Security is an important feature of any application. By default, VoltDB does not perform any security checks when a client application opens a connection to the database or invokes a stored procedure. This is convenient when developing and distributing an application on a private network.
However, on public or semi-private networks, it is important to make sure only known client applications are interacting with the database. VoltDB lets you control access to the database through settings in the schema and configuration. The following sections explain how to enable and configure security for your VoltDB application.
When an application creates a connection to a VoltDB database (using ClientFactory.clientCreate), it passes a username and password as part of the client configuration. These parameters identify the client to the database and are used for authenticating access.
At runtime, if security is enabled, the username and password passed in by the client application are validated by the server against the users defined in the configuration. If the client application passes in a valid username and password pair for an account that has not expired, the connection is established. When the application calls a stored procedure, permissions are checked again. If the schema identifies the user as being assigned a role having access to that stored procedure, the procedure is executed. If not, an error is returned to the calling application.
VoltDB uses SHA-256 hashing rather than encryption when passing the username and password between the client and the server. The passwords are also hashed within the database. To secure the actual communication between the server and client, you can implement either Transport Layer Security (TLS) or Kerberos security. Use of TLS is described in Section 12.7, “Encrypting VoltDB Communication Using TLS/SSL” while the use of Kerberos with VoltDB is described in Section 12.9, “Integrating Kerberos Security with VoltDB”.
There are three steps to enabling security for a VoltDB application:
Set the deployment.security.enabled property to true in the
configuration to turn on authentication and authorization.
Define the users and roles you need to authenticate.
Define which roles have access to each stored procedure.
The following sections describe each step of this process, plus how to enable access to system procedures and ad hoc queries.
Documentation