Type	NEW
Priority	HIGH
Status	CLOSED

Topic	XmlBlaster provides a crypt password based authentication plugin
Des cription	Authentication in xmlBlaster is based on plugins. The plugin described here is based on the UNIX /etc/passwd crypt password schema. The password file To get started with htpasswd authentication please setup a htpasswd file. Todo that, there are two methods to create a crypted password: Use httpasswd command found in Apache distribution Use jcrypt delivered with the xmlBlaster distribution (thanks to http://locutus.kingwoodcable.com/jfd/crypt.html and Eric Young, eay@psych.uq.oz.au) java org.xmlBlaster.authentication.plugins.htpasswd.jcrypt <salt> <password> [mad@kawa]$ java org.xmlBlaster.authentication.plugins.htpasswd.jcrypt yZ secret [yZ] [secret] => [yZ24stvIel1j6] Cut/paste the password (here yZ24stvIel1j6) in your htpassword file (here xmlBlaster.htpasswd): Joel:yZ24stvIel1j6 Lines starting with '#' are comments and are ignored. Consequently you can't have user names starting with a '#' with the current implementation. Empty lines are ignored. Configure xmlBlaster To configure xmlBlaster for that htpasswd auth plugin add these lines in xmlBlaster.properties #for server : Security.Server.Plugin[htpasswd][1.0]=org.xmlBlaster.authentication.plugins.htpasswd.Manager Security.Server.Plugin.htpasswd.secretfile=${user.home}${file.separator}xmlBlaster.htpasswd #for client : Security.Client.Plugin[htpasswd][1.0]=org.xmlBlaster.authentication.plugins.htpasswd.ClientPlugin Get it running Start the xmlBlaster server java -jar lib/xmlBlaster.jar Start a client (all in one line), e.g. java HelloWorld3 -Security.Client.DefaultPlugin htpasswd,1.0 -session.name <username> -passwd <username> java HelloWorld3 -Security.Client.DefaultPlugin htpasswd,1.0 -session.name Joel -passwd secret In the log output of xmlBlaster server you should see something like: SecurityPluginManager] Plugin 'org.xmlBlaster.authentication.plugins.htpasswd.Manager' successfully initialized Congratulations, you were authenticated by HTPASSWD ! The used connect() QoS which you can directly use from Python or Perl clients looks like this: <qos> <securityService type="htpasswd" version="1.0"> <user>Joel</user> <passwd>secret</passwd> </securityService> ... </qos> Now try an invalid password: java HelloWorld3 -Security.Client.DefaultPlugin htpasswd,1.0 -session.name Joel -passwd BadPassword You should get an authentication error from HTPASSWD That is not the best performing way for authentification, but it's very simple for managing 1 to 500 users. Reload The password file is reloaded on each login, but not on client-reconnect. Wildcard user names It is possible that the password file just contains a * instead of (username,password) tuples -> any username and password combination is authenticated. Same if setting Security.Server.Plugin.htpasswd.secretfile=NONE Additionally you can add a *:<password> entry, for example '*:sd7aksf1f'. This is used if the user is not found explicitly in the password file and the wildcard setting is used as the general fallback password. Partial user names You can switch on authentication with partial user name by setting Security.Server.Plugin.htpasswd.allowPartialUsername=true. In this case if a username starts with or ends with the token given in the htpasswd file that password is used. This may be useful for example for email based login names where all clients from the same email domain have the same password.
Example Java	Here is a password file which authenticates the internal user __sys__jdbc with the password secret. __sys__jdbc:yZ24stvIel1j6
Example all	Basic authorization Here is a password file which does basic authorization on method name level, all use the password secret. guest:yZ24stvIel1j6:connect,disconnect,publish(tennis;sailing) weatherAlert:yZ24stvIel1j6:connect,disconnect,publish("startsWith:weather.") jogger:yZ24stvIel1j6:connect,disconnect,publish(jogging),subscribe(jogging),unSubscribe(jogging),erase(jogging) joe:yZ24stvIel1j6:connect,disconnect,publish snoopy:yZ24stvIel1j6:subscribe("exact:tennis";"domain:sport";"xpath:/xmlBlaster/key[starts-with(@oid,'sport.')]") admin:yZ24stvIel1j6:!erase other:yZ24stvIel1j6:! subscribe,unSubscribe all:yZ24stvIel1j6:: __sys__jdbc:yZ24stvIel1j6 The user guest may only connect, disconnect. Additionally, he may publish on topics tennis and sailing. The user jogger is specialized on handling the topic jogging. The user admin may do anything, but not erase topics. The user all may do anything once he is authenticated. The user snoopy is authorized to do an EXACT subscribe on tennis, one XPATH and one DOMAIN specific subscribe, note that topic names without a schema prefix default to "exact:". The method names are separated by commas ',', for a complete list of method names, see MethodName.java A method name can be followed by round braces '(...)' containing topic oids separated by semicolons ';'. This is useful for publish, subscribe, unSubscribe, get and erase calls. Note that the negation sign '!' at the beginning negates the complete list given.
Configure	Server side configuration Property Default / Example Description Impl Security.Server.Plugin[htpasswd][1.0] org.xmlBlaster. authentication.plugins. htpasswd.Manager Load/activate this plugin Security.Server.Plugin. htpasswd.secretfile NONE Configure where to find the password file, NONE switches the passwd check off. A good name could be ${user.home} ${file.separator} xmlBlaster.htpasswd Security.Server.Plugin. htpasswd.allowPartialUsername false Setting it to true allows to add the starting letters of login names to the password files. All users starting with this token are authenticated by the same password. This simplifies authentication administration. Additional client side configuration Property Default Description Impl Security.Client.Plugin[htpasswd][1.0] org.xmlBlaster.authentication. plugins.htpasswd.ClientPlugin Load the plugin on client side NOTE: Configuration parameters are specified on command line (-someValue 17) or in the xmlBlaster.properties file (someValue=17). See requirement "util.property" for details. Columns named Impl tells you if the feature is implemented. Columns named Hot tells you if the configuration is changeable in hot operation.
Todo
See REQ	security.introduction
See REQ	security.development.serverPlugin.howto
See REQ	security.ldap
See API	org.xmlBlaster.authentication.plugins.htpasswd.HtPasswd
See	../../src/java/org/xmlBlaster/authentication/plugins/htpasswd/README
See TEST	org.xmlBlaster.test.authentication.TestAuthenticationHtPassWd
See TEST	org.xmlBlaster.test.authentication.TestHtpasswdAuthorization

This page is generated from the requirement XML file xmlBlaster/doc/requirements/security.htpasswd.xml

Back to overview