses the java keystore implementation.

For authenticating communication partners the Hedeby system uses JAAS. Hedeby it self does not specify how authentication is done. It is in the responsiblity of the security module.

Each Hedeby component provides a JMX interface, they are running in a MBeanServer. Client which want's to manage the component has to provide some credentials to gain access onto the component. The credential are passed through the JMXAuthenticator mechanism to the MBeanServer. The MBeanServer uses Java Authentication and Authorization Service (JAAS) to authenticate the user.

Generally a client has to provide username and password to gain access to a component. If the user has a valid certificate in it's keystore it a password less authentication is also possible.

The authentication itself is delegated to JAAS LoginModules. LoginModules can be stacked. The final LoginModule must be the Hedeby RoleLoginModule which assigns the role to an authenticated user (e.g admin, user). For details about the JAAS system see [JAASRefGuide].

Authorization is performed by the JAAS system base on java permissions. After authenticating a communication partner the JAAS LoginModule adds Principals to the java security Subject. All actions triggered by the communication partner are executed under this security subject. The java system checks if the security subject has permissions to execute critical code.

                        
   administrator {
      com.sun.security.auth.UnixPrincipal name="grm_admin";
  
      com.sun.security.auth.UnixNumericGroupPrincipal name="100";
   };
  
   daemon {
      com.sun.grid.grm.security.GrmDaemonPrincipal regexp=".*";
   };
   
                    

    hedeby_system {
  
     com.sun.grid.grm.security.GrmCATrustManagerLoginModule requisite;
     com.sun.security.auth.module.JndiLoginModule requisite
           user.provider.url="nis://<server>/<nis domain>/user"
           group.provider.url="nis://<nis server>/<nis domain>/system/group";
  
     com.sun.grid.security.login.UnixLoginModule requisite
           sge_root="${com.sun.grid.grm.bootstrap.sgeroot}"
           auth_method="pam" pam_service="su";
     com.sun.grid.grm.security.role.RoleLoginModule required 
          roleFile="${com.sun.grid.grm.bootstrap.shared}/security/roles.config";
    };