NO-JIRA fix duplicate text in security.md doc

Remove the duplicate text in CertificateLoginModule section of the
the security.md doc
This commit is contained in:
Tiago Bueno 2022-03-30 11:40:47 -03:00 committed by clebertsuconic
parent dbd60d0afb
commit 84c1feae8c
1 changed files with 11 additions and 31 deletions

View File

@ -893,34 +893,9 @@ In the preceding example, the JAAS realm is configured to use a single
`org.apache.activemq.artemis.spi.core.security.jaas.TextFileCertificateLoginModule` `org.apache.activemq.artemis.spi.core.security.jaas.TextFileCertificateLoginModule`
login module. The options supported by this login module are as follows: login module. The options supported by this login module are as follows:
- `debug` - boolean flag; if true, enable debugging; this is used only for testing or debugging; normally, - `debug` - boolean flag; if true, enable debugging; this is used only for
it should be set to `false`, or omitted; default is `false` testing or debugging; normally, it should be set to `false`, or omitted;
default is `false`
- `org.apache.activemq.jaas.textfiledn.user` - specifies the location of the user properties file (relative to the
directory containing the login configuration file).
- `org.apache.activemq.jaas.textfiledn.role` - specifies the location of the role properties file (relative to the
directory containing the login configuration file).
- `reload` - boolean flag; whether or not to reload the properties files when a modification occurs; default is `false`
In the context of the certificate login module, the `users.properties` file consists of a list of properties of the form,
`UserName=StringifiedSubjectDN` or `UserName=/SubjectDNRegExp/`. For example, to define the users, `system`, `user` and
`guest` as well as a `hosts` user matching several DNs, you could create a file like the following:
system=CN=system,O=Progress,C=US
user=CN=humble user,O=Progress,C=US
guest=CN=anon,O=Progress,C=DE
hosts=/CN=host\\d+\\.acme\\.com,O=Acme,C=UK/
Note that the backslash character has to be escaped because it has a special treatment in properties files.
Each username is mapped to a subject DN, encoded as a string (where the string encoding is specified by RFC 2253). For
example, the system username is mapped to the `CN=system,O=Progress,C=US` subject DN. When performing authentication,
the plug-in extracts the subject DN from the received certificate, converts it to the standard string format, and
compares it with the subject DNs in the `users.properties` file by testing for string equality. Consequently, you must
be careful to ensure that the subject DNs appearing in the `users.properties` file are an exact match for the subject
DNs extracted from the user certificates.
- `org.apache.activemq.jaas.textfiledn.user` - specifies the location of the - `org.apache.activemq.jaas.textfiledn.user` - specifies the location of the
user properties file (relative to the directory containing the login user properties file (relative to the directory containing the login
@ -934,16 +909,21 @@ DNs extracted from the user certificates.
modification occurs; default is `false` modification occurs; default is `false`
In the context of the certificate login module, the `users.properties` file In the context of the certificate login module, the `users.properties` file
consists of a list of properties of the form, `UserName=StringifiedSubjectDN`. consists of a list of properties of the form, `UserName=StringifiedSubjectDN`
For example, to define the users, system, user, and guest, you could create a or `UserName=/SubjectDNRegExp/`. For example, to define the users, `system`,
file like the following: `user` and `guest` as well as a `hosts` user matching several DNs, you could
create a file like the following:
```properties ```properties
system=CN=system,O=Progress,C=US system=CN=system,O=Progress,C=US
user=CN=humble user,O=Progress,C=US user=CN=humble user,O=Progress,C=US
guest=CN=anon,O=Progress,C=DE guest=CN=anon,O=Progress,C=DE
hosts=/CN=host\\d+\\.acme\\.com,O=Acme,C=UK/
``` ```
Note that the backslash character has to be escaped because it has a special
treatment in properties files.
Each username is mapped to a subject DN, encoded as a string (where the string Each username is mapped to a subject DN, encoded as a string (where the string
encoding is specified by RFC 2253). For example, the system username is mapped encoding is specified by RFC 2253). For example, the system username is mapped
to the `CN=system,O=Progress,C=US` subject DN. When performing authentication, to the `CN=system,O=Progress,C=US` subject DN. When performing authentication,