[jgroups-users] last v3 -> v4 question: authentication

Hi again,

Everything is working for me now except authentication. With v3, a node
would try to join and my token.authenticate() method would be called on the
coordinator only. If that returned true, great, if not, the new node's
jChannel.connect() method would get an Exception wrapped around a
SecurityException.

Am now trying the same thing with v4, and I see token.authenticate() called
on both the coordinator *and* the new node, and I can't find any
documentation to say that's now the proper case. In my success case, it
returns true for coordinator and false for the new node (because it hasn't
joined the cluster yet and doesn't have the info it needs to do this).
After a pause I see authenticate() called on the coordinator again 11
times, returning true each time.

On the new node, it returns false 10 times, forms its own 1-node cluster,
then the 2 nodes merge again and this time both accept each other. The
authenticate method is still called several times.

In the negative case -- both nodes return false from authenticate -- I see
authenticate() called a bunch again and get two 1-node clusters. After a
pause they go through it all again, etc, never stopping. The new node never
stops trying to connect.

Msgs on coordinator:
11/8/17 3:58:40 PM org.jgroups.protocols.AUTH handleAuthHeader WARNING:
localhost-58518: failed to validate AuthHeader (token:
DynamicMembershipToken) from localhost-57655; dropping message and sending
rejection message
11/8/17 3:58:40 PM <my auth method returns false>

On new node:
11/8/17 3:58:40 PM org.jgroups.protocols.pbcast.ClientGmsImpl joinInternal
WARNING: localhost-57655: JOIN(localhost-57655) sent to localhost-58518
timed out (after 3000 ms), on try 6
11/8/17 3:58:40 PM <my auth method returns false>
11/8/17 3:58:40 PM org.jgroups.protocols.AUTH handleAuthHeader WARNING:
localhost-57655: failed to validate AuthHeader (token:
DynamicMembershipToken) from localhost-58518; dropping message and sending
rejection message

How can I get back to the original behavior: only the coordinator
authenticates, and it only happens once and the new node does not connect
to the channel?

Trying to make this short, but here's my protocol stack:

        Protocol[] stack = {
            new TCP()
                .setValue("bind_addr",
InetAddress.getByName(getBindingAddress()))
                .setValue("bind_port", bindingPort)
                .setValue("thread_pool_min_threads", 1)
                .setValue("thread_pool_keep_alive_time", 5000)
                .setValue("send_buf_size", 640000)
                .setValue("sock_conn_timeout", 300)
                .setValue("recv_buf_size", 5000000),
            new TCPPING()
                .setValue("initial_hosts", parseHostList())
                .setValue("send_cache_on_join", true)
                .setValue("port_range", 0),
            new MERGE3()
                .setValue("min_interval", 10000)
                .setValue("max_interval", 30000),
            new FD_ALL()
                .setValue("timeout", getJGroupsTotalTimeout() * 1000L),
            new VERIFY_SUSPECT()
                .setValue("timeout", 1500),
            new BARRIER(),
            new NAKACK2()
                .setValue("use_mcast_xmit", false),
            new UNICAST3(),
            new STABLE()
                .setValue("desired_avg_gossip", 50000)
                .setValue("max_bytes", 4000000),
            createAuthProtocol(<some ob>),
            new GMS()
                .setValue("join_timeout", 3000),
            new MFC()
                .setValue("max_credits", 2000000)
                .setValue("min_credits", 800000),
            new FRAG2(),
            new STATE_TRANSFER()};

Auth protocol method:

    private Protocol createAuthProtocol(<some ob>) throws
UnknownHostException {
        DynamicMembershipToken dmt = new DynamicMembershipToken();
        dmt.setFixedMembersSeparator(AUTH_SEP);
        dmt.setMemberList(""); // will be overwritten

        AUTH auth = new AUTH();
        auth.setAuthToken(dmt);
        dmt.setAuth(auth);
        dmt.setNode(<some ob>);
        return auth;
    }

And DynamicMembershipToken simply extends FixedMembershipToken. When
authenticate() is called, it creates the proper list of allowed addresses
and does (simplified):

                setMemberList(sb.toString()); <-- in superclass
                return super.authenticate(token, msg);

Thanks again,
Bobby

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
javagroups-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/javagroups-users