Chapter 7. Security

AMQ Python uses SSL/TLS to encrypt communication between clients and servers.

To connect to a remote server with SSL/TLS, use a connection URL with the amqps scheme.

container.connect("amqps://example.com")

container.connect("amqps://example.com")

AMQ Python can authenticate connections with a user and password.

To specify the credentials used for authentication, set the user and password options on the connect() method.

container.connect("amqps://example.com", user="alice", password="secret")

container.connect("amqps://example.com", user="alice", password="secret")

AMQ Python uses the SASL protocol to perform authentication. SASL can use a number of different authentication mechanisms. When two network peers connect, they exchange their allowed mechanisms, and the strongest mechanism allowed by both is selected.

By default, AMQ Python allows all of the mechanisms supported by the local SASL library configuration. To restrict the allowed mechanisms and thereby control what mechanisms can be negotiated, use the allowed_mechs connection option. It takes a string containing a space-separated list of mechanism names.

container.connect("amqps://example.com", allowed_mechs="ANONYMOUS")

container.connect("amqps://example.com", allowed_mechs="ANONYMOUS")

This example forces the connection to authenticate using the ANONYMOUS mechanism even if the server we connect to offers other options. Valid mechanisms include ANONYMOUS, PLAIN, SCRAM-SHA-256, SCRAM-SHA-1, GSSAPI, and EXTERNAL.

AMQ Python enables SASL by default. To disable it, set the sasl_enabled connection option to false.

event.container.connect("amqps://example.com", sasl_enabled=False)

event.container.connect("amqps://example.com", sasl_enabled=False)

Kerberos is a network protocol for centrally managed authentication based on the exchange of encrypted tickets. See Using Kerberos for more information.