You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by ro...@apache.org on 2012/11/25 22:04:51 UTC
svn commit: r1413417 [2/12] - in /qpid/site/docs/books/trunk:
AMQP-Messaging-Broker-CPP-Book/html/ AMQP-Messaging-Broker-CPP-Book/pdf/
AMQP-Messaging-Broker-Java-Book/html/ AMQP-Messaging-Broker-Java-Book/pdf/
Programming-In-Apache-Qpid/html/ Programmi...
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html?rev=1413417&r1=1413416&r2=1413417&view=diff
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html (original)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html Sun Nov 25 21:04:37 2012
@@ -7,7 +7,7 @@
</p><p>
Both the Qpid broker and Qpid clients use the <a class="ulink" href="http://cyrusimap.web.cmu.edu/" target="_top">Cyrus SASL library</a>, a full-featured authentication framework, which offers many configuration options. This section shows how to configure users for authentication with SASL, which is sufficient when using <span class="command"><strong>SASL PLAIN</strong></span>. If you are not using SSL, you should configure SASL to use <span class="command"><strong>CRAM-MD5</strong></span>, <span class="command"><strong>DIGEST-MD5</strong></span>, or <span class="command"><strong>GSSAPI</strong></span> (which provides Kerberos authentication). For information on configuring these and other options in SASL, see the Cyrus SASL documentation.
</p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>
- The <span class="command"><strong>SASL PLAIN</strong></span> method sends passwords in cleartext, and is vulnerable to man-in-the-middle attacks unless SSL (Secure Socket Layer) is also used (see <a class="xref" href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-Encryption_using_SSL" title="1.5.3. Encryption using SSL">Section 1.5.3, âEncryption using SSLâ</a>).
+ The <span class="command"><strong>SASL PLAIN</strong></span> method sends passwords in cleartext, and is vulnerable to man-in-the-middle attacks unless SSL (Secure Socket Layer) is also used (see <a class="xref" href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-Encryption_using_SSL" title="1.5.4. Encryption using SSL">Section 1.5.4, âEncryption using SSLâ</a>).
</p><p>
If you are not using SSL, we recommend that you disable <span class="command"><strong>PLAIN</strong></span> authentication in the broker.
</p></div><p>
@@ -108,50 +108,78 @@ com.sun.security.jgss.initiate {
</p></li></ul></div><p>
Here is a sample connection URL for a Kerberos connection:
</p><pre class="screen">amqp://guest@clientid/testpath?brokerlist='tcp://localhost:5672?sasl_mechs='GSSAPI'&sasl_protocol='qpidd'&sasl_server='<server-host-name>''</pre></li></ol></div></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Authorization"></a>1.5.2. Authorization</h3></div></div></div><p>
- In Qpid, Authorization specifies which actions can be performed by each authenticated user using an Access Control List (ACL). Use the <span class="command"><strong>--acl-file</strong></span> command to load the access control list. The filename should have a <code class="filename">.acl</code> extension:
+ In Qpid, Authorization specifies which actions can be performed by each authenticated user using an Access Control List (ACL).
+ </p><p>
+ Use the <span class="command"><strong>--acl-file</strong></span> command to load the access control list. The filename should have a <code class="filename">.acl</code> extension:
</p><pre class="screen">
-$ qpidd --acl-file <em class="replaceable"><code>./aclfilename.acl</code></em></pre><p>
+ $ qpidd --acl-file <em class="replaceable"><code>./aclfilename.acl</code></em></pre><p>
Each line in an ACL file grants or denies specific rights to a user. If the last line in an ACL file is <code class="literal">acl deny all all</code>, the ACL uses <em class="firstterm">deny mode</em>, and only those rights that are explicitly allowed are granted:
</p><pre class="programlisting">
-acl allow rajith@QPID all all
-acl deny all all
+ acl allow rajith@QPID all all
+ acl deny all all
</pre><p>
On this server, <code class="literal">rajith@QPID</code> can perform any action, but nobody else can. Deny mode is the default, so the previous example is equivalent to the following ACL file:
</p><pre class="programlisting">
-acl allow rajith@QPID all all
+ acl allow rajith@QPID all all
</pre><p>
+ Alternatively the ACL file may use <em class="firstterm">allow mode</em> by placing:
+ </p><pre class="programlisting">
+ acl allow all all
+</pre><p>
+ as the final line in the ACL file. In <span class="emphasis"><em>allow mode</em></span> all actions by all users are allowed unless otherwise denied by specific ACL rules.
+ The ACL rule which selects <span class="emphasis"><em>deny mode</em></span> or <span class="emphasis"><em>allow mode</em></span> must be the last line in the ACL rule file.
+ </p><p>
ACL syntax allows fine-grained access rights for specific actions:
</p><pre class="programlisting">
-acl allow carlt@QPID create exchange name=carl.*
-acl allow fred@QPID create all
-acl allow all consume queue
-acl allow all bind exchange
-acl deny all all
+ acl allow carlt@QPID create exchange name=carl.*
+ acl allow fred@QPID create all
+ acl allow all consume queue
+ acl allow all bind exchange
+ acl deny all all
</pre><p>
An ACL file can define user groups, and assign permissions to them:
</p><pre class="programlisting">
-group admin ted@QPID martin@QPID
-acl allow admin create all
-acl deny all all
-</pre><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntax"></a>1.5.2.1. ACL Syntax</h4></div></div></div><p>
+ group admin ted@QPID martin@QPID
+ acl allow admin create all
+ acl deny all all
+</pre><p>
+ Performance Note: Most ACL queries are performed infrequently. The overhead associated with
+ ACL passing an allow or deny decision on the creation of a queue is negligible
+ compared to actually creating and using the queue. One notable exception is the <span class="command"><strong>publish exchange</strong></span>
+ query. ACL files with no <span class="emphasis"><em>publish exchange</em></span> rules are noted and the broker short circuits the logic
+ associated with the per-messsage <span class="emphasis"><em>publish exchange</em></span> ACL query.
+ However, if an ACL file has any <span class="emphasis"><em>publish exchange</em></span> rules
+ then the broker is required to perform a <span class="emphasis"><em>publish exchange</em></span> query for each message published.
+ Users with performance critical applications are encouraged to structure exchanges, queues, and bindings so that
+ the <span class="emphasis"><em>publish exchange</em></span> ACL rules are unnecessary.
+ </p><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntax"></a>1.5.2.1. ACL Syntax</h4></div></div></div><p>
ACL rules must be on a single line and follow this syntax:
</p><pre class="programlisting">
-user = username[/domain[@realm]]
-user-list = user1 user2 user3 ...
-group-name-list = group1 group2 group3 ...
-
-group <group-name> = [user-list] [group-name-list]
-
-permission = [allow|allow-log|deny|deny-log]
-action = [consume|publish|create|access|bind|unbind|delete|purge|update]
-object = [virtualhost|queue|exchange|broker|link|route|method]
-property = [name|durable|owner|routingkey|autodelete|exclusive|
- type|alternate|queuename|schemapackage|schemaclass|
- queuemaxsizelowerlimit|queuemaxsizeupperlimit|
- queuemaxcountlowerlimit|queuemaxcountupperlimit]
-
-acl permission {<group-name>|<user-name>|"all"} {action|"all"} [object|"all"
- [property=<property-value> ...]]
+ user = username[/domain[@realm]]
+ user-list = user1 user2 user3 ...
+ group-name-list = group1 group2 group3 ...
+
+ group <group-name> = [user-list] [group-name-list]
+
+ permission = [allow | allow-log | deny | deny-log]
+ action = [consume | publish | create | access |
+ bind | unbind | delete | purge | update]
+ object = [queue | exchange | broker | link | method]
+ property = [name | durable | owner | routingkey |
+ autodelete | exclusive |type |
+ alternate | queuename |
+ schemapackage | schemaclass |
+ queuemaxsizelowerlimit |
+ queuemaxsizeupperlimit |
+ queuemaxcountlowerlimit |
+ queuemaxcountupperlimit |
+ filemaxsizelowerlimit |
+ filemaxsizeupperlimit |
+ filemaxcountlowerlimit |
+ filemaxcountupperlimit ]
+
+ acl permission {<group-name>|<user-name>|"all"} {action|"all"} [object|"all"
+ [property=<property-value> ...]]
</pre><p>
ACL rules can also include a single object name (or the keyword <em class="parameter"><code>all</code></em>) and one or more property name value pairs in the form <span class="command"><strong>property=value</strong></span>
@@ -196,7 +224,9 @@ acl permission {<group-name>|<u
<span class="command"><strong>publish</strong></span>
</td><td>
<p>
- Applied on a per message basis on publish message transfers, this rule consumes the most resources
+ Applied on a per message basis
+ to verify that the user has rights to publish to the given
+ exchange with the given routingkey.
</p>
</td></tr><tr><td>
@@ -283,35 +313,186 @@ acl permission {<group-name>|<u
Management or agent or broker method
</p>
- </td></tr></tbody></table></div></div><br class="table-break"><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty"></a><p class="title"><b>Table 1.7. ACL Rules:property</b></p><div class="table-contents"><table summary="ACL Rules:property" border="1"><colgroup><col><col><col><col></colgroup><thead><tr><th>Property</th><th>Type</th><th>Description</th><th>Usage</th></tr></thead><tbody><tr><td> <span class="command"><strong>name</strong></span> </td><td>String</td><td>Object name, such as a queue name or exchange name.</td><td>.</td></tr><tr><td> <span class="command"><strong>durable</strong></span> </td><td>Boolean</td><td>Indicates the object is durable</td><td>CREATE QUEUE, CREATE EXCHANGE</td></tr><tr><td> <span class="command"><strong>routingkey</strong></span> </td><td>String</td><td>Specifies routing key</td><td>BIND EXCHANGE, UNBIND EXCHANGE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>autodelete</strong><
/span> </td><td>Boolean</td><td>Indicates whether or not the object gets deleted when the connection is closed</td><td>CREATE QUEUE</td></tr><tr><td> <span class="command"><strong>exclusive</strong></span> </td><td>Boolean</td><td>Indicates the presence of an <em class="parameter"><code>exclusive</code></em> flag</td><td>CREATE QUEUE</td></tr><tr><td> <span class="command"><strong>type</strong></span> </td><td>String</td><td>Type of exchange, such as topic, fanout, or xml</td><td>CREATE EXCHANGE</td></tr><tr><td> <span class="command"><strong>alternate</strong></span> </td><td>String</td><td>Name of the alternate exchange</td><td>CREATE EXCHANGE, CREATE QUEUE</td></tr><tr><td> <span class="command"><strong>queuename</strong></span> </td><td>String</td><td>Name of the queue</td><td>ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>schemapackage</strong></span> </td><td>String</td><td>QMF schema package name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="co
mmand"><strong>schemaclass</strong></span> </td><td>String</td><td>QMF schema class name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>queuemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_size</td><td>CREATE QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queue.max_size</td><td>CREATE QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_count</td><td>CREATE QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queue.max_count</td><td>CREATE QUEUE</td></tr></tbody></table></div></div><br class="table-break"></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntacti
c_Conventions"></a>1.5.2.2. ACL Syntactic Conventions</h4></div></div></div><p>
- In ACL files, the following syntactic conventions apply:
- </p><div class="itemizedlist"><ul><li><p>
- A line starting with the <span class="command"><strong>#</strong></span> character is considered a comment and is ignored.
- </p></li><li><p>
- Empty lines and lines that contain only whitespace (' ', '\f', '\n', '\r', '\t', '\v') are ignored.
- </p></li><li><p>
- All tokens are case sensitive. <em class="parameter"><code>name1</code></em> is not the same as <em class="parameter"><code>Name1</code></em> and <em class="parameter"><code>create</code></em> is not the same as <em class="parameter"><code>CREATE</code></em>.
- </p></li><li><p>
- Group lists can be extended to the following line by terminating the line with the <span class="command"><strong>\</strong></span> character.
- </p></li><li><p>
- Additional whitespace - that is, where there is more than one whitespace character - between and after tokens is ignored. Group and ACL definitions must start with either <span class="command"><strong>group</strong></span> or <span class="command"><strong>acl</strong></span> and with no preceding whitespace.
- </p></li><li><p>
- All ACL rules are limited to a single line of at most 1024 characters.
- </p></li><li><p>
- Rules are interpreted from the top of the file down until a matching rule is obtained. The matching rule then controls the allow or deny decision.
- </p></li><li><p>
- The keyword <em class="parameter"><code>all</code></em> is reserved and may be used in ACL rules to match all individuals and groups, all actions, or all objects.
- </p></li><li><p>
- By default ACL files are in 'Deny Mode' and deny all actions by all users. That is, there is an implicit <em class="parameter"><code>acl deny all all</code></em> rule appended to the ACL rule list.
- </p></li><li><p>
- Group names may contain only <em class="parameter"><code>a-z</code></em>, <em class="parameter"><code>A-Z</code></em>, <em class="parameter"><code>0-9</code></em>, <em class="parameter"><code>- hyphen</code></em> and <em class="parameter"><code>_ underscore</code></em>.
- </p></li><li><p>
- Individual user names may contain only <em class="parameter"><code>a-z</code></em>, <em class="parameter"><code>A-Z</code></em>, <em class="parameter"><code>0-9</code></em>, <em class="parameter"><code>- hyphen</code></em>, <em class="parameter"><code>_ underscore</code></em>, <em class="parameter"><code>. period</code></em>, <em class="parameter"><code>@ ampersand</code></em>, and <em class="parameter"><code>/ slash</code></em>.
- </p></li><li><p>
- Rules must be preceded by any group definitions they can use. Any name not defined as a group will be assumed to be that of an individual.
- </p></li></ul></div><p>
+ </td></tr></tbody></table></div></div><br class="table-break"><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty"></a><p class="title"><b>Table 1.7. ACL Rules:property</b></p><div class="table-contents"><table summary="ACL Rules:property" border="1"><colgroup><col><col><col><col></colgroup><thead><tr><th>Property</th><th>Type</th><th>Description</th><th>Usage</th></tr></thead><tbody><tr><td> <span class="command"><strong>name</strong></span> </td><td>String</td><td>Object name, such as a queue name or exchange name.</td><td> </td></tr><tr><td> <span class="command"><strong>durable</strong></span> </td><td>Boolean</td><td>Indicates the object is durable</td><td>CREATE QUEUE, CREATE EXCHANGE, ACCESS QUEUE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>routingkey</strong></span> </td><td>String</td><td>Specifies routing key</td><td>BIND EXCHANGE, UNBIND EXCHANGE, ACCESS EXCHANGE, PUBLISH EXCHANGE</td></tr><tr><td
> <span class="command"><strong>autodelete</strong></span> </td><td>Boolean</td><td>Indicates whether or not the object gets deleted when the connection is closed</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>exclusive</strong></span> </td><td>Boolean</td><td>Indicates the presence of an <em class="parameter"><code>exclusive</code></em> flag</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>type</strong></span> </td><td>String</td><td>Type of exchange, such as topic, fanout, or xml</td><td>CREATE EXCHANGE, ACCESS EXCHANGE</td></tr><tr><td> <span class="command"><strong>alternate</strong></span> </td><td>String</td><td>Name of the alternate exchange</td><td>CREATE EXCHANGE, CREATE QUEUE, ACCESS EXCHANGE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuename</strong></span> </td><td>String</td><td>Name of the queue</td><td>ACCESS EXCHANGE, BIND EXCHANGE, UNBIND EXCHANGE</td></tr><tr><td> <sp
an class="command"><strong>schemapackage</strong></span> </td><td>String</td><td>QMF schema package name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>schemaclass</strong></span> </td><td>String</td><td>QMF schema class name</td><td>ACCESS METHOD</td></tr><tr><td> <span class="command"><strong>queuemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_size (memory bytes)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queue.max_size (memory bytes)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for queue.max_count (messages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>queuemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for queu
e.max_count (messages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxsizelowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for file.max_size (64kb pages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxsizeupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for file.max_size (64kb pages)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxcountlowerlimit</strong></span> </td><td>Integer</td><td>Minimum value for file.max_count (files)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr><tr><td> <span class="command"><strong>filemaxcountupperlimit</strong></span> </td><td>Integer</td><td>Maximum value for file.max_count (files)</td><td>CREATE QUEUE, ACCESS QUEUE</td></tr></tbody></table></div></div><br class="table-break"><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_G
uide-Authorization-ACL_ActionObjectPropertyTuples"></a>ACL Action-Object-Property Tuples</h5></div></div></div><p>
+ Not every ACL action is applicable to every ACL object. Furthermore, not every property may be
+ specified for every action-object pair.
+ The following table enumerates which action and object pairs are allowed.
+ The table also lists which optional ACL properties are allowed to qualify
+ action-object pairs.
+ </p><p>
+ The <span class="emphasis"><em>access</em></span> action is called with different argument
+ lists for the <span class="emphasis"><em>exchange</em></span> and <span class="emphasis"><em>queue</em></span> objects.
+ A separate column shows the AMQP 0.10 method that the Access ACL rule is satisfying.
+ Write separate rules with the additional arguments for the <span class="emphasis"><em>declare</em></span>
+ and <span class="emphasis"><em>bind</em></span> methods and include these rules in the ACL file
+ before the rules for the <span class="emphasis"><em>query</em></span> method.
+
+ </p><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties"></a><p class="title"><b>Table 1.8. ACL Properties Allowed for each Action and Object</b></p><div class="table-contents"><table summary="ACL Properties Allowed for each Action and Object" border="1"><colgroup><col><col><col><col></colgroup><thead><tr><th>Action</th><th>Object</th><th>Properties</th><th>Method</th></tr></thead><tbody><tr><td>access</td><td>broker</td><td> </td><td class="auto-generated"> </td></tr><tr><td>access</td><td>exchange</td><td>name type alternate durable</td><td>declare</td></tr><tr><td>access</td><td>exchange</td><td>name queuename routingkey</td><td>bound</td></tr><tr><td>access</td><td>exchange</td><td>name</td><td>query</td></tr><tr><td>access</td><td>method</td><td>name schemapackage schemaclass</td><td> </td></tr><tr><td>access</td><td>queue</td><td>name alternate durable exclusive autodelete policy queuemaxsizelowerlimit queuem
axsizeupperlimit queuemaxcountlowerlimit queuemaxcountupperlimit filemaxsizelowerlimit filemaxsizeupperlimit filemaxcountlowerlimit filemaxcountupperlimit</td><td>declare</td></tr><tr><td>access</td><td>queue</td><td>name</td><td>query</td></tr><tr><td>bind</td><td>exchange</td><td>name queuename routingkey</td><td>Â </td></tr><tr><td>consume</td><td>queue</td><td>name</td><td>Â </td></tr><tr><td>create</td><td>exchange</td><td>name type alternate durable</td><td>Â </td></tr><tr><td>create</td><td>link</td><td>name</td><td>Â </td></tr><tr><td>create</td><td>queue</td><td>name alternate durable exclusive autodelete policy queuemaxsizelowerlimit queuemaxsizeupperlimit queuemaxcountlowerlimit queuemaxcountupperlimit filemaxsizelowerlimit filemaxsizeupperlimit filemaxcountlowerlimit filemaxcountupperlimit</td><td>Â </td></tr><tr><td>delete</td><td>exchange</td><td>name</td><td>Â </td></tr><tr><td>delete</td><td>queue</td><td>name</td><td>Â </td></tr><tr><td>publish
</td><td>exchange</td><td>name routingkey</td><td>Â </td></tr><tr><td>purge</td><td>queue</td><td>name</td><td>Â </td></tr><tr><td>unbind</td><td>exchange</td><td>name queuename routingkey</td><td>Â </td></tr><tr><td>update</td><td>broker</td><td>Â </td><td>Â </td></tr></tbody></table></div></div><br class="table-break"><p>
+
+ </p></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions"></a>1.5.2.2. ACL Syntactic Conventions</h4></div></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-comments"></a>Comments</h5></div></div></div><p>
+ </p><div class="itemizedlist"><ul><li><p>
+ A line starting with the <span class="command"><strong>#</strong></span> character is considered a comment and is ignored.
+ </p></li><li><p>
+ Embedded comments and trailing comments are not allowed. The <span class="command"><strong>#</strong></span> is commonly found in routing keys and other AMQP literals which occur naturally in ACL rule specifications.
+ </p></li></ul></div><p>
+ </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-whitespace"></a>White Space</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ Empty lines and lines that contain only whitespace (' ', '\f', '\n', '\r', '\t', '\v') are ignored.
+ </p></li><li><p>
+ Additional whitespace between and after tokens is allowed.
+ </p></li><li><p>
+ Group and Acl definitions must start with <span class="command"><strong>group</strong></span> and <span class="command"><strong>acl</strong></span> respectively and with no preceding whitespace.
+ </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-characterset"></a>Character Set</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ ACL files use 7-bit ASCII characters only
+ </p></li><li><p>
+ Group names may contain only
+ </p><div class="itemizedlist"><ul><li><span class="command"><strong>[a-z]</strong></span></li><li><span class="command"><strong>[A-Z]</strong></span></li><li><span class="command"><strong>[0-9]</strong></span></li><li><span class="command"><strong>'-'</strong></span> hyphen</li><li><span class="command"><strong>'_'</strong></span> underscore</li></ul></div><p>
+ </p></li><li><p>
+ Individual user names may contain only
+ </p><div class="itemizedlist"><ul><li><span class="command"><strong>[a-z]</strong></span></li><li><span class="command"><strong>[A-Z]</strong></span></li><li><span class="command"><strong>[0-9]</strong></span></li><li><span class="command"><strong>'-'</strong></span> hyphen</li><li><span class="command"><strong>'_'</strong></span> underscore</li><li><span class="command"><strong>'.'</strong></span> period</li><li><span class="command"><strong>'@'</strong></span> ampersand</li><li><span class="command"><strong>'/'</strong></span> slash</li></ul></div><p>
+ </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-casesensitivity"></a>Case Sensitivity</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ All tokens are case sensitive. <em class="parameter"><code>name1</code></em> is not the same as <em class="parameter"><code>Name1</code></em> and <em class="parameter"><code>create</code></em> is not the same as <em class="parameter"><code>CREATE</code></em>.
+ </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linecontinuation"></a>Line Continuation</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ Group lists can be extended to the following line by terminating the line with the <span class="command"><strong>'\'</strong></span> character. No other ACL file lines may be continued.
+ </p></li><li><p>
+ Group specification lines may be continued only after the group name or any of the user names included in the group. See example below.
+ </p></li><li><p>
+ Lines consisting solely of a <span class="command"><strong>'\'</strong></span> character are not permitted.
+ </p></li><li><p>
+ The <span class="command"><strong>'\'</strong></span> continuation character is recognized only if it is the last character in the line. Any characters after the <span class="command"><strong>'\'</strong></span> are not permitted.
+ </p></li></ul></div><pre class="programlisting">
+ #
+ # Examples of extending group lists using a trailing '\' character
+ #
+ group group1 name1 name2 \
+ name3 name4 \
+ name5
+
+ group group2 \
+ group1 \
+ name6
+ #
+ # The following are illegal:
+ #
+ # '\' must be after group name
+ #
+ group \
+ group3 name7 name8
+ #
+ # No empty extension line
+ #
+ group group4 name9 \
+ \
+ name10
+</pre></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-linelength"></a>Line Length</h5></div></div></div><div class="itemizedlist"><ul><li><p>
+ ACL file lines are limited to 1024 characters.
+ </p></li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords"></a>ACL File Keywords</h5></div></div></div>
+ ACL reserves several words for convenience and for context sensitive substitution.
+
+ <div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-all"></a>The <span class="command"><strong>all</strong></span> Keyword</h6></div></div></div>
+ The keyword <span class="command"><strong>all</strong></span> is reserved. It may be used in ACL rules to match all individuals and groups, all actions, or all objects.
+ <div class="itemizedlist"><ul><li>acl allow all create queue</li><li>acl allow bob@QPID all queue</li><li>acl allow bob@QPID create all</li></ul></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntactic_Conventions-keywords-userdomain"></a>User Name and Domain Name Keywords</h6></div></div></div><p>
+ In the C++ Broker 0.20 a simple set of user name and domain name substitution variable keyword tokens is defined. This provides administrators with an easy way to describe private or shared resources.
+ </p><p>
+ Symbol substitution is allowed in the ACL file anywhere that text is supplied for a property value.
+ </p><p>
+ In the following table an authenticated user named bob.user@QPID.COM has his substitution keywords expanded.
+
+ </p><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_UsernameSubstitution"></a><p class="title"><b>Table 1.9. ACL User Name and Domain Name Substitution Keywords</b></p><div class="table-contents"><table summary="ACL User Name and Domain Name Substitution Keywords" border="1"><colgroup><col><col></colgroup><thead><tr><th>Keyword</th><th>Expansion</th></tr></thead><tbody><tr><td> <span class="command"><strong>${userdomain}</strong></span> </td><td>bob_user_QPID_COM</td></tr><tr><td> <span class="command"><strong>${user}</strong></span> </td><td>bob_user</td></tr><tr><td> <span class="command"><strong>${domain}</strong></span> </td><td>QPID_COM</td></tr></tbody></table></div></div><p><br class="table-break">
+ </p><p>
+ </p><div class="itemizedlist"><ul><li>
+ The original user name has the period â.â and ampersand â@â characters translated into underscore â_â. This allows substitution to work when the substitution keyword is used in a routingkey in the Acl file.
+ </li><li>
+ The Acl processing matches ${userdomain} before matching either ${user} or ${domain}. Rules that specify the combination ${user}_${domain} will never match.
+ </li></ul></div><p>
+ </p><pre class="programlisting">
+ # Example:
+ #
+ # Administrators can set up Acl rule files that allow every user to create a
+ # private exchange, a private queue, and a private binding between them.
+ # In this example the users are also allowed to create private backup exchanges,
+ # queues and bindings. This effectively provides limits to user's exchange,
+ # queue, and binding creation and guarantees that each user gets exclusive
+ # access to these resources.
+ #
+ #
+ # Create primary queue and exchange:
+ #
+ acl allow all create queue name=$\{user}-work alternate=$\{user}-work2
+ acl deny all create queue name=$\{user}-work alternate=*
+ acl allow all create queue name=$\{user}-work
+ acl allow all create exchange name=$\{user}-work alternate=$\{user}-work2
+ acl deny all create exchange name=$\{user}-work alternate=*
+ acl allow all create exchange name=$\{user}-work
+ #
+ # Create backup queue and exchange
+ #
+ acl deny all create queue name=$\{user}-work2 alternate=*
+ acl allow all create queue name=$\{user}-work2
+ acl deny all create exchange name=$\{user}-work2 alternate=*
+ acl allow all create exchange name=$\{user}-work2
+ #
+ # Bind/unbind primary exchange
+ #
+ acl allow all bind exchange name=$\{user}-work routingkey=$\{user} queuename=$\{user}-work
+ acl allow all unbind exchange name=$\{user}-work routingkey=$\{user} queuename=$\{user}-work
+ #
+ # Bind/unbind backup exchange
+ #
+ acl allow all bind exchange name=$\{user}-work2 routingkey=$\{user} queuename=$\{user}-work2
+ acl allow all unbind exchange name=$\{user}-work2 routingkey=$\{user} queuename=$\{user}-work2
+ #
+ # Access primary exchange
+ #
+ acl allow all access exchange name=$\{user}-work routingkey=$\{user} queuename=$\{user}-work
+ #
+ # Access backup exchange
+ #
+ acl allow all access exchange name=$\{user}-work2 routingkey=$\{user} queuename=$\{user}-work2
+ #
+ # Publish primary exchange
+ #
+ acl allow all publish exchange name=$\{user}-work routingkey=$\{user}
+ #
+ # Publish backup exchange
+ #
+ acl allow all publish exchange name=$\{user}-work2 routingkey=$\{user}
+ #
+ # deny mode
+ #
+ acl deny all all
+</pre></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards"></a>Wildcards</h5></div></div></div>
+ ACL privides two types of wildcard matching to provide flexibility in writing rules.
+
+ <div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-asterisk"></a>Property Value Wildcard</h6></div></div></div><p>
+ Text specifying a property value may end with a single trailing <span class="command"><strong>*</strong></span> character.
+ This is a simple wildcard match indicating that strings which match up to that point are matches for the ACL property rule.
+ An ACL rule such as
+ </p><p>
+ </p><pre class="programlisting"> acl allow bob@QPID create queue name=bob*</pre><p>
+ </p><p>
+ allow user bob@QPID to create queues named bob1, bob2, bobQueue3, and so on.
+ </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h6 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Syntatic_Conventions-wildcards-topickey"></a>Topic Routing Key Wildcard</h6></div></div></div><p>
+ In the C++ Broker 0.20 the logic governing the ACL Match has changed for each ACL rule that contains a routingkey property.
+ The routingkey property is matched according to Topic Exchange match logic the broker uses when it distributes messages published to a topic exchange.
+ </p><p>
+ Routing keys are hierarchical where each level is separated by a period:
+ </p><div class="itemizedlist"><ul><li>weather.usa</li><li>weather.europe.germany</li><li>weather.europe.germany.berlin</li><li>company.engineering.repository</li></ul></div><p>
+ </p><p>
+ Within the routing key hierarchy two wildcard characters are defined.
+ </p><div class="itemizedlist"><ul><li><span class="command"><strong>*</strong></span> matches one field</li><li><span class="command"><strong>#</strong></span> matches zero or more fields</li></ul></div><p>
+ </p><p>
+ Suppose an ACL rule file is:
+ </p><p>
+ </p><pre class="programlisting">
+ acl allow-log uHash1@COMPANY publish exchange name=X routingkey=a.#.b
+ acl deny all all
+ </pre><p>
+ </p><p>
+ When user uHash1@COMPANY attempts to publish to exchange X the ACL will return these results:
+
+ </p><div class="table"><a name="tabl-Messaging_User_Guide-ACL_Syntax-ACL_TopicExchangeMatch"></a><p class="title"><b>Table 1.10. Topic Exchange Wildcard Match Examples</b></p><div class="table-contents"><table summary="Topic Exchange Wildcard Match Examples" border="1"><colgroup><col><col></colgroup><thead><tr><th>routingkey in publish to exchange X</th><th>result</th></tr></thead><tbody><tr><td> <span class="command"><strong>a.b</strong></span> </td><td>allow-log</td></tr><tr><td> <span class="command"><strong>a.x.b</strong></span> </td><td>allow-log</td></tr><tr><td> <span class="command"><strong>a.x.y.zz.b</strong></span> </td><td>allow-log</td></tr><tr><td> <span class="command"><strong>a.b.</strong></span> </td><td>deny</td></tr><tr><td> <span class="command"><strong>q.x.b</strong></span> </td><td>deny</td></tr></tbody></table></div></div><p><br class="table-break">
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching"></a>1.5.2.3. ACL Rule Matching</h4></div></div></div><p>
+ </p></div></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-ACL_Rule_Matching"></a>1.5.2.3. ACL Rule Matching</h4></div></div></div><p>
The minimum matching criteria for ACL rules are:
</p><div class="itemizedlist"><ul><li>An actor (individually named or group member)</li><li>An action</li><li>An object</li></ul></div><p>
</p><p>
@@ -321,117 +502,136 @@ acl permission {<group-name>|<u
</p><p>
The following illustration shows how ACL rules are processed to find matching rules.
</p><pre class="programlisting">
-# Example of rule matching
-#
-# Using this ACL file content:
-
-(1) acl deny bob create exchange name=test durable=true passive=true
-(2) acl deny bob create exchange name=myEx type=direct
-(3) acl allow all all
-
-#
-# Lookup 1. id:bob action:create objectType:exchange name=test
-# {durable=false passive=false type=direct alternate=}
-#
-# ACL Match Processing:
-# 1. Rule 1 passes minimum criteria with user bob, action create,
-# and object exchange.
-# 2. Rule 1 matches name=test.
-# 3. Rule 1 does not match the rule's durable=true with the requested
-# lookup of durable=false.
-# 4. Rule 1 does not control the decision and processing continues
-# to Rule 2.
-# 5. Rule 2 passes minimum criteria with user bob, action create,
-# and object exchange.
-# 6. Rule 2 does not match the rule's name=myEx with the requested
-# lookup of name=test.
-# 7. Rule 2 does not control the decision and processing continues
-# to Rule 3.
-# 8. Rule 3 matches everything and the decision is 'allow'.
-#
-# Lookup 2. id:bob action:create objectType:exchange name=myEx
-# {durable=true passive=true type=direct alternate=}
-#
-# ACL Match Processing:
-# 1. Rule 1 passes minimum criteria with user bob, action create,
-# and object exchange.
-# 6. Rule 1 does not match the rule's name=test with the requested
-# lookup of name=myEx.
-# 4. Rule 1 does not control the decision and processing continues
-# to Rule 2.
-# 5. Rule 2 passes minimum criteria with user bob, action create,
-# and object exchange.
-# 2. Rule 2 matches name=myEx.
-# 3. Rule 2 matches the rule's type=direct with the requested
-# lookup of type=direct.
-# 8. Rule 2 is the matching rule and the decision is 'deny'.
-#
+ # Example of rule matching
+ #
+ # Using this ACL file content:
+
+ (1) acl deny bob create exchange name=test durable=true passive=true
+ (2) acl deny bob create exchange name=myEx type=direct
+ (3) acl allow all all
+
+ #
+ # Lookup 1. id:bob action:create objectType:exchange name=test
+ # {durable=false passive=false type=direct alternate=}
+ #
+ # ACL Match Processing:
+ # 1. Rule 1 passes minimum criteria with user bob, action create,
+ # and object exchange.
+ # 2. Rule 1 matches name=test.
+ # 3. Rule 1 does not match the rule's durable=true with the requested
+ # lookup of durable=false.
+ # 4. Rule 1 does not control the decision and processing continues
+ # to Rule 2.
+ # 5. Rule 2 passes minimum criteria with user bob, action create,
+ # and object exchange.
+ # 6. Rule 2 does not match the rule's name=myEx with the requested
+ # lookup of name=test.
+ # 7. Rule 2 does not control the decision and processing continues
+ # to Rule 3.
+ # 8. Rule 3 matches everything and the decision is 'allow'.
+ #
+ # Lookup 2. id:bob action:create objectType:exchange name=myEx
+ # {durable=true passive=true type=direct alternate=}
+ #
+ # ACL Match Processing:
+ # 1. Rule 1 passes minimum criteria with user bob, action create,
+ # and object exchange.
+ # 2. Rule 1 does not match the rule's name=test with the requested
+ # lookup of name=myEx.
+ # 3. Rule 1 does not control the decision and processing continues
+ # to Rule 2.
+ # 4. Rule 2 passes minimum criteria with user bob, action create,
+ # and object exchange.
+ # 5. Rule 2 matches name=myEx.
+ # 6. Rule 2 matches the rule's type=direct with the requested
+ # lookup of type=direct.
+ # 7. Rule 2 is the matching rule and the decision is 'deny'.
+ #
</pre><p>
</p></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Permissions"></a>1.5.2.4. Specifying ACL Permissions</h4></div></div></div><p>
- Now that we have seen the ACL syntax, we will provide representative examples and guidelines for ACL files.
+ Now that we have seen the ACL syntax, we will provide representative examples and guidelines for ACL files.
</p><p>
Most ACL files begin by defining groups:
</p><pre class="programlisting">
-group admin ted@QPID martin@QPID
-group user-consume martin@QPID ted@QPID
-group group2 kim@QPID user-consume rob@QPID
-group publisher group2 \
-tom@QPID andrew@QPID debbie@QPID
+ group admin ted@QPID martin@QPID
+ group user-consume martin@QPID ted@QPID
+ group group2 kim@QPID user-consume rob@QPID
+ group publisher group2 \
+ tom@QPID andrew@QPID debbie@QPID
</pre><p>
Rules in an ACL file grant or deny specific permissions to users or groups:
</p><pre class="programlisting">
-acl allow carlt@QPID create exchange name=carl.*
-acl allow rob@QPID create queue
-acl allow guest@QPID bind exchange name=amq.topic routingkey=stocks.rht.#
-acl allow user-consume create queue name=tmp.*
-
-acl allow publisher publish all durable=false
-acl allow publisher create queue name=RequestQueue
-acl allow consumer consume queue durable=true
-acl allow fred@QPID create all
-acl allow bob@QPID all queue
-acl allow admin all
-acl allow all consume queue
-acl allow all bind exchange
-acl deny all all
+ acl allow carlt@QPID create exchange name=carl.*
+ acl allow rob@QPID create queue
+ acl allow guest@QPID bind exchange name=amq.topic routingkey=stocks.rht.#
+ acl allow user-consume create queue name=tmp.*
+
+ acl allow publisher publish all durable=false
+ acl allow publisher create queue name=RequestQueue
+ acl allow consumer consume queue durable=true
+ acl allow fred@QPID create all
+ acl allow bob@QPID all queue
+ acl allow admin all
+ acl allow all consume queue
+ acl allow all bind exchange
+ acl deny all all
</pre><p>
In the previous example, the last line, <code class="literal">acl deny all all</code>, denies all authorizations that have not been specifically granted. This is the default, but it is useful to include it explicitly on the last line for the sake of clarity. If you want to grant all rights by default, you can specify <code class="literal">acl allow all all</code> in the last line.
</p><p>
ACL allows specification of conflicting rules. Be sure to specify the most specific rules first followed by more general rules. Here is an example:
</p><p>
</p><pre class="programlisting">
-group users alice@QPID bob@QPID charlie@QPID
-acl deny charlie@QPID create queue
-acl allow users create queue
-acl deny all all
+ group users alice@QPID bob@QPID charlie@QPID
+ acl deny charlie@QPID create queue
+ acl allow users create queue
+ acl deny all all
</pre><p>
</p><p>
In this example users alice and bob would be able to create queues due to their membership in the users group. However, user charlie is denied from creating a queue despite his membership in the users group because a deny rule for him is stated before the allow rule for the users group.
</p><p>
Do not allow <em class="parameter"><code>guest</code></em> to access and log QMF management methods that could cause security breaches:
</p><pre class="programlisting">
-group allUsers guest@QPID
-....
-acl deny-log allUsers create link
-acl deny-log allUsers access method name=connect
-acl deny-log allUsers access method name=echo
-acl allow all all
-</pre></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Limits"></a>1.5.2.5. Specifying ACL Connection Limits</h4></div></div></div><p>
- The ACL module creates two broker command line switches that set limits on the number of connections allowed per user or per client host address. These settings are not specified in the ACL file.
- </p><p>
-</p><pre class="programlisting">
---acl-max-connect-per-user N_USER
---acl-max-connect-per-ip N_IP
-</pre><p>
- </p><p>
- If either of these switches is not specified or the value specified is zero then the corresponding connection limit is not enforced.
- </p><p>
- If a limit is set for user connections then all users are limited to that number of connections regardless of the client IP address the users are coming from.
- </p><p>
- If a limit is set for IP connections then connections for a given IP address are limited regardless of the user credentials presented with the connection.
- </p><p>
- Note that addresses using different transports are counted separately even though the host is actually the same physical machine. In the setting illustrated above a host would allow N_IP connections from [::1] IPv6 transport localhost and another N_IP connections from [127.0.0.1] IPv4 transport localhost.
- </p></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Encryption_using_SSL"></a>1.5.3. Encryption using SSL</h3></div></div></div><p>
+ group allUsers guest@QPID
+ ...
+ acl deny-log allUsers create link
+ acl deny-log allUsers access method name=connect
+ acl deny-log allUsers access method name=echo
+ acl allow all all
+</pre></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Quotas"></a>1.5.3. User Connection and Queue Quotas</h3></div></div></div>
+ The ACL module enforces various quotas and thereby limits user activity.
+
+ <div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Connection_Limits"></a>1.5.3.1. Connection Limits</h4></div></div></div><p>
+ The ACL module creates broker command line switches that set limits on the number of concurrent connections allowed per user or per client host address. These settings are not specified in the ACL file.
+ </p><p>
+ </p><pre class="programlisting">
+ --max-connections N
+ --max-connections-per-user N
+ --max-connections-per-ip N
+ </pre><p>
+ </p><p>
+ If a switch is not specified or the value specified is zero then the corresponding connection limit is not enforced.
+ </p><p>
+ <span class="command"><strong>max-connections</strong></span> specifies an upper limit for all user connections.
+ </p><p>
+ <span class="command"><strong>max-connections-per-user</strong></span> specifies an upper limit for each user based on the authenticated user name. This limit is enforced regardless of the client IP address from which the connection originates.
+ </p><p>
+ <span class="command"><strong>max-connections-per-ip</strong></span> specifies an upper limit for connections for all users based on the originating client IP address. This limit is enforced regardless of the user credentials presented with the connection.
+ </p><div class="itemizedlist"><ul><li>
+ Note that addresses using different transports are counted separately even though the originating host is actually the same physical machine. In the setting illustrated above a host would allow N_IP connections from [::1] IPv6 transport localhost and another N_IP connections from [127.0.0.1] IPv4 transport localhost.
+ </li><li>
+ The max-connections-per-ip and max-connections-per-user counts are active simultaneously. From a given client system users may be denied access to the broker by either connection limit.
+ </li></ul></div><p>
+ </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sect-Messaging_User_Guide-Authorization-Specifying_ACL_Queue_Limits"></a>1.5.3.2. Queue Limits</h4></div></div></div><p>
+ The ACL module creates a broker command line switch that set limits on the number of queues each user is allowed to create. This settings is not specified in the ACL file.
+ </p><p>
+ </p><pre class="programlisting">
+ --max-queues-per-user N
+ </pre><p>
+ </p><p>
+ If this switch is not specified or the value specified is zero then the queue limit is not enforced.
+ </p><p>
+ The queue limit is set for all users on the broker based on the authenticated user name.
+ </p></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sect-Messaging_User_Guide-Security-Encryption_using_SSL"></a>1.5.4. Encryption using SSL</h3></div></div></div><p>
Encryption and certificate management for <span class="command"><strong>qpidd</strong></span> is provided by Mozilla's Network Security Services Library (NSS).
</p><div class="orderedlist"><a name="orde-Messaging_User_Guide-Encryption_using_SSL-Enabling_SSL_for_the_RHM_broker"></a><p class="title"><b>Enabling SSL for the Qpid broker</b></p><ol type="1"><li><p>
You will need a certificate that has been signed by a Certification Authority (CA). This certificate will also need to be trusted by your client. If you require client authentication in addition to server authentication, the client's certificate will also need to be signed by a CA and trusted by the broker.
@@ -474,7 +674,7 @@ certutil -S -d ${CERT_DIR} -n ${NICKNAME
In C++ clients, SSL is implemented in the <span class="command"><strong>sslconnector.so</strong></span> module. This module is installed and loaded by default in Qpid.
</p><p>
The following options can be specified for C++ clients using environment variables:
- </p><div class="table"><a name="tabl-Messaging_User_Guide-Enabling_SSL_in_Clients-SSL_Client_Environment_Variables_for_C_clients"></a><p class="title"><b>Table 1.8. SSL Client Environment Variables for C++ clients</b></p><div class="table-contents"><table summary="SSL Client Environment Variables for C++ clients" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th colspan="2" align="center">
+ </p><div class="table"><a name="tabl-Messaging_User_Guide-Enabling_SSL_in_Clients-SSL_Client_Environment_Variables_for_C_clients"></a><p class="title"><b>Table 1.11. SSL Client Environment Variables for C++ clients</b></p><div class="table-contents"><table summary="SSL Client Environment Variables for C++ clients" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th colspan="2" align="center">
SSL Client Options for C++ clients
</th></tr></thead><tbody><tr><td align="left">
<span class="command"><strong>QPID_SSL_USE_EXPORT_POLICY</strong></span>
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html?rev=1413417&r1=1413416&r2=1413417&view=diff
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html (original)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/chapter-Managing-CPP-Broker.html Sun Nov 25 21:04:37 2012
@@ -11,7 +11,7 @@
</a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidprintevents">2.1.4.
Using
qpid-printevents
- </a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#id2502370">2.1.5. Using qpid-ha</a></span></dt></dl></dd><dt><span class="section"><a href="ch02s02.html">2.2.
+ </a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#id2522883">2.1.5. Using qpid-ha</a></span></dt></dl></dd><dt><span class="section"><a href="ch02s02.html">2.2.
Qpid Management Framework
</a></span></dt><dd><dl><dt><span class="section"><a href="ch02s02.html#QpidManagementFramework-WhatIsQMF">2.2.1.
What Is QMF
@@ -443,7 +443,7 @@ Options:
-h, --help show this help message and exit
</pre><p>
You get the idea... have fun!
- </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2502370"></a>2.1.5. Using qpid-ha</h3></div></div></div><p>This utility lets you monitor and control the activity of the clustering behavior provided by the HA module.
+ </p></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2522883"></a>2.1.5. Using qpid-ha</h3></div></div></div><p>This utility lets you monitor and control the activity of the clustering behavior provided by the HA module.
</p><pre class="programlisting">
qpid-ha --help
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/index.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/index.html?rev=1413417&r1=1413416&r2=1413417&view=diff
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/index.html (original)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/index.html Sun Nov 25 21:04:37 2012
@@ -26,7 +26,7 @@
Cheat Sheet for configuring Exchange Options
</a></span></dt><dd><dl><dt><span class="section"><a href="ch01s03.html#CheatSheetforconfiguringExchangeOptions-ConfiguringExchangeOptions">1.3.1.
Configuring Exchange Options
- </a></span></dt></dl></dd><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html">1.4. Broker Federation</a></span></dt><dd><dl><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-Message_Routes">1.4.1. Message Routes</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-Federation_Topologies">1.4.2. Federation Topologies</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-Federation_among_High_Availability_Message_Clusters">1.4.3. Federation among High Availability Message Clusters</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-The_qpid_route_Utility">1.4.4. The qpid-route Utility</a></span></dt>
</dl></dd><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html">1.5. Security</a></span></dt><dd><dl><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-User_Authentication">1.5.1. User Authentication</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-Authorization">1.5.2. Authorization</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-Encryption_using_SSL">1.5.3. Encryption using SSL</a></span></dt></dl></dd><dt><span class="section"><a href="ch01s06.html">1.6. LVQ - Last Value Queue</a></span></dt><dd><dl><dt><span class="section"><a href="ch01s06.html#LVQ-UnderstandingLVQ">1.6.1. Understanding LVQ</a></span></dt><dt><span class="section"><a href="ch01s06.html#LVQ-Creating">1.6.2. Creating a Last Value Queue</a></span></dt><dt><span class="section"
><a href="ch01s06.html#LVQ-Example">1.6.3. LVQ Example</a></span></dt><dt><span class="section"><a href="ch01s06.html#LVQ-Deprecated">1.6.4. Deprecated LVQ Modes</a></span></dt></dl></dd><dt><span class="section"><a href="queue-state-replication.html">1.7.
+ </a></span></dt></dl></dd><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html">1.4. Broker Federation</a></span></dt><dd><dl><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-Message_Routes">1.4.1. Message Routes</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-Federation_Topologies">1.4.2. Federation Topologies</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-Federation_among_High_Availability_Message_Clusters">1.4.3. Federation among High Availability Message Clusters</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Broker_Federation.html#sect-Messaging_User_Guide-Broker_Federation-The_qpid_route_Utility">1.4.4. The qpid-route Utility</a></span></dt>
</dl></dd><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html">1.5. Security</a></span></dt><dd><dl><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-User_Authentication">1.5.1. User Authentication</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-Authorization">1.5.2. Authorization</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Authorization-Specifying_ACL_Quotas">1.5.3. User Connection and Queue Quotas</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Security.html#sect-Messaging_User_Guide-Security-Encryption_using_SSL">1.5.4. Encryption using SSL</a></span></dt></dl></dd><dt><span class="section"><a href="ch01s06.html">1.6. LVQ - Last Value Queue</a></span></dt><dd><dl><dt><span class="section"><a href="ch01s06.html#LVQ-Un
derstandingLVQ">1.6.1. Understanding LVQ</a></span></dt><dt><span class="section"><a href="ch01s06.html#LVQ-Creating">1.6.2. Creating a Last Value Queue</a></span></dt><dt><span class="section"><a href="ch01s06.html#LVQ-Example">1.6.3. LVQ Example</a></span></dt><dt><span class="section"><a href="ch01s06.html#LVQ-Deprecated">1.6.4. Deprecated LVQ Modes</a></span></dt></dl></dd><dt><span class="section"><a href="queue-state-replication.html">1.7.
Queue State Replication
</a></span></dt><dd><dl><dt><span class="section"><a href="queue-state-replication.html#queuestatereplication-AsynchronousReplicationofQueueState">1.7.1.
Asynchronous
@@ -59,7 +59,7 @@
Well Behaved Consumers
</a></span></dt><dt><span class="section"><a href="Using-message-groups.html#usingmessagegroups-BrokerConfig">1.12.5.
Broker Configuration
- </a></span></dt></dl></dd><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html">1.13. Active-passive Messaging Clusters</a></span></dt><dd><dl><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2527186">1.13.1. Overview</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2521283">1.13.2. Virtual IP Addresses</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2507913">1.13.3. Configuring the Brokers</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2519604">1.13.4. The Cluster Resource Manager</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2521752">1.13.5. Configuring <span class="command"><strong>rgmanager</strong></span> as resource manager</a></span></dt><dt><span class="s
ection"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2530379">1.13.6. Broker Administration Tools</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#ha-creating-replicated">1.13.7. Creating replicated queues and exchanges</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2534176">1.13.8. Client Connection and Fail-over</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2511498">1.13.9. Security.</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2520122">1.13.10. Integrating with other Cluster Resource Managers</a></span></dt></dl></dd><dt><span class="section"><a href="ch01s14.html">1.14. Queue Replication with the HA module</a></span></dt></dl></dd><dt><span class="chapter"><a href="chapter-Managing-CPP-Broker.html">2.
+ </a></span></dt></dl></dd><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html">1.13. Active-passive Messaging Clusters</a></span></dt><dd><dl><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2504335">1.13.1. Overview</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2556078">1.13.2. Virtual IP Addresses</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2552113">1.13.3. Configuring the Brokers</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2502605">1.13.4. The Cluster Resource Manager</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2538674">1.13.5. Configuring <span class="command"><strong>rgmanager</strong></span> as resource manager</a></span></dt><dt><span class="s
ection"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2548120">1.13.6. Broker Administration Tools</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#ha-creating-replicated">1.13.7. Creating replicated queues and exchanges</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2500900">1.13.8. Client Connection and Fail-over</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2505763">1.13.9. Security.</a></span></dt><dt><span class="section"><a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#id2553256">1.13.10. Integrating with other Cluster Resource Managers</a></span></dt></dl></dd><dt><span class="section"><a href="ch01s14.html">1.14. Queue Replication with the HA module</a></span></dt></dl></dd><dt><span class="chapter"><a href="chapter-Managing-CPP-Broker.html">2.
Managing the AMQP Messaging Broker
</a></span></dt><dd><dl><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#section-Managing-CPP-Broker">2.1. Managing the C++ Broker </a></span></dt><dd><dl><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidconfig">2.1.1.
Using qpid-config
@@ -70,7 +70,7 @@
</a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#MgmtC-2B-2B-Usingqpidprintevents">2.1.4.
Using
qpid-printevents
- </a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#id2502370">2.1.5. Using qpid-ha</a></span></dt></dl></dd><dt><span class="section"><a href="ch02s02.html">2.2.
+ </a></span></dt><dt><span class="section"><a href="chapter-Managing-CPP-Broker.html#id2522883">2.1.5. Using qpid-ha</a></span></dt></dl></dd><dt><span class="section"><a href="ch02s02.html">2.2.
Qpid Management Framework
</a></span></dt><dd><dl><dt><span class="section"><a href="ch02s02.html#QpidManagementFramework-WhatIsQMF">2.2.1.
What Is QMF
@@ -101,4 +101,4 @@
Console Operations
</a></span></dt><dt><span class="section"><a href="ch02s03.html#QMFPythonConsoleTutorial-DiscoveringwhatKindsofObjectsareAvailable">2.3.4.
Discovering what Kinds of Objects are Available
- </a></span></dt></dl></dd></dl></dd></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1.1. <a href="ch01.html#id2492827">QMF Management - Broker Methods for Managing the Timestamp Configuration</a></dt><dt>1.2. <a href="chap-Messaging_User_Guide-Broker_Federation.html#tabl-Messaging_User_Guide-The_qpid_route_Utility-qpid_route_options"><span class="command">qpid-route</span> options</a></dt><dt>1.3. <a href="chap-Messaging_User_Guide-Broker_Federation.html#tabl-Messaging_User_Guide-Resilient_Connections-State_values_in_qpid_route_list_connections">State values in <span class="command">$ qpid-route list connections</span></a></dt><dt>1.4. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rules_permission">ACL Rules: permission</a></dt><dt>1.5. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesaction">ACL Rules:action</a></dt><dt>1.6. <a href="chap-Messaging_
User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesobject">ACL Rules:object</a></dt><dt>1.7. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty">ACL Rules:property</a></dt><dt>1.8. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-Enabling_SSL_in_Clients-SSL_Client_Environment_Variables_for_C_clients">SSL Client Environment Variables for C++ clients</a></dt><dt>1.9. <a href="chap-Messaging_User_Guide-Active_Active_Cluster.html#tabl-Messaging_User_Guide-Starting_a_Broker_in_a_Cluster-Options_for_High_Availability_Messaging_Cluster">Options for High Availability Messaging Cluster</a></dt><dt>1.10. <a href="producer-flow-control.html#id2513610">Queue Declare Method Flow Control Arguments</a></dt><dt>1.11. <a href="producer-flow-control.html#id2527671">Flow Control Statistics available in Queue's QMF Class</a></dt><dt>1.12. <a href="AMQP-Compatibility.html#id2519283">AMQP Version Su
pport by Qpid Release</a></dt><dt>1.13. <a href="AMQP-Compatibility.html#id2546097">AMQP Version Support - alternate format</a></dt><dt>1.14. <a href="QpidInteroperabilityDocumentation-QpidInteroperabilityDocumentation.html#id2549899">SASL Mechanism Support</a></dt><dt>1.15. <a href="QpidInteroperabilityDocumentation-QpidInteroperabilityDocumentation.html#id2500548">SASL Custom Mechanisms</a></dt><dt>1.16. <a href="Using-message-groups.html#id2529435">qpid-config options for creating message group queues</a></dt><dt>1.17. <a href="Using-message-groups.html#id2504917">Queue Declare/Address Syntax Message Group Configuration Arguments</a></dt><dt>1.18. <a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#ha-broker-options">Broker Options for High Availability Messaging Cluster</a></dt><dt>1.19. <a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#ha-broker-security-options">Security options for High Availability Messaging Cluster</a></dt><dt>2.1. <a href="c
h02s02.html#id2519179">XML Attributes for QMF Properties and Statistics</a></dt><dt>2.2. <a href="ch02s02.html#id2553476">QMF Datatypes</a></dt><dt>2.3. <a href="ch02s02.html#id2515475">XML Schema Mapping for QMF Types</a></dt><dt>2.4. <a href="ch02s03.html#id2505397">QMF Python Console Class Methods</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="ch01.html#id2492880">Enabling Message Timestamping via QMF - Python</a></dt><dt>1.2. <a href="Using-message-groups.html#id2509966">Creating a message group queue via qpid-config</a></dt><dt>1.3. <a href="Using-message-groups.html#id2528175">Creating a message group queue using address syntax (C++)</a></dt><dt>1.4. <a href="Using-message-groups.html#id2538058">Overriding the default message group identifier for the broker</a></dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left">Â </td><td width="20
%" align="center">Â </td><td width="40%" align="right">Â <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Â </td><td width="20%" align="center">Â </td><td width="40%" align="right" valign="top">Â Introduction</td></tr></table></div><div class="main_text_area_bottom"></div></div></div></body></html>
+ </a></span></dt></dl></dd></dl></dd></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1.1. <a href="ch01.html#id2492827">QMF Management - Broker Methods for Managing the Timestamp Configuration</a></dt><dt>1.2. <a href="chap-Messaging_User_Guide-Broker_Federation.html#tabl-Messaging_User_Guide-The_qpid_route_Utility-qpid_route_options"><span class="command">qpid-route</span> options</a></dt><dt>1.3. <a href="chap-Messaging_User_Guide-Broker_Federation.html#tabl-Messaging_User_Guide-Resilient_Connections-State_values_in_qpid_route_list_connections">State values in <span class="command">$ qpid-route list connections</span></a></dt><dt>1.4. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rules_permission">ACL Rules: permission</a></dt><dt>1.5. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesaction">ACL Rules:action</a></dt><dt>1.6. <a href="chap-Messaging_
User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesobject">ACL Rules:object</a></dt><dt>1.7. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_Rulesproperty">ACL Rules:property</a></dt><dt>1.8. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_ActionObject_properties">ACL Properties Allowed for each Action and Object</a></dt><dt>1.9. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_UsernameSubstitution">ACL User Name and Domain Name Substitution Keywords</a></dt><dt>1.10. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-ACL_Syntax-ACL_TopicExchangeMatch">Topic Exchange Wildcard Match Examples</a></dt><dt>1.11. <a href="chap-Messaging_User_Guide-Security.html#tabl-Messaging_User_Guide-Enabling_SSL_in_Clients-SSL_Client_Environment_Variables_for_C_clients">SSL Client Environment Variables for C++ clients</a></dt>
<dt>1.12. <a href="chap-Messaging_User_Guide-Active_Active_Cluster.html#tabl-Messaging_User_Guide-Starting_a_Broker_in_a_Cluster-Options_for_High_Availability_Messaging_Cluster">Options for High Availability Messaging Cluster</a></dt><dt>1.13. <a href="producer-flow-control.html#id2530895">Queue Declare Method Flow Control Arguments</a></dt><dt>1.14. <a href="producer-flow-control.html#id2513135">Flow Control Statistics available in Queue's QMF Class</a></dt><dt>1.15. <a href="AMQP-Compatibility.html#id2520724">AMQP Version Support by Qpid Release</a></dt><dt>1.16. <a href="AMQP-Compatibility.html#id2541660">AMQP Version Support - alternate format</a></dt><dt>1.17. <a href="QpidInteroperabilityDocumentation-QpidInteroperabilityDocumentation.html#id2510544">SASL Mechanism Support</a></dt><dt>1.18. <a href="QpidInteroperabilityDocumentation-QpidInteroperabilityDocumentation.html#id2531929">SASL Custom Mechanisms</a></dt><dt>1.19. <a href="Using-message-groups.html#id2505679">q
pid-config options for creating message group queues</a></dt><dt>1.20. <a href="Using-message-groups.html#id2538666">Queue Declare/Address Syntax Message Group Configuration Arguments</a></dt><dt>1.21. <a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#ha-broker-options">Broker Options for High Availability Messaging Cluster</a></dt><dt>1.22. <a href="chap-Messaging_User_Guide-Active_Passive_Cluster.html#ha-broker-security-options">Security options for High Availability Messaging Cluster</a></dt><dt>2.1. <a href="ch02s02.html#id2515109">XML Attributes for QMF Properties and Statistics</a></dt><dt>2.2. <a href="ch02s02.html#id2502148">QMF Datatypes</a></dt><dt>2.3. <a href="ch02s02.html#id2517777">XML Schema Mapping for QMF Types</a></dt><dt>2.4. <a href="ch02s03.html#id2507304">QMF Python Console Class Methods</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="ch01.html#id2492880">Enabling Message Timestamping via
QMF - Python</a></dt><dt>1.2. <a href="Using-message-groups.html#id2536899">Creating a message group queue via qpid-config</a></dt><dt>1.3. <a href="Using-message-groups.html#id2514746">Creating a message group queue using address syntax (C++)</a></dt><dt>1.4. <a href="Using-message-groups.html#id2549668">Overriding the default message group identifier for the broker</a></dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left">Â </td><td width="20%" align="center">Â </td><td width="40%" align="right">Â <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Â </td><td width="20%" align="center">Â </td><td width="40%" align="right" valign="top">Â Introduction</td></tr></table></div><div class="main_text_area_bottom"></div></div></div></body></html>
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/producer-flow-control.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/producer-flow-control.html?rev=1413417&r1=1413416&r2=1413417&view=diff
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/producer-flow-control.html (original)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/producer-flow-control.html Sun Nov 25 21:04:37 2012
@@ -168,7 +168,7 @@
<span class="command"><strong>queue.declare</strong></span> method, via the
<span class="command"><strong>arguments</strong></span> parameter map. The following keys can be
provided in the arguments map for setting flow thresholds:
- </p><div class="table"><a name="id2513610"></a><p class="title"><b>Table 1.10. Queue Declare Method Flow Control Arguments</b></p><div class="table-contents"><table summary="Queue Declare Method Flow Control Arguments" border="1"><colgroup><col><col></colgroup><thead><tr><th>Key</th><th>Value</th></tr></thead><tbody><tr><td>qpid.flow_stop_size</td><td>integer - queue's flow stop threshold value in bytes</td></tr><tr><td>qpid.flow_resume_size</td><td>integer - queue's flow resume threshold value in bytes</td></tr><tr><td>qpid.flow_stop_count</td><td>integer - queue's flow stop threshold value as a message count</td></tr><tr><td>qpid.flow_resume_count</td><td>integer - queue's flow resume threshold value as a message count</td></tr></tbody></table></div></div><br class="table-break"><p>
+ </p><div class="table"><a name="id2530895"></a><p class="title"><b>Table 1.13. Queue Declare Method Flow Control Arguments</b></p><div class="table-contents"><table summary="Queue Declare Method Flow Control Arguments" border="1"><colgroup><col><col></colgroup><thead><tr><th>Key</th><th>Value</th></tr></thead><tbody><tr><td>qpid.flow_stop_size</td><td>integer - queue's flow stop threshold value in bytes</td></tr><tr><td>qpid.flow_resume_size</td><td>integer - queue's flow resume threshold value in bytes</td></tr><tr><td>qpid.flow_stop_count</td><td>integer - queue's flow stop threshold value as a message count</td></tr><tr><td>qpid.flow_resume_count</td><td>integer - queue's flow resume threshold value as a message count</td></tr></tbody></table></div></div><br class="table-break"><p>
The user may disable flow control on a per queue basis by setting
the flow-stop-size and flow-stop-count to zero for the queue.
</p><p>
@@ -184,6 +184,6 @@
the queue's capacity exceeds a flow stop threshold. This statistic can
be used to monitor the activity of flow control for any given queue
over time.
- </p><div class="table"><a name="id2527671"></a><p class="title"><b>Table 1.11. Flow Control Statistics available in Queue's QMF Class</b></p><div class="table-contents"><table summary="Flow Control Statistics available in Queue's QMF Class" border="1"><colgroup><col><col><col></colgroup><thead><tr><th>Statistic Name</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td>flowStopped</td><td>Boolean</td><td>If true, producers are blocked by flow control.</td></tr><tr><td>flowStoppedCount</td><td>count32</td><td>Number of times flow control was activated for this queue</td></tr></tbody></table></div></div><br class="table-break"></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="chap-Messaging_User_Guide-Active_Active_Cluster.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ch01.html">Up</a></td><td width="40%" align="right"> <a
accesskey="n" href="AMQP-Compatibility.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">1.8. Active-active Messaging Clusters </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 1.10.Â
+ </p><div class="table"><a name="id2513135"></a><p class="title"><b>Table 1.14. Flow Control Statistics available in Queue's QMF Class</b></p><div class="table-contents"><table summary="Flow Control Statistics available in Queue's QMF Class" border="1"><colgroup><col><col><col></colgroup><thead><tr><th>Statistic Name</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td>flowStopped</td><td>Boolean</td><td>If true, producers are blocked by flow control.</td></tr><tr><td>flowStoppedCount</td><td>count32</td><td>Number of times flow control was activated for this queue</td></tr></tbody></table></div></div><br class="table-break"></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="chap-Messaging_User_Guide-Active_Active_Cluster.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ch01.html">Up</a></td><td width="40%" align="right"> <a
accesskey="n" href="AMQP-Compatibility.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">1.8. Active-active Messaging Clusters </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 1.10.Â
AMQP compatibility
</td></tr></table></div><div class="main_text_area_bottom"></div></div></div></body></html>
Modified: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/pdf/AMQP-Messaging-Broker-CPP-Book.pdf
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-CPP-Book/pdf/AMQP-Messaging-Broker-CPP-Book.pdf?rev=1413417&r1=1413416&r2=1413417&view=diff
==============================================================================
Binary files - no diff available.
Added: qpid/site/docs/books/trunk/AMQP-Messaging-Broker-Java-Book/html/Java-Broker-Concepts-Authentication-Providers.html
URL: http://svn.apache.org/viewvc/qpid/site/docs/books/trunk/AMQP-Messaging-Broker-Java-Book/html/Java-Broker-Concepts-Authentication-Providers.html?rev=1413417&view=auto
==============================================================================
--- qpid/site/docs/books/trunk/AMQP-Messaging-Broker-Java-Book/html/Java-Broker-Concepts-Authentication-Providers.html (added)
+++ qpid/site/docs/books/trunk/AMQP-Messaging-Broker-Java-Book/html/Java-Broker-Concepts-Authentication-Providers.html Sun Nov 25 21:04:37 2012
@@ -0,0 +1 @@
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>4.6. Authentication Providers</title><link rel="stylesheet" href="css/style.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="AMQP Messaging Broker (Java)"><link rel="up" href="Java-Broker-Concepts.html" title="Chapter 4. Concepts"><link rel="prev" href="Java-Broker-Concepts-Protocols.html" title="4.5. Protocols"><link rel="next" href="Java-Broker-Concepts-Other-Services.html" title="4.7. Other Services"></head><body><div class="container" bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><DIV class="header"><DIV class="logo"><H1>Apache Qpidâ¢</H1><H2>Open Source AMQP Messaging</H2></DIV></DIV><DIV class="menu_box"><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Apache Qpid</H3><UL><LI><A href="http://qpid.apache.org/index.html">Home</A></LI><LI><A href=
"http://qpid.apache.org/download.html">Download</A></LI><LI><A href="http://qpid.apache.org/getting_started.html">Getting Started</A></LI><LI><A href="http://www.apache.org/licenses/">License</A></LI><LI><A href="https://cwiki.apache.org/qpid/faq.html">FAQ</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Documentation</H3><UL><LI><A href="http://qpid.apache.org/documentation.html#doc-release">Latest Release</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-trunk">Trunk</A></LI><LI><A href="http://qpid.apache.org/documentation.html#doc-archives">Archive</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Community</H3><UL><LI><A href="http://qpid.apache.org/getting_involved.html">Getting Involved</A></LI><LI><A href="http://qpid.apache.org/source_repository.html">Source Repository</A></LI><LI><A href="http://qpid.apache.org/mail
ing_lists.html">Mailing Lists</A></LI><LI><A href="https://cwiki.apache.org/qpid/">Wiki</A></LI><LI><A href="https://issues.apache.org/jira/browse/qpid">Issue Reporting</A></LI><LI><A href="http://qpid.apache.org/people.html">People</A></LI><LI><A href="http://qpid.apache.org/acknowledgements.html">Acknowledgements</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>Developers</H3><UL><LI><A href="https://cwiki.apache.org/qpid/building.html">Building Qpid</A></LI><LI><A href="https://cwiki.apache.org/qpid/developer-pages.html">Developer Pages</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About AMQP</H3><UL><LI><A href="http://qpid.apache.org/amqp.html">What is AMQP?</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV><DIV class="menu_box_top"></DIV><DIV class="menu_box_body"><H3>About Apache</H3><UL><LI><A href="http://www.apache.org">Home
</A></LI><LI><A href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</A></LI><LI><A href="http://www.apache.org/foundation/thanks.html">Thanks</A></LI><LI><A href="http://www.apache.org/security/">Security</A></LI></UL></DIV><DIV class="menu_box_bottom"></DIV></DIV><div class="main_text_area"><div class="main_text_area_top"></div><div class="main_text_area_body"><DIV class="breadcrumbs"><span class="breadcrumb-link"><a href="index.html">AMQP Messaging Broker (Java)</a></span> > <span class="breadcrumb-link"><a href="Java-Broker-Concepts.html">Concepts</a></span> > <span class="breadcrumb-node">Authentication Providers</span></DIV><div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Java-Broker-Concepts-Authentication-Providers"></a>4.6. Authentication Providers</h2></div></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey
="p" href="Java-Broker-Concepts-Protocols.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="Java-Broker-Concepts.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Java-Broker-Concepts-Other-Services.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">4.5. Protocols </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 4.7. Other Services</td></tr></table></div><div class="main_text_area_bottom"></div></div></div></body></html>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org