Description of problem: When server cache is clustered, HR client is not able to authenticate itself even when using proper credentials. It seems that transport layer breaks authentication process. When local cache is used, everything works as expected. How reproducible: Always Steps to Reproduce: 1. setup HR security (config sniplets are bellow) 2. use security for distributed or replicated cache 3. connect to this cache from HR client, using proper credentials Actual results: HR authentication fails with 09:44:00,343 INFO [org.infinispan.AUDIT] (HotRodServerWorker-1) [DENY] null ADMIN cache[securedcache] Expected results: HR client should be able to authenticate and read/write to cache according to the specified rights Additional info: HR server config: <hotrod-connector socket-binding="hotrod" cache-container="securedcachecontainer"> <topology-state-transfer lazy-retrieval="false" lock-timeout="1000" replication-timeout="5000"/> <authentication security-realm="ApplicationRealm"> <sasl server-name="securedserver" mechanisms="DIGEST-MD5" qop="auth"> <policy> <no-anonymous value="true"/> </policy> <property name="com.sun.security.sasl.digest.utf8">true</property> </sasl> </authentication> </hotrod-connector> <cache-container name="securedcachecontainer" default-cache="securedcache"> <transport executor="infinispan-transport" lock-timeout="60000"/> <security> <authorization> <identity-role-mapper/> <role name="admin" permissions="ALL" /> <role name="reader" permissions="READ BULK_READ"/> <role name="writer" permissions="ALL" /> <role name="supervisor" permissions="READ WRITE EXEC" /> </authorization> </security> <replicated-cache name="securedcache" mode="SYNC" start="EAGER" remote-timeout="30000" > <security> <authorization roles="admin reader writer" /> </security> </replicated-cache> </cache-container>
PR: https://github.com/infinispan/jdg/pull/308