Chapter 6. Security 6.1. Connecting with a user and password Red Hat build of Apache Qpid ProtonJ2 can authenticate connections with a user and password. To specify the credentials used for authentication, set the Username and Password fields on the ConnectionOptions object Example: Connecting with a user and password ConnectionOptions connectionOptions = new ConnectionOptions(); connectionOptions.user("user"); connectionOptions.password("pass"); 6.2. Configuring SASL authentication Client connections to remote peers may exchange SASL user name and password credentials. The presence of the user field in the connection URI controls this exchange. If user is specified then SASL credentials are exchanged; if user is absent then the SASL credentials are not exchanged. Various SASL mechanisms are supported, please see SASL Reference Example: Adding an allowed mechanism ConnectionOptions connectionOptions = new ConnectionOptions(); connectionOptions.user(System.getProperty("USER")); connectionoptions.password(System.getProperty("PASSWORD")); connectionoptions.saslOptions().saslEnabled(true); connectionoptions.saslOptions().addAllowedMechanism("PLAIN") 6.3. Configuring an SSL/TLS transport SSL/TLS can be configured programmatically as follows. Example: Configuring SSL ConnectionOptions connectionOptions = new ConnectionOptions(); connectionOptions.sslOptions().sslEnabled(true); connectionOptions.sslOptions().keyAlias("alias"); connectionOptions.sslOptions().keyStoreLocation("keystore-location"); connectionOptions.sslOptions().keyStorePassword("password"); connectionOptions.sslOptions().trustStoreLocation("trustore-location"); For a full list of options refer to SSL Options Alternatively the trust store and keystore configuration can be set using the following environmental properties. javax.net.ssl.keyStore The location of the keystore javax.net.ssl.keyStoreType The type of the keystore javax.net.ssl.keyStorePassword The keystore password javax.net.ssl.trustStore The location of the truststore javax.net.ssl.trustStoreType The truststore type javax.net.ssl.trustStorePassword The truststore password Note TLS Server Name Indication (SNI) is handled automatically by the client library. However, SNI is signaled only for addresses that use the amqps transport scheme where the host is a fully qualified domain name or a host name. SNI is not signaled when the host is a numeric IP address.

Commands:
ConnectionOptions connectionOptions = new ConnectionOptions(); connectionOptions.user("user"); connectionOptions.password("pass");
ConnectionOptions connectionOptions = new ConnectionOptions(); connectionOptions.user(System.getProperty("USER")); connectionoptions.password(System.getProperty("PASSWORD")); connectionoptions.saslOptions().saslEnabled(true); connectionoptions.saslOptions().addAllowedMechanism("PLAIN")
ConnectionOptions connectionOptions = new ConnectionOptions(); connectionOptions.sslOptions().sslEnabled(true); connectionOptions.sslOptions().keyAlias("alias"); connectionOptions.sslOptions().keyStoreLocation("keystore-location"); connectionOptions.sslOptions().keyStorePassword("password"); connectionOptions.sslOptions().trustStoreLocation("trustore-location");