[
https://issues.apache.org/jira/browse/PROTON-1008?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14935246#comment-14935246
]
Gordon Sim commented on PROTON-1008:
------------------------------------
{quote}Is it ever sensible to not use SASL?{quote}
The protocol is certainly designed to allow it to be optional. If you are using
SSL then the SASL layer doesn't really add anything. However the main reason
for the change was to get back to the behaviour pre 0.10, that I inadvertently
broke by exposing the allowed mechanisms option.
{quote}As it stands, I don't know how to turn SASL on.{quote}
Agreed, and this is I think the actual issue. We need a way to easily control
whether sasl is used or not.
{quote}There may be existing mechanisms available (EXTERNAL, GSSAPI), but I
don't have a username to supply and I don't necessarily know which mechanisms
to put in the allowed_mechs list.{quote}
Agreed again, and for this reason I think the allowed_mechs property is not the
ideal way of turning sasl on. (And so I think the change mentioned in the bug
description is actually correct).
Proposal:
What if we add a new container level option (perhaps also with per-connection
override) for controlling whether or not sasl is to be used. We can set that to
True by default (though that would be a slight change in behaviour from pre
0.10, the 0.10 release actually has sasl forced on always, so this is an
improvement.
> Using a blank mech_list disables authentication
> -----------------------------------------------
>
> Key: PROTON-1008
> URL: https://issues.apache.org/jira/browse/PROTON-1008
> Project: Qpid Proton
> Issue Type: Bug
> Components: python-binding
> Affects Versions: 0.11
> Reporter: Ted Ross
> Assignee: Gordon Sim
> Fix For: 0.11
>
>
> This bug was introduced in commit
>
> https://github.com/apache/qpid-proton/commit/14956b07edc3de93f67179c753bbedcd9eba51a6
> If the client leaves allowed_mechs as None, the SASL protocol is not even
> executed. I claim that allowed_mechs is used to restrict the set of
> acceptable mechanisms. If it is None, then all available mechanisms may be
> used.
> This bug causes a failure in the Qpid Dispatch test suite
> (system_tests_qdstat). The failure is when the server requires
> authentication and will accept EXTERNAL and the client has a valid
> client-certificate but doesn't use the sasl protocol because qdstat doesn't
> (and can't) set the allowed_mechs.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
