Apache
/
activemq-artemis
mirror of https://github.com/apache/activemq-artemis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

This closes #2865

This commit is contained in:
Justin Bertram 2019-10-17 10:02:57 -05:00
parent 3687ae400c 8043828e84
commit 3baf602c11
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/user-manual/en/configuration-index.md
View File

@ -374,6 +374,9 @@ Name | Description
[permission](security.md) | [permission](security.md) |
[permission.type](security.md) | the type of permission [permission.type](security.md) | the type of permission
[permission.roles](security.md) | a comma-separated list of roles to apply the permission to [permission.roles](security.md) | a comma-separated list of roles to apply the permission to
[role-mapping](security.md) | A simple role mapping that can be used to map roles from external authentication providers (i.e. LDAP) to internal roles
[role-mapping.from](security.md) | The external role which should be mapped
[role-mapping.to](security.md) | The internal role which should be assigned to the authenticated user
## broker-plugin type ## broker-plugin type

14
docs/user-manual/en/security.md
View File

@ -1022,6 +1022,20 @@ superseded by SASL GSSAPI. However, for clients that don't support SASL (core
client), using TLS can provide Kerberos authentication over an *unsecure* client), using TLS can provide Kerberos authentication over an *unsecure*
channel. channel.
## Mapping external roles
Roles from external authentication providers (i.e. LDAP) can be mapped to internally used roles. The is done through role-mapping entries in the security-settings block:
```xml
<security-settings>
[...]
<role-mapping from="cn=admins,ou=Group,ou=ActiveMQ,ou=system" to="my-admin-role"/>
<role-mapping from="cn=users,ou=Group,ou=ActiveMQ,ou=system" to="my-user-role"/>
</security-settings>
```
Note: Role mapping is additive. That means the user will keep the original role(s) as well as the newly assigned role(s).
Note: This role mapping only affects the roles which are used to authorize queue access through the configured acceptors. It can not be used to map the role required to access the web console.
## SASL ## SASL
[AMQP](using-AMQP.md) supports SASL. The following mechanisms are supported; PLAIN, EXTERNAL, ANONYMOUS, GSSAPI. [AMQP](using-AMQP.md) supports SASL. The following mechanisms are supported; PLAIN, EXTERNAL, ANONYMOUS, GSSAPI.