Package org.apache.cassandra.auth.jmx

Class AuthenticationProxy

java.lang.Object
org.apache.cassandra.auth.jmx.AuthenticationProxy
All Implemented Interfaces:
JMXAuthenticator
public final class AuthenticationProxy extends Object implements JMXAuthenticator
An alternative to the JAAS based implementation of JMXAuthenticator provided by the JDK (JMXPluggableAuthenticator). Authentication is performed via delegation to a LoginModule. The JAAS login config is specified by passing its identifier in a custom system property: cassandra.jmx.remote.login.config The location of the JAAS configuration file containing that config is specified in the standard way, using the java.security.auth.login.config system property. If authentication is successful then a Subject containing one or more Principals is returned. This Subject may then be used during authorization if a JMX authorization is enabled.

  • Constructor Details

    • AuthenticationProxy

      public AuthenticationProxy(String loginConfigName)
      Creates an instance of JMXPluggableAuthenticator and initializes it with a LoginContext.
      Parameters:
      loginConfigName - name of the specifig JAAS login configuration to use when authenticating JMX connections
      Throws:
      SecurityException - if the authentication mechanism cannot be initialized.

  • Method Details

    • authenticate

      public Subject authenticate(Object credentials)
      Perform authentication of the client opening the MBeanServerConnection
      Specified by:
      authenticate in interface JMXAuthenticator
      Parameters:
      credentials - optionally these credentials may be supplied by the JMX user. Out of the box, the JDK's RMIServerImpl is capable of supplying a two element String[], containing username and password. If present, these credentials will be made available to configured LoginModules via JMXCallbackHandler.
      Returns:
      the authenticated subject containing any Principals added by the LoginModules
      Throws:
      SecurityException - if the server cannot authenticate the user with the provided credentials.