Bug 1268433 – None of the qpid command line tools work if the broker is configured w/SASL and AMQP1.0

Bug 1268433 - None of the qpid command line tools work if the broker is configured w/SASL and AMQP1.0

Summary:	None of the qpid command line tools work if the broker is configured w/SASL a...

Status:	NEW

Aliases:	None

Product:	Red Hat Enterprise MRG
Classification:	Red Hat
Component:	qpid-tools (Show other bugs)
Sub Component:
Version:	3.2
Hardware:	Unspecified Unspecified

Priority	unspecified Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	messaging-bugs
QA Contact:	Messaging QE
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2015-10-02 15:43 EDT by Ken Giusti
Modified:	2015-10-08 13:18 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Apache JIRA	QPID-6767	None	None	None	Never

Groups: None (edit)

Description Ken Giusti 2015-10-02 15:43:18 EDT

Description of problem:


When using AMQP1.0 clients with qpidd and authenticating with SASL DIGEST-MD5 or GSSAPI, the broker's sasl-service-name must be set to "amqp" for the clients to be authorized.

However, this causes the qpid-tools command line tools to fail as they set the sasl service name to 'qpidd'.

How to reproduce:

Configure broker to use SASL with DIGEST-MD5 as the only acceptable mech.

Attempt to run qpid-config against the broker:

 qpid-config -b amqp://<user>/<pw>@<hostname:port> 

this will fail with an authentication error (check qpidd logs --log-enable info+)

Comment 1 Ken Giusti 2015-10-02 15:51:23 EDT

Ugh - forgot the most important part:

set sasl-service-name to amqp in the broker config.

Confirm that AMQP1.0 test clients can authenticate using DIGEST-MD5

Comment 2 Ken Giusti 2015-10-08 08:44:37 EDT

Fix pushed upstream - two patches:

https://svn.apache.org/viewvc?view=revision&revision=r1706480
https://svn.apache.org/viewvc?view=revision&revision=r1706484

Comment 3 Ken Giusti 2015-10-08 13:18:12 EDT

Reopening.  Andrew has suggested a less intrusive fix.

Note You need to log in before you can comment on or make changes to this bug.