You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by ac...@apache.org on 2013/01/31 16:32:51 UTC
svn commit: r1441019 [5/6] - in
/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book: html/ pdf/
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html?rev=1441019&r1=1441018&r2=1441019&view=diff
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html (original)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html Thu Jan 31 15:32:50 2013
@@ -1,8 +1,8 @@
-<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>1.5. Security</title><link rel="stylesheet" href="css/style.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="AMQP Messaging Broker (Implemented in C++)"><link rel="up" href="ch01.html" title="Chapter 1. Running the AMQP Messaging Broker"><link rel="prev" href="chap-Messaging_User_Guide-Broker_Federation.html" title="1.4. Broker Federation"><link rel="next" href="ch01s06.html" title="1.6. LVQ - Last Value Queue"></head><body><div class="container" bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><DIV class="header"><DIV class="logo"><H1>Apache Qpidâ¢</H1><H2>Open Source AMQP Messaging</H2></DIV></DIV><DIV class="menu_box"><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Apache Qpid</H3><UL><LI><A href="http://qpid.apache.org/index.html">Home</A></LI><LI
><A href="http://qpid.apache.org/download.html">Download</A></LI><LI><A href="http://qpid.apache.org/getting_started.html">Getting Started</A></LI><LI><A href="http://www.apache.org/licenses/">License</A></LI><LI><A href="https://cwiki.apache.org/qpid/faq.html">FAQ</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Documentation</H3><UL><LI><A href="http://qpid.apache.org/documentation.html#doc-release">Latest Release</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-trunk">Trunk</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-archives">Archive</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Community</H3><UL><LI><A href="http://qpid.apache.org/getting_involved.html">Getting Involved</A></LI><LI><A href="http://qpid.apache.org/source_repository.html">Source Repository</A></LI><LI><A href="http://qpid.apache
.org/mailing_lists.html">Mailing Lists</A></LI><LI><A href="https://cwiki.apache.org/qpid/">Wiki</A></LI><LI><A href="https://issues.apache.org/jira/browse/qpid">Issue Reporting</A></LI><LI><A href="http://qpid.apache.org/people.html">People</A></LI><LI><A href="http://qpid.apache.org/acknowledgements.html">Acknowledgements</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Developers</H3><UL><LI><A href="https://cwiki.apache.org/qpid/building.html">Building Qpid</A></LI><LI><A href="https://cwiki.apache.org/qpid/developer-pages.html">Developer Pages</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About AMQP</H3><UL><LI><A href="http://qpid.apache.org/amqp.html">What is AMQP?</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About Apache</H3><UL><LI><A href="http://www.apache.
org">Home</A></LI><LI><A href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</A></LI><LI><A href="http://www.apache.org/foundation/thanks.html">Thanks</A></LI><LI><A href="http://www.apache.org/security/">Security</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV></DIV><div class="main_text_area"><div class="main_text_area_top"></div><div class="main_text_area_body"><DIV class="breadcrumbs"><span class="breadcrumb-link"><a href="index.html">AMQP Messaging Broker (Implemented in C++)</a></span> > <span class="breadcrumb-link"><a href="ch01.html">
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>1.5. Security</title><link rel="stylesheet" type="text/css" href="css/style.css"><meta name="generator" content="DocBook XSL Stylesheets V1.77.1"><link rel="home" href="index.html" title="AMQP Messaging Broker (Implemented in C++)"><link rel="up" href="ch01.html" title="Chapter 1. Running the AMQP Messaging Broker"><link rel="prev" href="chap-Messaging_User_Guide-Broker_Federation.html" title="1.4. Broker Federation"><link rel="next" href="ch01s06.html" title="1.6. LVQ - Last Value Queue"></head><body><div class="container" bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><DIV class="header"><DIV class="logo"><H1>Apache Qpidâ¢</H1><H2>Open Source AMQP Messaging</H2></DIV></DIV><DIV class="menu_box"><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Apache Qpid</H3><UL><LI><A href="http://qpid.apache.org/index.html">Home</A></LI><LI>
<A href="http://qpid.apache.org/download.html">Download</A></LI><LI><A href="http://qpid.apache.org/getting_started.html">Getting Started</A></LI><LI><A href="http://www.apache.org/licenses/">License</A></LI><LI><A href="https://cwiki.apache.org/qpid/faq.html">FAQ</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Documentation</H3><UL><LI><A href="http://qpid.apache.org/documentation.html#doc-release">Latest Release</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-trunk">Trunk</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-archives">Archive</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Community</H3><UL><LI><A href="http://qpid.apache.org/getting_involved.html">Getting Involved</A></LI><LI><A href="http://qpid.apache.org/source_repository.html">Source Repository</A></LI><LI><A href="http://qpid.apache.
org/mailing_lists.html">Mailing Lists</A></LI><LI><A href="https://cwiki.apache.org/qpid/">Wiki</A></LI><LI><A href="https://issues.apache.org/jira/browse/qpid">Issue Reporting</A></LI><LI><A href="http://qpid.apache.org/people.html">People</A></LI><LI><A href="http://qpid.apache.org/acknowledgements.html">Acknowledgements</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Developers</H3><UL><LI><A href="https://cwiki.apache.org/qpid/building.html">Building Qpid</A></LI><LI><A href="https://cwiki.apache.org/qpid/developer-pages.html">Developer Pages</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About AMQP</H3><UL><LI><A href="http://qpid.apache.org/amqp.html">What is AMQP?</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About Apache</H3><UL><LI><A href="http://www.apache.o
rg">Home</A></LI><LI><A href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</A></LI><LI><A href="http://www.apache.org/foundation/thanks.html">Thanks</A></LI><LI><A href="http://www.apache.org/security/">Security</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV></DIV><div class="main_text_area"><div class="main_text_area_top"></div><div class="main_text_area_body"><DIV class="breadcrumbs"><span class="breadcrumb-link"><a href="index.html">AMQP Messaging Broker (Implemented in C++)</a></span> > <span class="breadcrumb-link"><a href="ch01.html">
Running the AMQP Messaging Broker
- </a></span> > <span class="breadcrumb-node">Security</span></DIV><div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="chap-Messaging_User_Guide-Security"></a>1.5. Security</h2></div></div></div><p>
+ </a></span> > <span class="breadcrumb-node">Security</span></DIV><div class="section"><div class="titlepage"><div><div><h2 class="title"><a name="chap-Messaging_User_Guide-Security"></a>1.5. Security</h2></div></div></div><p>
This chapter describes how authentication, rule-based authorization, encryption, and digital signing can be accomplished using Qpid. Authentication is the process of verifying the identity of a user; in Qpid, this is done using the SASL framework. Rule-based authorization is a mechanism for specifying the actions that each user is allowed to perform; in Qpid, this is done using an Access Control List (ACL) that is part of the Qpid broker. Encryption is used to ensure that data is not transferred in a plain-text format that could be intercepted and read. Digital signatures provide proof that a given message was sent by a known sender. Encryption and signing are done using SSL (they can also be done using SASL, but SSL provides stronger encryption).
- </p><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-User_Authentication"></a>1.5.1. User Authentication</h3></div></div></div><p>
+ </p><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-User_Authentication"></a>1.5.1. User Authentication</h3></div></div></div><p>
AMQP uses Simple Authentication and Security Layer (SASL) to authenticate client connections to the broker. SASL is a framework that supports a variety of authentication methods. For secure applications, we suggest <span class="command"><strong>CRAM-MD5</strong></span>, <span class="command"><strong>DIGEST-MD5</strong></span>, or <span class="command"><strong>GSSAPI</strong></span>. The <span class="command"><strong>ANONYMOUS</strong></span> method is not secure. The <span class="command"><strong>PLAIN</strong></span> method is secure only when used together with SSL.
</p><p>
Both the Qpid broker and Qpid clients use the <a class="ulink" href="http://cyrusimap.web.cmu.edu/" target="_top">Cyrus SASL library</a>, a full-featured authentication framework, which offers many configuration options. This section shows how to configure users for authentication with SASL, which is sufficient when using <span class="command"><strong>SASL PLAIN</strong></span>. If you are not using SSL, you should configure SASL to use <span class="command"><strong>CRAM-MD5</strong></span>, <span class="command"><strong>DIGEST-MD5</strong></span>, or <span class="command"><strong>GSSAPI</strong></span> (which provides Kerberos authentication). For information on configuring these and other options in SASL, see the Cyrus SASL documentation.
@@ -18,7 +18,7 @@
# Set auth to 'yes' or 'no'
auth=yes
-</pre><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-User_Authentication-Configuring_SASL"></a>1.5.1.1. Configuring SASL</h4></div></div></div><p>
+</pre><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-User_Authentication-Configuring_SASL"></a>1.5.1.1. Configuring SASL</h4></div></div></div><p>
On Linux systems, the SASL configuration file is generally found in <code class="filename">/etc/sasl2/qpidd.conf</code> or <code class="filename">/usr/lib/sasl2/qpidd.conf</code>.
</p><p>
The SASL database contains user names and passwords for SASL. In SASL, a user may be associated with a <em class="firstterm">realm</em>. The Qpid broker authenticates users in the <span class="command"><strong>QPID</strong></span> realm by default, but it can be set to a different realm using the <span class="command"><strong>realm</strong></span> option:
@@ -42,13 +42,13 @@ realm=QPID
</p><pre class="screen"># sasldblistusers2 -f /var/lib/qpidd/qpidd.sasldb
</pre><p>
If you are using <span class="command"><strong>PLAIN</strong></span> authentication, users who are in the database can now connect with their user name and password. This is secure only if you are using SSL. If you are using a more secure form of authentication, please consult your SASL documentation for information on configuring the options you need.
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-User_Authentication-Kerberos"></a>1.5.1.2. Kerberos</h4></div></div></div><p>
+ </p></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-User_Authentication-Kerberos"></a>1.5.1.2. Kerberos</h4></div></div></div><p>
Both the Qpid broker and Qpid users are 'principals' of the Kerberos server, which means that they are both clients of the Kerberos authentication services.
</p><p>
To use Kerberos, both the Qpid broker and each Qpid user must be authenticated on the Kerberos server:
- </p><div class="procedure"><ol type="1"><li><p>
+ </p><div class="procedure"><ol class="procedure" type="1"><li class="step"><p>
Install the Kerberos workstation software and Cyrus SASL GSSAPI on each machine that runs a qpidd broker or a qpidd messaging client:
- </p><pre class="screen">$ sudo yum install cyrus-sasl-gssapi krb5-workstation</pre></li><li><p>
+ </p><pre class="screen">$ sudo yum install cyrus-sasl-gssapi krb5-workstation</pre></li><li class="step"><p>
Make sure that the Qpid broker is registered in the Kerberos database.
</p><p>
Traditionally, a Kerberos principal is divided into three parts: the primary, the instance, and the realm. A typical Kerberos V5 has the format <code class="literal">primary/instance@REALM</code>. For a Qpid broker, the primary is <code class="literal">qpidd</code>, the instance is the fully qualified domain name, which you can obtain using <span class="command"><strong>hostname --fqdn</strong></span>, and the REALM is the Kerberos domain realm. By default, this realm is <code class="literal">QPID</code>, but a different realm can be specified in qpid.conf, e.g.:
@@ -81,13 +81,13 @@ auth=yes
realm=EXAMPLE.COM
</pre><p>
Restart the broker to activate these settings.
- </p></li><li><p>
+ </p></li><li class="step"><p>
Make sure that each Qpid user is registered in the Kerberos database, and that Kerberos is correctly configured on the client machine. The Qpid user is the account from which a Qpid messaging client is run. If it is correctly configured, the following command should succeed:
</p><pre class="screen">$ kinit user@REALM.COM</pre></li></ol></div><p>
Java JMS clients require a few additional steps.
- </p><div class="procedure"><ol type="1"><li><p>
+ </p><div class="procedure"><ol class="procedure" type="1"><li class="step"><p>
The Java JVM must be run with the following arguments:
- </p><div class="variablelist"><dl><dt><span class="term">-Djavax.security.auth.useSubjectCredsOnly=false</span></dt><dd><p>
+ </p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-Djavax.security.auth.useSubjectCredsOnly=false</span></dt><dd><p>
Forces the SASL GASSPI client to obtain the kerberos credentials explicitly instead of obtaining from the "subject" that owns the current thread.
</p></dd><dt><span class="term">-Djava.security.auth.login.config=myjas.conf</span></dt><dd><p>
Specifies the jass configuration file. Here is a sample JASS configuration file:
@@ -97,17 +97,17 @@ com.sun.security.jgss.initiate {
};
</pre></dd><dt><span class="term">-Dsun.security.krb5.debug=true</span></dt><dd><p>
Enables detailed debug info for troubleshooting
- </p></dd></dl></div></li><li><p>
+ </p></dd></dl></div></li><li class="step"><p>
The client's Connection URL must specify the following Kerberos-specific broker properties:
- </p><div class="itemizedlist"><ul><li><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
<code class="varname">sasl_mechs</code> must be set to <code class="literal">GSSAPI</code>.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
<code class="varname">sasl_protocol</code> must be set to the principal for the qpidd broker, e.g. <code class="literal">qpidd</code>/
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
<code class="varname">sasl_server</code> must be set to the host for the SASL server, e.g. <code class="literal">sasl.com</code>.
</p></li></ul></div><p>
Here is a sample connection URL for a Kerberos connection:
- </p><pre class="screen">amqp://guest@clientid/testpath?brokerlist='tcp://localhost:5672?sasl_mechs='GSSAPI'&sasl_protocol='qpidd'&sasl_server='<server-host-name>''</pre></li></ol></div></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Authorization"></a>1.5.2. Authorization</h3></div></div></div><p>
+ </p><pre class="screen">amqp://guest@clientid/testpath?brokerlist='tcp://localhost:5672?sasl_mechs='GSSAPI'&sasl_protocol='qpidd'&sasl_server='<server-host-name>''</pre></li></ol></div></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Authorization"></a>1.5.2. Authorization</h3></div></div></div><p>
In Qpid, Authorization specifies which actions can be performed by each authenticated user using an Access Control List (ACL).
</p><p>
Use the <span class="command"><strong>--acl-file</strong></span> command to load the access control list. The filename should have a <code class="filename">.acl</code> extension:
@@ -152,7 +152,7 @@ com.sun.security.jgss.initiate {
then the broker is required to perform a <span class="emphasis"><em>publish exchange</em></span> query for each message published.
Users with performance critical applications are encouraged to structure exchanges, queues, and bindings so that
the <span class="emphasis"><em>publish exchange</em></span> ACL rules are unnecessary.
- </p><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntax"></a>1.5.2.1. ACL Syntax</h4></div></div></div><p>
+ </p><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntax"></a>1.5.2.1. ACL Syntax</h4></div></div></div><p>
ACL rules must be on a single line and follow this syntax:
</p><pre class="programlisting">
user = username[/domain[@realm]]
@@ -313,7 +313,7 @@ com.sun.security.jgss.initiate {
Management or agent or broker method
</p>
- </td></tr></tbody></table></div></div><br class="table-break"><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty"></a><p class="title"><b>Table 1.7. ACL Rules:property</b></p><div class="table-contents"><table summary="ACL Rules:property" border="1"><colgroup><col><col><col><col></colgroup><thead><tr><th>Property</th><th>Type</th><th>Description</th><th>Usage</th></tr></thead><tbody><tr><td> <span class="command"><strong>name</strong></span> </td><td>String</td><td>Object name, such as a queue name or exchange name.</td><td> </td></tr><tr><td> <span class="command"><strong>durable</strong></span> </td><td>Boolean</td><td>Indicates the object is durable</td><td>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>routingkey</strong></span> </td><td>String</td><td>Specifies routing key</td><td>BIND EXCHANGE, UNBIND EXCHANGE, ACCESS EXCHANGE, PUBLISH EXCHANGE</td></tr><tr><td
> <span class="command"><strong>autodelete</strong></span> </td><td>Boolean</td><td>Indicates whether or not the object gets deleted when the connection is closed</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>exclusive</strong></span> </td><td>Boolean</td><td>Indicates the presence of an <em class="parameter"><code>exclusive</code></em> flag</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>type</strong></span> </td><td>String</td><td>Type of exchange, such as topic, fanout, or xml</td><td>CREATE EXCHANGE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>alternate</strong></span> </td><td>String</td><td>Name of the alternate exchange</td><td>CREATE EXCHANGE, CREATE QUEUE, ACCESS EXCHANGE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuename</strong></span> </td><td>String</td><td>Name of the queue</td><td>ACCESS EXCHANGE, BIND EXCHANGE, UNBIND EXCHANGE</td></tr><tr><td> <sp
an class="command"><strong>schemapackage</strong></span> </td><td>String</td><td>QMF schema package name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>schemaclass</strong></span> </td><td>String</td><td>QMF schema class name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>queuemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_size (memory bytes)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queue.max_size (memory bytes)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_count (messages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queu
e.max_count (messages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for file.max_size (64kb pages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for file.max_size (64kb pages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for file.max_count (files)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for file.max_count (files)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr></tbody></table></div></div><br class="table-break"><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_G
uide-Authorization-ACL_ActionObjectPropertyTuples"></a>ACL Action-Object-Property Tuples</h5></div></div></div><p>
+ </td></tr></tbody></table></div></div><br class="table-break"><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty"></a><p class="title"><b>Table 1.7. ACL Rules:property</b></p><div class="table-contents"><table summary="ACL Rules:property" border="1"><colgroup><col><col><col><col></colgroup><thead><tr><th>Property</th><th>Type</th><th>Description</th><th>Usage</th></tr></thead><tbody><tr><td> <span class="command"><strong>name</strong></span> </td><td>String</td><td>Object name, such as a queue name or exchange name.</td><td> </td></tr><tr><td> <span class="command"><strong>durable</strong></span> </td><td>Boolean</td><td>Indicates the object is durable</td><td>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>routingkey</strong></span> </td><td>String</td><td>Specifies routing key</td><td>BIND EXCHANGE, UNBIND EXCHANGE, ACCESS EXCHANGE, PUBLISH EXCHANGE</td></tr><tr><td
> <span class="command"><strong>autodelete</strong></span> </td><td>Boolean</td><td>Indicates whether or not the object gets deleted when the connection is closed</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>exclusive</strong></span> </td><td>Boolean</td><td>Indicates the presence of an <em class="parameter"><code>exclusive</code></em> flag</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>type</strong></span> </td><td>String</td><td>Type of exchange, such as topic, fanout, or xml</td><td>CREATE EXCHANGE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>alternate</strong></span> </td><td>String</td><td>Name of the alternate exchange</td><td>CREATE EXCHANGE, CREATE QUEUE, ACCESS EXCHANGE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuename</strong></span> </td><td>String</td><td>Name of the queue</td><td>ACCESS EXCHANGE, BIND EXCHANGE, UNBIND EXCHANGE</td></tr><tr><td> <sp
an class="command"><strong>schemapackage</strong></span> </td><td>String</td><td>QMF schema package name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>schemaclass</strong></span> </td><td>String</td><td>QMF schema class name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>queuemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_size (memory bytes)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queue.max_size (memory bytes)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_count (messages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queu
e.max_count (messages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for file.max_size (64kb pages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for file.max_size (64kb pages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for file.max_count (files)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for file.max_count (files)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr></tbody></table></div></div><br class="table-break"><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Autho
rization-ACL_ActionObjectPropertyTuples"></a>ACL Action-Object-Property Tuples</h5></div></div></div><p>
Not every ACL action is applicable to every ACL object. Furthermore, not every property may be
specified for every action-object pair.
The following table enumerates which action and object pairs are allowed.
@@ -329,35 +329,35 @@ com.sun.security.jgss.initiate {
</p><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties"></a><p class="title"><b>Table 1.8. ACL Properties Allowed for each Action and Object</b></p><div class="table-contents"><table summary="ACL Properties Allowed for each Action and Object" border="1"><colgroup><col><col><col><col></colgroup><thead><tr><th>Action</th><th>Object</th><th>Properties</th><th>Method</th></tr></thead><tbody><tr><td>access</td><td>broker</td><td> </td><td class="auto-generated"> </td></tr><tr><td>access</td><td>exchange</td><td>name type alternate durable</td><td>declare</td></tr><tr><td>access</td><td>exchange</td><td>name queuename routingkey</td><td>bound</td></tr><tr><td>access</td><td>exchange</td><td>name</td><td>query</td></tr><tr><td>access</td><td>method</td><td>name schemapackage schemaclass</td><td> </td></tr><tr><td>access</td><td>queue</td><td>name alternate durable exclusive autodelete policy queuemaxsizelowerlimit queuem
axsizeupperlimit queuemaxcountlowerlimit queuemaxcountupperlimit filemaxsizelowerlimit filemaxsizeupperlimit filemaxcountlowerlimit filemaxcountupperlimit</td><td>declare</td></tr><tr><td>access</td><td>queue</td><td>name</td><td>query</td></tr><tr><td>bind</td><td>exchange</td><td>name queuename routingkey</td><td>Â </td></tr><tr><td>consume</td><td>queue</td><td>name</td><td>Â </td></tr><tr><td>create</td><td>exchange</td><td>name type alternate durable</td><td>Â </td></tr><tr><td>create</td><td>link</td><td>name</td><td>Â </td></tr><tr><td>create</td><td>queue</td><td>name alternate durable exclusive autodelete policy queuemaxsizelowerlimit queuemaxsizeupperlimit queuemaxcountlowerlimit queuemaxcountupperlimit filemaxsizelowerlimit filemaxsizeupperlimit filemaxcountlowerlimit filemaxcountupperlimit</td><td>Â </td></tr><tr><td>delete</td><td>exchange</td><td>name</td><td>Â </td></tr><tr><td>delete</td><td>queue</td><td>name</td><td>Â </td></tr><tr><td>publish
</td><td>exchange</td><td>name routingkey</td><td>Â </td></tr><tr><td>purge</td><td>queue</td><td>name</td><td>Â </td></tr><tr><td>unbind</td><td>exchange</td><td>name queuename routingkey</td><td>Â </td></tr><tr><td>update</td><td>broker</td><td>Â </td><td>Â </td></tr></tbody></table></div></div><br class="table-break"><p>
- </p></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions"></a>1.5.2.2. ACL Syntactic Conventions</h4></div></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-comments"></a>Comments</h5></div></div></div><p>
- </p><div class="itemizedlist"><ul><li><p>
+ </p></div></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions"></a>1.5.2.2. ACL Syntactic Conventions</h4></div></div></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-comments"></a>Comments</h5></div></div></div><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
A line starting with the <span class="command"><strong>#</strong></span> character is considered a comment and is ignored.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Embedded comments and trailing comments are not allowed. The <span class="command"><strong>#</strong></span> is commonly found in routing keys and other AMQP literals which occur naturally in ACL rule specifications.
</p></li></ul></div><p>
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-whitespace"></a>White Space</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ </p></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-whitespace"></a>White Space</h5></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
Empty lines and lines that contain only whitespace (' ', '\f', '\n', '\r', '\t', '\v') are ignored.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Additional whitespace between and after tokens is allowed.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Group and Acl definitions must start with <span class="command"><strong>group</strong></span> and <span class="command"><strong>acl</strong></span> respectively and with no preceding whitespace.
- </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-characterset"></a>Character Set</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ </p></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-characterset"></a>Character Set</h5></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
ACL files use 7-bit ASCII characters only
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Group names may contain only
- </p><div class="itemizedlist"><ul><li><span class="command"><strong>[a-z]</strong></span></li><li><span class="command"><strong>[A-Z]</strong></span></li><li><span class="command"><strong>[0-9]</strong></span></li><li><span class="command"><strong>'-'</strong></span> hyphen</li><li><span class="command"><strong>'_'</strong></span> underscore</li></ul></div><p>
- </p></li><li><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="circle"><li class="listitem"><span class="command"><strong>[a-z]</strong></span></li><li class="listitem"><span class="command"><strong>[A-Z]</strong></span></li><li class="listitem"><span class="command"><strong>[0-9]</strong></span></li><li class="listitem"><span class="command"><strong>'-'</strong></span> hyphen</li><li class="listitem"><span class="command"><strong>'_'</strong></span> underscore</li></ul></div><p>
+ </p></li><li class="listitem"><p>
Individual user names may contain only
- </p><div class="itemizedlist"><ul><li><span class="command"><strong>[a-z]</strong></span></li><li><span class="command"><strong>[A-Z]</strong></span></li><li><span class="command"><strong>[0-9]</strong></span></li><li><span class="command"><strong>'-'</strong></span> hyphen</li><li><span class="command"><strong>'_'</strong></span> underscore</li><li><span class="command"><strong>'.'</strong></span> period</li><li><span class="command"><strong>'@'</strong></span> ampersand</li><li><span class="command"><strong>'/'</strong></span> slash</li></ul></div><p>
- </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-casesensitivity"></a>Case Sensitivity</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="circle"><li class="listitem"><span class="command"><strong>[a-z]</strong></span></li><li class="listitem"><span class="command"><strong>[A-Z]</strong></span></li><li class="listitem"><span class="command"><strong>[0-9]</strong></span></li><li class="listitem"><span class="command"><strong>'-'</strong></span> hyphen</li><li class="listitem"><span class="command"><strong>'_'</strong></span> underscore</li><li class="listitem"><span class="command"><strong>'.'</strong></span> period</li><li class="listitem"><span class="command"><strong>'@'</strong></span> ampersand</li><li class="listitem"><span class="command"><strong>'/'</strong></span> slash</li></ul></div><p>
+ </p></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-casesensitivity"></a>Case Sensitivity</h5></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
All tokens are case sensitive. <em class="parameter"><code>name1</code></em> is not the same as <em class="parameter"><code>Name1</code></em> and <em class="parameter"><code>create</code></em> is not the same as <em class="parameter"><code>CREATE</code></em>.
- </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linecontinuation"></a>Line Continuation</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ </p></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linecontinuation"></a>Line Continuation</h5></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
Group lists can be extended to the following line by terminating the line with the <span class="command"><strong>'\'</strong></span> character. No other ACL file lines may be continued.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Group specification lines may be continued only after the group name or any of the user names included in the group. See example below.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Lines consisting solely of a <span class="command"><strong>'\'</strong></span> character are not permitted.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
The <span class="command"><strong>'\'</strong></span> continuation character is recognized only if it is the last character in the line. Any characters after the <span class="command"><strong>'\'</strong></span> are not permitted.
</p></li></ul></div><pre class="programlisting">
#
@@ -383,14 +383,14 @@ com.sun.security.jgss.initiate {
group group4 name9 \
\
name10
-</pre></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linelength"></a>Line Length</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+</pre></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linelength"></a>Line Length</h5></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
ACL file lines are limited to 1024 characters.
- </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords"></a>ACL File Keywords</h5></div></div></div>
+ </p></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords"></a>ACL File Keywords</h5></div></div></div>
ACL reserves several words for convenience and for context sensitive substitution.
- <div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-all"></a>The <span class="command"><strong>all</strong></span> Keyword</h6></div></div></div>
+ <div class="section"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-all"></a>The <span class="command"><strong>all</strong></span> Keyword</h6></div></div></div>
The keyword <span class="command"><strong>all</strong></span> is reserved. It may be used in ACL rules to match all individuals and groups, all actions, or all objects.
- <div class="itemizedlist"><ul><li>acl allow all create queue</li><li>acl allow bob@QPID all queue</li><li>acl allow bob@QPID create all</li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-userdomain"></a>User Name and Domain Name Keywords</h6></div></div></div><p>
+ <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">acl allow all create queue</li><li class="listitem">acl allow bob@QPID all queue</li><li class="listitem">acl allow bob@QPID create all</li></ul></div></div><div class="section"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-userdomain"></a>User Name and Domain Name Keywords</h6></div></div></div><p>
In the C++ Broker 0.20 a simple set of user name and domain name substitution variable keyword tokens is defined. This provides administrators with an easy way to describe private or shared resources.
</p><p>
Symbol substitution is allowed in the ACL file anywhere that text is supplied for a property value.
@@ -399,9 +399,9 @@ com.sun.security.jgss.initiate {
</p><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_UsernameSubstitution"></a><p class="title"><b>Table 1.9. ACL User Name and Domain Name Substitution Keywords</b></p><div class="table-contents"><table summary="ACL User Name and Domain Name Substitution Keywords" border="1"><colgroup><col><col></colgroup><thead><tr><th>Keyword</th><th>Expansion</th></tr></thead><tbody><tr><td> <span class="command"><strong>${userdomain}</strong></span> </td><td>bob_user_QPID_COM</td></tr><tr><td> <span class="command"><strong>${user}</strong></span> </td><td>bob_user</td></tr><tr><td> <span class="command"><strong>${domain}</strong></span> </td><td>QPID_COM</td></tr></tbody></table></div></div><p><br class="table-break">
</p><p>
- </p><div class="itemizedlist"><ul><li>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
The original user name has the period â.â and ampersand â@â characters translated into underscore â_â. This allows substitution to work when the substitution keyword is used in a routingkey in the Acl file.
- </li><li>
+ </li><li class="listitem">
The Acl processing matches ${userdomain} before matching either ${user} or ${domain}. Rules that specify the combination ${user}_${domain} will never match.
</li></ul></div><p>
</p><pre class="programlisting">
@@ -460,10 +460,10 @@ com.sun.security.jgss.initiate {
# deny mode
#
acl deny all all
-</pre></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards"></a>Wildcards</h5></div></div></div>
+</pre></div></div><div class="section"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards"></a>Wildcards</h5></div></div></div>
ACL privides two types of wildcard matching to provide flexibility in writing rules.
- <div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-asterisk"></a>Property Value Wildcard</h6></div></div></div><p>
+ <div class="section"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-asterisk"></a>Property Value Wildcard</h6></div></div></div><p>
Text specifying a property value may end with a single trailing <span class="command"><strong>*</strong></span> character.
This is a simple wildcard match indicating that strings which match up to that point are matches for the ACL property rule.
An ACL rule such as
@@ -471,15 +471,15 @@ com.sun.security.jgss.initiate {
</p><pre class="programlisting"> acl allow bob@QPID create queue name=bob*</pre><p>
</p><p>
allow user bob@QPID to create queues named bob1, bob2, bobQueue3, and so on.
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-topickey"></a>Topic Routing Key Wildcard</h6></div></div></div><p>
+ </p></div><div class="section"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-topickey"></a>Topic Routing Key Wildcard</h6></div></div></div><p>
In the C++ Broker 0.20 the logic governing the ACL Match has changed for each ACL rule that contains a routingkey property.
The routingkey property is matched according to Topic Exchange match logic the broker uses when it distributes messages published to a topic exchange.
</p><p>
Routing keys are hierarchical where each level is separated by a period:
- </p><div class="itemizedlist"><ul><li>weather.usa</li><li>weather.europe.germany</li><li>weather.europe.germany.berlin</li><li>company.engineering.repository</li></ul></div><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">weather.usa</li><li class="listitem">weather.europe.germany</li><li class="listitem">weather.europe.germany.berlin</li><li class="listitem">company.engineering.repository</li></ul></div><p>
</p><p>
Within the routing key hierarchy two wildcard characters are defined.
- </p><div class="itemizedlist"><ul><li><span class="command"><strong>*</strong></span> matches one field</li><li><span class="command"><strong>#</strong></span> matches zero or more fields</li></ul></div><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><span class="command"><strong>*</strong></span> matches one field</li><li class="listitem"><span class="command"><strong>#</strong></span> matches zero or more fields</li></ul></div><p>
</p><p>
Suppose an ACL rule file is:
</p><p>
@@ -492,9 +492,9 @@ com.sun.security.jgss.initiate {
</p><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_TopicExchangeMatch"></a><p class="title"><b>Table 1.10. Topic Exchange Wildcard Match Examples</b></p><div class="table-contents"><table summary="Topic Exchange Wildcard Match Examples" border="1"><colgroup><col><col></colgroup><thead><tr><th>routingkey in publish to exchange X</th><th>result</th></tr></thead><tbody><tr><td> <span class="command"><strong>a.b</strong></span> </td><td>allow-log</td></tr><tr><td> <span class="command"><strong>a.x.b</strong></span> </td><td>allow-log</td></tr><tr><td> <span class="command"><strong>a.x.y.zz.b</strong></span> </td><td>allow-log</td></tr><tr><td> <span class="command"><strong>a.b.</strong></span> </td><td>deny</td></tr><tr><td> <span class="command"><strong>q.x.b</strong></span> </td><td>deny</td></tr></tbody></table></div></div><p><br class="table-break">
- </p></div></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching"></a>1.5.2.3. ACL Rule Matching</h4></div></div></div><p>
+ </p></div></div></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching"></a>1.5.2.3. ACL Rule Matching</h4></div></div></div><p>
The minimum matching criteria for ACL rules are:
- </p><div class="itemizedlist"><ul><li>An actor (individually named or group member)</li><li>An action</li><li>An object</li></ul></div><p>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">An actor (individually named or group member)</li><li class="listitem">An action</li><li class="listitem">An object</li></ul></div><p>
</p><p>
If a rule does not match the minimum criteria then that rule does not control the ACL allow or deny decision.
</p><p>
@@ -548,7 +548,7 @@ com.sun.security.jgss.initiate {
# 7. Rule 2 is the matching rule and the decision is 'deny'.
#
</pre><p>
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Permissions"></a>1.5.2.4. Specifying ACL Permissions</h4></div></div></div><p>
+ </p></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Permissions"></a>1.5.2.4. Specifying ACL Permissions</h4></div></div></div><p>
Now that we have seen the ACL syntax, we will provide representative examples and guidelines for ACL files.
</p><p>
Most ACL files begin by defining groups:
@@ -597,10 +597,10 @@ com.sun.security.jgss.initiate {
acl deny-log allUsers access method name=connect
acl deny-log allUsers access method name=echo
acl allow all all
-</pre></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Quotas"></a>1.5.3. User Connection and Queue Quotas</h3></div></div></div>
+</pre></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Quotas"></a>1.5.3. User Connection and Queue Quotas</h3></div></div></div>
The ACL module enforces various quotas and thereby limits user activity.
- <div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Limits"></a>1.5.3.1. Connection Limits</h4></div></div></div><p>
+ <div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Limits"></a>1.5.3.1. Connection Limits</h4></div></div></div><p>
The ACL module creates broker command line switches that set limits on the number of concurrent connections allowed per user or per client host address. These settings are not specified in the ACL file.
</p><p>
</p><pre class="programlisting">
@@ -616,12 +616,12 @@ com.sun.security.jgss.initiate {
<span class="command"><strong>max-connections-per-user</strong></span> specifies an upper limit for each user based on the authenticated user name. This limit is enforced regardless of the client IP address from which the connection originates.
</p><p>
<span class="command"><strong>max-connections-per-ip</strong></span> specifies an upper limit for connections for all users based on the originating client IP address. This limit is enforced regardless of the user credentials presented with the connection.
- </p><div class="itemizedlist"><ul><li>
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
Note that addresses using different transports are counted separately even though the originating host is actually the same physical machine. In the setting illustrated above a host would allow N_IP connections from [::1] IPv6 transport localhost and another N_IP connections from [127.0.0.1] IPv4 transport localhost.
- </li><li>
+ </li><li class="listitem">
The max-connections-per-ip and max-connections-per-user counts are active simultaneously. From a given client system users may be denied access to the broker by either connection limit.
</li></ul></div><p>
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Queue_Limits"></a>1.5.3.2. Queue Limits</h4></div></div></div><p>
+ </p></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Queue_Limits"></a>1.5.3.2. Queue Limits</h4></div></div></div><p>
The ACL module creates a broker command line switch that set limits on the number of queues each user is allowed to create. This settings is not specified in the ACL file.
</p><p>
</p><pre class="programlisting">
@@ -631,9 +631,9 @@ com.sun.security.jgss.initiate {
If this switch is not specified or the value specified is zero then the queue limit is not enforced.
</p><p>
The queue limit is set for all users on the broker based on the authenticated user name.
- </p></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Encryption_using_SSL"></a>1.5.4. Encryption using SSL</h3></div></div></div><p>
+ </p></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Encryption_using_SSL"></a>1.5.4. Encryption using SSL</h3></div></div></div><p>
Encryption and certificate management for <span class="command"><strong>qpidd</strong></span> is provided by Mozilla's Network Security Services Library (NSS).
- </p><div class="orderedlist"><a name="orde-Messaging_User_Guide-Encryption_using_SSL-Enabling_SSL_for_the_RHM_broker"></a><p class="title"><b>Enabling SSL for the Qpid broker</b></p><ol type="1"><li><p>
+ </p><div class="orderedlist"><a name="orde-Messaging_User_Guide-Encryption_using_SSL-Enabling_SSL_for_the_RHM_broker"></a><p class="title"><b>Enabling SSL for the Qpid broker</b></p><ol class="orderedlist" type="1"><li class="listitem"><p>
You will need a certificate that has been signed by a Certification Authority (CA). This certificate will also need to be trusted by your client. If you require client authentication in addition to server authentication, the client's certificate will also need to be signed by a CA and trusted by the broker.
</p><p>
In the broker, SSL is provided through the <span class="command"><strong>ssl.so</strong></span> module. This module is installed and loaded by default in Qpid. To enable the module, you need to specify the location of the database containing the certificate and key to use. This is done using the <span class="command"><strong>ssl-cert-db</strong></span> option.
@@ -647,9 +647,9 @@ certutil -N -d ${CERT_DIR} -f ${CERT_PW_
certutil -S -d ${CERT_DIR} -n ${NICKNAME} -s "CN=${NICKNAME}" -t "CT,," -x -f ${CERT_PW_FILE} -z /usr/bin/certutil
</pre><p>
When starting the broker, set <span class="command"><strong>ssl-cert-password-file</strong></span> to the value of <span class="command"><strong>${CERT_PW_FILE}</strong></span>, set <span class="command"><strong>ssl-cert-db</strong></span> to the value of <span class="command"><strong>${CERT_DIR}</strong></span>, and set <span class="command"><strong>ssl-cert-name</strong></span> to the value of <span class="command"><strong>${NICKNAME}</strong></span>.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
The following SSL options can be used when starting the broker:
- </p><div class="variablelist"><dl><dt><span class="term"><span class="command"><strong>--ssl-use-export-policy</strong></span></span></dt><dd><p>
+ </p><div class="variablelist"><dl class="variablelist"><dt><span class="term"><span class="command"><strong>--ssl-use-export-policy</strong></span></span></dt><dd><p>
Use NSS export policy
</p></dd><dt><span class="term"><span class="command"><strong>--ssl-cert-password-file <em class="replaceable"><code>PATH</code></em></strong></span></span></dt><dd><p>
Required. Plain-text file containing password to use for accessing certificate database.
@@ -669,12 +669,12 @@ certutil -S -d ${CERT_DIR} -n ${NICKNAME
Do not accept SASL mechanisms that can be compromised by dictionary attacks. This prevents a weaker mechanism being selected instead of <code class="literal">EXTERNAL</code>, which is not vulnerable to dictionary attacks.
</p></dd></dl></div><p>
Also relevant is the <span class="command"><strong>--require-encryption</strong></span> broker option. This will cause <span class="command"><strong>qpidd</strong></span> to only accept encrypted connections.
- </p></li></ol></div><div class="variablelist"><a name="vari-Messaging_User_Guide-Encryption_using_SSL-Enabling_SSL_in_Clients"></a><p class="title"><b>Enabling SSL in Clients</b></p><dl><dt><span class="term">C++ clients:</span></dt><dd><p>
- </p><div class="orderedlist"><ol type="1"><li><p>
+ </p></li></ol></div><div class="variablelist"><a name="vari-Messaging_User_Guide-Encryption_using_SSL-Enabling_SSL_in_Clients"></a><p class="title"><b>Enabling SSL in Clients</b></p><dl class="variablelist"><dt><span class="term">C++ clients:</span></dt><dd><p>
+ </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
In C++ clients, SSL is implemented in the <span class="command"><strong>sslconnector.so</strong></span> module. This module is installed and loaded by default in Qpid.
</p><p>
The following options can be specified for C++ clients using environment variables:
- </p><div class="table"><a name="tabl-Messaging_User_Guide-Enabling_SSL_in_Clients-SSL_Client_Environment_Variables_for_C_clients"></a><p class="title"><b>Table 1.11. SSL Client Environment Variables for C++ clients</b></p><div class="table-contents"><table summary="SSL Client Environment Variables for C++ clients" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th colspan="2" align="center">
+ </p><div class="table"><a name="tabl-Messaging_User_Guide-Enabling_SSL_in_Clients-SSL_Client_Environment_Variables_for_C_clients"></a><p class="title"><b>Table 1.11. SSL Client Environment Variables for C++ clients</b></p><div class="table-contents"><table summary="SSL Client Environment Variables for C++ clients" border="1"><colgroup><col align="left" class="c1"><col align="left" class="c2"></colgroup><thead><tr><th colspan="2" align="center">
SSL Client Options for C++ clients
</th></tr></thead><tbody><tr><td align="left">
<span class="command"><strong>QPID_SSL_USE_EXPORT_POLICY</strong></span>
@@ -692,14 +692,14 @@ certutil -S -d ${CERT_DIR} -n ${NICKNAME
<span class="command"><strong>QPID_SSL_CERT_NAME <em class="replaceable"><code>NAME</code></em></strong></span>
</td><td align="left">
Name of the certificate to use. When SSL client authentication is enabled, a certificate name should normally be provided.
- </td></tr></tbody></table></div></div><br class="table-break"></li><li><p>
+ </td></tr></tbody></table></div></div><br class="table-break"></li><li class="listitem"><p>
When using SSL connections, clients must specify the location of the certificate database, a directory that contains the client's certificate and the public key of the Certificate Authority. This can be done by setting the environment variable <span class="command"><strong>QPID_SSL_CERT_DB</strong></span> to the full pathname of the directory. If a connection uses SSL client authentication, the client's password is also neededâthe password should be placed in a protected file, and the <span class="command"><strong>QPID_SSL_CERT_PASSWORD_FILE</strong></span> variable should be set to the location of the file containing this password.
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
To open an SSL enabled connection in the Qpid Messaging API, set the <em class="parameter"><code>protocol</code></em> connection option to <em class="parameter"><code>ssl</code></em>.
</p></li></ol></div><p>
</p></dd><dt><span class="term">Java clients:</span></dt><dd><p>
- </p><div class="orderedlist"><ol type="1"><li><p>
+ </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
For both server and client authentication, import the trusted CA to your trust store and keystore and generate keys for them. Create a certificate request using the generated keys and then create a certificate using the request. You can then import the signed certificate into your keystore. Pass the following arguments to the Java JVM when starting your client:
</p><pre class="programlisting">
-Djavax.net.ssl.keyStore=/home/bob/ssl_test/keystore.jks
@@ -708,17 +708,17 @@ certutil -S -d ${CERT_DIR} -n ${NICKNAME
-Djavax.net.ssl.trustStorePassword=password
</pre><p>
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
For server side authentication only, import the trusted CA to your trust store and pass the following arguments to the Java JVM when starting your client:
</p><pre class="programlisting">
-Djavax.net.ssl.trustStore=/home/bob/ssl_test/certstore.jks
-Djavax.net.ssl.trustStorePassword=password
</pre><p>
- </p></li><li><p>
+ </p></li><li class="listitem"><p>
Java clients must use the SSL option in the connection URL to enable SSL encryption, e.g.
</p><pre class="programlisting">amqp://username:password@clientid/test?brokerlist='tcp://localhost:5672?ssl='true''
-</pre></li><li><p>
+</pre></li><li class="listitem"><p>
If you need to debug problems in an SSL connection, enable Java's SSL debugging by passing the argument <code class="literal">-Djavax.net.debug=ssl</code> to the Java JVM when starting your client.
</p></li></ol></div><p>
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html?rev=1441019&r1=1441018&r2=1441019&view=diff
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html (original)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html Thu Jan 31 15:32:50 2013
@@ -1,8 +1,8 @@
-<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Chapter 2. Managing the AMQP Messaging Broker</title><link rel="stylesheet" href="css/style.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="AMQP Messaging Broker (Implemented in C++)"><link rel="up" href="index.html" title="AMQP Messaging Broker (Implemented in C++)"><link rel="prev" href="ch01s14.html" title="1.14. Queue Replication with the HA module"><link rel="next" href="ch02s02.html" title="2.2. Qpid Management Framework"></head><body><div class="container" bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><DIV class="header"><DIV class="logo"><H1>Apache Qpidâ¢</H1><H2>Open Source AMQP Messaging</H2></DIV></DIV><DIV class="menu_box"><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Apache Qpid</H3><UL><LI><A href="http://qpid.apache.org/index.html">
Home</A></LI><LI><A href="http://qpid.apache.org/download.html">Download</A></LI><LI><A href="http://qpid.apache.org/getting_started.html">Getting Started</A></LI><LI><A href="http://www.apache.org/licenses/">License</A></LI><LI><A href="https://cwiki.apache.org/qpid/faq.html">FAQ</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Documentation</H3><UL><LI><A href="http://qpid.apache.org/documentation.html#doc-release">Latest Release</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-trunk">Trunk</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-archives">Archive</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Community</H3><UL><LI><A href="http://qpid.apache.org/getting_involved.html">Getting Involved</A></LI><LI><A href="http://qpid.apache.org/source_repository.html">Source Repository</A></LI><LI><A href="ht
tp://qpid.apache.org/mailing_lists.html">Mailing Lists</A></LI><LI><A href="https://cwiki.apache.org/qpid/">Wiki</A></LI><LI><A href="https://issues.apache.org/jira/browse/qpid">Issue Reporting</A></LI><LI><A href="http://qpid.apache.org/people.html">People</A></LI><LI><A href="http://qpid.apache.org/acknowledgements.html">Acknowledgements</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Developers</H3><UL><LI><A href="https://cwiki.apache.org/qpid/building.html">Building Qpid</A></LI><LI><A href="https://cwiki.apache.org/qpid/developer-pages.html">Developer Pages</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About AMQP</H3><UL><LI><A href="http://qpid.apache.org/amqp.html">What is AMQP?</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About Apache</H3><UL><LI><A href="ht
tp://www.apache.org">Home</A></LI><LI><A href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</A></LI><LI><A href="http://www.apache.org/foundation/thanks.html">Thanks</A></LI><LI><A href="http://www.apache.org/security/">Security</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV></DIV><div class="main_text_area"><div class="main_text_area_top"></div><div class="main_text_area_body"><DIV class="breadcrumbs"><span class="breadcrumb-link"><a href="index.html">AMQP Messaging Broker (Implemented in C++)</a></span> > <span class="breadcrumb-node">
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Chapter 2. Managing the AMQP Messaging Broker</title><link rel="stylesheet" type="text/css" href="css/style.css"><meta name="generator" content="DocBook XSL Stylesheets V1.77.1"><link rel="home" href="index.html" title="AMQP Messaging Broker (Implemented in C++)"><link rel="up" href="index.html" title="AMQP Messaging Broker (Implemented in C++)"><link rel="prev" href="ch01s13.html" title="1.13. Queue Replication with the HA module"><link rel="next" href="ch02s02.html" title="2.2. Qpid Management Framework"></head><body><div class="container" bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><DIV class="header"><DIV class="logo"><H1>Apache Qpidâ¢</H1><H2>Open Source AMQP Messaging</H2></DIV></DIV><DIV class="menu_box"><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Apache Qpid</H3><UL><LI><A href="http://qpid.apache.org/index.html">H
ome</A></LI><LI><A href="http://qpid.apache.org/download.html">Download</A></LI><LI><A href="http://qpid.apache.org/getting_started.html">Getting Started</A></LI><LI><A href="http://www.apache.org/licenses/">License</A></LI><LI><A href="https://cwiki.apache.org/qpid/faq.html">FAQ</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Documentation</H3><UL><LI><A href="http://qpid.apache.org/documentation.html#doc-release">Latest Release</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-trunk">Trunk</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-archives">Archive</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Community</H3><UL><LI><A href="http://qpid.apache.org/getting_involved.html">Getting Involved</A></LI><LI><A href="http://qpid.apache.org/source_repository.html">Source Repository</A></LI><LI><A href="htt
p://qpid.apache.org/mailing_lists.html">Mailing Lists</A></LI><LI><A href="https://cwiki.apache.org/qpid/">Wiki</A></LI><LI><A href="https://issues.apache.org/jira/browse/qpid">Issue Reporting</A></LI><LI><A href="http://qpid.apache.org/people.html">People</A></LI><LI><A href="http://qpid.apache.org/acknowledgements.html">Acknowledgements</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Developers</H3><UL><LI><A href="https://cwiki.apache.org/qpid/building.html">Building Qpid</A></LI><LI><A href="https://cwiki.apache.org/qpid/developer-pages.html">Developer Pages</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About AMQP</H3><UL><LI><A href="http://qpid.apache.org/amqp.html">What is AMQP?</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About Apache</H3><UL><LI><A href="htt
p://www.apache.org">Home</A></LI><LI><A href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</A></LI><LI><A href="http://www.apache.org/foundation/thanks.html">Thanks</A></LI><LI><A href="http://www.apache.org/security/">Security</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV></DIV><div class="main_text_area"><div class="main_text_area_top"></div><div class="main_text_area_body"><DIV class="breadcrumbs"><span class="breadcrumb-link"><a href="index.html">AMQP Messaging Broker (Implemented in C++)</a></span> > <span class="breadcrumb-node">
Managing the AMQP Messaging Broker
- </span></DIV><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="chapter-Managing-CPP-Broker"></a>Chapter 2.Â
+ </span></DIV><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a name="chapter-Managing-CPP-Broker"></a>Chapter 2.Â
Managing the AMQP Messaging Broker
- </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#section-Managing-CPP-Broker">2.1. Managing the C++ Broker </a></span></dt><dd><dl><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidconfig">2.1.1.
+ </h1></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#section-Managing-CPP-Broker">2.1. Managing the C++ Broker </a></span></dt><dd><dl><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidconfig">2.1.1.
Using qpid-config
</a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidroute">2.1.2.
Using qpid-route
@@ -11,7 +11,7 @@
</a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidprintevents">2.1.4.
Using
qpid-printevents
- </a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#id2546331">2.1.5. Using qpid-ha</a></span></dt></dl></dd><dt><span class="section"><a href="ch02s02.html">2.2.
+ </a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#idp5126352">2.1.5. Using qpid-ha</a></span></dt></dl></dd><dt><span class="section"><a href="ch02s02.html">2.2.
Qpid Management Framework
</a></span></dt><dd><dl><dt><span class="section"><a href="ch02s02.html#QpidManagementFramework-WhatIsQMF">2.2.1.
What Is QMF
@@ -42,19 +42,19 @@
Console Operations
</a></span></dt><dt><span class="section"><a href="ch02s03.html#QMFPythonConsoleTutorial-DiscoveringwhatKindsofObjectsareAvailable">2.3.4.
Discovering what Kinds of Objects are Available
- </a></span></dt></dl></dd></dl></div><div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="section-Managing-CPP-Broker"></a>2.1. Managing the C++ Broker </h2></div></div></div><p>
+ </a></span></dt></dl></dd></dl></div><div class="section"><div class="titlepage"><div><div><h2 class="title"><a name="section-Managing-CPP-Broker"></a>2.1. Managing the C++ Broker </h2></div></div></div><p>
There are quite a few ways to interact with the C++ broker. The
command line tools
include:
- </p><div class="itemizedlist"><ul><li><p>qpid-route - used to configure federation (a set of federated
+ </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>qpid-route - used to configure federation (a set of federated
brokers)
- </p></li><li><p>qpid-config - used to configure queues, exchanges, bindings
+ </p></li><li class="listitem"><p>qpid-config - used to configure queues, exchanges, bindings
and list them etc
- </p></li><li><p>qpid-tool - used to view management information/statistics
+ </p></li><li class="listitem"><p>qpid-tool - used to view management information/statistics
and call any management actions on the broker
- </p></li><li><p>qpid-printevents - used to receive and print QMF events
- </p></li><li><p>qpid-ha - used to interact with the High Availability module
- </p></li></ul></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidconfig"></a>2.1.1.Â
+ </p></li><li class="listitem"><p>qpid-printevents - used to receive and print QMF events
+ </p></li><li class="listitem"><p>qpid-ha - used to interact with the High Availability module
+ </p></li></ul></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidconfig"></a>2.1.1.Â
Using qpid-config
</h3></div></div></div><p>
This utility can be used to create queues exchanges and bindings,
@@ -156,7 +156,7 @@ Exchange 'amq.fanout' (fanout)
Exchange 'amq.match' (headers)
Exchange 'qpid.management' (topic)
bind mgmt.# => mgmt-3206ff16-fb29-4a30-82ea-e76f50dd7d15
-</pre></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidroute"></a>2.1.2.Â
+</pre></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidroute"></a>2.1.2.Â
Using qpid-route
</h3></div></div></div><p>
This utility is to create federated networks of brokers, This
@@ -244,7 +244,7 @@ Static Routes:
localhost:10003(ex=amq.direct) <= localhost:10005(ex=amq.direct) key=rkey
localhost:10003(ex=amq.direct) <= localhost:10005(ex=amq.direct) key=rkey2
-</pre></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidtool"></a>2.1.3.Â
+</pre></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidtool"></a>2.1.3.Â
Using qpid-tool
</h3></div></div></div><p>
This utility provided a telnet style interface to be able to
@@ -424,7 +424,7 @@ Object of type qpid.queue: (last sample
inst messageLatencyMax 0
inst messageLatencyAverage 0
qpid:
-</pre></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidprintevents"></a>2.1.4.Â
+</pre></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="MgmtC-2B-2B-Usingqpidprintevents"></a>2.1.4.Â
Using
qpid-printevents
</h3></div></div></div><p>
@@ -443,7 +443,7 @@ Options:
-h, --help show this help message and exit
</pre><p>
You get the idea... have fun!
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2546331"></a>2.1.5. Using qpid-ha</h3></div></div></div><p>This utility lets you monitor and control the activity of the clustering behavior provided by the HA module.
+ </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="idp5126352"></a>2.1.5. Using qpid-ha</h3></div></div></div><p>This utility lets you monitor and control the activity of the clustering behavior provided by the HA module.
</p><pre class="programlisting">
qpid-ha --help
@@ -459,6 +459,6 @@ Commands are:
For help with a command type: qpid-ha <command> --help
- </pre></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ch01s14.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ch02s02.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">1.14. Queue Replication with the HA module </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 2.2.Â
+ </pre></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ch01s13.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ch02s02.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">1.13. Queue Replication with the HA module </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 2.2.Â
Qpid Management Framework
</td></tr></table></div><div class="main_text_area_bottom"></div></div></div></body></html>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org