QPID-2412: Support for EXTERNAL mechanism on client-authenticated SSL connections.

On SSL connection where the clients certificate is authenticated (requires the --ssl-require-client-authentication option at present), the clients identity will be taken from that certificate (it will be the CN with any DCs present appended as the domain, e.g. CN=bob,DC=acme,DC=com would result in an identity of bob@acme.com). This will enable the EXTERNAL mechanism when cyrus sasl is in use.

The client can still negotiate their desired mechanism. There is a new option on the ssl module (--ssl-sasl-no-dict) that allows the options on ssl connections to be restricted to those that are not vulnerable to dictionary attacks (EXTERNAL being the primary example).



git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@919487 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 3 insertions, 3 deletions

diff --git a/cpp/src/qpid/cluster/ConnectionCodec.h b/cpp/src/qpid/cluster/ConnectionCodec.h
index 74cb3c507d..4b919ed351 100644
--- a/cpp/src/qpid/cluster/ConnectionCodec.h
+++ b/cpp/src/qpid/cluster/ConnectionCodec.h
@@ -53,14 +53,14 @@ class ConnectionCodec : public sys::ConnectionCodec {
         Factory(boost::shared_ptr<sys::ConnectionCodec::Factory> f, Cluster& c)
             : next(f), cluster(c) {}
         sys::ConnectionCodec* create(framing::ProtocolVersion, sys::OutputControl&, const std::string& id,
-                                     unsigned int conn_ssf);
+                                     const qpid::sys::SecuritySettings& external);
         sys::ConnectionCodec* create(sys::OutputControl&, const std::string& id,
-                                     unsigned int conn_ssf);
+                                     const qpid::sys::SecuritySettings& external);
     };
 
     ConnectionCodec(const framing::ProtocolVersion&, sys::OutputControl& out,
                     const std::string& logId, Cluster& c, bool catchUp, bool isLink,
-                    unsigned int ssf);
+                    const qpid::sys::SecuritySettings& external);
     ~ConnectionCodec();
 
     // ConnectionCodec functions.