+ * This test demonstrates that in a P2P cache configuration (where all members are peers, no + * client/server distinction), Approach 3 works correctly: + *
+ * Key Difference from Client/Server: In P2P topology, all members are equal peers + * that communicate directly. Each peer presents a server certificate for TLS encryption, but + * authentication happens at the application layer using credentials validated by SecurityManager. + * + *
+ * This approach solves the public CA clientAuth EKU sunset problem for P2P topologies by: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies that the cluster supports heterogeneous peer credentials as long as all have + * CLUSTER:MANAGE permission. This demonstrates flexibility in credential management where + * different services/teams can use different credentials. + */ + @Test + public void testMultiplePeersWithDifferentCredentials() throws Exception { + CertStores clusterStores = fixture.createClusterStores(); + + // Start locator with "cluster" credentials + Properties locatorProps = clusterStores.propertiesWith("all", false, false); + fixture.addSecurityManagerConfig(locatorProps); + fixture.addPeerAuthProperties(locatorProps, "cluster", "cluster"); + MemberVM locator = cluster.startLocatorVM(0, locatorProps); + int locatorPort = locator.getPort(); + + // Start server1 with "clusterManage" credentials + // SimpleSecurityManager grants CLUSTER:MANAGE to "cluster" and "clusterManage" users + Properties server1Props = clusterStores.propertiesWith("all", false, false); + fixture.addSecurityManagerConfig(server1Props); + fixture.addPeerAuthProperties(server1Props, "clusterManage", "clusterManage"); + MemberVM server1 = cluster.startServerVM(1, server1Props, locatorPort); + + // Start server2 with "cluster" credentials (same as locator) + Properties server2Props = clusterStores.propertiesWith("all", false, false); + fixture.addSecurityManagerConfig(server2Props); + fixture.addPeerAuthProperties(server2Props, "cluster", "cluster"); + MemberVM server2 = cluster.startServerVM(2, server2Props, locatorPort); + + // Verify all peers joined successfully + server1.invoke(() -> { + assertThat(ClusterStartupRule.getCache().getDistributedSystem().getAllOtherMembers()) + .hasSize(2); // locator + server2 + }); + + server2.invoke(() -> { + assertThat(ClusterStartupRule.getCache().getDistributedSystem().getAllOtherMembers()) + .hasSize(2); // locator + server1 + }); + } +} diff --git a/geode-core/src/distributedTest/java/org/apache/geode/cache/ssl/ServerOnlyTLSWithAuthDUnitTest.java b/geode-core/src/distributedTest/java/org/apache/geode/cache/ssl/ServerOnlyTLSWithAuthDUnitTest.java new file mode 100644 index 000000000000..04305b0a0f32 --- /dev/null +++ b/geode-core/src/distributedTest/java/org/apache/geode/cache/ssl/ServerOnlyTLSWithAuthDUnitTest.java @@ -0,0 +1,513 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for additional information regarding + * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance with the License. You may obtain a + * copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License + * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express + * or implied. See the License for the specific language governing permissions and limitations under + * the License. + */ +package org.apache.geode.cache.ssl; + +import static org.assertj.core.api.Assertions.assertThat; + +import java.util.ArrayList; +import java.util.List; +import java.util.Properties; +import java.util.concurrent.CountDownLatch; +import java.util.concurrent.ExecutorService; +import java.util.concurrent.Executors; +import java.util.concurrent.Future; +import java.util.concurrent.TimeUnit; + +import org.junit.Before; +import org.junit.Rule; +import org.junit.Test; +import org.junit.experimental.categories.Category; + +import org.apache.geode.cache.Region; +import org.apache.geode.cache.RegionShortcut; +import org.apache.geode.cache.client.ClientCache; +import org.apache.geode.cache.client.ClientCacheFactory; +import org.apache.geode.cache.client.ClientRegionShortcut; +import org.apache.geode.examples.SimpleSecurityManager; +import org.apache.geode.test.dunit.IgnoredException; +import org.apache.geode.test.dunit.rules.ClientVM; +import org.apache.geode.test.dunit.rules.ClusterStartupRule; +import org.apache.geode.test.dunit.rules.MemberVM; +import org.apache.geode.test.junit.categories.SecurityTest; +import org.apache.geode.test.junit.rules.ServerOnlyTLSTestFixture; + +/** + * Distributed tests for Server-only TLS with Alternative Client Authentication. + * + *
+ * These tests verify that: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * These tests verify that security violations are properly detected and rejected: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * Verifies: + *
+ * This fixture creates: + *
+ * Key characteristics: + *
+ * Server truststore contains the CA certificate to verify peer connections. + *
+ * Server keystore contains the server's certificate for presentation to clients. + * + * @return CertStores configured for server with server certificate + */ + public CertStores createServerStores() { + CertStores certStores = CertStores.serverStore(); + certStores.withCertificate("server", serverCertificate); + certStores.trust("ca", ca); + return certStores; + } + + /** + * Creates and returns locator CertStores for server-only TLS. + * + *
+ * Locator truststore contains the CA certificate to verify peer connections. + *
+ * Locator keystore contains the locator's certificate for presentation to clients and peers. + * + * @return CertStores configured for locator with locator certificate + */ + public CertStores createLocatorStores() { + CertStores certStores = CertStores.locatorStore(); + certStores.withCertificate("locator", locatorCertificate); + certStores.trust("ca", ca); + return certStores; + } + + /** + * Creates and returns cluster CertStores for both locator and server. + * + *
+ * For peer SSL communication, both locator and server need compatible certificates. + * This method creates CertStores with the server certificate that works for both. + * The server certificate includes SANs for localhost/127.0.0.1 which work for both roles. + * + * @return CertStores configured with server certificate and CA trust + */ + public CertStores createClusterStores() { + CertStores certStores = CertStores.serverStore(); + // Use server certificate for both locator and server (SANs cover both roles) + certStores.withCertificate("server", serverCertificate); + certStores.trust("ca", ca); + return certStores; + } + + /** + * Creates and returns client CertStores for server-only TLS. + * + *
+ * Client truststore contains ONLY the CA certificate to verify server certificates. + *
+ * NO keystore is created - clients do not present certificates. + * + * @return CertStores configured for client with only truststore (no client certificate) + */ + public CertStores createClientStores() { + CertStores certStores = CertStores.clientStore(); + // Client only needs truststore with CA to verify servers + certStores.trust("ca", ca); + // NO client keystore - clients don't present certificates + return certStores; + } + + /** + * Adds security manager configuration to properties. + * Uses SimpleSecurityManager for authentication and authorization. + */ + public Properties addSecurityManagerConfig(Properties props) { + props.setProperty("security-manager", SimpleSecurityManager.class.getName()); + return props; + } + + /** + * Adds peer authentication credentials for server/locator-to-locator connections. + * Required when security-manager is enabled. + * + * @param props the properties to add authentication to + * @param username the username for peer authentication + * @param password the password for peer authentication + * @return the properties with peer authentication configured + */ + public Properties addPeerAuthProperties(Properties props, String username, String password) { + props.setProperty("security-username", username); + props.setProperty("security-password", password); + return props; + } + + /** + * Creates client authentication properties with username and password. + * + * @param username the username + * @param password the password + * @return Properties with authentication configuration + */ + public Properties createClientAuthProperties(String username, String password) { + Properties props = new Properties(); + props.setProperty("security-client-auth-init", + UserPasswordAuthInit.class.getName() + ".create"); + props.setProperty(UserPasswordAuthInit.USER_NAME, username); + props.setProperty(UserPasswordAuthInit.PASSWORD, password); + return props; + } + + /** + * Creates client authentication properties with a bearer token. + * + * @param token the bearer token + * @return Properties with token authentication configuration + */ + public Properties createClientTokenAuthProperties(String token) { + Properties props = new Properties(); + props.setProperty("security-client-auth-init", + "org.apache.geode.security.templates.TokenAuthInit.create"); + props.setProperty("security-bearer-token", token); + return props; + } + + /** + * Gets the CA certificate material for testing purposes. + */ + public CertificateMaterial getCA() { + return ca; + } + + /** + * Gets the server certificate material for testing purposes. + */ + public CertificateMaterial getServerCertificate() { + return serverCertificate; + } + + /** + * Gets the locator certificate material for testing purposes. + */ + public CertificateMaterial getLocatorCertificate() { + return locatorCertificate; + } +}