Basic SASL Configuration

SASL implementation in Tigase XMPP Server is compatible with Java API, the same exact interfaces are used.

The SASL implementation consists of following parts:

  1. mechanism-selector
  2. callback-handler-factory

'sess-man' () { 'sasl-provider' () { 'mechanism-selector' (class: tigase.auth.CustomMechanismSelector) {} 'callback-handler-factory' (class: tigase.auth.impl.ThirdAuthCallbackHandlerFactory) {} 'customSaslServerFactory' (class: tigase.auth.mechanisms.CustomSaslServerFactory) {} 'tigaseSaslServerFactory' (active: false) {} } }

Properties list for SASL plugin 'sasl-provider' () bean on 'sess-man' () {} bean.

Property

Description

callback-handler-factory

A factory class for SASL mechanisms. Detailed description at Mechanisms configuration

mechanism-selector

A class for filtering SASL mechanisms available in a stream. Detailed description at Selecting mechanisms

Mechanisms Configuration

To add a new mechanism, a new factory for the mechanism has to be registered. It can be done with a new line in the config.tdsl file like this one:

'sess-man' () {
    'sasl-provider' () {
        'customSaslServerFactory' (class: tigase.auth.mechanisms.CustomSaslServerFactory) {}
    }
}

The class must implement the SaslServerFactory interface. All mechanisms returned by getMechanismNames() method will be registered automatically.

The default factory that is available and registered by default is tigase.auth.TigaseSaslServerFactory which provides PLAIN and ANONYMOUS mechanisms. It can be disabled as follows:

'sess-man' () {
    'sasl-provider' () {
        'tigaseSaslServerFactory' (active: false) {}
    }
}
CallbackHandler Configuration

The CallbackHandler is a helper class used for loading/retrieving authentication data from data repository and providing them to a mechanism.

To register a new callback handler the config.tdsl file should include:

'sess-man' () {
    'urn:ietf:params:xml:ns:xmpp-sasl' () {
        'callback-handler-factory' (class: tigase.auth.impl.ThirdAuthCallbackHandlerFactory) {}
    }
}

During the authentication process, Tigase server always checks for a handler specific to selected mechanisms, and if there is no specific handler the default one is used.

Selecting Mechanisms Available in the Stream

The tigase.auth.MechanismSelector interface is used for selecting mechanisms available in a stream. Method filterMechanisms() should return a collection with mechanisms available based on:

  1. all registered SASL factories
  2. XMPP session data (from XMPPResourceConnection class)

The default selector returns mechanisms from Tigase’s default factory (TigaseSaslServerFactory) only.

It is possible to use a custom selector by specifying it’s class int the config.tdsl file:

'sess-man' () {
    'urn:ietf:params:xml:ns:xmpp-sasl' () {
        'mechanism-selector' (class: tigase.auth.CustomMechanismSelector) {}
    }
}