Hi,
It's correct that SecurityContext is null in your case:
SecurityContext subj = spi.nodeAuth.authenticateNode(node, cred);
if (subj == null) {
// Node has not pass authentication.
LT.warn(log, "Authentication failed [nodeId=" + node.id() +
", addrs=" + U.addressesAsString(node) + ']');
This subject should be returned from security processor (here spi is
DiscoverySPI):
spi.setAuthenticator(new DiscoverySpiNodeAuthenticator() {
@Override public SecurityContext
authenticateNode(ClusterNode node, SecurityCredentials cred) {
try {
return ctx.security().authenticateNode(node, cred);
}
catch (IgniteCheckedException e) {
throw U.convertException(e);
}
}
@Override public boolean isGlobalNodeAuthentication() {
return ctx.security().isGlobalNodeAuthentication();
}
});
From ctx.security().authenticateNode(node, cred); method.
But there is no security processor by default in Ignite. However, looks
like you should re-implement your DiscoverySPI and setAuthenticator method:
https://ignite.apache.org/releases/latest/javadoc/org/apache/ignite/spi/discovery/DiscoverySpi.html#setAuthenticator-org.apache.ignite.spi.discovery.DiscoverySpiNodeAuthenticator-
BR,
Andei
11/6/2019 1:26 PM, Sankar Ramiah пишет:
I have implemented custom authentication and authorization through a
plugin.
/public class MyPlugin implements GridSecurityProcessor, IgnitePlugin {/
Implemented authenticateNode method which bypasses authentication for
server nodes and returns a security context instance. validateNode is
returning null always. When I start the second server node,
authenticateNode is being invoked and it goes through code which
bypasses authentication but the startup fails after that with
Authentication Failed error. validateNode doesn't seem to be invoked.
ERROR: org.apache.ignite.internal.IgniteKernal - Got exception while
starting (will rollback startup routine).
org.apache.ignite.IgniteCheckedException: Failed to start manager:
GridManagerAdapter [enabled=true,
name=org.apache.ignite.internal.managers.discovery.GridDiscoveryManager]
at
org.apache.ignite.internal.IgniteKernal.startManager(IgniteKernal.java:1687)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.internal.IgniteKernal.start(IgniteKernal.java:1066)
[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.internal.IgnitionEx$IgniteNamedInstance.start0(IgnitionEx.java:2038)
[ignite-core-2.7.0.jar!/:2.7.0] Caused by:
org.apache.ignite.IgniteCheckedException: Failed to start SPI:
TcpDiscoverySpi [addrRslvr=null, sockTimeout=5000, ackTimeout=5000,
marsh=JdkMarshaller
[clsFilter=org.apache.ignite.marshaller.MarshallerUtils$1@5b51df3f],
reconCnt=10, reconDelay=2000, maxAckTimeout=600000,
forceSrvMode=false, clientReconnectDisabled=false, internalLsnr=null]
at
org.apache.ignite.internal.managers.GridManagerAdapter.startSpi(GridManagerAdapter.java:300)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.internal.managers.discovery.GridDiscoveryManager.start(GridDiscoveryManager.java:939)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.internal.IgniteKernal.startManager(IgniteKernal.java:1682)
~[ignite-core-2.7.0.jar!/:2.7.0] ... 66 more Caused by:
org.apache.ignite.spi.IgniteSpiException: Authentication failed
[nodeId=e3ab993e-0acf-4e55-86a7-473989e0fdca, addr=0.0.0.0] at
org.apache.ignite.spi.discovery.tcp.TcpDiscoverySpi.authenticationFailedError(TcpDiscoverySpi.java:1935)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.spi.discovery.tcp.ServerImpl.joinTopology(ServerImpl.java:967)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.spi.discovery.tcp.ServerImpl.spiStart(ServerImpl.java:391)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.spi.discovery.tcp.TcpDiscoverySpi.spiStart(TcpDiscoverySpi.java:2020)
~[ignite-core-2.7.0.jar!/:2.7.0] at
org.apache.ignite.internal.managers.GridManagerAdapter.startSpi(GridManagerAdapter.java:297)
~[ignite-core-2.7.0.jar!/:2.7.0]
I have spent quiet sometime with this error. The first node starts
without any issues. Multiple server start fine without the security
plugin in place. Any help in this regard would be highly appreciated.
Thanks.
------------------------------------------------------------------------
Sent from the Apache Ignite Users mailing list archive
<http://apache-ignite-users.70518.x6.nabble.com/> at Nabble.com.
