ZeroMQ

Authentication Using SASL

When we designed AMQP in 2007, we chose the Simple Authentication and Security Layer (SASL) for the authentication layer, one of the ideas we took from the BEEP protocol framework. SASL looks complex at first, but it’s actually simple and fits neatly into a ØMQ-based protocol. What I especially like about SASL is that it’s scalable. You can start with anonymous access or plain text authentication and no security, and grow to more secure mechanisms over time, without changing your protocol.

I’m not going to give a deep explanation now, since we’ll see SASL in action a bit later. But I’ll explain the principle so you’re already somewhat prepared.

In the NOM protocol the client started with an OHAI command, which the server either accepted (“Hi Joe!”) or rejected. This is simple but not scalable, since the server and client have to agree up-front on what kind of authentication they’re going to do.

What SASL introduces, which is genius, is a fully abstracted and negotiable security layer that’s still easy to implement at the protocol level. It works as follows:

1. The client connects.

2. The server challenges the client, passing a list of security “mechanisms” that it knows about.

3. The client chooses a security mechanism that it knows about, and answers the server’s challenge with a blob of opaque data that (and here’s the neat trick) some generic security library calculates and gives to the client.

4. The server takes the security mechanism the client chose, and that blob ...