[jira] [Commented] (FALCON-230) Secure activemq topics

["Jean-Baptiste Onofré (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FALCON-230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13877445#comment-13877445 ] 

Jean-Baptiste Onofré commented on FALCON-230:
---------------------------------------------

On this topic, I propose two parts:

1/ Secure of the transport
Currently, we use openwire directly, bound to all network interfaces. Using embedded broker, the user can only define the port number, not the protocol (hardcoded to tcp), not the network interface (hardcoded to 0.0.0.0 so all interfaces).
I propose to let the user define the transport connector URL.
Thanks to that, it would be possible:
- to bind to given network interface (for instance localhost or specific interface IP)
- use OpenWire over SSL (using a transport like ssl://0.0.0.0:61616 instead of tcp). In conf/falcon-env.sh, the user can defines his keystore (using -Djavax.net.ssl.keyStore=/path/to/falcon.ks -Djavax.net.ssl.keyStorePassword=password). The messaging interface in the cluster entity should use properties to contain keystore in order to correctly create the connection factory.
- eventually define clientAuth (using a transport like ssl://localhost:61616?transport.needClientAuth=true) and provide a keystore/truststore

I'm preparing a patch for that including update on the documentation.

2/ Add authentication support

On the other hand, we can force the authentication to use a broker. It means that the messaging interface in the cluster entity should use properties like principal/credential to use username/password when creating the connection factory.
On the embedded broker side, if the user provides a system property like falcon.embeddedmq.authentication=true, in that case, we can lookup a conf/users.properties file to create the ActiveMQ JAAS plugin and use it in the broker service.

I'm preparing another patch for that (including documentation update too).

The two topics are isolated (an user can do both, or only secure transport, or only force authentication).

> Secure activemq topics
> ----------------------
>
>                 Key: FALCON-230
>                 URL: https://issues.apache.org/jira/browse/FALCON-230
>             Project: Falcon
>          Issue Type: Sub-task
>            Reporter: Venkatesh Seetharam
>            Assignee: Jean-Baptiste Onofré
>
> I'm leaving it here for the sake of completeness. Topics might need authorization and not sure how to do it.



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)