From b50d7aead1c2a7893dc0f4281bf7fc8027e2dacb Mon Sep 17 00:00:00 2001 From: Mohammed Rafi KC Date: Mon, 2 Apr 2018 12:20:47 +0530 Subject: server/auth: add option for strict authentication When this option is enabled, we will check for a matching username and password, if not found then the connection will be rejected. This also does a checksum validation of volfile The option is invalid when SSL/TLS is in use, at which point the SSL/TLS certificate user name is used to validate and hence authorize the right user. This expects TLS allow rules to be setup correctly rather than the default *. This option is not settable, as a result this cannot be enabled for volumes using the CLI. This is used with the shared storage volume, to restrict access to the same in non-SSL/TLS environments to the gluster peers only. Tested: ./tests/bugs/protocol/bug-1321578.t ./tests/features/ssl-authz.t - Ran tests on volumes with and without strict auth checking (as brick vol file needed to be edited to test, or rather to enable the option) - Ran tests on volumes to ensure existing mounts are disconnected when we enable strict checking Change-Id: I2ac4f0cfa5b59cc789cc5a265358389b04556b59 fixes: bz#1570430 Signed-off-by: Mohammed Rafi KC Signed-off-by: ShyamsundarR --- xlators/protocol/server/src/authenticate.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'xlators/protocol/server/src/authenticate.h') diff --git a/xlators/protocol/server/src/authenticate.h b/xlators/protocol/server/src/authenticate.h index 3f80231ee0a..5f92183fb12 100644 --- a/xlators/protocol/server/src/authenticate.h +++ b/xlators/protocol/server/src/authenticate.h @@ -37,10 +37,8 @@ typedef struct { volume_opt_list_t *vol_opt; } auth_handle_t; -auth_result_t gf_authenticate (dict_t *input_params, - dict_t *config_params, - dict_t *auth_modules); int32_t gf_auth_init (xlator_t *xl, dict_t *auth_modules); void gf_auth_fini (dict_t *auth_modules); +auth_result_t gf_authenticate (dict_t *, dict_t *, dict_t *); #endif /* _AUTHENTICATE_H */ -- cgit