Rexster Security

Rexster supports a simple authentication model allowing configuration through rexster.xml. The model is extensible to allow Rexster users to plug-in their own security implementations with relative ease. The authentication process extends across all aspects of Rexster to include REST, Dog House and Rexster Console access.

From a REST and Dog House perspective, Rexster supports Basic Authentication with the default configuration:

<rexster>
  ...
  <security>
    <authentication>
        <type>default</type>
        <configuration>
          <users>
            <user>
              <username>rexster</username>
              <password>rexster</password>
            </user>
          </users>
        </configuration>
    </authentication>
  </security>
  ...
</rexster>

To make a REST API call to Rexster with authentication turned on:

curl -H "Authorization:Basic cmV4c3RlcjpyZXhzdGVy" http://localhost:8182/graphs

To prepare the request above, the user name is appended with a colon and concatenated with the password. The resulting string is encoded with the Base64 algorithm. For example, given the user name ‘rexster’ and password ‘rexster’, the string ‘rexster:rexster’ is Base64 encoded, resulting in ‘cmV4c3RlcjpyZXhzdGVy’. In the case of Dog House, the browser will produce an authentication dialog box to capture the username and password.

Custom Authentication

The default security model for Rexster that utilizes rexster.xml to house the usernames and passwords may not be the right choice for every environment. It is possible to develop a plug-in to Rexster to implement your own custom approach to validating a user’s credentials.

Create a class that extends the AbstractSecurityFilter. This class will require the implementation of three methods:

public boolean authenticate(final String username, final String password){
...
}

public void configure(XMLConfiguration configuration) {
...
}

public String getName() {
...
}

The authenticate method is the important one. For each request, a call will be made to this method. Validate the username and password combination in any way that makes sense for your solution (ie. connect to a database via JDBC) and return true if the the username and password combination are acceptable and false otherwise.

The configure method provides the means by which you can grab configuration information passed in from rexster.xml. This would obviously be useful for a JDBC-based solution where database connectivity information could be set in rexster.xml and passed in to this method at startup of Rexster. Rexster will pass in the contents of the <configuration> section of rexster.xml.

The getName method is fairly simple. It is just a name used for labeling of the implementation and can be any identifiable arbitrary string that you like.

Make this class available in the Rexster classpath by copying it to Rexster’s REXSTER_HOME/ext directory (just like Rexster Extensions).

The final step is to configure rexster.xml to use your custom security extension. Set the value of the <security><authentication><type> element to the fully qualified class name for your AbstractSecurityFilter implementation.