Gordon Sim wrote:
Gordon Sim wrote:
Thanks to Matt Farrellee, the c++ broker now has initial support for
PLAIN authentication (r647716). This is optional at compile time and
runtime and is based on the cyrus sasl lib (see the docs for that
library for info on configuring etc for your platform).
One further point: authentication is currently only performed when
using the 0-10 'preview' specification. Authentication of connections
using the final 0-10 spec will be coming shortly.
This (much needed) new feature means that the command-line utilities
(qpid-config, qpid-route, etc.) now need to provide authentication
credentials to the broker when establishing the AMQP connection for
management. It is an easy matter to provide credentials in option
switches or interactively through a prompt. However this is detrimental
to scripting. It is unacceptable to require passwords to appear in
script files and it is equally unacceptable for each line of a script to
interactively prompt the user.
Three possible solutions come to mind:
1) Provide a qpid-shell utility that authenticates once and provides a
shell-like prompt where the utilities can be invoked or scripts can be
executed. One downside is that the shell would lack the flexibility and
capability of a general-purpose shell. Furthermore, the scripting
language might be limited to a linear set of commands. The upside is
that a shared connection would make for efficient and fast script execution.
2) Provide a facility for a user to "log in" once by supplying plain
credentials and storing them securely in the user's private directory.
The qpid utilities could then check for stored credentials in lieu of
supplied credentials. A Kerberos-5 implementation will eventually
provide this kind of single-sign-on capability but for PLAIN
authentication, explicit storage would be needed. Perhaps we should
just hurry up and implement GSSAPI/Krb5.
3) Build the client in a two-tiered architecture where the first
invocation of a utility (for a process) would spawn a detached client
using supplied credentials. This detached process would then connect to
the broker and linger for a period of time handling traffic from
subsequent utilities from the same shell process. Once idle for a
period of time (say 5 minutes), the connection process would disconnect
from the broker and terminate.
All thoughts, ideas, preferences, suggestions, and criticism are more
than welcome.
-Ted
