ApacheCon Infinite Session Clustering with Apache Shiro & Cassandra

Transcription

1 ApacheCon 2014 Infinite Clustering with Apache Shiro & Cassandra Les Apache Shiro Project Chair CTO, Stormpath stormpath.com

2 .com User Management and Authen=ca=on API Security for your applica=ons User security workflows Security best prac=ces Developer tools, SDKs, libraries

3 What is Apache Shiro? Applica=on security framework ASF TLP hkp://shiro.apache.org Quick and Easy Simplifies Security

4 Web Management Authen=ca=on Management Authoriza=on Cryptography Web Support Auxiliary Features

5 Quick Concepts Subject currentuser = SecurityUtils.getSubject(); currentuser.login(...) currentuser.ispermitted(...)

6 Management Defined Managing the lifecycle of Subject- specific temporal data context

7 Management Features Heterogeneous client access POJO/J2SE based (IoC friendly) Event listeners Host address reten=on Inac=vity/expira=on support (touch()) Transparent web use - HKp Container- Independent Clustering!

8 Acquiring and CreaKng s Subject subject = SecurityUtils.getSubject() //guarantee a session session = subject.get(); //get a session if it exists subject.get(false);

9 API getstarttimestamp() getlastaccesstime() getattribute(key) setattribute(key, value) get/settimeout(long) touch()...

10 Management Architecture Subject.get() à

11 Management Architecture Subject.get() à Manager

12 Management Architecture Subject.get() à Manager Factory

13 Management Architecture Subject.get() à Manager Factory DAO

14 Management Architecture Subject.get() à Manager Factory ID Generator DAO

15 Management Architecture Subject.get() à Manager Factory ID Generator DAO Cache

16 Management Architecture Subject.get() à Manager Factory ID Generator DAO Cache Data store

17 Management Architecture Subject.get() à Manager Factory ID Generator DAO Cache Data store Valida=on Scheduler

18 Management Architecture Subject.get() à Manager Factory ID Generator DAO Cache Valida=on Scheduler Listeners Data store

19 Clustering: Clustered Data Store of Choice DAO Valida=on Scheduler ID Generator Cache Data store

20 Web ConfiguraKon web.xml elements Protects all URLs Innova=ve Filtering (URL- specific chains) JSP Tag support Transparent HKp support

21 web.xml <listener> <listener-class> org.apache.shiro.web.env.environmentloaderlistener </listener-class> </listener> <filter> <filter-name>shirofilter</filter-name> <filter-class> org.apache.shiro.web.servlet.shirofilter </filter-class> </filter>

22 web.xml cont d <filter-mapping> <filter-name>shirofilter</filter-name> <url-pattern>/*</url-pattern> <dispatcher>request</dispatcher> <dispatcher>forward</dispatcher> <dispatcher>include</dispatcher> <dispatcher>error</dispatcher> </filter-mapping>

23 shiro.ini overview [main] # bean config here [users] # optional static user accounts (and their roles) here [roles] # optional static roles (and their permissions) here [urls] # filter chains here

24 Clustering

25 Two Approaches Write a DAO Use EnterpriseCacheDAO and write a CacheManager

26 Cassandra DAO

27 DAO Concerns Manager DAO ID Generator Cache Data store

28 Custom DAO public class MyDAO extends AbstractDAO { protected void docreate( s){...} protected void doread(serializable id){...} protected void delete( s){...} protected void update( s){...} } Collection<> getactives(){...} Or public class MyDAO extends CachingDAO {... //enables write-through caching }

29 NaKve Web Manager [main] sessionmanager = org.apache.shiro.web.session.mgt.defaultwebmanager securitymanager.sessionmanager = $sessionmanager

30 Cassandra DAO [main]... cassandracluster = com.leshazlewood.samples.shiro.cassandra.clusterfactory sessiondao = com.leshazlewood.samples.shiro.cassandra.cassandradao sessiondao.cluster = $cassandracluster sessiondao.keyspacename = shirosessions sessiondao.tablename = sessions...

31 Plug in the DAO [main]... sessionmanager.sessiondao = $sessiondao

32 s Table (CQL 3) CREATE TABLE sessions ( id timeuuid PRIMARY KEY, start_ts timestamp, stop_ts timestamp, last_access_ts timestamp, timeout bigint, expired boolean, host varchar, serialized_value blob )

33 No ValidaKon Scheduler?

34 No ValidaKon Scheduler? Use Cassandra s TTL

35 TTL for session Kmeout [main] # Cassandra can enforce a TTL. # No need for Shiro to invalidate! sessionmanager.sessionvalidationschedulerenabled = false

36 Upsert (CQL 3) UPDATE sessions USING TTL $timeout SET start_ts =?, stop_ts =?, last_access_ts =?, timeout =?, expired =?, host =?, serialized_value =? WHERE id =?

37 But what about tombstones!?!?

38 s Table (revised) CREATE TABLE sessions ( id timeuuid PRIMARY KEY, start_ts timestamp, stop_ts timestamp, last_access_ts timestamp, timeout bigint, expired boolean, host varchar, serialized_value blob ) WITH gc_grace_seconds = AND compacation = { class : LeveledCompactionStrategy }

39 But what about row caching?

40 Row Cache? Probably don t need it (but maybe in some cases it would be useful) SSTable likely in Opera=ng System page cache (off heap) DO use Key Cache (very important, enabled by default in 1.2)

41 Code $ git clone $ cd shiro-cassandra-sample $ $CASSANDRA_HOME/bin/cassandra $ mvn jetty:run Open a browser to

42 Thank You! hkp://