Archive
Archive
Security is an important feature of any application. By default, VoltDB does not perform any security checks when a client application opens a connection to the database or invokes a stored procedure. This is convenient when developing and distributing an application on a private network.
However, on public or semi-private networks, it is important to make sure only known client applications are interacting with the database. VoltDB lets you control access to the database through settings in the schema and deployment files. The following sections explain how to enable and configure security for your VoltDB application.
When an application creates a connection to a VoltDB database (using ClientFactory.clientCreate), it passes a username and password as part of the client configuration. These parameters identify the client to the database and are used for authenticating access.
At runtime, if security is enabled, the username and password passed in by the client application are validated by the server against the users defined in the deployment file. If the client application passes in a valid username and password pair, the connection is established. When the application calls a stored procedure, permissions are checked again. If the schema identifies the user as being assigned a role having access to that stored procedure, the procedure is executed. If not, an error is returned to the calling application.
VoltDB uses SHA-1 hashing rather than encryption when passing the username and password between the client and the server. The passwords are also hashed within the database. For an encrypted solution, you can consider implementing Kerberos security, described in Section 8.7, “Integrating Kerberos Security with VoltDB”.
There are three steps to enabling security for a VoltDB application:
Add the <security enabled="true"/> tag to the deployment file to turn on authentication and
authorization.
Define the users and roles you need to authenticate.
Define which roles have access to each stored procedure.
The following sections describe each step of this process, plus how to enable access to system procedures and ad hoc queries.
V4.x Documentation