<div dir="ltr">+1<br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 30, 2017 at 1:25 PM, Tristan Tarrant <span dir="ltr"><<a href="mailto:ttarrant@redhat.com" target="_blank">ttarrant@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Dear all,<br>
<br>
after a mini chat on IRC, I wanted to bring this to everybody's attention.<br>
<br>
We should make the Hot Rod endpoint require authentication in the<br>
out-of-the-box configuration.<br>
The proposal is to enable the PLAIN (or, preferably, DIGEST) SASL<br>
mechanism against the ApplicationRealm and require users to run the<br>
add-user script.<br>
This would achieve two goals:<br>
- secure out-of-the-box configuration, which is always a good idea<br>
- access to the "protected" schema and script caches which is prevented<br>
when not on loopback on non-authenticated endpoints.<br>
<span class="HOEnZb"><font color="#888888"><br>
Tristan<br>
--<br>
Tristan Tarrant<br>
Infinispan Lead<br>
JBoss, a division of Red Hat<br>
______________________________<wbr>_________________<br>
infinispan-dev mailing list<br>
<a href="mailto:infinispan-dev@lists.jboss.org">infinispan-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/infinispan-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/infinispan-<wbr>dev</a><br>
</font></span></blockquote></div><br></div></div>