Skip to content

IGNITE-28669 Removed usages of security compatibility properties #13444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
petrov-mg wants to merge 2 commits into
base: master
Choose a base branch
from
Open

IGNITE-28669 Removed usages of security compatibility properties #13444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2bf23a4
IGNITE-28669
petrov-mg Aug 8, 2026
18d55b9
IGNITE-28669
petrov-mg Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -989,10 +989,13 @@ public final class IgniteSystemProperties extends IgniteCommonsSystemProperties
* <p>
* Default is {@code false}, which means that service security permissions will be respected.
* </p>
*
* @deprecated Has no usage.
*/
@SystemProperty("Enables Ignite to switch to compatibility mode with versions that " +
"don't support service security permissions. In this case security permissions will be ignored (if they set)." +
" Default is false, which means that service security permissions will be respected")
@Deprecated
public static final String IGNITE_SECURITY_COMPATIBILITY_MODE = "IGNITE_SECURITY_COMPATIBILITY_MODE";

/** Ignite cluster name. Defaults to {@link IgniteCluster#id()}. */
Expand Down
24 changes: 0 additions & 24 deletions ...ore/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,6 @@
import static org.apache.ignite.IgniteSystemProperties.IGNITE_BINARY_MARSHALLER_USE_STRING_SERIALIZATION_VER_2;
import static org.apache.ignite.IgniteSystemProperties.IGNITE_DISCOVERY_HISTORY_SIZE;
import static org.apache.ignite.IgniteSystemProperties.IGNITE_OPTIMIZED_MARSHALLER_USE_DEFAULT_SUID;
import static org.apache.ignite.IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE;
import static org.apache.ignite.IgniteSystemProperties.getInteger;
import static org.apache.ignite.cluster.ClusterState.ACTIVE;
import static org.apache.ignite.cluster.ClusterState.INACTIVE;
Expand All @@ -172,13 +171,11 @@
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_MARSHALLER_USE_DFLT_SUID;
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_OFFHEAP_SIZE;
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_PEER_CLASSLOADING;
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_SECURITY_COMPATIBILITY_MODE;
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_SHUTDOWN_POLICY;
import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_USER_NAME;
import static org.apache.ignite.internal.IgniteVersionUtils.VER;
import static org.apache.ignite.internal.events.DiscoveryCustomEvent.EVT_DISCOVERY_CUSTOM_EVT;
import static org.apache.ignite.internal.processors.metric.impl.MetricUtils.metricName;
import static org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode;
import static org.apache.ignite.internal.processors.security.SecurityUtils.nodeSecurityContext;
import static org.apache.ignite.internal.util.lang.ClusterNodeFunc.eqNodes;
import static org.apache.ignite.internal.util.lang.ClusterNodeFunc.nodeConsistentIds;
Expand Down Expand Up @@ -508,9 +505,6 @@ private void updateClientNodes(UUID leftNodeId) {
spi.setMetricsProvider(createMetricsProvider());

if (ctx.security().enabled()) {
if (isSecurityCompatibilityMode())
ctx.addNodeAttribute(ATTR_SECURITY_COMPATIBILITY_MODE, true);

spi.setAuthenticator(new DiscoverySpiNodeAuthenticator() {
@Override public SecurityContext authenticateNode(ClusterNode node, SecurityCredentials cred) {
try {
Expand Down Expand Up @@ -1246,8 +1240,6 @@ private void checkAttributes(Iterable<ClusterNode> nodes) throws IgniteCheckedEx

boolean locDelayAssign = locNode.attribute(ATTR_LATE_AFFINITY_ASSIGNMENT);

Boolean locSecurityCompatibilityEnabled = locNode.attribute(ATTR_SECURITY_COMPATIBILITY_MODE);

WALMode locWalMode = nodeWalMode(locNode);

for (ClusterNode n : nodes) {
Expand Down Expand Up @@ -1339,22 +1331,6 @@ private void checkAttributes(Iterable<ClusterNode> nodes) throws IgniteCheckedEx
", rmtAddrs=" + U.addressesAsString(n) + ", rmtNode=" + U.toShortString(n) + "]");
}

if (ctx.security().enabled()) {
Boolean rmtSecurityCompatibilityEnabled = n.attribute(ATTR_SECURITY_COMPATIBILITY_MODE);

if (!Objects.equals(locSecurityCompatibilityEnabled, rmtSecurityCompatibilityEnabled)) {
throw new IgniteCheckedException("Local node's " + IGNITE_SECURITY_COMPATIBILITY_MODE +
" property value differs from remote node's value " +
"(to make sure all nodes in topology have identical Ignite security compatibility mode enabled, " +
"configure system property explicitly) " +
"[locSecurityCompatibilityEnabled=" + locSecurityCompatibilityEnabled +
", rmtSecurityCompatibilityEnabled=" + rmtSecurityCompatibilityEnabled +
", locNodeAddrs=" + U.addressesAsString(locNode) +
", rmtNodeAddrs=" + U.addressesAsString(n) +
", locNodeId=" + locNode.id() + ", rmtNode=" + U.toShortString(n) + "]");
}
}

WALMode rmtWalMode = nodeWalMode(n);

if (locWalMode != null && rmtWalMode != null && locWalMode != rmtWalMode) {
Expand Down
53 changes: 0 additions & 53 deletions modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@
import java.util.stream.Collectors;
import org.apache.ignite.IgniteCheckedException;
import org.apache.ignite.IgniteException;
import org.apache.ignite.IgniteSystemProperties;
import org.apache.ignite.cluster.ClusterNode;
import org.apache.ignite.internal.GridKernalContext;
import org.apache.ignite.internal.IgniteInternalWrapper;
Expand Down Expand Up @@ -75,16 +74,6 @@ public class SecurityUtils {
/** Ignite internal package. */
public static final String IGNITE_INTERNAL_PACKAGE = "org.apache.ignite.internal";

/** Default serialization version. */
private static final int DFLT_SERIALIZE_VERSION = isSecurityCompatibilityMode() ? 1 : 2;

/** Current serialization version. */
private static final ThreadLocal<Integer> SERIALIZE_VERSION = new ThreadLocal<Integer>() {
@Override protected Integer initialValue() {
return DFLT_SERIALIZE_VERSION;
}
};

/** Permissions that contain {@code AllPermission}. */
public static final Permissions ALL_PERMISSIONS;

Expand All @@ -101,48 +90,6 @@ public class SecurityUtils {
private SecurityUtils() {
}

/**
* @return Security compatibility mode flag.
*/
public static boolean isSecurityCompatibilityMode() {
return IgniteSystemProperties.getBoolean(IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE, false);
}

/**
* @param ver Serialize version.
*/
public static void serializeVersion(int ver) {
SERIALIZE_VERSION.set(ver);
}

/**
* @return Serialize version.
*/
public static int serializeVersion() {
return SERIALIZE_VERSION.get();
}

/**
* Sets default serialize version {@link #DFLT_SERIALIZE_VERSION}.
*/
public static void restoreDefaultSerializeVersion() {
serializeVersion(DFLT_SERIALIZE_VERSION);
}

/**
* @return Allow all service permissions.
*/
public static Map<String, EnumSet<SecurityPermission>> compatibleServicePermissions() {
Map<String, EnumSet<SecurityPermission>> srvcPerms = new HashMap<>();

srvcPerms.put("*", EnumSet.of(
SecurityPermission.SERVICE_CANCEL,
SecurityPermission.SERVICE_DEPLOY,
SecurityPermission.SERVICE_INVOKE));

return srvcPerms;
}

/** */
public static Map<String, EnumSet<SecurityPermission>> normalizeResourcePermissions(
Map<String, ? extends Collection<SecurityPermission>> rsrcPerms
Expand Down
20 changes: 3 additions & 17 deletions modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@
import java.io.ObjectOutputStream;
import java.io.ObjectStreamField;
import java.util.Collection;
import java.util.Collections;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.Map;
Expand All @@ -34,10 +33,7 @@
import org.apache.ignite.internal.util.typedef.internal.U;
import org.jetbrains.annotations.Nullable;

import static org.apache.ignite.internal.processors.security.SecurityUtils.compatibleServicePermissions;
import static org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode;
import static org.apache.ignite.internal.processors.security.SecurityUtils.normalizeResourcePermissions;
import static org.apache.ignite.internal.processors.security.SecurityUtils.serializeVersion;
import static org.apache.ignite.internal.processors.security.SecurityUtils.toEnumSet;

/**
Expand Down Expand Up @@ -69,9 +65,7 @@ public class SecurityBasicPermissionSet implements SecurityPermissionSet {
/** Service permissions. */
@GridToStringInclude
@Order(2)
transient Map<String, EnumSet<SecurityPermission>> srvcPermissions = isSecurityCompatibilityMode()
? compatibleServicePermissions()
: new HashMap<>();
transient Map<String, EnumSet<SecurityPermission>> srvcPermissions = new HashMap<>();

/** System permissions. */
@GridToStringInclude
Expand Down Expand Up @@ -192,8 +186,7 @@ private void writeObject(ObjectOutputStream out) throws IOException {

out.writeFields();

if (serializeVersion() >= 2)
U.writeMap(out, srvcPermissions);
U.writeMap(out, srvcPermissions);
}

/** */
Expand All @@ -209,14 +202,7 @@ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundE

sysPermissions = sysPerms == null ? null : toEnumSet(sysPerms);

Map<String, ? extends Collection<SecurityPermission>> srvcPerms = serializeVersion() >= 2 ? U.readMap(in) : null;

if (srvcPerms == null) {
// Allow all for compatibility mode
srvcPerms = serializeVersion() < 2 ? compatibleServicePermissions() : Collections.emptyMap();
}

srvcPermissions = normalizeResourcePermissions(srvcPerms);
srvcPermissions = normalizeResourcePermissions(U.readMap(in));
}

/** {@inheritDoc} */
Expand Down
21 changes: 1 addition & 20 deletions modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,6 @@
import org.apache.ignite.internal.processors.metric.MetricRegistryImpl;
import org.apache.ignite.internal.processors.metric.impl.MaxValueMetric;
import org.apache.ignite.internal.processors.security.SecurityContext;
import org.apache.ignite.internal.processors.security.SecurityUtils;
import org.apache.ignite.internal.thread.context.Scope;
import org.apache.ignite.internal.thread.pool.IgniteThreadPoolExecutor;
import org.apache.ignite.internal.util.GridBoundedLinkedHashSet;
Expand Down Expand Up @@ -1333,16 +1332,7 @@ private boolean sendJoinRequestMessage(TcpDiscoveryJoinRequestMessage joinMsg) t
try {
IgniteSpiOperationTimeoutHelper timeoutHelper = new IgniteSpiOperationTimeoutHelper(spi, true);

Integer res;

try {
SecurityUtils.serializeVersion(1);

res = sendMessageDirectly(joinMsg, addr, timeoutHelper);
}
finally {
SecurityUtils.restoreDefaultSerializeVersion();
}
Integer res = sendMessageDirectly(joinMsg, addr, timeoutHelper);

assert res != null;

Expand Down Expand Up @@ -3662,8 +3652,6 @@ else if (!spi.failureDetectionTimeoutEnabled() && (e instanceof
prepareNodeAddedMessage(msg, next.id(), pendingMsgs.msgs);

try {
SecurityUtils.serializeVersion(1);

long tsNanos = System.nanoTime();

if (timeoutHelper == null)
Expand Down Expand Up @@ -3706,8 +3694,6 @@ else if (!spi.failureDetectionTimeoutEnabled() && (e instanceof
}
}
finally {
SecurityUtils.restoreDefaultSerializeVersion();

clearNodeAddedMessage(msg);
}

Expand Down Expand Up @@ -6827,8 +6813,6 @@ else if (e.hasCause(ObjectStreamException.class) ||

while (!isInterrupted()) {
try {
SecurityUtils.serializeVersion(1);

// Use inifinite timeout for accepting new messages.
TcpDiscoveryAbstractMessage msg = spi.readMessage(ses, 0);

Expand Down Expand Up @@ -7121,9 +7105,6 @@ else if (msg instanceof TcpDiscoveryRingLatencyCheckMessage) {

return;
}
finally {
SecurityUtils.restoreDefaultSerializeVersion();
}
}
}
catch (UnknownMessageException e) {
Expand Down
93 changes: 0 additions & 93 deletions ...org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,11 @@
import org.apache.ignite.configuration.IgniteConfiguration;
import org.apache.ignite.internal.IgniteEx;
import org.apache.ignite.marshaller.Marshallers;
import org.apache.ignite.spi.discovery.TestReconnectSecurityPluginProvider;
import org.apache.ignite.testframework.junits.common.GridCommonAbstractTest;
import org.junit.Test;

import static org.apache.ignite.IgniteSystemProperties.IGNITE_BINARY_MARSHALLER_USE_STRING_SERIALIZATION_VER_2;
import static org.apache.ignite.IgniteSystemProperties.IGNITE_OPTIMIZED_MARSHALLER_USE_DEFAULT_SUID;
import static org.apache.ignite.IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE;
import static org.apache.ignite.configuration.DeploymentMode.CONTINUOUS;
import static org.apache.ignite.configuration.DeploymentMode.SHARED;

Expand All @@ -46,9 +44,6 @@ public class GridDiscoveryManagerAttributesSelfTest extends GridCommonAbstractTe
/** */
private static boolean p2pEnabled;

/** Security enabled. */
private static boolean secEnabled;

/** {@inheritDoc} */
@Override protected IgniteConfiguration getConfiguration(String igniteInstanceName) throws Exception {
IgniteConfiguration cfg = super.getConfiguration(igniteInstanceName);
Expand All @@ -57,9 +52,6 @@ public class GridDiscoveryManagerAttributesSelfTest extends GridCommonAbstractTe
cfg.setDeploymentMode(mode);
cfg.setPeerClassLoadingEnabled(p2pEnabled);

if (secEnabled)
cfg.setPluginProviders(new TestReconnectSecurityPluginProvider());

return cfg;
}

Expand Down Expand Up @@ -230,91 +222,6 @@ private void doTestUseStrSerVer2(String first, String second, boolean fail) thro
}
}

/**
* @throws Exception If failed.
*/
@Test
public void testSecurityCompatibilityEnabled() throws Exception {
secEnabled = true;

try {
doTestSecurityCompatibilityEnabled(true, null, true);
doTestSecurityCompatibilityEnabled(true, false, true);
doTestSecurityCompatibilityEnabled(false, true, true);
doTestSecurityCompatibilityEnabled(null, true, true);

doTestSecurityCompatibilityEnabled(null, null, false);
doTestSecurityCompatibilityEnabled(null, false, false);
doTestSecurityCompatibilityEnabled(false, false, false);
doTestSecurityCompatibilityEnabled(false, null, false);
doTestSecurityCompatibilityEnabled(true, true, false);
}
finally {
secEnabled = false;
}
}

/**
* @param first Service compatibility enabled flag for first node.
* @param second Service compatibility enabled flag for second node.
* @param fail Fail flag.
* @throws Exception If failed.
*/
private void doTestSecurityCompatibilityEnabled(Object first, Object second, boolean fail) throws Exception {
doTestCompatibilityEnabled(IGNITE_SECURITY_COMPATIBILITY_MODE, first, second, fail);
}

/**
* @param prop System property.
* @param first Service compatibility enabled flag for first node.
* @param second Service compatibility enabled flag for second node.
* @param fail Fail flag.
* @throws Exception If failed.
*/
private void doTestCompatibilityEnabled(String prop, Object first, Object second, boolean fail) throws Exception {
String backup = System.getProperty(prop);
try {
if (first != null)
System.setProperty(prop, String.valueOf(first));
else
System.clearProperty(prop);

IgniteEx ignite = startGrid(0);

checkIsClientFlag(ignite);

// Ignore if disabled security plugin used.
if (IGNITE_SECURITY_COMPATIBILITY_MODE.equals(prop) && !ignite.context().security().enabled())
return;

if (second != null)
System.setProperty(prop, String.valueOf(second));
else
System.clearProperty(prop);

try {
IgniteEx g = startClientGrid(1);

checkIsClientFlag(g);

if (fail)
fail("Node must not join");
}
catch (Exception e) {
if (!fail)
fail("Node must join: " + e.getMessage());
}
}
finally {
stopAllGrids();

if (backup != null)
System.setProperty(prop, backup);
else
System.clearProperty(prop);
}
}

/**
* @throws Exception If failed.
*/
Expand Down
Loading