You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by Senaka Fernando <se...@gmail.com> on 2008/04/27 19:17:04 UTC
What SASL mechanisms does Qpid Support?
Hi all,
I would like to know what SASL mechanisms (out of the ones found in [1])
does Qpid support, in order to find a solution to issue [2].
[1] http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
[2] https://issues.apache.org/jira/browse/QPID-918
Regards,
Senaka
Re: What SASL mechanisms does Qpid Support?
Posted by Gordon Sim <gs...@redhat.com>.
Carl Trieloff wrote:
> The M3 C++ broker also now has full SASL support. If you look at the
> patches Matthew submitted -- I think Gordon might still be working
> some final updates for 0-10 final though - sure he will comment when
> he sees the thread.
The c++ broker now uses the cyrus sasl library (if available) for
authentication and should support whatever that is configured to offer
(CRAM-MD5 is listed as supported for my installed version of cyrus; only
PLAIN and ANONYMOUS tested so far).
The c++ client however currently only supports PLAIN. Thats next on the
list though:
https://issues.apache.org/jira/browse/QPID-976
Re: What SASL mechanisms does Qpid Support?
Posted by Martin Ritchie <ri...@apache.org>.
2008/4/27 Carl Trieloff <cc...@redhat.com>:
>
> Tomas Restrepo wrote:
>
> > Hi Marnie,
> >
> >
> >
> > > I don't know of any samples though thinking about it I believe it was
> the
> > > .NET guys that did some work on this stuff.
> > >
> > > Anyone know better/more ?
> > >
> > >
> >
> > I did most of the authentication support on the .NET client,
> > implementing the core SASL support. Currently the .NET client itself
> > should support Anonymous, CRAM-MD5, Digest, Plain and External (useful
> > if eventually implicit SSL with client-side certificates are supported
> > by the spec).
> >
> > From what I remember, though, the Java client only supported Plain and
> > CRAM-MD5 (and one of them had an issue which I do not know if it was
> > fixed or not).
> >
> >
> >
> To complete the picture,
>
> The M3 C++ broker also now has full SASL support. If you look at the
> patches Matthew
> submitted -- I think Gordon might still be working some final updates for
> 0-10 final though -
> sure he will comment when he sees the thread.
>
> Carl.
The Java client will log out the password when set to debug level
logging otherwise it * out the value.
The Java broker does have a bug in it with AMQPLAIN and PLAIN
authentication, implementations. (QPID-474)
The Java broker/client also implements a modified CRAM-MD5 called
CRAM-MD5-HASHED where the hash of the password is used to
authenticate. This means the broker never needs to know the full
password, only the hash is ever stored on disk.
Hope that helps,
Martin
--
Martin Ritchie
Re: What SASL mechanisms does Qpid Support?
Posted by Carl Trieloff <cc...@redhat.com>.
Tomas Restrepo wrote:
> Hi Marnie,
>
>
>> I don't know of any samples though thinking about it I believe it was the
>> .NET guys that did some work on this stuff.
>>
>> Anyone know better/more ?
>>
>
> I did most of the authentication support on the .NET client,
> implementing the core SASL support. Currently the .NET client itself
> should support Anonymous, CRAM-MD5, Digest, Plain and External (useful
> if eventually implicit SSL with client-side certificates are supported
> by the spec).
>
> From what I remember, though, the Java client only supported Plain and
> CRAM-MD5 (and one of them had an issue which I do not know if it was
> fixed or not).
>
>
To complete the picture,
The M3 C++ broker also now has full SASL support. If you look at the
patches Matthew
submitted -- I think Gordon might still be working some final updates
for 0-10 final though -
sure he will comment when he sees the thread.
Carl.
Re: What SASL mechanisms does Qpid Support?
Posted by Robert Greig <ro...@gmail.com>.
2008/4/30 Martin Ritchie <ri...@apache.org>:
> So does that mean the later version of the OpenAMQ do PLAIN
> authentication now or do we need to maintain the AMQPLAIN in the
> client if we want to interop?
I believe that they do PLAIN now.
RG
Re: What SASL mechanisms does Qpid Support?
Posted by Martin Ritchie <ri...@apache.org>.
On 30/04/2008, Robert Greig <ro...@gmail.com> wrote:
> 2008/4/30 Gordon Sim <gs...@redhat.com>:
>
>
> > I don't think either 0-8 or 0-9 specifies AMQPLAIN.
>
>
> Yes, AMQPLAIN was an unfortunate aberration due to someone not
> bothering to read the SASL specification. (Not someone associated with
> Qpid I hasten to add).
So does that mean the later version of the OpenAMQ do PLAIN
authentication now or do we need to maintain the AMQPLAIN in the
client if we want to interop?
I have no objection to removing it from the Java Broker if there are
no other clients that will be potentially wanting to use it.
> RG
>
--
Martin Ritchie
Re: What SASL mechanisms does Qpid Support?
Posted by Robert Greig <ro...@gmail.com>.
2008/4/30 Gordon Sim <gs...@redhat.com>:
> I don't think either 0-8 or 0-9 specifies AMQPLAIN.
Yes, AMQPLAIN was an unfortunate aberration due to someone not
bothering to read the SASL specification. (Not someone associated with
Qpid I hasten to add).
RG
Re: What SASL mechanisms does Qpid Support?
Posted by Gordon Sim <gs...@redhat.com>.
Martin Ritchie wrote:
> Sure AMQPLAIN is not an official SASL mechanism but it is a mechanism
> for authentication. The Java broker/client simply implements it as a
> SASL plugin to unify authentication.
>
> IIRC AMQP 0-8 and 0-9 both specify hence if our clients can run
> 0-8/0-9 we should maintain that functionality.
I don't think either 0-8 or 0-9 specifies AMQPLAIN.
Re: What SASL mechanisms does Qpid Support?
Posted by Martin Ritchie <ri...@apache.org>.
On 30/04/2008, Ted Ross <tr...@redhat.com> wrote:
> Martin Ritchie wrote:
>
> > On 28/04/2008, Marnie McCormack <ma...@googlemail.com> wrote:
> >
> >
> > > Thanks Tomas - nice to hear from you !
> > >
> > > Regards,
> > >
> > > Marnie
> > >
> > >
> > >
> > > On 4/27/08, Tomas Restrepo <to...@devdeo.com> wrote:
> > > >
> > > > Hi Marnie,
> > > >
> > > > > I don't know of any samples though thinking about it I believe it
> was
> > > > the
> > > > > .NET guys that did some work on this stuff.
> > > > >
> > > > > Anyone know better/more ?
> > > >
> > > > I did most of the authentication support on the .NET client,
> > > > implementing the core SASL support. Currently the .NET client itself
> > > > should support Anonymous, CRAM-MD5, Digest, Plain and External
> (useful
> > > > if eventually implicit SSL with client-side certificates are
> supported
> > > > by the spec).
> > > >
> > > > From what I remember, though, the Java client only supported Plain
> and
> > > > CRAM-MD5 (and one of them had an issue which I do not know if it was
> > > > fixed or not).
> > > >
> > > > --
> > > > Tomas Restrepo
> > > >
> > >
> > >
> >
> > I've captured this thread here :
> >
> http://cwiki.apache.org/confluence/display/qpid/Qpid+Interoperability+Documentation#sasl
> >
> > so it would be good for those better in the know to update the docs.
> > Also if someone has a link or two ticks to put a description of
> > AMQPLAIN in that would be great.
> >
> >
> For what it's worth, AMQPLAIN is not a SASL mechanism. Furthermore, it's
> not mentioned in the 0-10 AMQP spec.
>
> I think AMQPLAIN used AMQP str8 encoding for the username and password
> whereas SASL PLAIN uses null characters to delimit the fields.
>
> I suggest that we abandon AMQPLAIN and use the standard SASL PLAIN instead.
>
> -Ted
Sure AMQPLAIN is not an official SASL mechanism but it is a mechanism
for authentication. The Java broker/client simply implements it as a
SASL plugin to unify authentication.
IIRC AMQP 0-8 and 0-9 both specify hence if our clients can run
0-8/0-9 we should maintain that functionality.
I'd like to see us standardise on CRAM-MD5, something that doesn't
plain text the password of the wire would be good. Sure SSL would be
ideal but without any documentation on how the Java SSL Client
implementation works (Kevin if your about would love to chat to get
some docs on this) then I'll settle for not sending plain text
passwords.
Cheers
Martin
--
Martin Ritchie
Re: What SASL mechanisms does Qpid Support?
Posted by Robert Greig <ro...@gmail.com>.
2008/4/30 Ted Ross <tr...@redhat.com>:
> For what it's worth, AMQPLAIN is not a SASL mechanism. Furthermore, it's
> not mentioned in the 0-10 AMQP spec.
>
> I think AMQPLAIN used AMQP str8 encoding for the username and password
> whereas SASL PLAIN uses null characters to delimit the fields.
>
> I suggest that we abandon AMQPLAIN and use the standard SASL PLAIN instead.
Yes, AMQPLAIN was really just added because an early version of the
spec did not describe SASL PLAIN correctly and we needed to have
compatibility with a single broker implementation (not qpid).
RG
Re: What SASL mechanisms does Qpid Support?
Posted by Ted Ross <tr...@redhat.com>.
Martin Ritchie wrote:
> On 28/04/2008, Marnie McCormack <ma...@googlemail.com> wrote:
>
>> Thanks Tomas - nice to hear from you !
>>
>> Regards,
>>
>> Marnie
>>
>>
>>
>> On 4/27/08, Tomas Restrepo <to...@devdeo.com> wrote:
>> >
>> > Hi Marnie,
>> >
>> > > I don't know of any samples though thinking about it I believe it was
>> > the
>> > > .NET guys that did some work on this stuff.
>> > >
>> > > Anyone know better/more ?
>> >
>> > I did most of the authentication support on the .NET client,
>> > implementing the core SASL support. Currently the .NET client itself
>> > should support Anonymous, CRAM-MD5, Digest, Plain and External (useful
>> > if eventually implicit SSL with client-side certificates are supported
>> > by the spec).
>> >
>> > From what I remember, though, the Java client only supported Plain and
>> > CRAM-MD5 (and one of them had an issue which I do not know if it was
>> > fixed or not).
>> >
>> > --
>> > Tomas Restrepo
>> >
>>
>
> I've captured this thread here :
> http://cwiki.apache.org/confluence/display/qpid/Qpid+Interoperability+Documentation#sasl
>
> so it would be good for those better in the know to update the docs.
> Also if someone has a link or two ticks to put a description of
> AMQPLAIN in that would be great.
>
For what it's worth, AMQPLAIN is not a SASL mechanism. Furthermore,
it's not mentioned in the 0-10 AMQP spec.
I think AMQPLAIN used AMQP str8 encoding for the username and password
whereas SASL PLAIN uses null characters to delimit the fields.
I suggest that we abandon AMQPLAIN and use the standard SASL PLAIN instead.
-Ted
Re: What SASL mechanisms does Qpid Support?
Posted by Martin Ritchie <ri...@apache.org>.
On 28/04/2008, Marnie McCormack <ma...@googlemail.com> wrote:
> Thanks Tomas - nice to hear from you !
>
> Regards,
>
> Marnie
>
>
>
> On 4/27/08, Tomas Restrepo <to...@devdeo.com> wrote:
> >
> > Hi Marnie,
> >
> > > I don't know of any samples though thinking about it I believe it was
> > the
> > > .NET guys that did some work on this stuff.
> > >
> > > Anyone know better/more ?
> >
> > I did most of the authentication support on the .NET client,
> > implementing the core SASL support. Currently the .NET client itself
> > should support Anonymous, CRAM-MD5, Digest, Plain and External (useful
> > if eventually implicit SSL with client-side certificates are supported
> > by the spec).
> >
> > From what I remember, though, the Java client only supported Plain and
> > CRAM-MD5 (and one of them had an issue which I do not know if it was
> > fixed or not).
> >
> > --
> > Tomas Restrepo
> >
I've captured this thread here :
http://cwiki.apache.org/confluence/display/qpid/Qpid+Interoperability+Documentation#sasl
so it would be good for those better in the know to update the docs.
Also if someone has a link or two ticks to put a description of
AMQPLAIN in that would be great.
So far .NET is winning with 5 implementations thanks to the good work my Tomas!
Java has 4, C++ Broker 3 and the rest are limping behind with just the
1 implementation.
Cheers
Martin
--
Martin Ritchie
Re: What SASL mechanisms does Qpid Support?
Posted by Marnie McCormack <ma...@googlemail.com>.
Thanks Tomas - nice to hear from you !
Regards,
Marnie
On 4/27/08, Tomas Restrepo <to...@devdeo.com> wrote:
>
> Hi Marnie,
>
> > I don't know of any samples though thinking about it I believe it was
> the
> > .NET guys that did some work on this stuff.
> >
> > Anyone know better/more ?
>
> I did most of the authentication support on the .NET client,
> implementing the core SASL support. Currently the .NET client itself
> should support Anonymous, CRAM-MD5, Digest, Plain and External (useful
> if eventually implicit SSL with client-side certificates are supported
> by the spec).
>
> From what I remember, though, the Java client only supported Plain and
> CRAM-MD5 (and one of them had an issue which I do not know if it was
> fixed or not).
>
> --
> Tomas Restrepo
>
Re: What SASL mechanisms does Qpid Support?
Posted by Tomas Restrepo <to...@devdeo.com>.
Hi Marnie,
> I don't know of any samples though thinking about it I believe it was the
> .NET guys that did some work on this stuff.
>
> Anyone know better/more ?
I did most of the authentication support on the .NET client,
implementing the core SASL support. Currently the .NET client itself
should support Anonymous, CRAM-MD5, Digest, Plain and External (useful
if eventually implicit SSL with client-side certificates are supported
by the spec).
>From what I remember, though, the Java client only supported Plain and
CRAM-MD5 (and one of them had an issue which I do not know if it was
fixed or not).
--
Tomas Restrepo
Re: What SASL mechanisms does Qpid Support?
Posted by Marnie McCormack <ma...@googlemail.com>.
Hi,
I don't know of any samples though thinking about it I believe it was the
.NET guys that did some work on this stuff.
Anyone know better/more ?
Regards,
Marnie
On 4/27/08, Senaka Fernando <se...@gmail.com> wrote:
>
> Hi Marnie,
>
> Thanks for the link. Do you have any samples that use CRAM-MD5 which I
> believe will not send the password over the wire, according to [1], that
> will be helpful in fixing the JIRA issue I mentioned earlier on this
> thread.
>
> [1] http://en.wikipedia.org/wiki/CRAM-MD5
>
> Regards,
> Senaka
>
> On Sun, Apr 27, 2008 at 10:51 PM, Marnie McCormack <
> marnie.mccormack@googlemail.com> wrote:
>
> > Hi Senaka,
> >
> > Not my area of expertise but this might be helpful, though its mainly
> > theory:
> >
> > http://cwiki.apache.org/qpid/qpid-design-authentication.html
> >
> > I vaguely recall a JIRA for this, relating to implementation so might be
> > worth having a look around.
> >
> > Hth,
> > Marnie
> >
> > On 4/27/08, Senaka Fernando <se...@gmail.com> wrote:
> > >
> > > Hi all,
> > >
> > > I would like to know what SASL mechanisms (out of the ones found in
> [1])
> > > does Qpid support, in order to find a solution to issue [2].
> > >
> > > [1]
> > http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
> > > [2] https://issues.apache.org/jira/browse/QPID-918
> > >
> > > Regards,
> > > Senaka
> > >
> >
>
Re: What SASL mechanisms does Qpid Support?
Posted by Senaka Fernando <se...@gmail.com>.
Hi Marnie,
Thanks for the link. Do you have any samples that use CRAM-MD5 which I
believe will not send the password over the wire, according to [1], that
will be helpful in fixing the JIRA issue I mentioned earlier on this thread.
[1] http://en.wikipedia.org/wiki/CRAM-MD5
Regards,
Senaka
On Sun, Apr 27, 2008 at 10:51 PM, Marnie McCormack <
marnie.mccormack@googlemail.com> wrote:
> Hi Senaka,
>
> Not my area of expertise but this might be helpful, though its mainly
> theory:
>
> http://cwiki.apache.org/qpid/qpid-design-authentication.html
>
> I vaguely recall a JIRA for this, relating to implementation so might be
> worth having a look around.
>
> Hth,
> Marnie
>
> On 4/27/08, Senaka Fernando <se...@gmail.com> wrote:
> >
> > Hi all,
> >
> > I would like to know what SASL mechanisms (out of the ones found in [1])
> > does Qpid support, in order to find a solution to issue [2].
> >
> > [1]
> http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
> > [2] https://issues.apache.org/jira/browse/QPID-918
> >
> > Regards,
> > Senaka
> >
>
Re: What SASL mechanisms does Qpid Support?
Posted by Marnie McCormack <ma...@googlemail.com>.
Hi Senaka,
Not my area of expertise but this might be helpful, though its mainly
theory:
http://cwiki.apache.org/qpid/qpid-design-authentication.html
I vaguely recall a JIRA for this, relating to implementation so might be
worth having a look around.
Hth,
Marnie
On 4/27/08, Senaka Fernando <se...@gmail.com> wrote:
>
> Hi all,
>
> I would like to know what SASL mechanisms (out of the ones found in [1])
> does Qpid support, in order to find a solution to issue [2].
>
> [1] http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
> [2] https://issues.apache.org/jira/browse/QPID-918
>
> Regards,
> Senaka
>
Re: What SASL mechanisms does Qpid Support?
Posted by Senaka Fernando <se...@gmail.com>.
On Mon, Apr 28, 2008 at 12:08 AM, Robert Greig <ro...@gmail.com>
wrote:
> On 27/04/2008, Senaka Fernando <se...@gmail.com> wrote:
>
> > OK. I thought that would be better too. But, what made me think twice is
> > that
> > if the mechanism was PLAIN the password is sent in clear text.
>
Well what I meant was, if the password is sent in clear text, logging it
wouldn't be of much harm. Implementing CRAM-MD5 is something that can be
thought about.
Regards,
Senaka
>
>
> If you mean that people should not use PLAIN, then yes I agree. The
> Java broker supports CRAM-MD5 out of the box and I am sure the C++
> guys would be very pleased if you were to implement CRAM-MD5 on the
> C++ side (assuming it does not already support it?).
>
> RG
>
Re: What SASL mechanisms does Qpid Support?
Posted by Robert Greig <ro...@gmail.com>.
On 27/04/2008, Senaka Fernando <se...@gmail.com> wrote:
> OK. I thought that would be better too. But, what made me think twice is
> that
> if the mechanism was PLAIN the password is sent in clear text.
If you mean that people should not use PLAIN, then yes I agree. The
Java broker supports CRAM-MD5 out of the box and I am sure the C++
guys would be very pleased if you were to implement CRAM-MD5 on the
C++ side (assuming it does not already support it?).
RG
Re: What SASL mechanisms does Qpid Support?
Posted by Senaka Fernando <se...@gmail.com>.
Hi Robert,
Hi Senaka,
>
> I think the best thing to do is simply ensure that the response field
> of start-ok is never logged irrespective of the SASL mechanism being
> used. That is safer and probably simpler (since ideally we will want
> people to be able to plug in arbitrary SASL implementations at some
> point in the future so you can't necessarily make a decision whether
> to log or not).
OK. I thought that would be better too. But, what made me think twice is
that
if the mechanism was PLAIN the password is sent in clear text.
Regards,
Senaka
>
>
> The Java broker does support CRAM-MD5 but I think the C++ broker only
> does PLAIN at the moment.
>
> RG
>
Re: What SASL mechanisms does Qpid Support?
Posted by Robert Greig <ro...@gmail.com>.
On 27/04/2008, Senaka Fernando <se...@gmail.com> wrote:
> I would like to know what SASL mechanisms (out of the ones found in [1])
> does Qpid support, in order to find a solution to issue [2].
>
> [1] http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer
> [2] https://issues.apache.org/jira/browse/QPID-918
Hi Senaka,
I think the best thing to do is simply ensure that the response field
of start-ok is never logged irrespective of the SASL mechanism being
used. That is safer and probably simpler (since ideally we will want
people to be able to plug in arbitrary SASL implementations at some
point in the future so you can't necessarily make a decision whether
to log or not).
The Java broker does support CRAM-MD5 but I think the C++ broker only
does PLAIN at the moment.
RG