Mailing-List: contact users-help@qpid.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@qpid.apache.org
Received-SPF: pass (athena.apache.org: domain of fraser.adams@blueyonder.co.uk
 designates 81.103.221.48 as permitted sender)
Message-ID: <4E89F3E9.9040601@blueyonder.co.uk>
Date: Mon, 03 Oct 2011 18:42:01 +0100
From: Fraser Adams <fraser.adams@blueyonder.co.uk>
User-Agent: Thunderbird 2.0.0.24 (X11/20101027)
MIME-Version: 1.0
To: users@qpid.apache.org
Subject: Is it possible to set authentication to only authenticate consumers?
References: 
 <CAECqq8qC+3YdjS3euX+9mVwEpuf5QRWyx3mXE7wZpPr_sbgZTA@mail.gmail.com>
	<4E72452A.50709@blueyonder.co.uk>
	<CAECqq8q47w39PXKi+N_Sxr2ztinhx19+XGWCtKvmhpOCaUgNRQ@mail.gmail.com>
	<4E7308E3.7080804@blueyonder.co.uk>
 <CAECqq8paCiu6E8-zv4Qxsb05XzEYZQDMsO=0O=HVHSyufO1_sw@mail.gmail.com>
 <4E734780.30509@blueyonder.co.uk> <4E737ECC.2020509@redhat.com>
 <4E85EB31.5070602@blueyonder.co.uk>
In-Reply-To: <4E85EB31.5070602@blueyonder.co.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi,
I haven't done any work playing with authentication, so I'm curious - Is 
it possible to set authentication to only authenticate consumers so 
producers can connect in without needing authentication?

Also is there a good tutorial for getting started with authentication - 
preferable something that starts with the basics to help a total 
authentication noob get something up and running quickly.

My personal view was that I wanted to run our system in a "trust and 
verify" model where we'd audit connections, but some folks in my 
organisation are getting a bit twitchy about that, so I want to keep my 
options open. It's unfortunate as my system is sitting behind a firewall 
on a trusted network and I wanted to have a model that maximises 
business agility by allowing consumers to quickly subscribe to the data 
they need when they need it and do cool stuff with it.

One of my biggest concerns about going down an authentication path is 
the administrative overhead of setting up and managing 
usernames/passwords. How do I do it so that it's not burdonsome to allow 
a new connection - especially if someone needs one in a hurry "out of 
hours". I guess the simple answer might be to have a single 
qpid-subscriber "account", but surely one account/password is little 
better than no authentication at all as anyone who knows this could 
easily set up another consumer client and subscribe to different data.

MTIA
Frase

---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project:      http://qpid.apache.org
Use/Interact: mailto:users-subscribe@qpid.apache.org