You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@activemq.apache.org by Mark Raynsford <or...@io7m.com> on 2024/03/23 12:39:09 UTC
How to add a new authentication mechanism?
Hello!
I'm working with a custom authentication mechanism for a few projects.
I'd like to be able to implement that mechanism within ActiveMQ Artemis.
Is there any documentation on adding new authentication mechanisms? It
seems like I should be able to register a new SASL mechanism somewhere
and then have ActiveMQ call my own code to do the authentication. If
not, is there another method that's better suited than SASL?
While the new authentication mechanism is documented in a specification,
it's essentially "proprietary" and probably not of general use to others.
For the morbidly curious: The connecting client forwards the public part
of an Ed448 keypair. The server checks to see if the public key is
registered in its own database. If not, authentication fails. If the
public key _is_ known to the server, the server sends a long random
string. The client signs the long random string, and sends it back. The
server verifies the signature on the long random string (thus seeing if
the client can prove that it owns the private key associated with the
keypair). This is basically analogous to SSH public key authentication.
--
Mark Raynsford | https://www.io7m.com
Re: How to add a new authentication mechanism?
Posted by Mark Raynsford <or...@io7m.com>.
On 26/03/2024 03:35, Justin Bertram wrote:
> In that case you're probably better off implementing your own security
> manager [1]. ActiveMQ Artemis ships with three implementations [2] which
> you can use as a reference:
>
> -
> org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager
> [3] (used by default by the standalone broker)
> -
> org.apache.activemq.artemis.spi.core.security.ActiveMQBasicSecurityManager
> [4]
> -
> org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManagerImpl
> [5]
>
> If you're using
> org.apache.activemq.artemis.core.server.embedded.EmbeddedActiveMQ to embed
> the broker you can set the security manager using the setSecurityManager
> method [6].
OK, thanks! That's the conclusion I was starting to lean towards.
Thankfully, I only have to support the AMQP case, so I think that makes
things slightly easier with regard to handling SASL and the like.
--
Mark Raynsford | https://www.io7m.com
Re: How to add a new authentication mechanism?
Posted by Justin Bertram <jb...@apache.org>.
In that case you're probably better off implementing your own security
manager [1]. ActiveMQ Artemis ships with three implementations [2] which
you can use as a reference:
-
org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager
[3] (used by default by the standalone broker)
-
org.apache.activemq.artemis.spi.core.security.ActiveMQBasicSecurityManager
[4]
-
org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManagerImpl
[5]
If you're using
org.apache.activemq.artemis.core.server.embedded.EmbeddedActiveMQ to embed
the broker you can set the security manager using the setSecurityManager
method [6].
Justin
[1]
https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQSecurityManager5.java
[2]
https://activemq.apache.org/components/artemis/documentation/latest/security.html#user-credentials
[3]
https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java
[4]
https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQBasicSecurityManager.java
[5]
https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQSecurityManagerImpl.java
[6]
https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/core/server/embedded/EmbeddedActiveMQ.java#L72
On Mon, Mar 25, 2024 at 4:13 PM Mark Raynsford <or...@io7m.com>
wrote:
> On 25/03/2024 01:36, Justin Bertram wrote:
> > It's simple to use login.config with an embedded broker. You just need to
> > set the java.security.auth.login.config system property to the path of
> your
> > login.config file and it should work.
> >
>
> That's not great, to be honest. I'm essentially building what amounts to
> a reusable library that embeds a broker. Although I doubt many people
> would be creating multiple broker instances in the same application when
> using the library, it would mean that the library would have to set that
> system property (which might conflict with something the user has
> already set for their own application), and then create a file in the
> filesystem that otherwise wouldn't exist, and multiple brokers would
> likely step on each other's state.
>
> Is there no other way to pass in a list of login modules?
>
> --
> Mark Raynsford | https://www.io7m.com
>
>
Re: How to add a new authentication mechanism?
Posted by Mark Raynsford <or...@io7m.com>.
On 25/03/2024 01:36, Justin Bertram wrote:
> It's simple to use login.config with an embedded broker. You just need to
> set the java.security.auth.login.config system property to the path of your
> login.config file and it should work.
>
That's not great, to be honest. I'm essentially building what amounts to
a reusable library that embeds a broker. Although I doubt many people
would be creating multiple broker instances in the same application when
using the library, it would mean that the library would have to set that
system property (which might conflict with something the user has
already set for their own application), and then create a file in the
filesystem that otherwise wouldn't exist, and multiple brokers would
likely step on each other's state.
Is there no other way to pass in a list of login modules?
--
Mark Raynsford | https://www.io7m.com
Re: How to add a new authentication mechanism?
Posted by Justin Bertram <jb...@apache.org>.
It's simple to use login.config with an embedded broker. You just need to
set the java.security.auth.login.config system property to the path of your
login.config file and it should work.
Justin
On Sun, Mar 24, 2024 at 4:27 AM Mark Raynsford <or...@io7m.com>
wrote:
> On 24/03/2024 03:21, Justin Bertram wrote:
> > ActiveMQ Artemis uses JAAS [1] which uses pluggable "login modules" [2]
> > configured via the login.config file in the etc directory of the broker
> > instance. We ship a handful of our own login modules which you can peruse
> > [3] for pointers on how to implement your own. Documentation is here [4].
> >
> >
> > Justin
> >
> > [1]
> >
> https://docs.oracle.com/en/java/javase/11/security/java-authentication-and-authorization-service-jaas-reference-guide.html
> > [2]
> >
> https://docs.oracle.com/en/java/javase/11/docs/api/java.base/javax/security/auth/spi/LoginModule.html
> > [3]
> >
> https://github.com/apache/activemq-artemis/tree/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas
> > [4]
> >
> https://activemq.apache.org/components/artemis/documentation/latest/security.html#authentication-authorization
>
> Thanks! This looks good.
>
> I'm actually using an embedded broker, so presumably I'll need to do the
> registration in some other way than login.config.
>
> --
> Mark Raynsford | https://www.io7m.com
>
>
Re: How to add a new authentication mechanism?
Posted by Mark Raynsford <or...@io7m.com>.
On 24/03/2024 03:21, Justin Bertram wrote:
> ActiveMQ Artemis uses JAAS [1] which uses pluggable "login modules" [2]
> configured via the login.config file in the etc directory of the broker
> instance. We ship a handful of our own login modules which you can peruse
> [3] for pointers on how to implement your own. Documentation is here [4].
>
>
> Justin
>
> [1]
> https://docs.oracle.com/en/java/javase/11/security/java-authentication-and-authorization-service-jaas-reference-guide.html
> [2]
> https://docs.oracle.com/en/java/javase/11/docs/api/java.base/javax/security/auth/spi/LoginModule.html
> [3]
> https://github.com/apache/activemq-artemis/tree/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas
> [4]
> https://activemq.apache.org/components/artemis/documentation/latest/security.html#authentication-authorization
Thanks! This looks good.
I'm actually using an embedded broker, so presumably I'll need to do the
registration in some other way than login.config.
--
Mark Raynsford | https://www.io7m.com
Re: How to add a new authentication mechanism?
Posted by Justin Bertram <jb...@apache.org>.
ActiveMQ Artemis uses JAAS [1] which uses pluggable "login modules" [2]
configured via the login.config file in the etc directory of the broker
instance. We ship a handful of our own login modules which you can peruse
[3] for pointers on how to implement your own. Documentation is here [4].
Justin
[1]
https://docs.oracle.com/en/java/javase/11/security/java-authentication-and-authorization-service-jaas-reference-guide.html
[2]
https://docs.oracle.com/en/java/javase/11/docs/api/java.base/javax/security/auth/spi/LoginModule.html
[3]
https://github.com/apache/activemq-artemis/tree/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas
[4]
https://activemq.apache.org/components/artemis/documentation/latest/security.html#authentication-authorization
On Sat, Mar 23, 2024 at 7:49 AM Mark Raynsford <or...@io7m.com>
wrote:
> Hello!
>
> I'm working with a custom authentication mechanism for a few projects.
> I'd like to be able to implement that mechanism within ActiveMQ Artemis.
>
> Is there any documentation on adding new authentication mechanisms? It
> seems like I should be able to register a new SASL mechanism somewhere
> and then have ActiveMQ call my own code to do the authentication. If
> not, is there another method that's better suited than SASL?
>
> While the new authentication mechanism is documented in a specification,
> it's essentially "proprietary" and probably not of general use to others.
>
> For the morbidly curious: The connecting client forwards the public part
> of an Ed448 keypair. The server checks to see if the public key is
> registered in its own database. If not, authentication fails. If the
> public key _is_ known to the server, the server sends a long random
> string. The client signs the long random string, and sends it back. The
> server verifies the signature on the long random string (thus seeing if
> the client can prove that it owns the private key associated with the
> keypair). This is basically analogous to SSH public key authentication.
>
> --
> Mark Raynsford | https://www.io7m.com
>
>