Re: [jgroups-users] last v3 -> v4 question: authentication

Use 4.0.8, you may have run into [1]

[1] https://issues.jboss.org/browse/JGRP-2227

On 08/11/17 22:08, Questions/problems related to using JGroups wrote:
> Hi again,
> 
> Everything is working for me now except authentication. With v3, a node 
> would try to join and my token.authenticate() method would be called on 
> the coordinator only. If that returned true, great, if not, the new 
> node's jChannel.connect() method would get an Exception wrapped around a 
> SecurityException.
> 
> Am now trying the same thing with v4, and I see token.authenticate() 
> called on both the coordinator *and* the new node, and I can't find any 
> documentation to say that's now the proper case. In my success case, it 
> returns true for coordinator and false for the new node (because it 
> hasn't joined the cluster yet and doesn't have the info it needs to do 
> this). After a pause I see authenticate() called on the coordinator 
> again 11 times, returning true each time.
> 
> On the new node, it returns false 10 times, forms its own 1-node 
> cluster, then the 2 nodes merge again and this time both accept each 
> other. The authenticate method is still called several times.
> 
> In the negative case -- both nodes return false from authenticate -- I 
> see authenticate() called a bunch again and get two 1-node clusters. 
> After a pause they go through it all again, etc, never stopping. The new 
> node never stops trying to connect.
> 
> Msgs on coordinator:
> 11/8/17 3:58:40 PM org.jgroups.protocols.AUTH handleAuthHeader WARNING: 
> localhost-58518: failed to validate AuthHeader (token: 
> DynamicMembershipToken) from localhost-57655; dropping message and 
> sending rejection message
> 11/8/17 3:58:40 PM <my auth method returns false>
> 
> On new node:
> 11/8/17 3:58:40 PM org.jgroups.protocols.pbcast.ClientGmsImpl 
> joinInternal WARNING: localhost-57655: JOIN(localhost-57655) sent to 
> localhost-58518 timed out (after 3000 ms), on try 6
> 11/8/17 3:58:40 PM <my auth method returns false>
> 11/8/17 3:58:40 PM org.jgroups.protocols.AUTH handleAuthHeader WARNING: 
> localhost-57655: failed to validate AuthHeader (token: 
> DynamicMembershipToken) from localhost-58518; dropping message and 
> sending rejection message
> 
> How can I get back to the original behavior: only the coordinator 
> authenticates, and it only happens once and the new node does not 
> connect to the channel?
> 
> Trying to make this short, but here's my protocol stack:
> 
>          Protocol[] stack = {
>              new TCP()
>                  .setValue("bind_addr", 
> InetAddress.getByName(getBindingAddress()))
>                  .setValue("bind_port", bindingPort)
>                  .setValue("thread_pool_min_threads", 1)
>                  .setValue("thread_pool_keep_alive_time", 5000)
>                  .setValue("send_buf_size", 640000)
>                  .setValue("sock_conn_timeout", 300)
>                  .setValue("recv_buf_size", 5000000),
>              new TCPPING()
>                  .setValue("initial_hosts", parseHostList())
>                  .setValue("send_cache_on_join", true)
>                  .setValue("port_range", 0),
>              new MERGE3()
>                  .setValue("min_interval", 10000)
>                  .setValue("max_interval", 30000),
>              new FD_ALL()
>                  .setValue("timeout", getJGroupsTotalTimeout() * 1000L),
>              new VERIFY_SUSPECT()
>                  .setValue("timeout", 1500),
>              new BARRIER(),
>              new NAKACK2()
>                  .setValue("use_mcast_xmit", false),
>              new UNICAST3(),
>              new STABLE()
>                  .setValue("desired_avg_gossip", 50000)
>                  .setValue("max_bytes", 4000000),
>              createAuthProtocol(<some ob>),
>              new GMS()
>                  .setValue("join_timeout", 3000),
>              new MFC()
>                  .setValue("max_credits", 2000000)
>                  .setValue("min_credits", 800000),
>              new FRAG2(),
>              new STATE_TRANSFER()};
> 
> Auth protocol method:
> 
>      private Protocol createAuthProtocol(<some ob>) throws 
> UnknownHostException {
>          DynamicMembershipToken dmt = new DynamicMembershipToken();
>          dmt.setFixedMembersSeparator(AUTH_SEP);
>          dmt.setMemberList(""); // will be overwritten
> 
>          AUTH auth = new AUTH();
>          auth.setAuthToken(dmt);
>          dmt.setAuth(auth);
>          dmt.setNode(<some ob>);
>          return auth;
>      }
> 
> And DynamicMembershipToken simply extends FixedMembershipToken. When 
> authenticate() is called, it creates the proper list of allowed 
> addresses and does (simplified):
> 
>                  setMemberList(sb.toString()); <-- in superclass
>                  return super.authenticate(token, msg);
> 
> Thanks again,
> Bobby
> 
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> 
> 
> 
> _______________________________________________
> javagroups-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/javagroups-users
> 

-- 
Bela Ban | http://www.jgroups.org


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
javagroups-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/javagroups-users