This is an automated email from the ASF dual-hosted git repository.
petrov-mg pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ignite.git
The following commit(s) were added to refs/heads/master by this push:
new 862cb4e37b4 IGNITE-28669 Removed usages of legacy security
compatibility properties (#13444)
862cb4e37b4 is described below
commit 862cb4e37b4d0cf86d6ae5d8028eb0eb7ed88298
Author: Mikhail Petrov <[email protected]>
AuthorDate: Mon Aug 10 08:54:31 2026 +0300
IGNITE-28669 Removed usages of legacy security compatibility properties
(#13444)
---
.../org/apache/ignite/IgniteSystemProperties.java | 3 +
.../managers/discovery/GridDiscoveryManager.java | 24 ------
.../processors/security/SecurityUtils.java | 53 ------------
.../security/SecurityBasicPermissionSet.java | 20 +----
.../ignite/spi/discovery/tcp/ServerImpl.java | 21 +----
.../GridDiscoveryManagerAttributesSelfTest.java | 93 ----------------------
6 files changed, 7 insertions(+), 207 deletions(-)
diff --git
a/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java
b/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java
index 965da1fa93b..da5fb38349c 100644
--- a/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java
+++ b/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java
@@ -989,10 +989,13 @@ public final class IgniteSystemProperties extends
IgniteCommonsSystemProperties
* <p>
* Default is {@code false}, which means that service security
permissions will be respected.
* </p>
+ *
+ * @deprecated Has no usage.
*/
@SystemProperty("Enables Ignite to switch to compatibility mode with
versions that " +
"don't support service security permissions. In this case security
permissions will be ignored (if they set)." +
" Default is false, which means that service security permissions will
be respected")
+ @Deprecated
public static final String IGNITE_SECURITY_COMPATIBILITY_MODE =
"IGNITE_SECURITY_COMPATIBILITY_MODE";
/** Ignite cluster name. Defaults to {@link IgniteCluster#id()}. */
diff --git
a/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java
b/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java
index 5c09f3660f2..74af20d016c 100644
---
a/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java
+++
b/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java
@@ -151,7 +151,6 @@ import static java.util.concurrent.TimeUnit.MILLISECONDS;
import static
org.apache.ignite.IgniteSystemProperties.IGNITE_BINARY_MARSHALLER_USE_STRING_SERIALIZATION_VER_2;
import static
org.apache.ignite.IgniteSystemProperties.IGNITE_DISCOVERY_HISTORY_SIZE;
import static
org.apache.ignite.IgniteSystemProperties.IGNITE_OPTIMIZED_MARSHALLER_USE_DEFAULT_SUID;
-import static
org.apache.ignite.IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE;
import static org.apache.ignite.IgniteSystemProperties.getInteger;
import static org.apache.ignite.cluster.ClusterState.ACTIVE;
import static org.apache.ignite.cluster.ClusterState.INACTIVE;
@@ -172,13 +171,11 @@ import static
org.apache.ignite.internal.IgniteNodeAttributes.ATTR_MARSHALLER_US
import static
org.apache.ignite.internal.IgniteNodeAttributes.ATTR_MARSHALLER_USE_DFLT_SUID;
import static
org.apache.ignite.internal.IgniteNodeAttributes.ATTR_OFFHEAP_SIZE;
import static
org.apache.ignite.internal.IgniteNodeAttributes.ATTR_PEER_CLASSLOADING;
-import static
org.apache.ignite.internal.IgniteNodeAttributes.ATTR_SECURITY_COMPATIBILITY_MODE;
import static
org.apache.ignite.internal.IgniteNodeAttributes.ATTR_SHUTDOWN_POLICY;
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_USER_NAME;
import static org.apache.ignite.internal.IgniteVersionUtils.VER;
import static
org.apache.ignite.internal.events.DiscoveryCustomEvent.EVT_DISCOVERY_CUSTOM_EVT;
import static
org.apache.ignite.internal.processors.metric.impl.MetricUtils.metricName;
-import static
org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode;
import static
org.apache.ignite.internal.processors.security.SecurityUtils.nodeSecurityContext;
import static org.apache.ignite.internal.util.lang.ClusterNodeFunc.eqNodes;
import static
org.apache.ignite.internal.util.lang.ClusterNodeFunc.nodeConsistentIds;
@@ -508,9 +505,6 @@ public class GridDiscoveryManager extends
GridManagerAdapter<DiscoverySpi> {
spi.setMetricsProvider(createMetricsProvider());
if (ctx.security().enabled()) {
- if (isSecurityCompatibilityMode())
- ctx.addNodeAttribute(ATTR_SECURITY_COMPATIBILITY_MODE, true);
-
spi.setAuthenticator(new DiscoverySpiNodeAuthenticator() {
@Override public SecurityContext authenticateNode(ClusterNode
node, SecurityCredentials cred) {
try {
@@ -1246,8 +1240,6 @@ public class GridDiscoveryManager extends
GridManagerAdapter<DiscoverySpi> {
boolean locDelayAssign =
locNode.attribute(ATTR_LATE_AFFINITY_ASSIGNMENT);
- Boolean locSecurityCompatibilityEnabled =
locNode.attribute(ATTR_SECURITY_COMPATIBILITY_MODE);
-
WALMode locWalMode = nodeWalMode(locNode);
for (ClusterNode n : nodes) {
@@ -1339,22 +1331,6 @@ public class GridDiscoveryManager extends
GridManagerAdapter<DiscoverySpi> {
", rmtAddrs=" + U.addressesAsString(n) + ", rmtNode=" +
U.toShortString(n) + "]");
}
- if (ctx.security().enabled()) {
- Boolean rmtSecurityCompatibilityEnabled =
n.attribute(ATTR_SECURITY_COMPATIBILITY_MODE);
-
- if (!Objects.equals(locSecurityCompatibilityEnabled,
rmtSecurityCompatibilityEnabled)) {
- throw new IgniteCheckedException("Local node's " +
IGNITE_SECURITY_COMPATIBILITY_MODE +
- " property value differs from remote node's value " +
- "(to make sure all nodes in topology have identical
Ignite security compatibility mode enabled, " +
- "configure system property explicitly) " +
- "[locSecurityCompatibilityEnabled=" +
locSecurityCompatibilityEnabled +
- ", rmtSecurityCompatibilityEnabled=" +
rmtSecurityCompatibilityEnabled +
- ", locNodeAddrs=" + U.addressesAsString(locNode) +
- ", rmtNodeAddrs=" + U.addressesAsString(n) +
- ", locNodeId=" + locNode.id() + ", rmtNode=" +
U.toShortString(n) + "]");
- }
- }
-
WALMode rmtWalMode = nodeWalMode(n);
if (locWalMode != null && rmtWalMode != null && locWalMode !=
rmtWalMode) {
diff --git
a/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java
b/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java
index a8aa2f64c82..e83a1cda5da 100644
---
a/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java
+++
b/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java
@@ -39,7 +39,6 @@ import java.util.concurrent.Callable;
import java.util.stream.Collectors;
import org.apache.ignite.IgniteCheckedException;
import org.apache.ignite.IgniteException;
-import org.apache.ignite.IgniteSystemProperties;
import org.apache.ignite.cluster.ClusterNode;
import org.apache.ignite.internal.GridKernalContext;
import org.apache.ignite.internal.IgniteInternalWrapper;
@@ -75,16 +74,6 @@ public class SecurityUtils {
/** Ignite internal package. */
public static final String IGNITE_INTERNAL_PACKAGE =
"org.apache.ignite.internal";
- /** Default serialization version. */
- private static final int DFLT_SERIALIZE_VERSION =
isSecurityCompatibilityMode() ? 1 : 2;
-
- /** Current serialization version. */
- private static final ThreadLocal<Integer> SERIALIZE_VERSION = new
ThreadLocal<Integer>() {
- @Override protected Integer initialValue() {
- return DFLT_SERIALIZE_VERSION;
- }
- };
-
/** Permissions that contain {@code AllPermission}. */
public static final Permissions ALL_PERMISSIONS;
@@ -101,48 +90,6 @@ public class SecurityUtils {
private SecurityUtils() {
}
- /**
- * @return Security compatibility mode flag.
- */
- public static boolean isSecurityCompatibilityMode() {
- return
IgniteSystemProperties.getBoolean(IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE,
false);
- }
-
- /**
- * @param ver Serialize version.
- */
- public static void serializeVersion(int ver) {
- SERIALIZE_VERSION.set(ver);
- }
-
- /**
- * @return Serialize version.
- */
- public static int serializeVersion() {
- return SERIALIZE_VERSION.get();
- }
-
- /**
- * Sets default serialize version {@link #DFLT_SERIALIZE_VERSION}.
- */
- public static void restoreDefaultSerializeVersion() {
- serializeVersion(DFLT_SERIALIZE_VERSION);
- }
-
- /**
- * @return Allow all service permissions.
- */
- public static Map<String, EnumSet<SecurityPermission>>
compatibleServicePermissions() {
- Map<String, EnumSet<SecurityPermission>> srvcPerms = new HashMap<>();
-
- srvcPerms.put("*", EnumSet.of(
- SecurityPermission.SERVICE_CANCEL,
- SecurityPermission.SERVICE_DEPLOY,
- SecurityPermission.SERVICE_INVOKE));
-
- return srvcPerms;
- }
-
/** */
public static Map<String, EnumSet<SecurityPermission>>
normalizeResourcePermissions(
Map<String, ? extends Collection<SecurityPermission>> rsrcPerms
diff --git
a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java
b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java
index 627cd5a2250..3736f88bd2b 100644
---
a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java
+++
b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java
@@ -22,7 +22,6 @@ import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamField;
import java.util.Collection;
-import java.util.Collections;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.Map;
@@ -34,10 +33,7 @@ import org.apache.ignite.internal.util.typedef.internal.S;
import org.apache.ignite.internal.util.typedef.internal.U;
import org.jetbrains.annotations.Nullable;
-import static
org.apache.ignite.internal.processors.security.SecurityUtils.compatibleServicePermissions;
-import static
org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode;
import static
org.apache.ignite.internal.processors.security.SecurityUtils.normalizeResourcePermissions;
-import static
org.apache.ignite.internal.processors.security.SecurityUtils.serializeVersion;
import static
org.apache.ignite.internal.processors.security.SecurityUtils.toEnumSet;
/**
@@ -69,9 +65,7 @@ public class SecurityBasicPermissionSet implements
SecurityPermissionSet {
/** Service permissions. */
@GridToStringInclude
@Order(2)
- transient Map<String, EnumSet<SecurityPermission>> srvcPermissions =
isSecurityCompatibilityMode()
- ? compatibleServicePermissions()
- : new HashMap<>();
+ transient Map<String, EnumSet<SecurityPermission>> srvcPermissions = new
HashMap<>();
/** System permissions. */
@GridToStringInclude
@@ -192,8 +186,7 @@ public class SecurityBasicPermissionSet implements
SecurityPermissionSet {
out.writeFields();
- if (serializeVersion() >= 2)
- U.writeMap(out, srvcPermissions);
+ U.writeMap(out, srvcPermissions);
}
/** */
@@ -209,14 +202,7 @@ public class SecurityBasicPermissionSet implements
SecurityPermissionSet {
sysPermissions = sysPerms == null ? null : toEnumSet(sysPerms);
- Map<String, ? extends Collection<SecurityPermission>> srvcPerms =
serializeVersion() >= 2 ? U.readMap(in) : null;
-
- if (srvcPerms == null) {
- // Allow all for compatibility mode
- srvcPerms = serializeVersion() < 2 ?
compatibleServicePermissions() : Collections.emptyMap();
- }
-
- srvcPermissions = normalizeResourcePermissions(srvcPerms);
+ srvcPermissions = normalizeResourcePermissions(U.readMap(in));
}
/** {@inheritDoc} */
diff --git
a/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java
b/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java
index 1d70baed0aa..c17346d10e7 100644
---
a/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java
+++
b/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java
@@ -89,7 +89,6 @@ import
org.apache.ignite.internal.processors.failure.FailureProcessor;
import org.apache.ignite.internal.processors.metric.MetricRegistryImpl;
import org.apache.ignite.internal.processors.metric.impl.MaxValueMetric;
import org.apache.ignite.internal.processors.security.SecurityContext;
-import org.apache.ignite.internal.processors.security.SecurityUtils;
import org.apache.ignite.internal.thread.context.Scope;
import org.apache.ignite.internal.thread.pool.IgniteThreadPoolExecutor;
import org.apache.ignite.internal.util.GridBoundedLinkedHashSet;
@@ -1333,16 +1332,7 @@ class ServerImpl extends TcpDiscoveryImpl {
try {
IgniteSpiOperationTimeoutHelper timeoutHelper = new
IgniteSpiOperationTimeoutHelper(spi, true);
- Integer res;
-
- try {
- SecurityUtils.serializeVersion(1);
-
- res = sendMessageDirectly(joinMsg, addr,
timeoutHelper);
- }
- finally {
- SecurityUtils.restoreDefaultSerializeVersion();
- }
+ Integer res = sendMessageDirectly(joinMsg, addr,
timeoutHelper);
assert res != null;
@@ -3662,8 +3652,6 @@ class ServerImpl extends TcpDiscoveryImpl {
prepareNodeAddedMessage(msg, next.id(),
pendingMsgs.msgs);
try {
- SecurityUtils.serializeVersion(1);
-
long tsNanos = System.nanoTime();
if (timeoutHelper == null)
@@ -3706,8 +3694,6 @@ class ServerImpl extends TcpDiscoveryImpl {
}
}
finally {
- SecurityUtils.restoreDefaultSerializeVersion();
-
clearNodeAddedMessage(msg);
}
@@ -6827,8 +6813,6 @@ class ServerImpl extends TcpDiscoveryImpl {
while (!isInterrupted()) {
try {
- SecurityUtils.serializeVersion(1);
-
// Use inifinite timeout for accepting new messages.
TcpDiscoveryAbstractMessage msg = spi.readMessage(ses,
0);
@@ -7121,9 +7105,6 @@ class ServerImpl extends TcpDiscoveryImpl {
return;
}
- finally {
- SecurityUtils.restoreDefaultSerializeVersion();
- }
}
}
catch (UnknownMessageException e) {
diff --git
a/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java
b/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java
index a89a8dfb11f..21e4b555482 100644
---
a/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java
+++
b/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java
@@ -23,13 +23,11 @@ import org.apache.ignite.configuration.DeploymentMode;
import org.apache.ignite.configuration.IgniteConfiguration;
import org.apache.ignite.internal.IgniteEx;
import org.apache.ignite.marshaller.Marshallers;
-import org.apache.ignite.spi.discovery.TestReconnectSecurityPluginProvider;
import org.apache.ignite.testframework.junits.common.GridCommonAbstractTest;
import org.junit.Test;
import static
org.apache.ignite.IgniteSystemProperties.IGNITE_BINARY_MARSHALLER_USE_STRING_SERIALIZATION_VER_2;
import static
org.apache.ignite.IgniteSystemProperties.IGNITE_OPTIMIZED_MARSHALLER_USE_DEFAULT_SUID;
-import static
org.apache.ignite.IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE;
import static org.apache.ignite.configuration.DeploymentMode.CONTINUOUS;
import static org.apache.ignite.configuration.DeploymentMode.SHARED;
@@ -46,9 +44,6 @@ public class GridDiscoveryManagerAttributesSelfTest extends
GridCommonAbstractTe
/** */
private static boolean p2pEnabled;
- /** Security enabled. */
- private static boolean secEnabled;
-
/** {@inheritDoc} */
@Override protected IgniteConfiguration getConfiguration(String
igniteInstanceName) throws Exception {
IgniteConfiguration cfg = super.getConfiguration(igniteInstanceName);
@@ -57,9 +52,6 @@ public class GridDiscoveryManagerAttributesSelfTest extends
GridCommonAbstractTe
cfg.setDeploymentMode(mode);
cfg.setPeerClassLoadingEnabled(p2pEnabled);
- if (secEnabled)
- cfg.setPluginProviders(new TestReconnectSecurityPluginProvider());
-
return cfg;
}
@@ -230,91 +222,6 @@ public class GridDiscoveryManagerAttributesSelfTest
extends GridCommonAbstractTe
}
}
- /**
- * @throws Exception If failed.
- */
- @Test
- public void testSecurityCompatibilityEnabled() throws Exception {
- secEnabled = true;
-
- try {
- doTestSecurityCompatibilityEnabled(true, null, true);
- doTestSecurityCompatibilityEnabled(true, false, true);
- doTestSecurityCompatibilityEnabled(false, true, true);
- doTestSecurityCompatibilityEnabled(null, true, true);
-
- doTestSecurityCompatibilityEnabled(null, null, false);
- doTestSecurityCompatibilityEnabled(null, false, false);
- doTestSecurityCompatibilityEnabled(false, false, false);
- doTestSecurityCompatibilityEnabled(false, null, false);
- doTestSecurityCompatibilityEnabled(true, true, false);
- }
- finally {
- secEnabled = false;
- }
- }
-
- /**
- * @param first Service compatibility enabled flag for first node.
- * @param second Service compatibility enabled flag for second node.
- * @param fail Fail flag.
- * @throws Exception If failed.
- */
- private void doTestSecurityCompatibilityEnabled(Object first, Object
second, boolean fail) throws Exception {
- doTestCompatibilityEnabled(IGNITE_SECURITY_COMPATIBILITY_MODE, first,
second, fail);
- }
-
- /**
- * @param prop System property.
- * @param first Service compatibility enabled flag for first node.
- * @param second Service compatibility enabled flag for second node.
- * @param fail Fail flag.
- * @throws Exception If failed.
- */
- private void doTestCompatibilityEnabled(String prop, Object first, Object
second, boolean fail) throws Exception {
- String backup = System.getProperty(prop);
- try {
- if (first != null)
- System.setProperty(prop, String.valueOf(first));
- else
- System.clearProperty(prop);
-
- IgniteEx ignite = startGrid(0);
-
- checkIsClientFlag(ignite);
-
- // Ignore if disabled security plugin used.
- if (IGNITE_SECURITY_COMPATIBILITY_MODE.equals(prop) &&
!ignite.context().security().enabled())
- return;
-
- if (second != null)
- System.setProperty(prop, String.valueOf(second));
- else
- System.clearProperty(prop);
-
- try {
- IgniteEx g = startClientGrid(1);
-
- checkIsClientFlag(g);
-
- if (fail)
- fail("Node must not join");
- }
- catch (Exception e) {
- if (!fail)
- fail("Node must join: " + e.getMessage());
- }
- }
- finally {
- stopAllGrids();
-
- if (backup != null)
- System.setProperty(prop, backup);
- else
- System.clearProperty(prop);
- }
- }
-
/**
* @throws Exception If failed.
*/
