You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@qpid.apache.org by André van der Heijden <va...@gmail.com> on 2021/03/12 07:50:51 UTC
Passthrough authentication with linkrouting
Dear qpid developers,
I have a question regarding a setup I have running, to test out
link-routing. The topology looks as follows (simplified), where ZoneA is
Azure and ZoneB is AWS:
Edge Router (Zone A) → Mesh Router (Zone A) → Mesh Router (Zone B) → Edge
Router (Zone B) à Edge Broker (Zone B)
The meshes of Zone A and Zone B are connected via a connector over port 443
using the route-container role. In the setup I want to consume by
connecting a client to Edge Router (Zone A). The address I connect to is on
Broker (Zone B). I have set up a linkroute to this address and can
successfully consume messages in this way.
*However:*I was under the impression that the SASL authentication would be
passed-through from where you establish the link (Edge Router Zone A), all
the way through to the ultimate broker you connect with. I hoped that the
SASL credentials you passed in to Edge Router (Zone A) would travel all the
way to Edge Broker (Zone B) so that at this final station (Edge Broker Zone
B) we could let the initial consumer authenticate and the broker could
(de)-authorize the request to setup the link.
However, when I look at the connection in the broker console when setting
up such a link route, the broker sees the edge router (zone B) as *his
client* and not the original consumer.
*The Question*
Is there a way to pass the authentication of the initial consumer all the
way through the link-route down to the end-station? This could be either
username/password or something like an OAuth token or so. The point for us
is that we would want a way to authenticate/authorize the consumer at the
source of the data (Broker zone B) rather than at the gate (Edge Router
Zone A). Would be valuable to hear your perspective/take on this.
Thanks a lot for your time.
Kind regards,
André van der Heijden
Re: Passthrough authentication with linkrouting
Posted by Chuck Rolke <cr...@redhat.com>.
The qpid-dispatch network security model is connection based. The connection over which a user connects to the network determines that user's policy restrictions. Once a user has connected and performed an allowed operation at the ingress connection then the rest of the network passes the request through without checking permissions again. [1]
Link routes are meant to be shared with requests from across the network. A single connection hosting the link route serves the address to any number of users on the network. The router does not create a new connection for each link route request and does not renegotiate with new user credentials.
--Chuck
[1] An exception for multiple policy checks: policy for max-message-size is enforced at edge router ingress and again at interior router ingress if the message is forwarded to an interior router.
----- Original Message -----
> From: "André van der Heijden" <va...@gmail.com>
> To: users@qpid.apache.org
> Sent: Friday, March 12, 2021 6:05:07 AM
> Subject: Re: Passthrough authentication with linkrouting
>
> All right, thanks, good to know. I read in this Protocol Guide from
> Microsoft / Redhat
> <https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/service-bus-messaging/service-bus-amqp-protocol-guide.md#claims-based-authorization>
> about claims-based authorisation. This seems more or less in line with what
> I referred to in my original question. Do you know if there are plans to
> support this via qpid routers? Thanks already.
>
> Kind regards,
>
> André van der Heijden
>
>
> Op vr 12 mrt. 2021 om 11:27 schreef Gordon Sim <gs...@redhat.com>:
>
> > On 12/03/2021 07:50, André van der Heijden wrote:
> > > *The Question*
> > > Is there a way to pass the authentication of the initial consumer all the
> > > way through the link-route down to the end-station? This could be either
> > > username/password or something like an OAuth token or so. The point for
> > us
> > > is that we would want a way to authenticate/authorize the consumer at the
> > > source of the data (Broker zone B) rather than at the gate (Edge Router
> > > Zone A). Would be valuable to hear your perspective/take on this.
> >
> > No, there is no way to do that for link routes.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> > For additional commands, e-mail: users-help@qpid.apache.org
> >
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Passthrough authentication with linkrouting
Posted by Gordon Sim <gs...@redhat.com>.
On 12/03/2021 11:05, André van der Heijden wrote:
> All right, thanks, good to know. I read in this Protocol Guide from
> Microsoft / Redhat
> <https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/service-bus-messaging/service-bus-amqp-protocol-guide.md#claims-based-authorization>
> about claims-based authorisation. This seems more or less in line with what
> I referred to in my original question. Do you know if there are plans to
> support this via qpid routers?
I'm not aware of any plans for that.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Passthrough authentication with linkrouting
Posted by André van der Heijden <va...@gmail.com>.
All right, thanks, good to know. I read in this Protocol Guide from
Microsoft / Redhat
<https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/service-bus-messaging/service-bus-amqp-protocol-guide.md#claims-based-authorization>
about claims-based authorisation. This seems more or less in line with what
I referred to in my original question. Do you know if there are plans to
support this via qpid routers? Thanks already.
Kind regards,
André van der Heijden
Op vr 12 mrt. 2021 om 11:27 schreef Gordon Sim <gs...@redhat.com>:
> On 12/03/2021 07:50, André van der Heijden wrote:
> > *The Question*
> > Is there a way to pass the authentication of the initial consumer all the
> > way through the link-route down to the end-station? This could be either
> > username/password or something like an OAuth token or so. The point for
> us
> > is that we would want a way to authenticate/authorize the consumer at the
> > source of the data (Broker zone B) rather than at the gate (Edge Router
> > Zone A). Would be valuable to hear your perspective/take on this.
>
> No, there is no way to do that for link routes.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>
Re: Passthrough authentication with linkrouting
Posted by Gordon Sim <gs...@redhat.com>.
On 12/03/2021 07:50, André van der Heijden wrote:
> *The Question*
> Is there a way to pass the authentication of the initial consumer all the
> way through the link-route down to the end-station? This could be either
> username/password or something like an OAuth token or so. The point for us
> is that we would want a way to authenticate/authorize the consumer at the
> source of the data (Broker zone B) rather than at the gate (Edge Router
> Zone A). Would be valuable to hear your perspective/take on this.
No, there is no way to do that for link routes.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org