Running in-memory server with aurthentication enabled

[MDanialSaleem]

Hi,

I am trying to set up in-memory backed janusgraph with authentication enabled.
These are my config files:

host: 0.0.0.0
port: 8182
evaluationTimeout: 30000
channelizer: org.apache.tinkerpop.gremlin.server.channel.WsAndHttpChannelizer
graphs: {
  graph: /etc/opt/janusgraph/janusgraph.properties
}
scriptEngines: {
  gremlin-groovy: {
    plugins: { org.janusgraph.graphdb.tinkerpop.plugin.JanusGraphGremlinPlugin: {},
              org.apache.tinkerpop.gremlin.server.jsr223.GremlinServerGremlinPlugin: {},
              org.apache.tinkerpop.gremlin.tinkergraph.jsr223.TinkerGraphGremlinPlugin: {},
              org.apache.tinkerpop.gremlin.jsr223.ImportGremlinPlugin: {classImports: [java.lang.Math], methodImports: [java.lang.Math#*]},
              org.apache.tinkerpop.gremlin.jsr223.ScriptFileGremlinPlugin: {files: [/etc/opt/janusgraph/janusgraph.init.groovy]}}}}
serializers:
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV3d0, config: { ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistry] }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV3d0, config: { serializeResultToString: true }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GraphSONMessageSerializerV3d0, config: { ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistry] }}
  # Older serialization versions for backwards compatibility:
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0, config: { ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistry] }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GryoLiteMessageSerializerV1d0, config: {ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistry] }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0, config: { serializeResultToString: true }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GraphSONMessageSerializerV2d0, config: { ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistry] }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GraphSONMessageSerializerGremlinV1d0, config: { ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistryV1d0] }}
  - { className: org.apache.tinkerpop.gremlin.driver.ser.GraphSONMessageSerializerV1d0, config: { ioRegistries: [org.janusgraph.graphdb.tinkerpop.JanusGraphIoRegistryV1d0] }}
processors:
  - { className: org.apache.tinkerpop.gremlin.server.op.session.SessionOpProcessor, config: { sessionTimeout: 28800000 }}
  - { className: org.apache.tinkerpop.gremlin.server.op.traversal.TraversalOpProcessor, config: { cacheExpirationTime: 600000, cacheMaxSize: 1000 }}
metrics: {
  jmxReporter: {enabled: true}
}
maxInitialLineLength: 4096
maxHeaderSize: 8192
maxChunkSize: 8192
maxContentLength: 262144
maxAccumulationBufferComponents: 1024
resultIterationBatchSize: 64
writeBufferLowWaterMark: 32768
writeBufferHighWaterMark: 65536

threadPoolWorker: 1
gremlinPool: 8
authentication: {
  authenticator: org.janusgraph.graphdb.tinkerpop.gremlin.server.auth.SaslAndHMACAuthenticator,
  authenticationHandler: org.janusgraph.graphdb.tinkerpop.gremlin.server.handler.SaslAndHMACAuthenticationHandler,
  config: {
    defaultUsername: user,
    defaultPassword: pass,
    hmacSecret: secret,
    credentialsDb: /etc/opt/janusgraph/db-credentials-server.properties
  }
}

And contents of /etc/opt/janusgraph/db-credentials-server.properties:

gremlin.graph=org.janusgraph.core.JanusGraphFactory
storage.backend=inmemory

contents of janusgraph.properties

gremlin.graph=org.janusgraph.core.JanusGraphFactory
storage.backend=inmemory
query.force-index=true

But I get a 401 unauthorized.

Could not find any information on in-memory authentication enabled deployment in the docs either. Is it even possible (Considering the fact that "credentialsDb should be different from the graph(s) you are using". )?

Thanks :)

[FlorianHockmann]

Maybe someone with more experience of the inmemory backend will correct me here, but I think the problem is that you cannot really create separate graphs with it. So your credentials would be stored in the same graph that you're trying to protect via authentication. Maybe it will work, but users who have valid credentials will be able to modify the credentials completely (like removing / changing credentials of other users).
I would suggest that you use a different backend for authentication like BerkeleyDB which is quite easy to set up and just stores its data on the local file system.
Another alternative in your case might be to use TinkerGraph as the credentialsDb. You can then create the credentials graph once, export it to a file and then let TinkerGraph just read that file. TinkerGraph is documented here.

[MDanialSaleem]

Thanks @FlorianHockmann
I had the same hunch, and it makes sense to me.

1. The reason I am not using BerkelyDB or any other backend is because this is for local development environment and I want to keep it as minimal as possible, I already have far too many services running in the docker compose :)
2. Will try out TinkerGraph and get back to you.
3. Hypothetically, is it not possible to make two separate in-memory graphs in the same instance, one for credentials and one for actual storage? I think that's what we are doing with the TinkerGraph approach, right? So, maybe it should be possible to do two Janusgraph instances as well.

[FlorianHockmann]

BerkelyDB at least isn't a separate process / service as it's executed within the same JVM as JanusGraph itself. See the docs for this storage backend for more information. The JanusGraph Docker image also uses this backend for that reason by default if no other backend is specified.

But regarding the in-memory backend: I think I was wrong in my initial assumption here that the problem would be to create multiple different graphs. You can of course create different graphs with the in-memory backend. The easiest way to do this is like this:

graph1 = JanusGraphFactory.build().set('storage.backend', 'inmemory').open()
graph2 = JanusGraphFactory.build().set('storage.backend', 'inmemory').open()

The problem with using the in-memory backend for authentication however is that you need to access the credentialsDb somehow to create new users. But you can't do that as you will get a completely different in-memory instance each time you open the graph with your db-credentials-server.properties file. You would of course also have to create the users again for every start of JanusGraph as it doesn't persist the credentials.
What I however don't understand here is why this at least doesn't work with the defaultUsername and defaultPassword. I'm not sure though whether authentication can in general work with the in-memory backend. You could create an issue for this as we should probably either get this to work at least for the default credentials with the in-memory backend or clearly document that this backend cannot be used for authentication.