CallerIdentity and Trusted Payload

If client wants to pass in simple text password or a certificate or a custom serialized object as token credential to the data source, user can configure "CallerIdentity" login module. Using this login module, user can pass-in same credential that user logged into Teiid security domain to the data source. Here is a sample configuration

<subsystem xmlns="urn:jboss:domain:security:1.1">
    <security-domains>
        <security-domain name="my-security-domain" cache-type="default">
            <authentication>
                <login-module code="UsersRoles" flag="required">
                    <module-option name="password-stacking">useFirstPass</module-option>
                    <module-option name="usersProperties">props/teiid-security-users.properties</module-option>
                    <module-option name="rolesProperties">props/teiid-security-roles.properties</module-option>
                </login-module>

                <login-module code="org.jboss.resource.security.CallerIdentityLoginModule" flag="required">
                    <module-option name="password-stacking">useFirstPass</module-option>
                    <module-option name="managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=DefaultDS</module-option>
                </login-module>

            </authentication>
        </security-domain>
    </security-domains>
</subsystem>  

In the datasource defined as the "managedConnectionFactoryName" in the above configuration, you need to add the following element

<security-domain>teiid-security</security-domain>

In the above configuration example, in the primary login module "UsersRoles" is setup to hold the passwords in the file, and when user logs in with password, the same password will be also set on the logged in Subject after authentication. These credentials can be extracted by the data source by asking for Subject's private credentials.

To use a certificate or serialized object instead of plain password as the token, replace the simple text password with Base64 encoded contents of the serialized object. Please note that encoding and decoding of this object is strictly up to the user as JBoss AS and Teiid will only act as a carrier of the information from login module to connection factory. Using this CallerIdentity module, the connection pool for data source is segmented by Subject.

Role Based Credential Map

In some use cases, the users are divided by their functionality and they have varied levels of security access to data sources. These types of users are identified by their roles as to what they have access to. In the above "CallerIdentity" login scenario, that may be too fine-grained security at data sources, that can lead resource exhaustion as every user has their own separate connection. Using Role based security gives a balance, where the users with same role are treated equally for authentication purposes at the data source. Teiid provides a login module called "RoleBasedCredentialMap" for this purposes, where administrator can define a role-based authentication module, where given the role of the user from the primary login module, this module will hold a credential to that role. So, it is the container of credentials that maps to different roles. If a user has multiple roles, the first role that has the credential will be chosen. Below find the sample configuration.

<subsystem xmlns="urn:jboss:domain:security:1.1">
    <security-domains>
        <security-domain name="my-security-domain" cache-type="default">
            <authentication>

                <login-module code="UsersRoles" flag="required">
                    <module-option name="password-stacking">useFirstPass</module-option>
                    <module-option name="usersProperties">teiid-security-users.properties</module-option>
                    <module-option name="rolesProperties">teiid-security-roles.properties</module-option>
                </login-module>

                <login-module code="org.teiid.jboss.RoleBasedCredentialMapIdentityLoginModule" flag="required">
                    <module-option name="password-stacking">useFirstPass</module-option>
                    <module-option name="credentialMap">teiid-credentialmap.properties</module-option>
                    <module-option name="managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=DefaultDS</module-option>
                </login-module>

            </authentication>
        </security-domain>
    </security-domains>
    </subsystem>

In the datasource that is defined as the "managedConnectionFactoryName" in the above configuration, you need to add the following element

<security-domain>teiid-security</security-domain>

In the above configuration example, in the primary login module "UsersRolesLoginModule" is set up for logging in the primary user and assign some roles. The "RoleBasedCredentialMap" login module is configured to hold role to password information in the file defined by "credentialMap" property. When user logs in, the role information from the primary login module is taken, and extracts the role's passsword and attaches as a private credential to the Subject. If you want use this for role based trusted token, you can configure the Base64 based endcoding/decoded object as defined above.

You can also encrypt the password instead of plain text password using this module. Just include the encrypted password in the file defined by the "credentialMap" property, and define following properties in the "RoleBasedCredentialMap" login module.

<login-module code="org.teiid.jboss.RoleBasedCredentialMapIdentityLoginModule" flag="required">
    <module-option name = "password-stacking">useFirstPass</module-option>
    <module-option name="credentialMap">props/teiid-credentialmap.properties</module-option>
    <module-option name = "managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=DefaultDS</module-option>
    
   <!-- below properties are only required when passwords are encrypted -->
   <module-option name = "pbealgo">PBEWithMD5AndDES</module-option>
   <module-option name = "pbepass">testPBEIdentityLoginModule</module-option>
   <module-option name = "salt">abcdefgh</module-option>
   <module-option name = "iterationCount">19</module-option>
</login-module>

For full details about encryption of the password, please follow this document's "A KeyStore based login module for encrypting a datasource password" section. Be sure to give the same configuration elements in the above configuration, as they are used to encrypt the password.