Securing the REST data service

Secure multiple aspects of the REST data service. Access to the eXtreme Scale REST data service can be secured through authentication and authorization. Access can also be controlled by service-scoped configuration rules, known as access rules. Transport security is the third consideration.

About this task

Access to the eXtreme Scale REST data service can be secured through authentication and authorization. Authentication and authorization is accomplished by integrating with eXtreme Scale security.

Access can also be controlled by service-scoped configuration rules, known as access rules Two types of access rules exist, service operation rights which control the CRUD operations that are allowed by the service and entity access rights which control the CRUD operations that are allowed for a particular entity type.

Transport security is provided by the hosting container configuration for connections between the web client and the REST service. And transport security is provided by eXtreme Scale client configuration (for REST service to eXtreme Scale data grid connections).

Procedure

  • Control authentication and authorization.

    Access to the eXtreme Scale REST data service can be secured through authentication and authorization. Authentication and authorization are accomplished by integrating with eXtreme Scale security.

    The eXtreme Scale REST data service uses eXtreme Scale security, for authentication and authorization, to control which users can access the service and the operations a user is allowed to perform through the service. The eXtreme Scale REST data service uses either a configured global credential, with user and password, or a credential derived from an HTTP BASIC challenge that is sent with each transaction to the eXtreme Scale data grid where authentication and authorization is performed.

    1. Configure eXtreme Scale client authentication and authorization on the grid
      See Security integration with external providers for details about how to configure eXtreme Scale client authentication and authorization.
    2. Configure the eXtreme Scale client, which is used by the REST service, for security.

      The eXtreme Scale REST data service invokes the eXtreme Scale client library when communicating with the eXtreme Scale grid. Therefore, the eXtreme Scale client must be configured for eXtreme Scale security.

      eXtreme Scale client authentication is enabled via properties in objectgrid client properties file. At a minimum, the following attributes must be enabled when using client security with the REST service:
      securityEnabled=true
credentialAuthentication=Supported [-or-] Required
credentialGeneratorProps=user:pass [-or-] {xor encoded user:pass}
      Remember: The user and password specified in the credentialGeneratorProps property must map to an ID in the authentication registry and have sufficient ObjectGrid policy rights to connect to and create ObjectGrids.

      A sample objectgrid client policy file is located in restservice_home/security/security.ogclient.properties. See also Client properties file.

    3. Configure the eXtreme Scale REST data service for security.

      The eXtreme Scale REST data service configuration properties file needs to contain the following entries to integrate with eXtreme Scale security:

      ogClientPropertyFile=file_name

      The ogClientPropertyFile is the location of the propery file that contains ObjectGrid client properties mentioned in the preceding step. The REST service uses this file to initialize the eXtreme Scale client to talk to the grid when security is enabled.

      loginType=basic [-or-] none

      The loginType property configures the REST service for the login type. If a value of none is specified, the “global” user id and password defined by the credentialGeneratorProps will be sent to the grid for each transaction. If a value of basic is specified, the REST service will present an HTTP BASIC challenge to the client asking for credentials that it will send in each transaction when communicating with the grid.

      For more information about the ogClientPropertyFile and loginType properties, refer to REST data service properties file.

  • Apply access rules.

    Access can also be controlled by service scoped configuration rules, known as access rules Two types of access rules exist, service operation rights which control the CRUD operations that are allowed by the service and entity access rights which control the CRUD operations that are allowed for a particular entity type.

    The eXtreme Scale REST data service optionally allows access rules that can be configured to restrict access to the service and entities in the service. These access rules are specified in the REST service access rights property file. The name of this file is specified in the REST data service properties file by the wxsRestAccessRightsFile property. For more information about this property, see REST data service properties file. This file is a typical Java™ property file with key and value pairs. Two types of access rules exist, service operation rights which control the CRUD operations that are allowed by the service and entity access rights which control the CRUD operations that are allowed for a particular entity type.

    1. Configure service operation rights.

      Service Operations rights specify access rights that apply to all the ObjectGrids exposed via the REST service or to all entities of an individual ObjectGrid as specified.

      Use the following syntax.
      serviceOperationRights=service_operation_right
serviceOperationRights.grid_name -OR- *=service_operation_right
      where
      • serviceOperationRights can be one of the following [NONE, READSINGLE, READMULTIPLE, ALLREAD, ALL]
      • serviceOperationRights.grid_name -OR- * implies that the access right applies to all the ObjectGrids, else name of a specific ObjectGrid can be provided.
      For example:
      serviceOperationsRights=ALL
serviceOperationsRights.*=NONE
serviceOperationsRights.EMPLOYEEGRID=READSINGLE

      The first example specifies that all service operations are allowed for all the ObjectGrids exposed by this REST Service. The second example is similar to the first example as it also applies to all the ObjectGrids exposed by the REST service, however it specifies the access right as NONE, which means none of the service operations are allowed on the ObjectGrids. The last example specifies how to control the service operations for a specific grid, here only Reads which results in a single record are allowed for all entities of the EMPLOYEEGRID.

      The default assumed by the REST service is serviceOperationsRights=ALL which means that all operations are allowed for all the ObjectGrids exposed by this service. This is different from the Microsoft implementation, for which the default is NONE, so no operations are allowed on the REST Service.

      Important: The service operations rights are evaluated in the order they are specified in this file, so the last specified right will override the rights preceding it.
    2. Configure entity access rights.

      Entity set rights specify access rights that apply to specific ObjectGrid entities exposed via the REST service. These rights provide a way to impose tighter and more finer-grained access control on individual ObjectGrid entities than compared to Service Operation rights.

      Use the following syntax.
      entitySetRights.grid_name.entity_name=entity_set_right
      where
      • entity_set_right can be one of the following rights.
        Table 1. Entity access rights. Supported values.
        Access right Description
        NONE Denies all rights to access data
        READSINGLE Allows to read single data items
        READMULTIPLE Allows reading sets of data
        ALLREAD Allows reading single or multiple sets of data
        WRITEAPPEND Allows creating new data items in data sets
        WRITEREPLACE Allows replacing data
        WRITEDELETE Allows deleting data items from data sets
        WRITEMERGE Allows merging data
        ALLWRITE Allows to write (i.e. create, replace, merge or delete) data
        ALL Allows creating, reading, updating, and deleting data
      • entity_name is the name of a specific ObjectGrid within the REST service.
      • grid_name is the name of a specific entity within the specified ObjectGrid.
      Note: If both service operation rights and entity set rights are specified for a respective ObjectGrid and its entities, then the more restrictive of those rights will be enforced, as illustrated in the following examples. Note also that the entity set rights are evaluated in the order they are specified in the file. The last specified right will override the rights preceding it.

      Example 1: If serviceOperationsRights.NorthwindGrid=READSINGLE and entitySetRights.NorthwindGrid.Customer=ALL are specified. READSINGLE will be enforced for the Customer entity.

      Example 2: If serviceOperationsRights.NorthwindGrid=ALLREAD is specified and entitySetRights.NorthwindGrid.Customer=ALLWRITE is specified then only Reads will be allowed for all entities of NorthwindGrid. However for Customer its entity set rights will prevent any Reads (since it specified ALLWRITE) and hence effectively the Customer entity will have access right as NONE.

  • Secure transports.

    Transport security is provided by the hosting container configuration for connections between the web client and REST service. Transport security is provided by the eXtreme Scale client configuration for connections between the REST service and the eXtreme Scale grid.

    1. Secure the connection from the client and REST service.
      Transport security for this connection is provided by the hosting container environment, not in eXtreme Scale.
    2. Secure the connection from the REST service and the eXtreme Scale grid.
      Transport security for this connection is configured in eXtreme Scale. See Transport layer security and secure sockets layer.