You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by kw...@apache.org on 2014/10/15 23:29:57 UTC

svn commit: r1632181 [13/16] - in /qpid/site: docs/releases/qpid-trunk/ docs/releases/qpid-trunk/java-broker/ docs/releases/qpid-trunk/java-broker/book/ docs/releases/qpid-trunk/java-broker/book/images/ docs/releases/qpid-trunk/jms-client-0-8/ docs/rel...

Modified: qpid/site/docs/releases/qpid-trunk/java-broker/book/Java-Broker-Security.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/Java-Broker-Security.html?rev=1632181&r1=1632180&r2=1632181&view=diff
==============================================================================
--- qpid/site/docs/releases/qpid-trunk/java-broker/book/Java-Broker-Security.html (original)
+++ qpid/site/docs/releases/qpid-trunk/java-broker/book/Java-Broker-Security.html Wed Oct 15 21:29:55 2014
@@ -21,7 +21,7 @@
 -->
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
-    <title>Chapter&#160;11.&#160;Security - Apache Qpid&#8482;</title>
+    <title>Chapter&#160;8.&#160;Security - Apache Qpid&#8482;</title>
     <meta http-equiv="X-UA-Compatible" content="IE=edge"/>
     <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
     <link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
@@ -106,68 +106,48 @@
       </div>
 
       <div id="-middle" class="panel">
-        <ul id="-path-navigation"><li><a href="/releases/index.html">Releases</a></li><li><a href="/releases/qpid-trunk/index.html">Qpid Trunk</a></li><li><a href="/releases/qpid-trunk/java-broker/book/index.html">AMQP Messaging Broker (Java)</a></li><li>Chapter&#160;11.&#160;Security</li></ul>
-        <div class="docbook"><div class="navheader"><table summary="Navigation header" width="100%"><tr><th align="center" colspan="3">Chapter&#160;11.&#160;Security</th></tr><tr><td align="left" width="20%"><a accesskey="p" href="Java-Broker-Stores-HA-BDB-Store.html">Prev</a>&#160;</td><th align="center" width="60%">&#160;</th><td align="right" width="20%">&#160;<a accesskey="n" href="Java-Broker-Security-Group-Providers.html">Next</a></td></tr></table><hr /></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a id="Java-Broker-Security"></a>Chapter&#160;11.&#160;Security</h1></div></div></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Authentication-Providers">11.1. Authentication Providers</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-LDAP-Provider">11.1.1. Simple LDAP Authentication P
 rovider</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Kerberos-Provider">11.1.2. Kerberos</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-External-Provider">11.1.3. External (SSL Client Certificates)</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Anonymous-Provider">11.1.4. Anonymous</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-PlainPasswordFile-Provider">11.1.5. Plain Password File</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Base64MD5PasswordFile-Provider">11.1.6. Base64MD5 Password File</a></span></dt></dl></dd><dt><span class="section"><a href="Java-Broker-Security-Group-Providers.html">11.2. Group Providers</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security-Group-Providers.html#File-Group-Manager">11.
 2.1. GroupFile Provider</a></span></dt></dl></dd><dt><span class="section"><a href="Java-Broker-Security-ACLs.html">11.3. Access Control Lists</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security-ACLs.html#Java-Broker-Security-ACLs-WriteACL">11.3.1. 
+        <ul id="-path-navigation"><li><a href="/releases/index.html">Releases</a></li><li><a href="/releases/qpid-trunk/index.html">Qpid Trunk</a></li><li><a href="/releases/qpid-trunk/java-broker/book/index.html">AMQP Messaging Broker (Java)</a></li><li>Chapter&#160;8.&#160;Security</li></ul>
+        <div class="docbook"><div class="navheader"><table summary="Navigation header" width="100%"><tr><th align="center" colspan="3">Chapter&#160;8.&#160;Security</th></tr><tr><td align="left" width="20%"><a accesskey="p" href="Java-Broker-Management-Managing-Plugins-JMX.html">Prev</a>&#160;</td><th align="center" width="60%">&#160;</th><td align="right" width="20%">&#160;<a accesskey="n" href="Java-Broker-Security-Group-Providers.html">Next</a></td></tr></table><hr /></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a id="Java-Broker-Security"></a>Chapter&#160;8.&#160;Security</h1></div></div></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Authentication-Providers">8.1. Authentication Providers</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-LDAP-Provider">8.1.1. Simple LDAP Authenti
 cation Provider</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Kerberos-Provider">8.1.2. Kerberos</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-External-Provider">8.1.3. External (SSL Client Certificates)</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Anonymous-Provider">8.1.4. Anonymous</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-ScramSha-Providers">8.1.5. SCRAM SHA Providers</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-PlainPasswordFile-Provider">8.1.6. Plain Password File</a></span></dt><dt><span class="section"><a href="Java-Broker-Security.html#Java-Broker-Security-Base64MD5PasswordFile-Provider">8.1.7. Base64MD5 Password File</a></span></dt></dl></dd><dt><span class="section"><a href="Java-Broker-Security-Group-Providers.html
 ">8.2. Group Providers</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security-Group-Providers.html#File-Group-Manager">8.2.1. GroupFile Provider</a></span></dt></dl></dd><dt><span class="section"><a href="Java-Broker-Security-ACLs.html">8.3. Access Control Lists</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security-ACLs.html#Java-Broker-Security-ACLs-WriteACL">8.3.1. 
        Writing .acl files
-    </a></span></dt><dt><span class="section"><a href="Java-Broker-Security-ACLs.html#Java-Broker-Security-ACLs-Syntax">11.3.2. 
+    </a></span></dt><dt><span class="section"><a href="Java-Broker-Security-ACLs.html#Java-Broker-Security-ACLs-Syntax">8.3.2. 
        Syntax
-    </a></span></dt><dt><span class="section"><a href="Java-Broker-Security-ACLs.html#Java-Broker-Security-ACLs-WorkedExamples">11.3.3. 
+    </a></span></dt><dt><span class="section"><a href="Java-Broker-Security-ACLs.html#Java-Broker-Security-ACLs-WorkedExamples">8.3.3. 
       Worked Examples
-    </a></span></dt></dl></dd><dt><span class="section"><a href="Java-Broker-Security-SSL.html">11.4. SSL</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security-SSL.html#Java-Broker-SSL-Keystore">11.4.1. Keystore Configuration</a></span></dt><dt><span class="section"><a href="Java-Broker-Security-SSL.html#SSL-Truststore-ClientCertificate">11.4.2. Truststore / Client Certificate Authentication</a></span></dt></dl></dd></dl></div><div class="section"><div class="titlepage"><div><div><h2 class="title"><a id="Java-Broker-Security-Authentication-Providers"></a>11.1.&#160;Authentication Providers</h2></div></div></div><p>
-    In order to successfully establish a connection to the Java Broker, the connection must be
-    authenticated. The Java Broker supports a number of different authentication schemes, each
-    with its own "authentication provider". Any number of Authentication Providers can be configured
-    on the Broker at the same time.
-  </p><p>
-    The Authentication Providers can be configured using <a class="link" href="Java-Broker-Configuring-And-Managing-HTTP-Management.html#Java-Broker-Configuring-And-Managing-REST-API" title="5.2.4.&#160;REST API">REST Management interfaces</a>
-             and <a class="link" href="Java-Broker-Configuring-And-Managing-HTTP-Management.html#Java-Broker-Configuring-And-Managing-Web-Console" title="5.2.2.&#160;Web Management Console">Web Management Console</a>.
-  </p><p>The following Authentication Provider managing operations are available from Web Management Console:
-    </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A new Authentication Provider can be added by clicking onto "Add Provider" on the Broker tab.</p></li><li class="listitem"><p>An Authentication Provider details can be viewed on the Authentication Provider tab.
-        The tab is displayed after clicking onto Authentication Provider name in the Broker object tree or after clicking
-        onto Authentication Provider row in Authentication Providers grid on the Broker tab.</p></li><li class="listitem"><p>Editing of Authentication Provider can be performed by clicking on "Edit" button
-        on Authentication Provider tab.</p></li><li class="listitem"><p>An existing  Authentication Provider can be deleted by clicking on "Delete Provider" button
-        on Broker tab or "Delete" button on the Authentication Provider tab.</p></li></ul></div><p>
-    The Authentication Provider type and name cannot be changed for existing providers as editing of name and type
-    is unsupported at the moment. Only provider specific attributes can be modified in the editing dialog
-    and stored in the broker configuration store.
-  </p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3>
-  Only unused Authentication Provider can be deleted. For delete requests attempting to delete Authentication Provider
-  associated with the Ports, the errors will be returned and delete operations will be aborted. It is possible to change
-  the Authentication Provider on Port at runtime. However, the Broker restart is required for changes on Port to take effect.
-  </div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-LDAP-Provider"></a>11.1.1.&#160;Simple LDAP Authentication Provider</h3></div></div></div><p>
-    SimpleLDAPAuthenticationProvider authenticates connections against a Directory (LDAP).
-  </p><p>
-    To create a SimpleLDAPAuthenticationProvider the following mandatory fields are required:
-    </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>LDAP server URL</em></span> is the URL of the server, for example, <code class="literal">ldaps://example.com:636</code></p></li><li class="listitem"><p><span class="emphasis"><em>Search context</em></span> is the distinguished name of the search base object. It defines the location from which
-        the search for users begins, for example, <code class="literal">dc=users,dc=example,dc=com</code></p></li><li class="listitem"><p><span class="emphasis"><em>Search filter</em></span> is a DN template to find an LDAP user entry by provided user name, for example, <code class="literal">(uid={0})</code></p></li></ul></div><p>
-    Additionally, the following optional fields can be specified:
-    </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>LDAP context factory</em></span> is a fully qualified class name for the JNDI LDAP context factory.
-        This class must implement the <a class="ulink" href="http://docs.oracle.com/javase/6/docs/api/javax/naming/spi/InitialContextFactory.html" target="_top">InitialContextFactory</a>
-        interface and produce instances of <a class="ulink" href="http://docs.oracle.com/javase/6/docs/api/javax/naming/directory/DirContext.html" target="_top">DirContext</a>.
-        If not specified a default value of <code class="literal">com.sun.jndi.ldap.LdapCtxFactory</code> is used.</p></li><li class="listitem"><p><span class="emphasis"><em>LDAP authentication URL</em></span> is the URL of LDAP server for performing "ldap bind". If not
-        specified, the <span class="emphasis"><em>LDAP server URL</em></span> will be used for both searches and authentications.</p></li><li class="listitem"><p><span class="emphasis"><em>Truststore name</em></span> is a name of <a class="link" href="Java-Broker-Security-SSL.html#SSL-Truststore-ClientCertificate" title="11.4.2.&#160;Truststore / Client Certificate Authentication">configured truststore</a>.
-        Use this if connecting to a Directory over SSL (i.e. ldaps://) which is protected by a certificate signed by a private CA (or
-        utilising a self-signed certificate).</p></li></ul></div><p>
-  </p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3>
-    In order to protect the security of the user's password, when using LDAP authentication, you must:
-    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Use SSL on the broker's AMQP, JMX, and HTTP ports to protect the password during
-        transmission to the Broker.</p></li><li class="listitem"><p>Authenticate to the Directory using SSL (i.e. ldaps://) to protect the password
-        during transmission from the Broker to the Directory.</p></li></ul></div></div><p>
-    The LDAP Authentication Provider works in the following manner.  It first connects to the Directory anonymously
-    and searches for the ldap entity which is identified by the username. The search begins at the distinguished name
-    identified by <code class="literal">Search Context</code> and uses the username as a filter.  The search scope is sub-tree
-    meaning the search will include the base object and the subtree extending beneath it.
-  </p><p>
-    If the search returns a match, the Authentication Provider then attempts to bind to the LDAP server with the given
-    name and the password.  Note that
-    <a class="ulink" href="http://docs.oracle.com/javase/6/docs/api/javax/naming/Context.html#SECURITY_AUTHENTICATION" target="_top">simple security authentication</a>
-    is used so the Directory receives the password in the clear.
-  </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-Kerberos-Provider"></a>11.1.2.&#160;Kerberos</h3></div></div></div><p>
-    Kereberos Authentication Provider uses java GSS-API SASL mechanism to authenticate the connections.
-  </p><p>
-    Configuration of kerberos is done through system properties (there doesn't seem to be a way
-    around this unfortunately).
-  </p><pre class="programlisting">
+    </a></span></dt></dl></dd><dt><span class="section"><a href="Java-Broker-Security-Configuration-Encryption.html">8.4. Configuration Encryption</a></span></dt><dd><dl><dt><span class="section"><a href="Java-Broker-Security-Configuration-Encryption.html#Java-Broker-Security-Configuration-Encryption-Configuration">8.4.1. Configuration</a></span></dt><dt><span class="section"><a href="Java-Broker-Security-Configuration-Encryption.html#Java-Broker-Security-Configuration-Encryption-Alternate-Implementations">8.4.2. Alternate Implementations</a></span></dt></dl></dd></dl></div><div class="section"><div class="titlepage"><div><div><h2 class="title"><a id="Java-Broker-Security-Authentication-Providers"></a>8.1.&#160;Authentication Providers</h2></div></div></div><p> In order to successfully establish a connection to the Java Broker, the connection must be
+    authenticated. The Java Broker supports a number of different authentication schemes, each with
+    its own "authentication provider". Any number of Authentication Providers can be configured on
+    the Broker at the same time. </p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p> Only unused Authentication Provider can be deleted. For delete requests attempting to
+      delete Authentication Provider associated with the Ports, the errors will be returned and
+      delete operations will be aborted. It is possible to change the Authentication Provider on
+      Port at runtime. However, the Broker restart is required for changes on Port to take effect.
+    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-LDAP-Provider"></a>8.1.1.&#160;Simple LDAP Authentication Provider</h3></div></div></div><p> SimpleLDAPAuthenticationProvider authenticates connections against a Directory (LDAP). </p><p> To create a SimpleLDAPAuthenticationProvider the following mandatory fields are required: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>LDAP server URL</em></span> is the URL of the server, for example,
+              <code class="literal">ldaps://example.com:636</code></p></li><li class="listitem"><p><span class="emphasis"><em>Search context</em></span> is the distinguished name of the search base
+            object. It defines the location from which the search for users begins, for example,
+              <code class="literal">dc=users,dc=example,dc=com</code></p></li><li class="listitem"><p><span class="emphasis"><em>Search filter</em></span> is a DN template to find an LDAP user entry by
+            provided user name, for example, <code class="literal">(uid={0})</code></p></li></ul></div><p> Additionally, the following optional fields can be specified: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>LDAP context factory</em></span> is a fully qualified class name for the
+            JNDI LDAP context factory. This class must implement the <a class="ulink" href="http://docs.oracle.com/javase/6/docs/api/javax/naming/spi/InitialContextFactory.html" target="_top">InitialContextFactory</a> interface and produce instances of <a class="ulink" href="http://docs.oracle.com/javase/6/docs/api/javax/naming/directory/DirContext.html" target="_top">DirContext</a>. If
+            not specified a default value of <code class="literal">com.sun.jndi.ldap.LdapCtxFactory</code> is
+            used.</p></li><li class="listitem"><p><span class="emphasis"><em>LDAP authentication URL</em></span> is the URL of LDAP server for
+            performing "ldap bind". If not specified, the <span class="emphasis"><em>LDAP server URL</em></span> will
+            be used for both searches and authentications.</p></li><li class="listitem"><p><span class="emphasis"><em>Truststore name</em></span> is a name of <a class="link" href="Java-Broker-Management-Managing-Truststores.html#Java-Broker-Management-Managing-Truststores-Attributes" title="7.12.1.&#160;Attributes">configured
+              truststore</a>. Use this if connecting to a Directory over SSL (i.e. ldaps://)
+            which is protected by a certificate signed by a private CA (or utilising a self-signed
+            certificate).</p></li></ul></div><p>
+    </p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>In order to protect the security of the user's password, when using LDAP authentication,
+        you must: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Use SSL on the broker's AMQP, HTTP and JMX ports to protect the password during
+            transmission to the Broker. The Broker enforces this restriction automatically on AMQP
+            and HTTP ports.</p></li><li class="listitem"><p>Authenticate to the Directory using SSL (i.e. ldaps://) to protect the password
+            during transmission from the Broker to the Directory.</p></li></ul></div></div><p> The LDAP Authentication Provider works in the following manner. If not in <code class="literal">bind
+        without search</code> mode, it first connects to the Directory and searches for the ldap
+      entity which is identified by the username. The search begins at the distinguished name
+      identified by <code class="literal">Search Context</code> and uses the username as a filter. The search
+      scope is sub-tree meaning the search will include the base object and the subtree extending
+      beneath it. </p><p> If the search returns a match, or is configured in <code class="literal">bind without search</code>
+      mode, the Authentication Provider then attempts to bind to the LDAP server with the given name
+      and the password. Note that <a class="ulink" href="http://docs.oracle.com/javase/6/docs/api/javax/naming/Context.html#SECURITY_AUTHENTICATION" target="_top">simple security
+        authentication</a> is used so the Directory receives the password in the clear. </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-Kerberos-Provider"></a>8.1.2.&#160;Kerberos</h3></div></div></div><p> Kereberos Authentication Provider uses java GSS-API SASL mechanism to authenticate the
+      connections. </p><p> Configuration of kerberos is done through system properties (there doesn't seem to be a
+      way around this unfortunately). </p><pre class="programlisting">
     export JAVA_OPTS=-Djavax.security.auth.useSubjectCredsOnly=false -Djava.security.auth.login.config=qpid.conf
     ${QPID_HOME}/bin/qpid-server
   </pre><p>Where qpid.conf would look something like this:</p><pre class="programlisting">
@@ -181,69 +161,52 @@ com.sun.security.jgss.accept {
     kdc="kerberos.example.com"
     keyTab="/path/to/keytab-file"
     principal="&lt;name&gt;/&lt;host&gt;";
-};</pre><p>
-    Where realm, kdc, keyTab and principal should obviously be set correctly for the environment
-    where you are running (see the existing documentation for the C++ broker about creating a keytab
-    file).
-  </p><p>
-    Note: You may need to install the "Java Cryptography Extension (JCE) Unlimited Strength
-    Jurisdiction Policy Files" appropriate for your JDK in order to get Kerberos support working.
-  </p><p>
-    Since Kerberos support only works where SASL authentication is available (e.g. not for JMX
-    authentication) you may wish to also include an alternative Authentication Provider
-    configuration, and use this for JMX and HTTP ports.
-  </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-External-Provider"></a>11.1.3.&#160;External (SSL Client Certificates)</h3></div></div></div><p>
-      When <a class="link" href="Java-Broker-Security-SSL.html#SSL-Truststore-ClientCertificate" title="11.4.2.&#160;Truststore / Client Certificate Authentication"> requiring SSL Client Certificates</a> be
-      presented the External Authentication Provider can be used, such that the user is authenticated based on
-      trust of their certificate alone, and the X500Principal from the SSL session is then used as the username
-      for the connection, instead of also requiring the user to present a valid username and password.
-    </p><p>
-      <span class="bold"><strong>Note:</strong></span> The External Authentication Provider should typically only be used on the
-      AMQP ports, in conjunction with <a class="link" href="Java-Broker-Security-SSL.html#SSL-Truststore-ClientCertificate" title="11.4.2.&#160;Truststore / Client Certificate Authentication">SSL client certificate
-      authentication</a>. It is not intended for other uses such as the JMX management port and will treat any
-      non-sasl authentication processes on these ports as successful with the given username. As such you should
-      configure another Authentication Provider for use on non-AMQP ports. Perhaps the only exception to this
-      would be where the broker is embedded in a container that is itself externally protecting the HTTP interface
-      and then providing the remote users name.
-    </p><p>On creation of External Provider the use of full DN or username CN as a principal name can be configured.
-    If field "Use the full DN as the Username" is set to "true" the full DN is used as an authenticated principal name.
-    If field "Use the full DN as the Username" is set to "false" the user name CN part is used as the authenticated principal name.
-    Setting the field to "false" is particular useful when <a class="link" href="Java-Broker-Security-ACLs.html" title="11.3.&#160;Access Control Lists">ACL</a> is required,
-    as at the moment, ACL does not support commas in the user name.
-    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-Anonymous-Provider"></a>11.1.4.&#160;Anonymous</h3></div></div></div><p>
-      The Anonymous Authentication Provider will allow users to connect with or without credentials and result
-      in their identification on the broker as the user ANONYMOUS. This Provider does not require specification
-      of any additional fields on creation.
-    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-PlainPasswordFile-Provider"></a>11.1.5.&#160;Plain Password File</h3></div></div></div><p>
-      The PlainPasswordFile Provider uses local file to store and manage user credentials.
-      When creating an authentication provider the path to the file needs to be specified.
-      If specified file does not exist an empty file is created automatically on Authentication Provider creation.
-      On  Provider deletion the password file is deleted as well. For this Provider
-      user credentials can be added, removed or changed using REST management interfaces and web management console.
-    </p><p>
-    On navigating to the Plain Password File Provider tab (by clicking onto provider name from Broker tree or provider
-    row in providers grid on Broker tab) the list of existing credentials is displayed on the tab with the buttons "Add User"
-    and "Delete Users" to add new user credentials and delete the existing user credentials respectively.
-    On clicking into user name on Users grid the pop-up dialog to change the password is displayed.
-    </p><div class="section"><div class="titlepage"><div><div><h4 class="title"><a id="idm233114546208"></a>11.1.5.1.&#160;Plain Password File Format</h4></div></div></div><p>
-            The user credentials are stored on the single file line as user name and user password pairs separated by colon character.
-        </p><pre class="programlisting">
+};</pre><p> Where realm, kdc, keyTab and principal should obviously be set correctly for the
+      environment where you are running (see the existing documentation for the C++ broker about
+      creating a keytab file). </p><p> Note: You may need to install the "Java Cryptography Extension (JCE) Unlimited Strength
+      Jurisdiction Policy Files" appropriate for your JDK in order to get Kerberos support working. </p><p> Since Kerberos support only works where SASL authentication is available (e.g. not for
+      JMX authentication) you may wish to also include an alternative Authentication Provider
+      configuration, and use this for JMX and HTTP ports. </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-External-Provider"></a>8.1.3.&#160;External (SSL Client Certificates)</h3></div></div></div><p> When <a class="link" href="Java-Broker-Management-Managing-Truststores.html" title="7.12.&#160;Truststores"> requiring SSL Client
+        Certificates</a> be presented the External Authentication Provider can be used, such that
+      the user is authenticated based on trust of their certificate alone, and the X500Principal
+      from the SSL session is then used as the username for the connection, instead of also
+      requiring the user to present a valid username and password. </p><p>
+      <span class="bold"><strong>Note:</strong></span> The External Authentication Provider should typically
+      only be used on the AMQP/HTTP ports, in conjunction with <a class="link" href="Java-Broker-Management-Managing-Ports.html" title="7.9.&#160;Ports">SSL client certificate
+      authentication</a>. It is not intended for other uses such as the JMX management port and
+      will treat any non-sasl authentication processes on these ports as successful with the given
+      username. As such you should configure another Authentication Provider for use on JMX
+      ports.</p><p>On creation of External Provider the use of full DN or username CN as a principal name can
+      be configured. If attribute "Use the full DN as the Username" is set to "true" the full DN is
+      used as an authenticated principal name. If attribute "Use the full DN as the Username" is set
+      to "false" the user name CN part is used as the authenticated principal name. Setting the
+      field to "false" is particular useful when <a class="link" href="Java-Broker-Security-ACLs.html" title="8.3.&#160;Access Control Lists">ACL</a> is required, as at the moment, ACL does not support commas in the user name.
+    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-Anonymous-Provider"></a>8.1.4.&#160;Anonymous</h3></div></div></div><p> The Anonymous Authentication Provider will allow users to connect with or without
+      credentials and result in their identification on the broker as the user ANONYMOUS. This
+      Provider does not require specification of any additional attributes on creation. </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-ScramSha-Providers"></a>8.1.5.&#160;SCRAM SHA Providers</h3></div></div></div><p>The SCRAM SHA Providers uses the Broker configuration itself to store the database of
+      users. (Unlike the <a class="link" href="Java-Broker-Security.html#Java-Broker-Security-PlainPasswordFile-Provider" title="8.1.6.&#160;Plain Password File">Plain</a> and <a class="link" href="Java-Broker-Security.html#Java-Broker-Security-Base64MD5PasswordFile-Provider" title="8.1.7.&#160;Base64MD5 Password File">Base64MD5</a> providers that follow, there is no separate password file). The users'
+      passwords are stored as salted SHA digested password. This can be further encrypted using the
+      facilities described in <a class="xref" href="Java-Broker-Security-Configuration-Encryption.html" title="8.4.&#160;Configuration Encryption">Section&#160;8.4, &#8220;Configuration Encryption&#8221;</a>.</p><p>There are two variants of this provider, SHA1 and SHA256. SHA256 is recommended whenever
+      possible. SHA1 is provided with compatibility with clients utilising JDK 1.6 (which does not
+      support SHA256).</p><p>For these providers user credentials can be added, removed or changed using
+      Management.</p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-PlainPasswordFile-Provider"></a>8.1.6.&#160;Plain Password File</h3></div></div></div><p> The PlainPasswordFile Provider uses local file to store and manage user credentials. When
+      creating an authentication provider the path to the file needs to be specified. If specified
+      file does not exist an empty file is created automatically on Authentication Provider
+      creation. On Provider deletion the password file is deleted as well.</p><p>For these providers user credentials can be added, removed or changed using
+      Management.</p><div class="section"><div class="titlepage"><div><div><h4 class="title"><a id="idp1059824"></a>8.1.6.1.&#160;Plain Password File Format</h4></div></div></div><p> The user credentials are stored on the single file line as user name and user password
+        pairs separated by colon character. This file must not be modified externally whilst the
+        Broker is running.</p><pre class="programlisting">
 # password file format
 # &lt;user name&gt;: &lt;user password&gt;
 guest:guest
-        </pre></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-Base64MD5PasswordFile-Provider"></a>11.1.6.&#160;Base64MD5 Password File</h3></div></div></div><p>
-      Base64MD5PasswordFile Provider uses local file to store and manage user credentials similar to Similar to PlainPasswordFile
-      but instead of storing a password the MD5 password digest encoded with Base64 encoding is stored in the file.
-      When creating an authentication provider the path to the file needs to be specified.
-      If specified file does not exist an empty file is created automatically on Authentication Provider creation.
-      On Base64MD5PasswordFile Provider deletion the password file is deleted as well. For this Provider
-      user credentials can be added, removed or changed using REST management interfaces and web management console.
-    </p><p>
-    On navigating to the Base64MD5PasswordFile Provider tab (by clicking onto provider name from Broker tree or provider
-    row in providers grid on Broker tab) the list of existing credentials is displayed on the tab with the buttons "Add User"
-    and "Delete Users" to add new user credentials and delete the existing user credentials respectively.
-    On clicking into user name on Users grid the pop-up dialog to change the password is displayed.
-    </p></div></div></div><div class="navfooter"><hr /><table summary="Navigation footer" width="100%"><tr><td align="left" width="40%"><a accesskey="p" href="Java-Broker-Stores-HA-BDB-Store.html">Prev</a>&#160;</td><td align="center" width="20%">&#160;</td><td align="right" width="40%">&#160;<a accesskey="n" href="Java-Broker-Security-Group-Providers.html">Next</a></td></tr><tr><td align="left" valign="top" width="40%">10.5.&#160;High Availability BDB Message Store&#160;</td><td align="center" width="20%"><a accesskey="h" href="index.html">Home</a></td><td align="right" valign="top" width="40%">&#160;11.2.&#160;Group Providers</td></tr></table></div></div>
+        </pre></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a id="Java-Broker-Security-Base64MD5PasswordFile-Provider"></a>8.1.7.&#160;Base64MD5 Password File</h3></div></div></div><p> Base64MD5PasswordFile Provider uses local file to store and manage user credentials
+      similar to PlainPasswordFile but instead of storing a password the MD5 password digest encoded
+      with Base64 encoding is stored in the file. When creating an authentication provider the path
+      to the file needs to be specified. If specified file does not exist an empty file is created
+      automatically on Authentication Provider creation. On Base64MD5PasswordFile Provider deletion
+      the password file is deleted as well.</p><div class="section"><div class="titlepage"><div><div><h4 class="title"><a id="idp1063952"></a>8.1.7.1.&#160;Base64MD5 File Format</h4></div></div></div><p> The user credentials are stored on the single file line as user name and user password
+        pairs separated by colon character. The password is stored MD5 digest/Base64 encoded. This
+        file must not be modified externally whilst the Broker is running.</p></div></div></div></div><div class="navfooter"><hr /><table summary="Navigation footer" width="100%"><tr><td align="left" width="40%"><a accesskey="p" href="Java-Broker-Management-Managing-Plugins-JMX.html">Prev</a>&#160;</td><td align="center" width="20%">&#160;</td><td align="right" width="40%">&#160;<a accesskey="n" href="Java-Broker-Security-Group-Providers.html">Next</a></td></tr><tr><td align="left" valign="top" width="40%">7.16.&#160;JMX Plugin&#160;</td><td align="center" width="20%"><a accesskey="h" href="index.html">Home</a></td><td align="right" valign="top" width="40%">&#160;8.2.&#160;Group Providers</td></tr></table></div></div>
 
         <hr/>
 

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-MessageFlow.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-MessageFlow.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-MessageFlow.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Modified: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-Model.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-Model.png?rev=1632181&r1=1632180&r2=1632181&view=diff
==============================================================================
Binary files - no diff available.

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-PortAuthFlow.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-PortAuthFlow.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Broker-PortAuthFlow.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-1.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-1.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-1.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-2.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-2.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-2.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-3.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-3.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Create-3.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Overview.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Overview.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/HA-Overview.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Add-Dialogue.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Add-Dialogue.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Add-Dialogue.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Auth.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Auth.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Auth.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Modified: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Console.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Console.png?rev=1632181&r1=1632180&r2=1632181&view=diff
==============================================================================
Binary files - no diff available.

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-ContextVar.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-ContextVar.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-ContextVar.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Edit-Dialogue.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Edit-Dialogue.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Edit-Dialogue.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Tab.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Tab.png?rev=1632181&view=auto
==============================================================================
Binary file - no diff available.

Propchange: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/Management-Web-Tab.png
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Modified: qpid/site/docs/releases/qpid-trunk/java-broker/book/images/VirtualHost-Model.png
URL: http://svn.apache.org/viewvc/qpid/site/docs/releases/qpid-trunk/java-broker/book/images/VirtualHost-Model.png?rev=1632181&r1=1632180&r2=1632181&view=diff
==============================================================================
Binary files - no diff available.



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org