Slushpupie: WildFire/Config (last edited 2006-07-12 18:26:55 by Slushpupie)
Sample config changes:
<!-- sasl configuration --> <sasl> <!-- Mechs to advertise. Order here should reflect preference advertised to client. Just because you put it in this list dosnt mean it will be advertised either. If the authProvider cant support the mechanism, it wont be shown. PLAIN and ANONYMOUS mechs also enable non-SASL authentication (the old style XMPP auth), so removing them from this list will disallow non-SASL auth --> <mechs>GSSAPI</mechs> <!-- <mechs>CRAM-MD5,DIGEST-MD5,PLAIN,EXTERNAL,ANONYMOUS</mechs> --> <!-- Several SASL mechanisms have a concept of a realm, but as of today only GSSAPI uses it. --> <realm>REALM.COM</realm> <!-- Mech specific configs here --> <gssapi> <debug>true</debug> <!-- GSSAPI needs its own config file --> <config>/opt/wildfire/conf/gssapi.conf</config> <!-- most will set useSubjectCredOnly to false (the default) See http://java.sun.com/j2se/1.4.2/docs/api/org/ietf/jgss/package-summary.html for more details --> <useSubjectCredsOnly>false</useSubjectCredsOnly> </gssapi> <!-- Some mechanisms allow for a principal different than the username authenticating. The policyProvider is what provides a storage for matching principals to JIDs. The default uses the database provider for storage. Not all providers will allow changes, some --> </sasl> <provider> <authorization> <classList>org.jivesoftware.wildfire.sasl.LazyAuthorizationPolicy org.jivesoftware.wildfire.sasl.DefaultAuthorizationProvider</classList> <!-- other options: null, LdapAuthorizationProvider, UnixK5LoginProvider, Strict and Lazy--> </authorization> </provider> <!-- If LdapAuthorizationProvider is selected... --> <!-- <ldap> <authorizeField>k5login</authorizeField> </ldap> --> <!-- If UnixK5LoginProvider is selected... --> <!-- <unix> <k5login>/home/{0}/.k5login</k5login> <!-- Will "~{0}/.k5login" work? --> </unix> -->