[IGNITE-11346] Remote client authentication failed for the CommandHandler in the case where it optional on the server

• Type: Bug
• Status: Patch Available
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 2.7
• Component/s: clients, security, thin client
• Assignee: Maxim Karavaev
• Reporter: Maxim Karavaev
• Created: 18/Feb/19 13:25
• Updated: 02/Dec/20 11:20

Description

Preposition:

Custom GridSecurityProcessor implementation allows optional authentication. With other words, if some credentials are presents then authentication performed, otherwise - not (some restricted SecurityContext returned).

REST API works fine. If credentials are present or the auth request was made then the auth works as desired, if not - it also works but only for some authorized requests.

The problem:

CommandHandler which is used for controlling a cluster through the CLI script command.sh|bat doesn't respect credential parameters and sends auth request only in case of authentication exception for a regular request. In the described case of optional authentication it never happens, so the result always depends on the "default" Permissions.

Possible solution:

Change GridClientNioTcpConnection to always send first an auth request in case of provided credentials.

Issue Links

• links to: GitHub Pull Request #6528
• links to: Pull requests