Package com.gigaspaces.security.serviceaccount

Class ServiceAccountAwareSecurityManager

java.lang.Object

com.gigaspaces.security.serviceaccount.ServiceAccountAwareSecurityManager

All Implemented Interfaces:

SecurityManager

public class ServiceAccountAwareSecurityManager
extends Object
implements SecurityManager

A SecurityManager wrapper that adds service-account JWT authentication on top of any legacy SecurityManager (File-based or Spring-based).

Authentication chain (mirrors the ProviderManager pattern in the auth server):

1. If the password looks like a JWT → validate signature via auth server JWK endpoint, extract privilege strings from the sa_scope claim.
2. Otherwise (or if JWT validation fails) → delegate to the wrapped legacy SecurityManager.

Required configuration properties (in security.properties):

   com.gs.security.security-manager.class=com.gigaspaces.security.serviceaccount.ServiceAccountAwareSecurityManager
   com.gs.security.service-account.delegate-class=com.gigaspaces.security.spring.SpringSecurityManager
   com.gs.security.service-account.auth-url=http://localhost:9000
 

All other properties (e.g. spring-security-config-location) are forwarded to the delegate.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AUTH_URL_PROPERTY
static final String	DEFAULT_AUTH_URL
static final String	DELEGATE_CLASS_PROPERTY

Fields inherited from interface com.gigaspaces.security.SecurityManager

SECURITY_MANAGER_CLASS_PROPERTY_KEY

Constructor Summary

Constructors

Constructor	Description
ServiceAccountAwareSecurityManager()

Method Summary

Modifier and Type	Method	Description
Authentication	authenticate(UserDetails userDetails)	Attempts to authenticate the passed user represented by UserDetails, returning a fully populated UserDetails object (including granted authorities) if successful.
void	close()	Closes any excess resource kept by the security manager; e.g.
DirectoryManager	createDirectoryManager(UserDetails userDetails)	Attempts to authenticate the passed user represented by UserDetails, granting access only for users that are allowed to manage the directory.
void	init(Properties properties)	Initializes this security manager instance with implementation specific properties, and any resource creation/access needed.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DELEGATE_CLASS_PROPERTY

public static final String DELEGATE_CLASS_PROPERTY

See Also:

• Constant Field Values

AUTH_URL_PROPERTY

public static final String AUTH_URL_PROPERTY

See Also:

• Constant Field Values

DEFAULT_AUTH_URL

public static final String DEFAULT_AUTH_URL

See Also:

• Constant Field Values

Constructor Details

ServiceAccountAwareSecurityManager

public ServiceAccountAwareSecurityManager()

Method Details

init

public void init(Properties properties)
          throws SecurityException

Description copied from interface: SecurityManager

Initializes this security manager instance with implementation specific properties, and any resource creation/access needed.

Specified by:

init in interface SecurityManager

Parameters:

properties - properties to use configure this instance.

Throws:

SecurityException

authenticate

public Authentication authenticate(UserDetails userDetails)
                            throws AuthenticationException

Description copied from interface: SecurityManager

Attempts to authenticate the passed user represented by UserDetails, returning a fully populated UserDetails object (including granted authorities) if successful.

Specified by:

authenticate in interface SecurityManager

Parameters:

userDetails - the user request object

Returns:

a fully authenticated object including authorities

Throws:

AuthenticationException - if authentication fails

createDirectoryManager

public DirectoryManager createDirectoryManager(UserDetails userDetails)
                                        throws AuthenticationException,
AccessDeniedException

Description copied from interface: SecurityManager

Attempts to authenticate the passed user represented by UserDetails, granting access only for users that are allowed to manage the directory.

Creates a directory manager for managing of users and roles, granting access only for users that are allowed to manage, but may be restrictive (to read-only) based on their privileges.

If the directory is to be managed by an external tool, implementors may wish to throw DirectoryAccessDeniedException to deny access to the API (e.g. from UI).

Specified by:

createDirectoryManager in interface SecurityManager

Parameters:

userDetails - the user request object

Returns:

a directory manager instance

Throws:

AuthenticationException - if authentication fails for the specified user

AccessDeniedException - if not granted sufficient access required to manage role details

DirectoryAccessDeniedException - if the directory should not be managed by API.

close

public void close()

Description copied from interface: SecurityManager

Closes any excess resource kept by the security manager; e.g. connection to a data-source.

Specified by:

close in interface SecurityManager