Client authentication and authorization

You can use Operator to configure client authentication and client authorization.

Simple authentication

You can enable Hazelcast simple authentication with minimal changes to the original configuration.

To enable simple authentication:

• Remove security.enabled.

• Convert kebab case to camel case:

  • client-authentication → clientAuthentication
  • client-permissions → clientPermissions

• Add a permissions node to clientPermissions to wrap permissions other than all.

For example:

yaml

apiVersion: hazelcast.com/v1alpha1
kind: Hazelcast
metadata:
  name: hazelcast
spec:
    security:
        operatorClientSecretName: user1-secret
        realms:
          - name: simpleRealm-clients
            authentication:
              simple:
                users:
                - secretName: user1-secret
                  roles:
                    - admin
                - secretName: user2-secret
                  roles:
                    - monitor
                    - application
        clientAuthentication:
          realm: simpleRealm-clients
        clientPermissions:
          all:
            principal: admin
            endpoints:
              - 127.0.0.1
          permissions:
            map:
              - name: playground
                actions:
                  - all
              - name: accounts
                principal: monitor
                actions:
                  - read
              - name: accounts
                principal: application
                endpoints:
                  - 192.168.1.*
                  - 192.168.2.*
                actions:
                  - create
                  - destroy
                  - put
                  - read
                  - remove
                  - lock

note

operatorClientSecretName is mandatory whenever spec.security is configured. Operator uses this Secret to authenticate to the cluster as a client.

For simple authentication, the user in that Secret must also be listed under realms.authentication.simple.users and must have a role that matches clientPermissions.all.principal. Otherwise Operator fails validation.

For JAAS authentication, this field is also required. See Configure JAAS-based authentication.

Configure Management Center

Because Management Center serves as a client of the Hazelcast cluster, it must be properly configured to connect to the cluster. The security.clientSecretName field in the hazelcastClusters section is used for this configuration.

Management Center Simple Authentication Example

yaml

apiVersion: hazelcast.com/v1alpha1
kind: ManagementCenter
metadata:
  name: managementcenter-sample
spec:
  repository: 'hazelcast/management-center'
  version: '5.11.1'
  hazelcastClusters:
    - address: hazelcast-sample
      name: dev
      security:
        clientSecretName: user1-secret

note

The given user in the ClientSecretName field must have a role that has all the client permissions. Otherwise, Operator will fail with a validation error.