Hazelcast: Improve group password configuration

[kwart]

There is an ongoing effort related to removing group password from Hazelcast configuration. The password is not checked anymore during member joins. This should be also reflected in XML configurations and XSD element descriptions.

Suggestion for improvement:

• remove the <password> element from hazelcast-default.xml, hazelcast-full-example.xml (fix also the related comment) and hazelcast-client-full.xml
• update password element description in hazelcast-config-3.10.xsd and hazelcast-client-config-3.10.xsd. Add there a note that this is deprecated and not used for join checks anymore.

[nlwillia]

What's the alternative if you don't care about fine grained security (an Enterprise feature), but do want to prevent just any process from being able to connect to your cluster (as a member or as a client)?

[kwart]

I've realized the the client connections still check the group passwords. New issue #11867 was reported to fix it

[ramtech123]

Hi Team,
Googled around, but just couldn't find any reason for removal of 'group password' feature. I also have the same questions that was asked by @nlwillia above.

Could somebody clear the doubts, please? Thanks.

[mmedenjak]

Password has an unfortunate name. It was not intended to provide security, only to prevent members with different values from forming a cluster.

To this end, we already have a hazelcast property hazelcast.application.validation.token. Members with the same group name but different validation tokens will not form a cluster.

[ramtech123]

Thanks @mmedenjak. That helps 👍

[ramtech123]

Just verified the behavior of hazelcast.application.validation.token - new member having same group name but a non-matching validation token will not be able to start itself, as it will be forcefully shutdown. So, group name is the only field which will let two (or more) different nodes run as separate independent clusters.

Node could not join cluster. A Configuration mismatch was detected: Incompatible 'hazelcast.application.validation.token'! expected: test.validation.token1, found: test.validation.token2 Node is going to shutdown now!

[sancar]

Client side is also fixed by https://github.com/hazelcast/hazelcast/pull/13597 in 3.11.
Related documentation will be addressed with https://github.com/hazelcast/hazelcast-reference-manual/issues/590 in 3.11.
Moving this to 3.11 and closing the issue since there is nothing left to do on main repo.