Kerberos
Kereberos Authentication Provider uses java GSS-API SASL mechanism to authenticate the
connections.
Configuration of kerberos is done through system properties (there doesn't seem to be a
way around this unfortunately).
export JAVA_OPTS=-Djavax.security.auth.useSubjectCredsOnly=false -Djava.security.auth.login.config=qpid.conf
\${QPID_HOME}/bin/qpid-server
Where qpid.conf would look something like this:
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
doNotPrompt=true
realm="EXAMPLE.COM"
useSubjectCredsOnly=false
kdc="kerberos.example.com"
keyTab="/path/to/keytab-file"
principal="<name>/<host>";
};
Where realm, kdc, keyTab and principal should obviously be set correctly for the
environment where you are running (see the existing documentation for the C++ broker about
creating a keytab file).
Note: You may need to install the "Java Cryptography Extension (JCE) Unlimited Strength
Jurisdiction Policy Files" appropriate for your JDK in order to get Kerberos support working.