Administrative user management

This section describes how to set up users and user rights for accessing administrative instruments.

Administrative access to FEJ can be obtained through:

• remote shell
• JMX
• FIXICC app

Configuration of users and their access rights are performed by using Spring Security.

For details on monitoring and management by using a remote shell, refer to FIXEdge Java Administration.

Security configuration

FEJ uses Spring Security for authentication purposes. Authentication configuration is located in the spring/custom-security.xml file.

File-based authentication

By default, for testing purposes, the FEJ container uses simple in-memory authentication with the NoOpPasswordEncoder encoder and plain-text credentials.

For other password encoder options, please check Spring Security 5.0.

If you need a more complex authentication solution, please refer to the Spring Security documentation.

The authentication mechanism is defined in spring/custom-security.xml:

   <!--Mock Authentication-->
    <sec:authentication-manager id="authenticationManager">
        <sec:authentication-provider>
            <sec:password-encoder ref="passwordEncoder"/>
            <sec:user-service id="userDetailsService" properties="admin-users.properties"/>
        </sec:authentication-provider>
    </sec:authentication-manager>
 
    <!-- Password encode bean to support plain text passwords in user.properties -->
    <bean id="passwordEncoder"
          class="org.springframework.security.crypto.password.NoOpPasswordEncoder"
          factory-method="getInstance"/>
 
    <!-- Password encode bean to support passwords encrypted with BCrypt way in admin.properties -->
<!--    <bean id="adminPasswordEncoder"-->
<!--          class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>-->

Authorized administrative users are defined in the admin-users.properties properties file:

# Spring security file format
# password depends on configured spring PasswordEncoder (hash or plain text)
#
# Format: username=password,grantedAuthority[,grantedAuthority][,enabled|disabled]

# password is plain text
admin=admin,JMX_ADMIN,SSH_ADMIN,FIXICC_ADMIN,enabled
guest=guest,FIXICC_GUEST,enabled

# password is hash (bcrypt)
#admin=$2a$10$hCDWIHTwb7zui0dDbG8dXe2r9x3H4JDEynQuoGDn85rk6vOjxGoJC,JMX_ADMIN,SSH_ADMIN,FIXICC_ADMIN,enabled
#guest=$2a$10$pQcJLlpuHRmn5w1MdBx/xudmEBKc0l/ER7TXifc2zntKIrW3lw8S2,FIXICC_GUEST,enabled

By default, FEJ provides such user roles with different access level: 

• FIXICC_ADMIN - access by FIXICC with ALL permissions (the role is defined in fixicc_permissions.properties )
• FIXICC_GUEST - access by FIXICC with ONLY READ permissions (the role is defined in fixicc_permissions.properties )
• SSH_ADMIN - access by Remote Shell with ALL permissions (the role is defined in fixedge.properties)
• JMX_ADMIN - access by JMX with ALL permissions (the role is defined in fixedge.properties)

LDAP authentication

FEJ also supports authentication against an LDAP server.

Before getting deep into LDAP authentication, let’s get familiar with some LDAP terms.

To activate authentication of administrative users with LDAP, it needs to replace the authentication-manager bean definition in the spring/custom-security.xml file:

<authentication-manager>
    <ldap-authentication-provider
      ="ou=people"
      user-search-filter="(uid={0})"
      group-search-base="ou=groups"
      group-search-filter="(member={0})">
    </ldap-authentication-provider>
</authentication-manager>
   
<ldap-server url="ldap://epam.com:389/dc=epam,dc=com" 
                     manager-dn="uid=admin,ou=system"
                     manager-password="admin"/>

where

Check more details about the configuration authentication with an LDAP server on Spring Documentation.

Administrative shell configuration

To configure access to the interactive shell, shell configuration properties are used.

Shell configuration properties are defined by the shell.properties file.

FEJ uses the Java shell called ‘CRaSH’. For more information about configuration properties, please refer to the CRaSH reference documentation.

Administrative JMX configuration

The fixedge.properties file contains settings for defining the JMX port and the URL for accessing the JMX service.

For details, refer to the official Java documentation.

Monitoring and management by using the JMX technology is described in the Management over JMX section.

FIXICC access configuration

For details on the FIXICC access configuration, refer to the FIXICC & FEJ Integration User Guide.

Administrative REST API configuration

FIX Edge Java has REST API functionality that can be used for FIX sessions management.

REST API is configuring in the fixedge.properties file.

# Enable REST service, if it is false or empty, REST service will not be available
rest.service.enable=true

# Name of REST service, if it is empty or disabled, REST service will not be available and registered in Service Discovery
# rest.service.name=REST-AdminAPI

# Name of REST port, if it is empty or disabled, REST service will not be available and registered in Service Discovery
rest.service.port=9010

# Path to SSL certificate, should not be empty to create REST service and register it in Discovery
rest.ssl.cert.path=/ssl/cert.pem

# Path to SSL key, should not be empty to create REST service and register it in Discovery
rest.ssl.key.path=/ssl/key.pem