PyPI - amps-python-client - Versions diffs - 5.3.4.1__zip → 5.3.4.3__zip - Mend

amps-python-client 5.3.4.1zip → 5.3.4.3zip

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (918) hide show

amps-python-client-5.3.4.1/docs/user-guide/html/chapters/auxiliary_modules.html DELETED Viewed

@@ -1,2548 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-  <head>
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>34. Auxiliary Modules &#8212; AMPS User Guide develop documentation</title>
-    <link rel="stylesheet" href="../_static/alabaster.css" type="text/css" />
-    <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
-    <script type="text/javascript">
-      var DOCUMENTATION_OPTIONS = {
-        URL_ROOT:    '../',
-        VERSION:     'develop',
-        COLLAPSE_INDEX: false,
-        FILE_SUFFIX: '.html',
-        HAS_SOURCE:  true,
-        SOURCELINK_SUFFIX: '.txt'
-      };
-    </script>
-    <script type="text/javascript" src="../_static/jquery.js"></script>
-    <script type="text/javascript" src="../_static/underscore.js"></script>
-    <script type="text/javascript" src="../_static/doctools.js"></script>
-    <link rel="index" title="Index" href="../genindex.html" />
-    <link rel="search" title="Search" href="../search.html" />
-    <link rel="next" title="35. The AMPS Statistics Database" href="amps-statistics.html" />
-    <link rel="prev" title="33. Spark" href="spark.html" />
-  <link rel="stylesheet" href="../_static/custom.css" type="text/css" />
-  <meta name="viewport" content="width=device-width, initial-scale=0.9, maximum-scale=0.9" />
-  </head>
-  <body role="document">
-  <div class="document">
-      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
-        <div class="sphinxsidebarwrapper">
-            <p class="logo"><a href="../index.html">
-              <img class="logo" src="../_static/flag_logo.png" alt="Logo"/>
-            </a></p>
-  <h3><a href="../index.html">Table Of Contents</a></h3>
-  <ul>
-<li><a class="reference internal" href="#">34. Auxiliary Modules</a><ul>
-<li><a class="reference internal" href="#legacy-messaging-compatibility-functions">Legacy Messaging Compatibility Functions</a></li>
-<li><a class="reference internal" href="#experimental-functions">Experimental Functions</a><ul>
-<li><a class="reference internal" href="#preprocessing-enrichment">Preprocessing/Enrichment</a><ul>
-<li><a class="reference internal" href="#limitations-and-usage">Limitations and Usage</a></li>
-</ul>
-</li>
-<li><a class="reference internal" href="#loading-the-module">Loading the Module</a></li>
-</ul>
-</li>
-<li><a class="reference internal" href="#key-generation-for-chained-messages">Key Generation for Chained Messages</a><ul>
-<li><a class="reference internal" href="#chained-message-sample-case">Chained Message Sample Case</a></li>
-<li><a class="reference internal" href="#configuring-the-chaining-key-generator">Configuring the Chaining Key Generator</a><ul>
-<li><a class="reference internal" href="#example">Example</a></li>
-</ul>
-</li>
-</ul>
-</li>
-<li><a class="reference internal" href="#authentication-and-entitlement-using-a-web-service">Authentication and Entitlement using a Web Service</a><ul>
-<li><a class="reference internal" href="#when-to-use-the-web-service-module">When to Use the Web Service Module</a></li>
-<li><a class="reference internal" href="#permissions-document-format">Permissions Document Format</a></li>
-<li><a class="reference internal" href="#configuring-amps-to-use-web-service-authentication-and-entitlements">Configuring AMPS to use Web Service Authentication and Entitlements</a><ul>
-<li><a class="reference internal" href="#using-https-for-authentication-and-entitlement-requests">Using HTTPS for Authentication and Entitlement Requests</a></li>
-</ul>
-</li>
-<li><a class="reference internal" href="#permissions-management-and-request-flow">Permissions Management and Request Flow</a><ul>
-<li><a class="reference internal" href="#authentication-step">Authentication Step</a></li>
-<li><a class="reference internal" href="#entitlement-step">Entitlement Step</a></li>
-<li><a class="reference internal" href="#entitlement-reset">Entitlement Reset</a></li>
-<li><a class="reference internal" href="#entitlement-only-mode">Entitlement Only Mode</a></li>
-<li><a class="reference internal" href="#entitlement-only-request-flow">Entitlement Only Request Flow</a></li>
-</ul>
-</li>
-</ul>
-</li>
-<li><a class="reference internal" href="#authentication-with-the-amps-multimechanism-authentication-module">Authentication with the AMPS Multimechanism Authentication Module</a><ul>
-<li><a class="reference internal" href="#when-to-use-the-multimechanism-authentication-module">When to Use the Multimechanism Authentication Module</a></li>
-<li><a class="reference internal" href="#setting-authentication-mechanisms">Setting Authentication Mechanisms</a></li>
-<li><a class="reference internal" href="#configuring-amps-to-use-the-multimechanism-authentication-module">Configuring AMPS to use the Multimechanism Authentication Module</a></li>
-</ul>
-</li>
-<li><a class="reference internal" href="#entitlement-with-the-simple-access-module">Entitlement with the Simple Access Module</a><ul>
-<li><a class="reference internal" href="#when-to-use-the-simple-access-module">When to Use the Simple Access Module</a></li>
-<li><a class="reference internal" href="#configuring-amps-to-use-the-simple-access-module">Configuring AMPS to use the Simple Access Module</a></li>
-</ul>
-</li>
-<li><a class="reference internal" href="#providing-replication-credentials-with-the-amps-multimechanism-authenticator-module">Providing Replication Credentials with the AMPS Multimechanism Authenticator Module</a><ul>
-<li><a class="reference internal" href="#when-to-use-the-multimechanism-authenticator-module">When to Use the Multimechanism Authenticator Module</a></li>
-<li><a class="reference internal" href="#id2">Setting Authentication Mechanisms</a></li>
-<li><a class="reference internal" href="#configuring-amps-to-use-the-multimechanism-authenticator-module">Configuring AMPS to use the Multimechanism Authenticator Module</a></li>
-</ul>
-</li>
-<li><a class="reference internal" href="#providing-replication-credentials-with-the-amps-exec-authenticator-module">Providing Replication Credentials with the AMPS Exec Authenticator Module</a><ul>
-<li><a class="reference internal" href="#when-to-use-the-exec-authenticator-module">When to Use the Exec Authenticator Module</a></li>
-<li><a class="reference internal" href="#configuring-amps-to-use-the-exec-authenticator-module">Configuring AMPS to use the Exec Authenticator Module</a></li>
-</ul>
-</li>
-</ul>
-</li>
-</ul>
-<div class="relations">
-<h3>Related Topics</h3>
-<ul>
-  <li><a href="../index.html">Documentation overview</a><ul>
-      <li>Previous: <a href="spark.html" title="previous chapter">33. Spark</a></li>
-      <li>Next: <a href="amps-statistics.html" title="next chapter">35. The AMPS Statistics Database</a></li>
-  </ul></li>
-</ul>
-</div>
-<div id="searchbox" style="display: none" role="search">
-  <h3>Quick search</h3>
-    <form class="search" action="../search.html" method="get">
-      <div><input type="text" name="q" /></div>
-      <div><input type="submit" value="Go" /></div>
-      <input type="hidden" name="check_keywords" value="yes" />
-      <input type="hidden" name="area" value="default" />
-    </form>
-</div>
-<script type="text/javascript">$('#searchbox').show(0);</script>
-        </div>
-      </div>
-      <div class="documentwrapper">
-        <div class="bodywrapper">
-          <div class="body" role="main">
-  <div class="section" id="auxiliary-modules">
-<span id="ug-appendix-auxilliary-modules"></span><span id="id1"></span><h1>34. Auxiliary Modules<a class="headerlink" href="#auxiliary-modules" title="Permalink to this headline">¶</a></h1>
-<p>The AMPS distribution provides several modules that extend AMPS with
-optional behavior. These modules are <em>not</em> loaded by default.</p>
-<p>In this release, AMPS includes auxiliary modules that provide the
-following functionality:</p>
-<ul>
-<li><p class="first"><strong>User-Defined Functions</strong></p>
-<p>AMPS includes the <code class="docutils literal"><span class="pre">libamps_udf_legacy_compatibility</span></code> module that
-provides date and time handling functions similar to those provided
-by legacy messaging systems.</p>
-<p>AMPS provides a <code class="docutils literal"><span class="pre">libamps_udf_experimental</span></code> module that contains
-special purpose functions.</p>
-</li>
-<li><p class="first"><strong>SOW Key Generation</strong></p>
-<p>AMPS includes the <code class="docutils literal"><span class="pre">libamps_id_chaining_generator</span></code> module that
-provides chained SOW key generation.</p>
-</li>
-<li><p class="first"><strong>Authentication and Entitlement</strong></p>
-<p>AMPS includes several modules to help you implement an authentication
-and entitlement system.</p>
-<ul class="simple">
-<li>The <code class="docutils literal"><span class="pre">libamps_http_entitlement</span></code> module makes requests to an
-external web service to validate authentication credentials and
-retrieve the set of applicable entitlements. With this module,
-you can provide both authentication and entitlement infrastructure.</li>
-<li>The <code class="docutils literal"><span class="pre">libamps_multi_authentication</span></code> module supports multi-mechanism
-authentication. In this release, the module supports both LDAP
-and Kerberos. This module does not provide an entitlements
-implementation.</li>
-<li>The <code class="docutils literal"><span class="pre">libamps_simple_access_entitlement</span></code> module restricts access
-to specific resources. This module is most often used to provide
-limited access to the AMPS Admin console. This module does not
-provide an authentication implementation, and does not consider
-individual user entitlements &#8211; the restrictions applied by
-this module apply to all users.</li>
-</ul>
-</li>
-<li><p class="first"><strong>Authenticators</strong></p>
-<ul class="simple">
-<li>AMPS includes a module, <code class="docutils literal"><span class="pre">libamps_multi_authenticator</span></code>,  to provide
-credentials for outgoing replication connections. Notice that the default
-authenticator module, which is automatically loaded, can also be
-configured to provide credentials.</li>
-<li>AMPS includes a module, <code class="docutils literal"><span class="pre">libamps_exec_authenticator</span></code>,  that
-executes an external application and provides the output of
-that process as the credentials for an outgoing replication
-connection.</li>
-</ul>
-</li>
-</ul>
-<p>The auxiliary modules are described in more detail in the following sections.</p>
-<div class="section" id="legacy-messaging-compatibility-functions">
-<span id="ug-legacy-messaging-compatibility"></span><h2>Legacy Messaging Compatibility Functions<a class="headerlink" href="#legacy-messaging-compatibility-functions" title="Permalink to this headline">¶</a></h2>
-<p>The AMPS distribution includes a library of legacy messaging
-compatibility functions. These functions are intended to ease migration
-to AMPS from legacy messaging systems that provide similar functions.</p>
-<p>In this release, the legacy messaging functions provide functions to
-make it easy to work with date and time.</p>
-<p>These functions are not loaded into AMPS by default. To enable them,
-you must load the legacy messaging compatibility module by adding a
-directive to the AMPS configuration file. Once the module is loaded,
-the functions become available. No further configuration is required.</p>
-<p>For example, adding the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code>
-block of the AMPS configuration file loads the legacy messaging
-compatibility functions.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    ...
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>compatibility-functions-module<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_udf_legacy_compatibility.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-    <span class="nt">&lt;/Modules&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-<table border="1" class="docutils" id="id3">
-<caption><span class="caption-text"><em>AMPS Legacy Messaging Compatibility Functions</em></span><a class="headerlink" href="#id3" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="33%" />
-<col width="33%" />
-<col width="33%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Function</th>
-<th class="head">Parameters</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">TIMEZONEOFFSET</span></code></td>
-<td>&#160;</td>
-<td>Returns a <code class="docutils literal"><span class="pre">long</span></code> that contains the current
-timezone offset from UTC, represented in
-seconds.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">YEAR</span></code></td>
-<td><em>timestamp</em></td>
-<td>Returns the year for
-the provided timestamp.
-The year is calculated
-in the UTC timezone.
-For example, calling
-<code class="docutils literal"><span class="pre">YEAR</span></code> on a timestamp
-that represents January
-25, 2010 at 10:04 AM in
-UTC returns <code class="docutils literal"><span class="pre">2010</span></code>.</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">MONTH</span></code></td>
-<td><em>timestamp</em></td>
-<td>Returns the month for
-the provided timestamp.
-The month is calculated
-in the UTC timezone.
-For example, calling
-<code class="docutils literal"><span class="pre">MONTH</span></code> on a
-timestamp that
-represents January 25,
-2010 at 10:04 AM in UTC
-returns <code class="docutils literal"><span class="pre">1</span></code>.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">DAY</span></code></td>
-<td><em>timestamp</em></td>
-<td>Returns the day for the
-provided timestamp. The
-day is calculated in
-the UTC timezone. For
-example, calling
-<code class="docutils literal"><span class="pre">DAY</span></code> on a timestamp
-that represents January
-25, 2010 at 10:04 AM in
-UTC returns <code class="docutils literal"><span class="pre">25</span></code>.</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">DATE_UTC</span></code></td>
-<td><em>timestamp</em></td>
-<td>Returns a timestamp for
-the beginning of the
-provided day (00:00:00)
-in UTC. The timestamp is
-represented in seconds.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">DATE</span></code></td>
-<td><em>timestamp</em></td>
-<td>Returns the UNIX timestamp for
-the beginning of the
-provided day (00:00:00)
-in the local timezone. The timestamp is
-represented in seconds.</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">TODAY_UTC</span></code></td>
-<td>&#160;</td>
-<td>Returns the UNIX timestamp for
-the beginning of the
-current day (00:00:00)
-in UTC &#8211; that is, the local timestamp that
-corresponds to the UTC time for the start of
-the current day. The timestamp is
-represented in seconds.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">TODAY</span></code></td>
-<td>&#160;</td>
-<td>Returns the UNIX timestamp for
-the beginning of the
-current day (00:00:00)
-in the local timezone. The timestamp is
-represented in seconds.</td>
-</tr>
-</tbody>
-</table>
-</div>
-<div class="section" id="experimental-functions">
-<span id="ug-udf-experimental"></span><h2>Experimental Functions<a class="headerlink" href="#experimental-functions" title="Permalink to this headline">¶</a></h2>
-<p>This module contains User-Defined Functions (UDF) that are a part of the
-AMPS distribution, but which serve specialized use cases and are
-not currently intended for use outside of those scenarios. The
-current implementations of these UDFs are considered to be
-experimental and are only supported for use in the intended context
-&#8211; a general-purpose version of these features might behave somewhat
-differently.</p>
-<p>In this release, the experimental UDF module contains one function
-for use in preprocessing or enrichment.</p>
-<div class="section" id="preprocessing-enrichment">
-<h3>Preprocessing/Enrichment<a class="headerlink" href="#preprocessing-enrichment" title="Permalink to this headline">¶</a></h3>
-<p>The <code class="docutils literal"><span class="pre">VALUE_LOOKUP</span></code> function can be used to look up a value in another topic
-during preprocessing or enrichment of a SOW topic.</p>
-<p>To use the function, you must first load the experimental UDF module and
-register the lookups that will be used by the module.</p>
-<p>A lookup is declared using the Lookup option to the module. This option
-uses a semicolon-delimited list of parameters to define the lookup. All
-parameters are required.</p>
-<table border="1" class="docutils" id="id4">
-<caption><span class="caption-text"><em>Lookup option parameters</em></span><a class="headerlink" href="#id4" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head"><strong>Option</strong></th>
-<th class="head"><strong>Definition</strong></th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td>Name</td>
-<td>The name to use for the lookup.</td>
-</tr>
-<tr class="row-odd"><td>Parameter Count</td>
-<td>The number of fields to use for
-the lookup.</td>
-</tr>
-<tr class="row-even"><td>Message Type</td>
-<td>The message type of the topic to
-use for lookup.</td>
-</tr>
-<tr class="row-odd"><td>Topic Name</td>
-<td>The name of the topic to use for
-lookup.</td>
-</tr>
-<tr class="row-even"><td>Return Field</td>
-<td>The field to return from the
-located message.</td>
-</tr>
-<tr class="row-odd"><td>Lookup Fields</td>
-<td>The fields to use to look up the
-message.</td>
-</tr>
-</tbody>
-</table>
-<p>For example, to create a lookup named <code class="docutils literal"><span class="pre">return-value-by-id</span></code>,
-that takes a single parameter and uses that to match the
-<code class="docutils literal"><span class="pre">/id</span></code> field in the <code class="docutils literal"><span class="pre">data</span></code> topic of <code class="docutils literal"><span class="pre">json</span></code> type, returning
-the <code class="docutils literal"><span class="pre">/value</span></code> field of the matched record, you would provide
-this option when loading the module:</p>
-<div class="code xml highlight-default"><div class="highlight"><pre><span></span><span class="o">&lt;</span><span class="n">Lookup</span><span class="o">&gt;</span><span class="k">return</span><span class="o">-</span><span class="n">value</span><span class="o">-</span><span class="n">by</span><span class="o">-</span><span class="nb">id</span><span class="p">;</span><span class="mi">1</span><span class="p">;</span><span class="n">json</span><span class="p">;</span><span class="n">data</span><span class="p">;</span><span class="o">/</span><span class="n">value</span><span class="p">;</span><span class="o">/</span><span class="nb">id</span><span class="o">&lt;/</span><span class="n">Lookup</span><span class="o">&gt;</span>
-</pre></div>
-</div>
-<p>Likewise, to create a lookup named <code class="docutils literal"><span class="pre">getNotes</span></code> that uses a
-combination of <code class="docutils literal"><span class="pre">/customerId</span></code> and <code class="docutils literal"><span class="pre">/orderId</span></code> to return the
-<code class="docutils literal"><span class="pre">/notes</span></code> field of a matching record from the orders topic of
-<code class="docutils literal"><span class="pre">nvfix</span></code> type, you would provide this option when loading the
-module:</p>
-<div class="code xml highlight-default"><div class="highlight"><pre><span></span><span class="o">&lt;</span><span class="n">Lookup</span><span class="o">&gt;</span><span class="n">getNotes</span><span class="p">;</span><span class="mi">2</span><span class="p">;</span><span class="n">nvfix</span><span class="p">;</span><span class="n">orders</span><span class="p">;</span><span class="o">/</span><span class="n">notes</span><span class="p">;</span><span class="o">/</span><span class="n">customerId</span><span class="p">;</span><span class="o">/</span><span class="n">orderId</span><span class="o">&lt;/</span><span class="n">Lookup</span><span class="o">&gt;</span>
-</pre></div>
-</div>
-<p>To use the UDF, provide the name of the lookup and the values to lookup:</p>
-<div class="code sql highlight-default"><div class="highlight"><pre><span></span><span class="n">VALUE_LOOKUP</span><span class="p">(</span><span class="s2">&quot;return-value-by-id&quot;</span><span class="p">,</span> <span class="o">/</span><span class="n">thisId</span><span class="p">)</span>
-</pre></div>
-</div>
-<p>The above function call will take the <code class="docutils literal"><span class="pre">/thisId</span></code> field from the current
-message, use that to find a matching <code class="docutils literal"><span class="pre">/id</span></code> value in the data topic (of
-<code class="docutils literal"><span class="pre">json</span></code> type), and then return the <code class="docutils literal"><span class="pre">/value</span></code> field from a matching record.</p>
-<p>The <code class="docutils literal"><span class="pre">VALUE_LOOKUP</span></code> function uses an exact match for the fields specified.</p>
-<table border="1" class="docutils" id="id5">
-<caption><span class="caption-text"><em>VALUE_LOOKUP function</em></span><a class="headerlink" href="#id5" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="33%" />
-<col width="33%" />
-<col width="33%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Function</th>
-<th class="head">Parameters</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">VALUE_LOOKUP</span></code></td>
-<td><p class="first"><em>name of lookup</em></p>
-<p><em>one or more values
-for lookup</em></p>
-<p class="last">The number of values
-provided must match
-the definition for
-the lookup name.</p>
-</td>
-<td><p class="first">Returns a value from the
-referenced topic as a string.</p>
-<p class="last">If multiple records match the
-lookup, returns one of those
-records.  If no records match the
-lookup, returns <code class="docutils literal"><span class="pre">NULL</span></code>.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>To use this function, the module must be loaded and one or more lookup
-functions must be declared when the module is loaded, as described
-in this section. This function is not loaded by default.</p>
-<div class="section" id="limitations-and-usage">
-<h4>Limitations and Usage<a class="headerlink" href="#limitations-and-usage" title="Permalink to this headline">¶</a></h4>
-<p>This UDF has the following limitations:</p>
-<ul class="simple">
-<li>60East makes no particular performance guarantees for this UDF, but
-recommends that the topics used for lookup be relatively small topics
-with infrequently updated data.</li>
-<li>The UDF caches lookup results for performance. This means that the UDF
-will increase the memory footprint of the AMPS instance (typically by
-the size of the lookup values + the size of the return values + 32
-bytes per record indexed in the target topic + a small amount of
-overhead per defined lookup).</li>
-<li>The lookup returns the value retrieved as an AMPS string. As with
-all AMPS values, if the value of the string can be coerced to a number,
-it can be used as a numeric value.</li>
-<li>If a lookup results in multiple matches, the UDF will return values
-for one of the matching records, but does not guarantee which
-result will be returned.</li>
-<li>The lookup function should only be used in preprocessing and enrichment
-in cases where it is not possible to use a view instead. The function
-cannot be used in view definitions, since it cannot guarantee that data
-is available during view recovery. The function cannot be used for a
-SOW topic with <code class="docutils literal"><span class="pre">transient</span></code> durability and a recovery point other than
-<code class="docutils literal"><span class="pre">now</span></code>, since the function cannot guarantee that data is available during
-SOW recovery.</li>
-<li>Values provided are cached for performance and the cache is updated
-asynchronously. This means that a publish to the source topic
-immediately followed by a call to the UDF may or may not produce
-the newly published value.</li>
-<li>AMPS considers the lookup function non-deterministic,
-since the value returned depends on the state of a message stored
-in a SOW topic, rather than the message being currently evaluated.</li>
-</ul>
-</div>
-</div>
-<div class="section" id="loading-the-module">
-<h3>Loading the Module<a class="headerlink" href="#loading-the-module" title="Permalink to this headline">¶</a></h3>
-<p>The experimental functions  module is shipped in the AMPS <code class="docutils literal"><span class="pre">lib</span></code> directory,
-and is named <code class="docutils literal"><span class="pre">libamps_udf_experimental.so</span></code>. To use the module, you load it
-as shown below, providing any options necessary for the functions
-contained in the module.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-  <span class="nt">&lt;Module&gt;</span>
-    <span class="nt">&lt;Name&gt;</span>experimental-udf<span class="nt">&lt;/Name&gt;</span>
-    <span class="nt">&lt;Library&gt;</span>libamps_udf_experimental.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;Options&gt;</span>
-      <span class="nt">&lt;Lookup&gt;</span>value-by-id;1;json;source-sow;/value;/id<span class="nt">&lt;/Lookup&gt;</span>
-      <span class="nt">&lt;Lookup&gt;</span>customer-id-by-order-id;1;nvfix;orders;/id;/customerId<span class="nt">&lt;/Lookup&gt;</span>
-    <span class="nt">&lt;/Options&gt;</span>
-  <span class="nt">&lt;/Module&gt;</span>
-<span class="nt">&lt;/Modules&gt;</span>
-</pre></div>
-</div>
-</div>
-</div>
-<div class="section" id="key-generation-for-chained-messages">
-<h2>Key Generation for Chained Messages<a class="headerlink" href="#key-generation-for-chained-messages" title="Permalink to this headline">¶</a></h2>
-<p>The AMPS distribution includes a module that can generate a SOW key for
-a set of chained messages.</p>
-<p>Message chains are most frequently used in FIX order processing systems
-to track a set of updates to an original order from a set of systems
-that use unique local identifiers for the order. As messages arrive,
-AMPS must update the record for the original order, regardless of
-whether the identifier on the current message is the original order, or
-is an order chained to the original order.</p>
-<p>A message chain allows an application to treat any update to an
-identifier in the chain as an update to the original message in the
-chain. The <code class="docutils literal"><span class="pre">libamps_id_chaining_key_generator</span></code> module supports this by
-generating the same SOW key for any message in the chain. To use this
-module, messages must have a field that identifies the current message
-and a field that identifies the previous message in the message chain,
-if one exists.</p>
-<div class="section" id="chained-message-sample-case">
-<h3>Chained Message Sample Case<a class="headerlink" href="#chained-message-sample-case" title="Permalink to this headline">¶</a></h3>
-<p>Consider a message processing scheme that uses two fields to identify
-related messages. Each message contains a <code class="docutils literal"><span class="pre">DocumentNumber</span></code> field
-that indicates the current document. If the message updates or extends
-an existing document, the message contains a <code class="docutils literal"><span class="pre">ParentDocument</span></code> that,
-when present, refers to the <code class="docutils literal"><span class="pre">DocumentNumber</span></code> of the document that the
-message updates or extends.</p>
-<p>With the default SOW key generator, each of the following messages would
-be a distinct message in the SOW topic:</p>
-<div class="highlight-javascript"><div class="highlight"><pre><span></span><span class="nx">delta_publish</span><span class="o">:</span> <span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">1</span><span class="p">,</span> <span class="s2">&quot;Status&quot;</span><span class="o">:</span><span class="s2">&quot;Started&quot;</span><span class="p">}</span>
-<span class="nx">delta_publish</span><span class="o">:</span> <span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">2</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">1</span><span class="p">,</span> <span class="s2">&quot;Order&quot;</span><span class="o">:</span><span class="s2">&quot;Antivenom&quot;</span><span class="p">}</span>
-<span class="nx">delta_publish</span><span class="o">:</span> <span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">3</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">2</span><span class="p">,</span> <span class="s2">&quot;Order&quot;</span><span class="o">:</span><span class="s2">&quot;Sandwich&quot;</span><span class="p">}</span>
-<span class="nx">delta_publish</span><span class="o">:</span> <span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">4</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">1</span><span class="p">,</span> <span class="s2">&quot;Status&quot;</span><span class="o">:</span><span class="s2">&quot;Pending&quot;</span><span class="p">}</span>
-</pre></div>
-</div>
-<p>With the default SOW key generator, at the end of the publishing
-process, the SOW contains four distinct records:</p>
-<div class="highlight-javascript"><div class="highlight"><pre><span></span><span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">1</span><span class="p">,</span> <span class="s2">&quot;Status&quot;</span><span class="o">:</span><span class="s2">&quot;Started&quot;</span><span class="p">}</span>
-<span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">2</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">1</span><span class="p">,</span> <span class="s2">&quot;Order&quot;</span><span class="o">:</span><span class="s2">&quot;Antivenom&quot;</span><span class="p">}</span>
-<span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">3</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">2</span><span class="p">,</span> <span class="s2">&quot;Order&quot;</span><span class="o">:</span><span class="s2">&quot;Sandwich&quot;</span><span class="p">}</span>
-<span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">4</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">1</span><span class="p">,</span> <span class="s2">&quot;Status&quot;</span><span class="o">:</span><span class="s2">&quot;Pending&quot;</span><span class="p">}</span>
-</pre></div>
-</div>
-<p>However, with the chaining key generator, AMPS is able to combine these
-messages into a single chain and produces the following single record:</p>
-<div class="highlight-javascript"><div class="highlight"><pre><span></span><span class="p">{</span><span class="s2">&quot;DocumentNumber&quot;</span><span class="o">:</span><span class="mf">4</span><span class="p">,</span> <span class="s2">&quot;ParentDocument&quot;</span><span class="o">:</span><span class="mf">1</span> <span class="p">,</span> <span class="s2">&quot;Order&quot;</span><span class="o">:</span><span class="s2">&quot;Sandwich&quot;</span><span class="p">,</span> <span class="s2">&quot;Status&quot;</span><span class="o">:</span><span class="s2">&quot;Pending&quot;</span><span class="p">}</span>
-</pre></div>
-</div>
-<p>The sequence of events for producing this message is as follows:</p>
-<ul class="simple">
-<li>When the first message arrives with a <code class="docutils literal"><span class="pre">/DocumentNumber</span></code> of <code class="docutils literal"><span class="pre">1</span></code>,
-the module begins a new chain (since there is no <code class="docutils literal"><span class="pre">/ParentDocument</span></code>
-present).</li>
-<li>When the second message arrives, the module knows that it is an
-update to the same message since the message contains a
-<code class="docutils literal"><span class="pre">/ParentDocument</span></code> value. In this case, because the value is <code class="docutils literal"><span class="pre">1</span></code>,
-the update is to the first message received. The module also adds a
-<code class="docutils literal"><span class="pre">/DocumentNumber</span></code> of <code class="docutils literal"><span class="pre">2</span></code> to the chain, so that subsequent
-messages that refer to a <code class="docutils literal"><span class="pre">/ParentDocument</span></code> of <code class="docutils literal"><span class="pre">2</span></code> are a part of
-the chain and update the same message.</li>
-<li>The same process occurs for the third message: the module looks up
-the message that should be updated when the <code class="docutils literal"><span class="pre">/ParentDocument</span></code> is
-<code class="docutils literal"><span class="pre">2</span></code>, and traces the chain back to the original underlying message.
-The module adds a <code class="docutils literal"><span class="pre">/DocumentNumber</span></code> of <code class="docutils literal"><span class="pre">3</span></code> to the chain, so that
-updates with a <code class="docutils literal"><span class="pre">/ParentDocument</span></code> of <code class="docutils literal"><span class="pre">3</span></code> will update the same
-message.</li>
-<li>When the last message arrives, the module knows that a
-<code class="docutils literal"><span class="pre">/ParentDocument</span></code> of <code class="docutils literal"><span class="pre">1</span></code> is still an update to the same message,
-since this is the original value. The module adds the value <code class="docutils literal"><span class="pre">4</span></code> to
-the chain.</li>
-</ul>
-<p>In each case, rather than simply using the fields in the message
-directly, the module creates a chain of linked identifiers: each
-identifier in the chain produces the same SOW key as the first
-identifier in the chain, so each update in the chain updates the same
-message.</p>
-<p>It is an error for a publisher to publish a message that resolves to two
-different message chains. If the module receives such a message, the
-module will not generate a SOW key, and the message is not processed by
-AMPS.</p>
-</div>
-<div class="section" id="configuring-the-chaining-key-generator">
-<h3>Configuring the Chaining Key Generator<a class="headerlink" href="#configuring-the-chaining-key-generator" title="Permalink to this headline">¶</a></h3>
-<p>To load the module in AMPS, add the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code>
-block of the AMPS configuration file:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    ...
-    <span class="nt">&lt;Modules&gt;</span>
-         ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>key-chaining<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_id_chaining_key_generator.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-    <span class="nt">&lt;/Modules&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-<p>You then use the module as the <code class="docutils literal"><span class="pre">KeyGenerator</span></code> for each topic in the
-SOW that will use chaining key generation.</p>
-<p>The module accepts the following options:</p>
-<table border="1" class="docutils" id="id6">
-<caption><span class="caption-text"><em>Parameters for chaining key generator</em></span><a class="headerlink" href="#id6" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Parameter</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><div class="code first last highlight-default"><div class="highlight"><pre><span></span><span class="n">Key</span>
-</pre></div>
-</div>
-</td>
-<td><p class="first">A field to use in chaining. AMPS supports any number
-of <code class="docutils literal"><span class="pre">Key</span></code> fields.</p>
-<p>The first <code class="docutils literal"><span class="pre">Key</span></code> field specified in the configuration
-is the <em>primary field</em> to use in chaining. When the
-primary field is present on a message, and the value
-of the field <em>is not</em> in an existing chain of values,
-the module creates a new chain.</p>
-<p>When the message contains the <em>primary field</em>
-and there is no previous entry for the value of that
-field, this message is the head of the chain and is
-used to generate the SOW key.</p>
-<p><code class="docutils literal"><span class="pre">Key</span></code> parameters specified after the first <code class="docutils literal"><span class="pre">Key</span></code>
-are <em>secondary fields</em>.</p>
-<p>When a secondary field is present on the message, the
-module generates a SOW key for this message as
-though the message contained a primary field
-with this value. In addition, the module stores the
-value of the primary field in the current, if any,
-message as equivalent to this value, enabling
-subsequent messages to be chained to this message.</p>
-<p>There is no default for this parameter. The
-parameter requires an AMPS field identifier, such as
-<code class="docutils literal"><span class="pre">/11</span></code> or <code class="docutils literal"><span class="pre">/Order/ClOrdID</span></code>.</p>
-<p class="last">The module requires a primary field and at least one
-secondary field to be defined.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><div class="code first last highlight-default"><div class="highlight"><pre><span></span><span class="n">FileName</span>
-</pre></div>
-</div>
-</td>
-<td><p class="first">Sets the name of the file that the module uses to
-store chaining data.</p>
-<p class="last">This module persists existing chains between restarts
-of the AMPS server. If a file with the given name
-exists when AMPS starts, the module reads chaining
-data from the file. Otherwise, the module creates a
-new file.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">Primary</span></code></td>
-<td><p class="first">A synonym for <code class="docutils literal"><span class="pre">Key</span></code> that explicitly specifies
-that this field is the primary field.</p>
-<p class="last">When this configuration element is present, AMPS uses
-the field specified in this element as the <em>primary
-field</em> and considers any field specified in a <code class="docutils literal"><span class="pre">Key</span></code>
-element to be a secondary field.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">Secondary</span></code></td>
-<td>A synonym for <code class="docutils literal"><span class="pre">Key</span></code> that explicitly specifies that
-this field is a secondary field.</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">Validation</span></code></td>
-<td><p class="first">Specifies whether the module validates that incoming
-messages are properly chained. When set to <code class="docutils literal"><span class="pre">true</span></code>
-or <code class="docutils literal"><span class="pre">1</span></code>, the module records extra data to attempt
-to detect errors in the sequencing of the chain. The
-module will consider it an error when it detects
-that two or more distinct chains share identifiers
-and would have been combined into a single chain had
-messages arrived in a different order. In some
-systems, this indicates an error in message
-processing.</p>
-<p class="last">Default: This option defaults to <code class="docutils literal"><span class="pre">false</span></code>.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<div class="section" id="example">
-<h4>Example<a class="headerlink" href="#example" title="Permalink to this headline">¶</a></h4>
-<p>The example configuration file below shows one way to use the chaining
-key generator module.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-   ...
-    <span class="nt">&lt;Module&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>key-chaining<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;Library&gt;</span>libamps_id_chaining_key_generator.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;/Module&gt;</span>
-<span class="nt">&lt;/Modules&gt;</span>
-<span class="nt">&lt;SOW&gt;</span>
-    ...
-    <span class="nt">&lt;Topic&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>Orders<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;MessageType&gt;</span>json<span class="nt">&lt;/MessageType&gt;</span>
-        <span class="nt">&lt;KeyGenerator&gt;</span>
-            <span class="nt">&lt;Module&gt;</span>key-chaining<span class="nt">&lt;/Module&gt;</span>
-            <span class="nt">&lt;Options&gt;</span>
-                <span class="nt">&lt;Primary&gt;</span>/DocumentNumber<span class="nt">&lt;/Primary&gt;</span>
-                <span class="nt">&lt;Key&gt;</span>/ParentDocument<span class="nt">&lt;/Key&gt;</span>
-                <span class="nt">&lt;Key&gt;</span>/RelatedDocument<span class="nt">&lt;/Key&gt;</span>
-                <span class="nt">&lt;FileName&gt;</span>./sow/Orders.chain<span class="nt">&lt;/FileName&gt;</span>
-            <span class="nt">&lt;/Options&gt;</span>
-        <span class="nt">&lt;/KeyGenerator&gt;</span>
-        <span class="nt">&lt;FileName&gt;</span>./sow/%n.sow<span class="nt">&lt;/FileName&gt;</span>
-    <span class="nt">&lt;/Topic&gt;</span>
-    <span class="nt">&lt;Topic&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>ExternalOrders<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;MessageType&gt;</span>fix<span class="nt">&lt;/MessageType&gt;</span>
-        <span class="nt">&lt;KeyGenerator&gt;</span>
-            <span class="nt">&lt;Module&gt;</span>key-chaining<span class="nt">&lt;/Module&gt;</span>
-            <span class="nt">&lt;Options&gt;</span>
-                <span class="c">&lt;!-- /11 is the primary field --&gt;</span>
-                <span class="nt">&lt;Key&gt;</span>/11<span class="nt">&lt;/Key&gt;</span>
-                <span class="nt">&lt;Key&gt;</span>/41<span class="nt">&lt;/Key&gt;</span>
-                <span class="nt">&lt;FileName&gt;</span>./sow/ExternalOrders.chain<span class="nt">&lt;/FileName&gt;</span>
-            <span class="nt">&lt;/Options&gt;</span>
-        <span class="nt">&lt;/KeyGenerator&gt;</span>
-        <span class="nt">&lt;FileName&gt;</span>./sow/%n.sow<span class="nt">&lt;/FileName&gt;</span>
-    <span class="nt">&lt;/Topic&gt;</span>
-<span class="nt">&lt;/SOW&gt;</span>
-</pre></div>
-</div>
-<p>Notice that once the module is loaded, it can be used for any message
-type, and can accept different configuration values for each topic in
-the SOW that uses the generator.</p>
-</div>
-</div>
-</div>
-<div class="section" id="authentication-and-entitlement-using-a-web-service">
-<span id="ug-auth-module"></span><h2>Authentication and Entitlement using a Web Service<a class="headerlink" href="#authentication-and-entitlement-using-a-web-service" title="Permalink to this headline">¶</a></h2>
-<p>The AMPS distribution includes a module that provides authentication and
-entitlement via an external Web Service. For some installations, this
-module provides a convenient way to integrate with an existing
-authentication and entitlement infrastructure without creating an
-entitlement plugin.</p>
-<p>In this release, the HTTP authentication module is provided with AMPS,
-but is not loaded by default. This module is an optional extension to
-the AMPS product, and while it is included with the AMPS distribution,
-the module must be explicitly loaded, enabled, and configured.</p>
-<p>When using this module, AMPS requests permissions documents from an
-external service using <code class="docutils literal"><span class="pre">http</span></code> or <code class="docutils literal"><span class="pre">https</span></code>. The request to retrieve
-the permissions document includes the credentials provided with the
-client logon. If the request succeeds, the module considers the user to
-have successfully authenticated to AMPS. If the request to retrieve the
-permissions document fails, the module considers the user to have failed
-authentication. When authentication succeeds, the contents of the
-document returned specify the permissions that the module grants to the
-user.</p>
-<p>The web service module expects that the web service endpoint will follow RESTful
-(HTTP) semantics. For example, the module uses standard HTTP headers for
-authentication and expects that if the credentials provided are not valid,
-the endpoint will return an HTTP 403 status code (or equivalent).</p>
-<div class="section" id="when-to-use-the-web-service-module">
-<h3>When to Use the Web Service Module<a class="headerlink" href="#when-to-use-the-web-service-module" title="Permalink to this headline">¶</a></h3>
-<p>The AMPS Web Service Authentication and Entitlement module can be a good
-option when:</p>
-<ul class="simple">
-<li>The site does not have an existing authentication and entitlements
-infrastructure for AMPS.</li>
-<li>It is more feasible to develop and test a standalone web service than
-to develop a server plugin for AMPS.</li>
-<li>Applications need to integrate with an existing authentication and
-entitlement system that offers limited Linux or C/C++ support.</li>
-<li>An application that will use another authentication scheme in
-production needs an easy way to test changes to entitlements and
-entitlement scenarios that are difficult to replicate in the
-production system.</li>
-</ul>
-</div>
-<div class="section" id="permissions-document-format">
-<h3>Permissions Document Format<a class="headerlink" href="#permissions-document-format" title="Permalink to this headline">¶</a></h3>
-<p>This section describes the format of the permissions documents used by
-the Web Service Authentication and Entitlement module.</p>
-<p>All documents are in JSON format, and consist of a set of permissions.
-The document <em>is not required</em> to contain the user name: this is
-intentional, and allows systems to easily provide identical permissions for
-all users in a group without having to create unique documents.</p>
-<p>The entitlement document expresses each permission as a field of a JSON
-document. The following is an example of a permissions document:</p>
-<div class="highlight-javascript"><div class="highlight"><pre><span></span><span class="p">{</span>
-  <span class="s2">&quot;logon&quot;</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span>
-  <span class="s2">&quot;replication-logon&quot;</span> <span class="o">:</span> <span class="kc">false</span><span class="p">,</span>
-  <span class="s2">&quot;topic&quot;</span><span class="o">:</span> <span class="p">[</span>
-            <span class="p">{</span> <span class="s2">&quot;topic&quot;</span><span class="o">:</span> <span class="s2">&quot;test&quot;</span><span class="p">,</span>
-              <span class="s2">&quot;read&quot;</span><span class="o">:</span> <span class="s2">&quot;/priority = 1&quot;</span><span class="p">,</span>
-              <span class="s2">&quot;write&quot;</span><span class="o">:</span> <span class="kc">false</span> <span class="p">},</span>
-            <span class="p">{</span> <span class="s2">&quot;topic&quot;</span><span class="o">:</span> <span class="s2">&quot;.*&quot;</span><span class="p">,</span>
-              <span class="s2">&quot;read&quot;</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span>
-              <span class="s2">&quot;write&quot;</span><span class="o">:</span> <span class="kc">true</span> <span class="p">}</span>
-           <span class="p">],</span>
-  <span class="s2">&quot;admin&quot;</span><span class="o">:</span> <span class="p">[</span>
-            <span class="p">{</span> <span class="s2">&quot;topic&quot;</span><span class="o">:</span> <span class="s2">&quot;^/amps/instance/.*&quot;</span><span class="p">,</span>
-              <span class="s2">&quot;read&quot;</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span>
-              <span class="s2">&quot;write&quot;</span><span class="o">:</span> <span class="kc">false</span> <span class="p">},</span>
-            <span class="p">{</span> <span class="s2">&quot;topic&quot;</span><span class="o">:</span> <span class="s2">&quot;.*&quot;</span><span class="p">,</span>
-              <span class="s2">&quot;read&quot;</span><span class="o">:</span> <span class="kc">false</span><span class="p">,</span>
-              <span class="s2">&quot;write&quot;</span><span class="o">:</span> <span class="kc">false</span> <span class="p">}</span>
-           <span class="p">]</span>
-<span class="p">}</span>
-</pre></div>
-</div>
-<p>The Web Authentication Module processes the entitlements in document
-order. Going through the document in order, this set of entitlements
-specifies the following permissions:</p>
-<ul class="simple">
-<li>This user has permission to log on to AMPS, as set by the logon
-field.</li>
-<li>This user does not have permission to make a replication connection
-to AMPS. A replication connection that uses these credentials will be
-refused.</li>
-<li>This user has read permissions to the topic <code class="docutils literal"><span class="pre">test</span></code> for messages
-that match the filter <code class="docutils literal"><span class="pre">/priority</span> <span class="pre">=</span> <span class="pre">1</span></code>. This user does not have
-write permissions to the topic.</li>
-<li>The user has read and write permissions to every other topic in the
-instance without content restrictions.</li>
-<li>The user has read permissions to the administrative interface for
-information under the <code class="docutils literal"><span class="pre">/amps/instance</span></code> path.</li>
-<li>The user has no other permissions to the administrative interface.</li>
-</ul>
-<p>The Web Service Authentication and Entitlement Module also allows
-fine-grained control of the topics that a given user is allowed to
-publish to via replication with the <code class="docutils literal"><span class="pre">replicated-topics</span></code> configuration
-element. The following permissions document shows sample permissions for
-a replication connection:</p>
-<div class="highlight-javascript"><div class="highlight"><pre><span></span><span class="p">{</span>
-  <span class="s2">&quot;replication-logon&quot;</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span>
-  <span class="s2">&quot;logon&quot;</span><span class="o">:</span> <span class="kc">false</span><span class="p">,</span>
-  <span class="s2">&quot;replicated-topics&quot;</span><span class="o">:</span><span class="p">[</span><span class="s2">&quot;^/orders/NYC/.*&quot;</span><span class="p">,</span>
-                       <span class="s2">&quot;/events/P1&quot;</span><span class="p">]</span>
-<span class="p">}</span>
-</pre></div>
-</div>
-<p>This document specifies that the user can only log on to AMPS via
-replication connections. The user has permission to replicate messages
-to the topic <code class="docutils literal"><span class="pre">/events/P1</span></code> (using an exact match) and topics that begin
-with <code class="docutils literal"><span class="pre">/orders/NYC</span></code>, as specified by the regular expression
-<code class="docutils literal"><span class="pre">^/orders/NYC/.*</span></code>. The user has no other permissions. In particular,
-the user cannot log on from an AMPS client, and could not publish to or
-subscribe to any topics even if <code class="docutils literal"><span class="pre">logon</span></code> was changed to <code class="docutils literal"><span class="pre">true</span></code>
-without an explicit <code class="docutils literal"><span class="pre">topic</span></code> permission.</p>
-<p>The structure of the permissions document is as follows:</p>
-<table border="1" class="colwidths-given docutils" id="id7">
-<caption><span class="caption-text"><em>Client Transport Permissions</em></span><a class="headerlink" href="#id7" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="30%" />
-<col width="70%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Field</th>
-<th class="head">Value</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">logon</span></code></td>
-<td><p class="first">Specifies permission for an application
-to log on to AMPS.</p>
-<p class="last">When this field is present, the value of
-the field must be a boolean <code class="docutils literal"><span class="pre">true</span></code> or
-<code class="docutils literal"><span class="pre">false</span></code>.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">topic</span></code></td>
-<td><p class="first">Controls access to topics within AMPS.</p>
-<p>When this field is present, the value of
-the field must be a <em>permission list</em>, as
-described below.</p>
-<p class="last">If this field is not present, the user
-cannot publish to or subscribe to any
-topics.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<table border="1" class="colwidths-given docutils" id="id8">
-<caption><span class="caption-text"><em>Admin Interface Permissions</em></span><a class="headerlink" href="#id8" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="30%" />
-<col width="70%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Field</th>
-<th class="head">Value</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">admin</span></code></td>
-<td><p class="first">Controls access to the administrative
-interface.</p>
-<p>When this field is present,
-the value of the field must be a
-<em>permission list</em>, as described below.</p>
-<p>If this field is not present, the user
-has no access to the administrative
-interface.</p>
-<p class="last">Notice that, because the Admin console
-uses HTTP, there is no equivalent of the
-<cite>logon</cite> or <cite>replication-logon</cite> permission
-for the Admin transport.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<table border="1" class="colwidths-given docutils" id="id9">
-<caption><span class="caption-text"><em>Replication Transport Permissions</em></span><a class="headerlink" href="#id9" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="30%" />
-<col width="70%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Field</th>
-<th class="head">Value</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">replication-logon</span></code></td>
-<td><p class="first">Controls permission for a replication
-connection to log on to AMPS.</p>
-<p class="last">When this field is present, the value of
-this field must be a boolean <code class="docutils literal"><span class="pre">true</span></code> or
-<code class="docutils literal"><span class="pre">false</span></code>.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">replicated-topics</span></code></td>
-<td><p class="first">An array containing the topics that this
-user can replicate to.</p>
-<p>When this field is present, the value of
-the field must be an array of strings that
-specify topic names or regular expressions.
-For example, the following entry allows
-this user to replicate ONLY to topics that
-begin with <code class="docutils literal"><span class="pre">/orders/NYC</span></code></p>
-<div class="code highlight-default"><div class="highlight"><pre><span></span><span class="s2">&quot;replicated-topics&quot;</span><span class="p">:[</span><span class="s2">&quot;^/orders/NYC/.*&quot;</span><span class="p">]</span>
-</pre></div>
-</div>
-<p class="last">If this field is not present in the
-permissions document, the user cannot
-replicate to any topics.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<table border="1" class="colwidths-given docutils" id="id10">
-<caption><span class="caption-text"><em>Connection Properties</em></span><a class="headerlink" href="#id10" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="30%" />
-<col width="70%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Field</th>
-<th class="head">Value</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">user_name</span></code></td>
-<td><p class="first">Specifies that the module should set
-the authenticated user name of the
-connection to the provided value.</p>
-<p>This option is ignored when the module
-is in <code class="docutils literal"><span class="pre">EntitlementsOnly</span></code> mode.</p>
-<p class="last">If this field is not present in the
-returned permissions document, the
-authenticated user name is set to the
-value provided with the <code class="docutils literal"><span class="pre">logon</span></code>
-request from the client.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>Permissions lists within this document are arrays of entries. Each entry
-in the array is a JSON object with the following format:</p>
-<table border="1" class="docutils" id="id11">
-<caption><span class="caption-text"><em>Permission list format</em></span><a class="headerlink" href="#id11" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Field</th>
-<th class="head">Value</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">topic</span></code></td>
-<td><p class="first">The name of the topic this permission
-definition applies to.</p>
-<p>This name can be either a literal value,
-or a regular expression to use to match
-topic names.</p>
-<p class="last">A name is interpreted as a regular
-expression if it contains any characters
-used in regular expression matching (for
-example; <code class="docutils literal"><span class="pre">^</span></code>, <code class="docutils literal"><span class="pre">$</span></code>, <code class="docutils literal"><span class="pre">*</span></code>, <code class="docutils literal"><span class="pre">.</span></code> and
-so on). Regular expression matching
-provides full support for PCRE regular
-expressions.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">read</span></code></td>
-<td><p class="first">Defines the read permission for the
-topic.</p>
-<p>The value of this field can be either
-<code class="docutils literal"><span class="pre">true</span></code>, <code class="docutils literal"><span class="pre">false</span></code> or an AMPS filter</p>
-<p class="last">When the value is <code class="docutils literal"><span class="pre">true</span></code>, the module
-grants read permission to the topic with
-no restrictions. When the value is
-<code class="docutils literal"><span class="pre">false</span></code>, the module denies read
-permission. When the value is a filter,
-the module grants read permission to the
-topic only for those messages that match
-the filter.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">write</span></code></td>
-<td><p class="first">Defines the write permission for the
-topic.</p>
-<p>The value of this field can be either
-<code class="docutils literal"><span class="pre">true</span></code>, <code class="docutils literal"><span class="pre">false</span></code> or an AMPS filter</p>
-<p class="last">When the value is <code class="docutils literal"><span class="pre">true</span></code>, the module
-grants write permission to the topic with
-no restrictions. When the value is
-<code class="docutils literal"><span class="pre">false</span></code>, the module denies write
-permission. When the value is a filter,
-the module grants write permission to
-the topic only for those messages that
-match the filter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">select</span></code></td>
-<td><p class="first">Defines the entitlement select list for
-this topic.</p>
-<p>When this value is present,
-the module applies the select list
-provided to the topic entitlement.</p>
-<p class="last">Notice that this element should include
-<em>only</em> the select list specifier and not
-the enclosing brackets for the select
-list. For example, a valid <code class="docutils literal"><span class="pre">select</span></code>
-element might be:</p>
-</td>
-</tr>
-</tbody>
-</table>
-</div>
-<div class="section" id="configuring-amps-to-use-web-service-authentication-and-entitlements">
-<h3>Configuring AMPS to use Web Service Authentication and Entitlements<a class="headerlink" href="#configuring-amps-to-use-web-service-authentication-and-entitlements" title="Permalink to this headline">¶</a></h3>
-<p>The web service authentication and entitlement module is included in the
-AMPS distribution, but is not loaded by default. To load the module in
-AMPS, add the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code> block
-of the AMPS configuration file:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Module&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>web-entitlements<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;Library&gt;</span>libamps_http_entitlement.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="c">&lt;!-- You may specify options here, or where the module is used.--&gt;</span>
-    <span class="nt">&lt;/Module&gt;</span>
-    ...
-<span class="nt">&lt;/Modules&gt;</span>
-</pre></div>
-</div>
-<p>Options for the module may be set when the module is loaded, when the
-module is used for <code class="docutils literal"><span class="pre">Authentication</span></code> or <code class="docutils literal"><span class="pre">Entitlement</span></code>, or in both
-places. Options set when the module is loaded are inherited as the
-default values for all uses of the module in the instance. Options
-specified in an <code class="docutils literal"><span class="pre">Authentication</span></code> or <code class="docutils literal"><span class="pre">Entitlement</span></code> block override
-options set when the module is loaded.</p>
-<p>For <code class="docutils literal"><span class="pre">Authentication</span></code>, the module supports the following options:</p>
-<table border="1" class="docutils" id="id12">
-<caption><span class="caption-text"><em>Options in Authentication directive</em></span><a class="headerlink" href="#id12" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><div class="req first last docutils container">
-ResourceURI</div>
-</td>
-<td><p class="first">The URI to request when a user logs
-into AMPS using this module. This
-option is required.</p>
-<p>For this option, AMPS substitutes
-the placeholder <code class="docutils literal"><span class="pre">{{USER_NAME}}</span></code>
-with the name of the user being
-authenticated. For example, here are
-two possible values for the
-<code class="docutils literal"><span class="pre">ResourceURI</span></code>:</p>
-<div class="code highlight-default"><div class="highlight"><pre><span></span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">cred</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">8080</span><span class="o">/</span><span class="p">{{</span><span class="n">USER_NAME</span><span class="p">}}</span><span class="o">.</span><span class="n">json</span>
-</pre></div>
-</div>
-<div class="code highlight-default"><div class="highlight"><pre><span></span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">cred</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">8080</span><span class="o">/</span><span class="n">admin</span><span class="o">/</span><span class="n">group_policy</span><span class="o">.</span><span class="n">json</span>
-</pre></div>
-</div>
-<p>In the first case, AMPS requests a
-document with the current user name
-of the user logging on substituted
-for the <code class="docutils literal"><span class="pre">{{USER_NAME}}</span></code> component
-of the URI. In the second case, the
-document is requested with the
-credentials of the user connecting,
-but AMPS requests the same document
-for each user.</p>
-<p class="last">There is no default for this
-parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">CredentialStore</span></code></td>
-<td><p class="first">Identifier for the entitlement store
-where the retrieved permission sets
-will be stored. When used for
-authentication, this is the name of
-the entitlement cache that the
-module stores parsed information
-into until AMPS requests the
-information.</p>
-<p>In most cases, there is no need to
-set this parameter. When multiple
-transports use different
-<code class="docutils literal"><span class="pre">ResourceURI</span></code> values, but those
-transports are expected to maintain
-the same information, specifying a
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> value can speed
-the logon process and reduce the
-number of copies of the parsed
-permissions document in memory.
-Likewise, if a module must ensure
-that permission sets are kept
-separate (so that, for example, an
-internal user named <code class="docutils literal"><span class="pre">'johndoe'</span></code>
-and a web user named <code class="docutils literal"><span class="pre">'johndoe'</span></code>
-have separate credentials),
-explicitly setting a
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> value can make
-it easier to verify that the
-permission sets are completely
-separate.</p>
-<p class="last">Default: The literal value of the
-<code class="docutils literal"><span class="pre">ResourceURI</span></code> parameter.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">ConnectionTimeout</span></code></td>
-<td><p class="first">The maximum amount of time to wait
-for a connection to the web server
-for each request, in milliseconds.
-If a connection is not made within
-the specified time, the module stops
-the connection attempt and the
-request fails.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">2000</span></code></p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">RequestTimeout</span></code></td>
-<td><p class="first">The maximum amount of time to wait
-for the web server to return a
-permissions document on each
-request, in milliseconds. If the
-server does not return a permissions
-document within the specified time,
-the module closes the connection and
-the request fails.</p>
-<div class="admonition tip">
-<p class="first admonition-title">Tip</p>
-<p class="last">Increasing this timeout above the default
-value may produce potential stuck thread
-warnings if the web service is slow to
-respond.</p>
-</div>
-<p class="last">Default: <code class="docutils literal"><span class="pre">5000</span></code></p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">RetryCount</span></code></td>
-<td><p class="first">Sets the number of times to retry
-the request if retrieving the
-authentication document fails for
-any reason.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">0</span></code> (only try once)</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">HTTPHeader</span></code></td>
-<td><p class="first">Sets a header to add to the HTTP
-request. The configuration can
-specify any number of <code class="docutils literal"><span class="pre">HTTPHeader</span></code>
-elements, and the module will
-provide each of the specified
-headers with the authentication
-request.</p>
-<p>There is no default for this option.
-If no <code class="docutils literal"><span class="pre">HTTPHeader</span></code> option is
-included, the module provides a
-standard set of headers.</p>
-<p>This option supports variable
-replacement during an authentication
-request, as described in the following table.</p>
-<p class="last">This option supports expansion of the
-<code class="docutils literal"><span class="pre">AMPS_USER_NAME</span></code>
-(and the <code class="docutils literal"><span class="pre">USER_NAME</span></code>
-backward compatibility form) when the module
-is in <code class="docutils literal"><span class="pre">EntitlementsOnly</span></code> mode.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">EntitlementTimeout</span></code></td>
-<td><p class="first">Optionally, sets the amount of time to consider
-an entitlements document to be valid. After this
-timeout period, if an authentication request
-returns a different entitlements document, the
-module will reset permissions for all connections
-currently connected with the username being
-authenticated (which will disconnect those
-connections and clear the entitlement cache).</p>
-<p>When this option is not provided, the module
-retains permissions until all connections with the
-current user name are disconnected, then removes
-cached permissions in the module and clears the
-AMPS entitlement cache.</p>
-<p>This option is not supported in
-<code class="docutils literal"><span class="pre">EntitlementsOnly</span></code> mode.</p>
-<p>This option accepts a number of milliseconds or
-an AMPS interval.</p>
-<p class="last">The granularity for the <code class="docutils literal"><span class="pre">EntitlementTimeout</span></code> is
-a second. Fractions of a second, or values less
-than one second, may be rounded or truncated.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">ReuseConnections</span></code></td>
-<td><p class="first">Optionally, sets the module to reuse connections
-to the entitlement service when possible. By
-default, the module creates a new connection for
-each entitlement request.</p>
-<p>When set to <code class="docutils literal"><span class="pre">enabled</span></code>, the module will reuse
-HTTP connections when possible.</p>
-<p>This option is only supported within the
-<code class="docutils literal"><span class="pre">Modules</span></code> definition, and is set for all
-uses of the module within the configuration.
-The option will be ignored if it is set within
-the <code class="docutils literal"><span class="pre">Authentication</span></code> or <code class="docutils literal"><span class="pre">Entitlement</span></code>
-blocks.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">disabled</span></code></p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">ServerAcceptsEmptyAuthId</span></code></td>
-<td><p class="first">By default, the module will refuse authentication
-requests that do not contain an auth ID
-without allowing the request to reach the server.
-Instead, the module returns an authentication
-failure to AMPS immediately. This is designed to
-protect the authentication web service from
-requests that cannot succeed.</p>
-<p>In some environments, the web service providing
-authentication will authenticate a user based
-entirely on the authentication token provided as
-the password, and will return the authentication ID
-for AMPS to use in the permissions document.</p>
-<p>When this option is set to <code class="docutils literal"><span class="pre">true</span></code>, the module
-will submit authentication requests to the
-service even when no authentication ID is
-provided on the logon request from the AMPS
-client.</p>
-<p>An authentication ID is still required
-for AMPS to be able to track permissions, so
-when this option is set to <code class="docutils literal"><span class="pre">true</span></code>, the
-authentication service must set the auth ID
-in the permissions document when no auth ID is
-provided in the permissions request. Otherwise,
-the authentication request will fail.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">false</span></code></p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>The following tokens are expanded in the <code class="docutils literal"><span class="pre">HTTPHeader</span></code> element of an
-authentication request:</p>
-<table border="1" class="docutils" id="id13">
-<caption><span class="caption-text"><em>Tokens expanded in HTTPHeader</em></span><a class="headerlink" href="#id13" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Authentication Header Token</th>
-<th class="head">Expansion</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AMPS_CLIENT_NAME</span></code></td>
-<td>Client name provided in the logon request.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">AMPS_CONNECTION_NAME</span></code></td>
-<td>The connection name for the connection
-requesting logon, as assigned by the AMPS
-server (based on the transport name).</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AMPS_CORRELATION_ID</span></code></td>
-<td>The correlation ID provided on the logon
-request.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">AMPS_MESSAGE_TYPE</span></code></td>
-<td>The message type of the logon request.</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AMPS_PASSWORD</span></code></td>
-<td>The password provided with the logon request.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">AMPS_REMOTE_ADDRESS</span></code></td>
-<td>Remote address from which the logon request
-was made.</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AMPS_USER_NAME</span></code></td>
-<td>User name for the request.</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">CORRELATION_ID</span></code></td>
-<td>The correlation ID provided on the logon
-request. <em>legacy compatibility token</em></td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">USER_NAME</span></code></td>
-<td>User name for the request.
-<em>legacy compatibility token</em></td>
-</tr>
-</tbody>
-</table>
-<p>For <code class="docutils literal"><span class="pre">Entitlement</span></code> blocks, the module requires one of the following two
-options. These options are used to specify the entitlements to use for
-the context.</p>
-<table border="1" class="docutils" id="id14">
-<caption><span class="caption-text"><em>Entitlement block options</em></span><a class="headerlink" href="#id14" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">ResourceURI</span></code></td>
-<td><p class="first">Identifier for the credential store
-to use for this entitlement context.
-This is a synonym for the
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> parameter. The
-module accepts this synonym to make
-it easier to verify that the
-<code class="docutils literal"><span class="pre">Entitlement</span></code> context and the
-<code class="docutils literal"><span class="pre">Authentication</span></code> context use the
-same values.</p>
-<p class="last">There is no default for this
-parameter. Either the
-<code class="docutils literal"><span class="pre">ResourceURI</span></code> or
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> must be
-provided. If both are provided, the
-module uses the value of the
-<code class="docutils literal"><span class="pre">CredentialStore</span></code>.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">CredentialStore</span></code></td>
-<td><p class="first">Identifier for the entitlement
-cache. When used for entitlement,
-this is the name of the entitlement
-cache that AMPS uses to look up the
-information.</p>
-<p class="last">There is no default for this
-parameter. Either the
-<code class="docutils literal"><span class="pre">ResourceURI</span></code> or
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> must be
-provided. If both are provided, the
-module uses the value of the
-<code class="docutils literal"><span class="pre">CredentialStore</span></code>.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>For example, the following configuration loads the module and sets
-default values that are used for client transports. The module is also
-used for the admin interface, but that interface uses a separate
-credential store. Notice that, since the <code class="docutils literal"><span class="pre">HTTPHeader</span></code> options are set
-when the module is loaded, the custom headers are provided everywhere
-the module is used, regardless of the <code class="docutils literal"><span class="pre">ResourceURI</span></code> or
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> values.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>web-entitlements<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_http_entitlement.so<span class="nt">&lt;/Library&gt;</span>
-            <span class="c">&lt;!-- Sets defaults for all uses of the module --&gt;</span>
-            <span class="nt">&lt;Options&gt;</span>
-                <span class="nt">&lt;ResourceURI&gt;</span>http://permissions-server:8080/{{USER_NAME}}.json<span class="nt">&lt;/ResourceURI&gt;</span>
-                <span class="nt">&lt;HTTPHeader&gt;</span>x-tracking-id: {{CORRELATION_ID}}<span class="nt">&lt;/HTTPHeader&gt;</span>
-                <span class="nt">&lt;HTTPHeader&gt;</span>x-origin: AMPS<span class="nt">&lt;/HTTPHeader&gt;</span>
-            <span class="nt">&lt;/Options&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-        ...
-    <span class="nt">&lt;/Modules&gt;</span>
-    <span class="c">&lt;!-- Use the web-entitlements module with the default values for all authentication and entitlement</span>
-<span class="c">        unless a transport or the admin interface explicitly sets different values. --&gt;</span>
-    <span class="nt">&lt;Authentication&gt;</span>
-        <span class="nt">&lt;Module&gt;</span>web-entitlements<span class="nt">&lt;/Module&gt;</span>
-    <span class="nt">&lt;/Authentication&gt;</span>
-    <span class="nt">&lt;Entitlement&gt;</span>
-        <span class="nt">&lt;Module&gt;</span>web-entitlements<span class="nt">&lt;/Module&gt;</span>
-    <span class="nt">&lt;/Entitlement&gt;</span>
-    <span class="nt">&lt;Admin&gt;</span>
-        <span class="nt">&lt;InetAddr&gt;</span>localhost:8085<span class="nt">&lt;/InetAddr&gt;</span>
-        <span class="c">&lt;!-- enable Basic authentication; see the Monitoring chapter for other options --&gt;</span>
-        <span class="nt">&lt;WWWAuthenticate&gt;</span>Basic realm=&quot;AMPS Admin&quot;<span class="nt">&lt;/WWWAuthenticate&gt;</span>
-        <span class="c">&lt;!-- Use the web-entitlements module, but set a different URI and credential store for the admin</span>
-<span class="c">            interface. --&gt;</span>
-        <span class="nt">&lt;Authentication&gt;</span>
-            <span class="nt">&lt;Module&gt;</span>web-entitlements<span class="nt">&lt;/Module&gt;</span>
-            <span class="nt">&lt;Options&gt;</span>
-                <span class="nt">&lt;CredentialStore&gt;</span>AdminCreds<span class="nt">&lt;/CredentialStore&gt;</span>
-                <span class="nt">&lt;ResourceURI&gt;</span>http://permissions-server:8080/admin/{{USER_NAME}}.json<span class="nt">&lt;/ResourceURI&gt;</span>
-            <span class="nt">&lt;/Options&gt;</span>
-        <span class="nt">&lt;/Authentication&gt;</span>
-        <span class="nt">&lt;Entitlement&gt;</span>
-            <span class="nt">&lt;Module&gt;</span>web-entitlements<span class="nt">&lt;/Module&gt;</span>
-            <span class="nt">&lt;Options&gt;</span>
-                <span class="nt">&lt;ResourceURI&gt;</span>http://permissions-server:8080/admin/{{USER_NAME}}.json<span class="nt">&lt;/ResourceURI&gt;</span>
-                <span class="nt">&lt;CredentialStore&gt;</span>AdminCreds<span class="nt">&lt;/CredentialStore&gt;</span>
-            <span class="nt">&lt;/Options&gt;</span>
-        <span class="nt">&lt;/Entitlement&gt;</span>
-    <span class="nt">&lt;/Admin&gt;</span>
-    <span class="c">&lt;!-- All of these transports use the Authentication and Entitlement set at the instance level. --&gt;</span>
-    <span class="nt">&lt;Transports&gt;</span>
-        <span class="nt">&lt;Transport&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>json-tcp<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Type&gt;</span>tcp<span class="nt">&lt;/Type&gt;</span>
-            <span class="nt">&lt;InetAddr&gt;</span>9007<span class="nt">&lt;/InetAddr&gt;</span>
-            <span class="nt">&lt;MessageType&gt;</span>json<span class="nt">&lt;/MessageType&gt;</span>
-            <span class="nt">&lt;Protocol&gt;</span>amps<span class="nt">&lt;/Protocol&gt;</span>
-        <span class="nt">&lt;/Transport&gt;</span>
-        <span class="nt">&lt;Transport&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>any-tcp<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Type&gt;</span>tcp<span class="nt">&lt;/Type&gt;</span>
-            <span class="nt">&lt;InetAddr&gt;</span>9090<span class="nt">&lt;/InetAddr&gt;</span>
-            <span class="nt">&lt;Protocol&gt;</span>amps<span class="nt">&lt;/Protocol&gt;</span>
-        <span class="nt">&lt;/Transport&gt;</span>
-    <span class="nt">&lt;/Transports&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-<div class="section" id="using-https-for-authentication-and-entitlement-requests">
-<h4>Using HTTPS for Authentication and Entitlement Requests<a class="headerlink" href="#using-https-for-authentication-and-entitlement-requests" title="Permalink to this headline">¶</a></h4>
-<p>The Web Service Authentication and Entitlement Module optionally
-supports <code class="docutils literal"><span class="pre">https</span></code> entitlement requests. When the <code class="docutils literal"><span class="pre">ResourceURI</span></code> uses <code class="docutils literal"><span class="pre">https</span></code>
-as the scheme, the module will attempt to use <code class="docutils literal"><span class="pre">https</span></code> to connect to the
-web service.</p>
-<p>By default, the module attempts to verify the identity of the remote web
-service, which requires a key file containing the key for the
-certificate authority that signed the certificate for the remote web
-service.</p>
-<p>AMPS does not require that the certificate and key provided for outgoing
-<code class="docutils literal"><span class="pre">https</span></code> requests be the same certificates used for incoming SSL
-connections to AMPS. However, if you have configured AMPS to accept SSL
-connections from AMPS clients, the certificates you use for those
-connections are often suitable for outgoing web authentication module
-connections, and the same certificates can be provided in both sections
-of the configuration file.</p>
-<table border="1" class="docutils" id="id15">
-<caption><span class="caption-text"><em>HTTPS options</em></span><a class="headerlink" href="#id15" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">Certificate</span></code></td>
-<td><p class="first">The certificate to use for the AMPS
-connection to the web service. When
-configured, this certificate can be
-provided to the web service if the
-web service requests client
-authentication for the connection.</p>
-<p class="last">There is no default for this
-parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">Key</span></code></td>
-<td><p class="first">The key file to use for the AMPS
-connection to the web service. When
-configured, this key can be used
-for client authentication if the
-web service requests client
-authentication for the connection.</p>
-<p class="last">There is no default for this
-parameter.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">CAKey</span></code></td>
-<td><p class="first">The certificate authority key. When
-configured, this key can be used
-for the AMPS server to verify the
-identity of the web service.</p>
-<p class="last">There is no default for this
-parameter. The <code class="docutils literal"><span class="pre">CAKey</span></code> must be
-provided when
-<code class="docutils literal"><span class="pre">AllowUnverfiedPeer</span></code> is set to
-<code class="docutils literal"><span class="pre">false</span></code>, the default.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">AllowUnverifiedPeer</span></code></td>
-<td><p class="first">Specifies whether AMPS requires the
-web service to identify itself.
-When this is set to false, the
-default, AMPS requires that the web
-service provides a certificate that
-can be verified with the configured
-<code class="docutils literal"><span class="pre">CAKey</span></code>.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">false</span></code></p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AllowSelfSigned</span></code></td>
-<td><p class="first">Specifies whether AMPS will accept
-self-signed certificates for
-<code class="docutils literal"><span class="pre">https</span></code> connections.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">false</span></code></p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>The following configuration file shows a common way to configure the
-module for testing purposes when working with a server that accepts
-<code class="docutils literal"><span class="pre">https</span></code> connections. While the outgoing connection will use SSL, the
-module will not provide certificates to the server, or request that the
-server verify its identity.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Module&gt;</span>
-    <span class="nt">&lt;Name&gt;</span>web-entitlements<span class="nt">&lt;/Name&gt;</span>
-    <span class="nt">&lt;Library&gt;</span>libamps_http_entitlement.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;Options&gt;</span>
-        <span class="nt">&lt;ResourceURI&gt;</span>https://permissions-server:443/{{USER_NAME}}.json<span class="nt">&lt;/ResourceURI&gt;</span>
-        <span class="nt">&lt;AllowUnverifiedPeer&gt;</span>true<span class="nt">&lt;/AllowUnverifiedPeer&gt;</span>
-        <span class="nt">&lt;AllowSelfSigned&gt;</span>true<span class="nt">&lt;/AllowSelfSigned&gt;</span>
-    <span class="nt">&lt;/Options&gt;</span>
-<span class="nt">&lt;/Module&gt;</span>
-</pre></div>
-</div>
-<p>The following configuration file demonstrates how to configure the
-module to verify the identity of the remote server, provide verification
-of the AMPS server identity to that server, and require that all
-certificates be signed by a certificate authority.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Module&gt;</span>
-    <span class="nt">&lt;Name&gt;</span>web-entitlements<span class="nt">&lt;/Name&gt;</span>
-    <span class="nt">&lt;Library&gt;</span>libamps_http_entitlement.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;Options&gt;</span>
-        <span class="nt">&lt;ResourceURI&gt;</span>https://permissions-server:443/{{USER_NAME}}.json<span class="nt">&lt;/ResourceURI&gt;</span>
-        <span class="nt">&lt;Certificate&gt;</span>/etc/security/amps-cert.pem<span class="nt">&lt;/Certificate&gt;</span>
-        <span class="nt">&lt;Key&gt;</span>/etc/security/amps-key.pem<span class="nt">&lt;/Key&gt;</span>
-        <span class="nt">&lt;CAKey&gt;</span>/etc/security/ca.pem<span class="nt">&lt;/CAKey&gt;</span>
-    <span class="nt">&lt;/Options&gt;</span>
-<span class="nt">&lt;/Module&gt;</span>
-</pre></div>
-</div>
-</div>
-</div>
-<div class="section" id="permissions-management-and-request-flow">
-<h3>Permissions Management and Request Flow<a class="headerlink" href="#permissions-management-and-request-flow" title="Permalink to this headline">¶</a></h3>
-<p>This section describes the request flow for the Web Service
-Authentication and Entitlement Module when used in the default mode.</p>
-<p>Notice that authentication and entitlement are two separate steps. The
-module obtains the set of permissions during the authentication step,
-and then provides responses to AMPS entitlement requests during the
-entitlement step. What this means is that, in the default mode,
-a user must have authenticated using the module for an entitlement request to be allowed.</p>
-<div class="section" id="authentication-step">
-<h4>Authentication Step<a class="headerlink" href="#authentication-step" title="Permalink to this headline">¶</a></h4>
-<ol class="arabic simple">
-<li>Logon request received from the client.</li>
-<li>Module requests an entitlement document (via <code class="docutils literal"><span class="pre">GET</span></code>) from a
-specified Web Service. The credentials in the logon request are
-provided as the credentials for the <code class="docutils literal"><span class="pre">GET</span></code>. The module supports
-both Basic and Digest authentication to the Web Service, as
-described in RFC 7616 (HTTP digest access authentication) and
-RFC 7617 (The &#8216;Basic&#8217; HTTP authentication scheme).</li>
-<li>If AMPS cannot retrieve the entitlement document using the provided
-credentials, AMPS returns a failure for the logon request.</li>
-<li>If the Web Service Authentication and Entitlement module already has
-a parsed entitlement document for this user in the
-<code class="docutils literal"><span class="pre">CredentialStore</span></code> for this request, the module simply returns
-success for the authentication request.</li>
-<li>Otherwise, the module parses the entitlement document and stores the
-entitlements in the <code class="docutils literal"><span class="pre">CredentialStore</span></code>. If the module can&#8217;t
-successfully parse the document, it returns a failure for the
-authentication request.</li>
-</ol>
-</div>
-<div class="section" id="entitlement-step">
-<h4>Entitlement Step<a class="headerlink" href="#entitlement-step" title="Permalink to this headline">¶</a></h4>
-<ol class="arabic simple">
-<li>The module looks up the user name in the <code class="docutils literal"><span class="pre">CredentialStore</span></code> for the
-request. If the module has no stored entitlements for the user, the
-module denies the request.</li>
-<li>The module looks for a matching entitlement. Entitlements for a user
-are searched in exactly the same order in which they appear in the
-document. The module uses the first entitlement that matches the
-request. If no entitlements match, the module denies the request.</li>
-<li>The module checks the entitlement to see if the entitlement grants
-access to the user or disallows access to the user. If the
-entitlement disallows access, the module denies the request.</li>
-<li>The module allows the request and applies any filter specified in the
-matching entitlement.</li>
-</ol>
-</div>
-<div class="section" id="entitlement-reset">
-<h4>Entitlement Reset<a class="headerlink" href="#entitlement-reset" title="Permalink to this headline">¶</a></h4>
-<p>The module caches the set of entitlements for a user while that user is
-connected. As described in the previous section, the module parses
-the returned permissions document if the module does not have an
-existing set of entitlements for that user or if the <code class="docutils literal"><span class="pre">EntitlementTimeout</span></code>
-has expired and the document has changed.</p>
-<p>The module provides two mechanisms for automatically resetting
-the entitlement cache and updating permissions for the user:</p>
-<ol class="arabic">
-<li><p class="first">The module provides &#8220;reset cache on disconnect&#8221; entitlement
-behavior when in authentication and entitlement  mode.  The module resets
-both the AMPS entitlement cache and the information on the parsed permissions
-document for a given user when all of the connections for that user are
-closed.  In practical terms, this means that changing the entitlement
-document returned by the web service has no immediate effect on the
-permission set that AMPS enforces. AMPS will continue to use the permissions
-in the document returned from the first logon request for that user until
-all connections for that user have been closed. When used in authentication
-and entitlement mode, this functionality is always active; when the last
-connection for a given user disconnects, the AMPS entitlement cache and
-the module entitlements are reset.</p>
-<p>Notice that this also means that if AMPS entitlements are reset
-for a user (for example, using the <code class="docutils literal"><span class="pre">amps-action-do-reset-entitlement</span></code>
-action), this will also clear the module cache, since all connections
-for that user will be closed. Likewise, a user can always update
-permissions by completely logging out of AMPS and then logging back
-in.</p>
-</li>
-<li><p class="first">Optionally, the module can set an <code class="docutils literal"><span class="pre">EntitlementTimeout</span></code>. When this is
-set, a change to the user permissions after the timeout period will
-reset any current connections for that user, clear the AMPS entitlement
-cache, and replace existing permissions with the contents of the
-permissions document returned.</p>
-</li>
-</ol>
-<div class="admonition tip">
-<p class="first admonition-title">Tip</p>
-<p class="last">This functionality is not available when
-the module is in <code class="docutils literal"><span class="pre">EntitlementOnly</span></code> mode, as described below. When
-used in <code class="docutils literal"><span class="pre">EntitlementOnly</span></code> mode, the module does not track connection
-or disconnection, so entitlements are cached in the module for the
-lifetime of the instance.</p>
-</div>
-</div>
-<div class="section" id="entitlement-only-mode">
-<h4>Entitlement Only Mode<a class="headerlink" href="#entitlement-only-mode" title="Permalink to this headline">¶</a></h4>
-<p>Starting in AMPS 5.3.1, the HTTP authentication and entitlements module supports
-a mode where another module can be used for authentication, and this module
-can be used for entitlements. To enable this mode, include the following
-configuration item in the <code class="docutils literal"><span class="pre">Modules</span></code> block that loads the module:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Options&gt;</span>
-  <span class="c">&lt;!-- other options here --&gt;</span>
-  <span class="nt">&lt;EntitlementOnly/&gt;</span>
-<span class="nt">&lt;/Options&gt;</span>
-</pre></div>
-</div>
-<p>When an <code class="docutils literal"><span class="pre">EntitlementOnly</span></code> element is provided, the module cannot be used
-to authenticate users. Instead, the module makes an <em>unauthenticated</em> HTTP
-request the first time that permissions are requested for a given user ID.
-The permissions document returned is cached, and used for subsequent requests.</p>
-<p>When using the module in this mode, the module may not be used in an
-<code class="docutils literal"><span class="pre">Authentication</span></code> block. The module configuration or <code class="docutils literal"><span class="pre">Entitlement</span></code> block
-configuration must provide a <code class="docutils literal"><span class="pre">ResourceURI</span></code>, and may provide the other
-options normally accepted in the <code class="docutils literal"><span class="pre">Authentication</span></code> block (for example,
-<code class="docutils literal"><span class="pre">HTTPHeader</span></code>, <code class="docutils literal"><span class="pre">RetryCount</span></code>, and so on).</p>
-<p>In this mode, the module does not see connect and logon requests. Therefore,
-the module does not provide automatic entitlement cache reset in this mode
-and the module caches the permissions for a given user in a given
-credential store for the lifetime of the instance.</p>
-</div>
-<div class="section" id="entitlement-only-request-flow">
-<h4>Entitlement Only Request Flow<a class="headerlink" href="#entitlement-only-request-flow" title="Permalink to this headline">¶</a></h4>
-<p>This section describes the request flow when the module is operating
-in entitlement only mode. This is very similar to the flow in the
-default mode, except that all of the processing happens as a part of
-the first entitlement request for a given user ID, and no credential
-information is available for the request to the HTTP server.</p>
-<ol class="arabic simple">
-<li>Entitlement request is received from AMPS.</li>
-<li>The module looks up the user name in the <code class="docutils literal"><span class="pre">CredentialStore</span></code> for the
-request. If the module has stored entitlements for the user, the
-module proceeds to step 6.</li>
-<li>Module requests an entitlement document (via <code class="docutils literal"><span class="pre">GET</span></code>) from a
-specified Web Service. No credentials are provided on this request.</li>
-<li>If the module cannot retrieve the entitlement document, the module returns
-a failure for the entitlement request.</li>
-<li>The module parses the returned permissions document. If an error occurs while
-parsing the permissions document, the module returns a failure for the
-entitlement request. Otherwise, the module loads the parsed permissions
-into the <code class="docutils literal"><span class="pre">CredentialStore</span></code>.</li>
-<li>The module uses the <code class="docutils literal"><span class="pre">CredentialStore</span></code> to look for a matching entitlement.
-Entitlements for a user are searched in exactly the same order in which they
-appear in the document. The module uses the first entitlement that matches
-the request. If no entitlements match, the module denies the request.</li>
-<li>The module checks the entitlement to see if the entitlement grants
-access to the user or disallows access to the user. If the
-entitlement disallows access, the module denies the request.</li>
-<li>If the module allows the request, any filters specified in the matching
-entitlement are applied.</li>
-</ol>
-</div>
-</div>
-</div>
-<div class="section" id="authentication-with-the-amps-multimechanism-authentication-module">
-<span id="ug-multimechanism-authentication"></span><span id="ug-multi-authentication"></span><h2>Authentication with the AMPS Multimechanism Authentication Module<a class="headerlink" href="#authentication-with-the-amps-multimechanism-authentication-module" title="Permalink to this headline">¶</a></h2>
-<p>AMPS includes a module that supports the commonly used infrastructure
-for enterprise authentication. In this release, the module includes
-support for LDAP or Kerberos authentication.</p>
-<p>In this release, the multimechanism authentication module is provided with AMPS,
-but is not loaded by default. This module is an optional extension to
-the AMPS product, and while it is included with the AMPS distribution,
-the module must be explicitly loaded, enabled, and configured.</p>
-<p>This module provides authentication, but does not provide an entitlement
-mechanism. When planning a strategy for securing AMPS using this module,
-you will also need to plan a strategy to manage entitlements.</p>
-<div class="section" id="when-to-use-the-multimechanism-authentication-module">
-<h3>When to Use the Multimechanism Authentication Module<a class="headerlink" href="#when-to-use-the-multimechanism-authentication-module" title="Permalink to this headline">¶</a></h3>
-<p>60East recommends using this module when integrating AMPS authentication
-into an existing infrastructure. If your environment does not have an
-existing infrastructure that offers one of the authentication methods
-supported by this module, it is typically easier to use the HTTP
-authentication and entitlement module than it is to implement or deploy
-a new authentication system.</p>
-<p>The AMPS Multimechanism authentication module can be a good option when:</p>
-<ul class="simple">
-<li>The site has an existing authentication infrastructure for users
-that need to be authenticated to AMPS, and that infrastructure supports
-authentication using:<ul>
-<li>Kerberos, <em>or</em></li>
-<li>LDAP</li>
-</ul>
-</li>
-<li>The authentication infrastructure is relatively stable and well-supported,
-with support for adding AMPS to the set of applications that use
-this infrastructure</li>
-</ul>
-</div>
-<div class="section" id="setting-authentication-mechanisms">
-<h3>Setting Authentication Mechanisms<a class="headerlink" href="#setting-authentication-mechanisms" title="Permalink to this headline">¶</a></h3>
-<p>To enable a particular authentication mechanism in the
-multimechanism authentication module, you simply provide
-configuration parameters for that mechanism.</p>
-<p>For example, if you provide configuration parameters for an
-LDAP server, the module will enable LDAP. If you provide
-configuration parameters for Kerberos, the module will enable
-Kerberos.</p>
-<p>When more than one authentication mechanism is enabled, the
-module will attempt to detect the authentication mechanism used
-for a given logon request based on the credentials provided. If
-the module cannot determine the mechanism to use for a given request,
-and there is more than one mechanism configured,
-the module defaults to the mechanism specified in the
-<code class="docutils literal"><span class="pre">DefaultAuthenticationMechanism</span></code> in the module options.</p>
-<p>Notice, however, that the module does not allow a mechanism that
-accepts arbitrary passwords (in this release, LDAP) to be configured
-with a mechanism that accepts passwords of a specific format (in this
-release, Kerberos). In this release, the practical result is that a
-given module can be configured to use Kerberos <em>or</em> LDAP for authentication,
-but cannot be configured to use both.</p>
-</div>
-<div class="section" id="configuring-amps-to-use-the-multimechanism-authentication-module">
-<h3>Configuring AMPS to use the Multimechanism Authentication Module<a class="headerlink" href="#configuring-amps-to-use-the-multimechanism-authentication-module" title="Permalink to this headline">¶</a></h3>
-<p>The multimechanism authentication module is included in the AMPS
-distribution, but is not loaded in AMPS by default. To load the
-module, add the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code> block
-in your AMPS configuration:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Module&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>multimech-authentication<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;Library&gt;</span>libamps_multi_authentication.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;/Module&gt;</span>
-    ...
-<span class="nt">&lt;/Modules&gt;</span>
-</pre></div>
-</div>
-<p>This module does not require any options as part of the module configuration
-and ignores any options provided when the module is loaded.</p>
-<p>This module supports the following options when used in an <code class="docutils literal"><span class="pre">Authentication</span></code>
-block:</p>
-<p><strong>Kerberos Options</strong></p>
-<table border="1" class="docutils" id="id16">
-<caption><span class="caption-text"><em>Kerberos options for Multimechanism Authentication</em></span><a class="headerlink" href="#id16" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">Kerberos.Keytab</span></code></td>
-<td><p class="first">Sets a keytab file to use for Kerberos authentication.
-This option must be set to the path of the file, which
-can be either an absolute path or a relative path
-based on the current working directory of the AMPS
-server process.</p>
-<p>When this option is specified, the module will provide
-Kerberos authentication and a <code class="docutils literal"><span class="pre">Kerberos.SPN</span></code> must
-be specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">Kerberos.SPN</span></code></td>
-<td><p class="first">Sets the Service Principal Name (SPN) to use for
-Kerberos authentication.</p>
-<p>When this option is specified, the module will provide
-Kerberos authentication and a <code class="docutils literal"><span class="pre">Kerberos.Keytab</span></code> must
-be specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p><strong>LDAP Options</strong></p>
-<table border="1" class="docutils" id="id17">
-<caption><span class="caption-text"><em>LDAP options for Multimechanism Authentication</em></span><a class="headerlink" href="#id17" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">LDAP.Host</span></code></td>
-<td><p class="first">Sets the host name to use for LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication. This parameter is
-required if any other <code class="docutils literal"><span class="pre">LDAP</span></code> parameter is specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">LDAP.Port</span></code></td>
-<td><p class="first">Sets the port number to use for LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication and an <code class="docutils literal"><span class="pre">LDAP.Host</span></code>
-must also be specified.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">389</span></code></p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">LDAP.ProtocolVersion</span></code></td>
-<td><p class="first">Sets the version of the LDAP protocol to use.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication and an <code class="docutils literal"><span class="pre">LDAP.Host</span></code>
-must also be specified.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">2</span></code></p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">LDAP.BaseDN</span></code></td>
-<td><p class="first">Sets the base Distinguished Name (DN) to use for
-LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication and an <code class="docutils literal"><span class="pre">LDAP.Host</span></code>
-must also be specified.</p>
-<p class="last">This parameter defaults to an empty string.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">LDAP.ServiceAccountDN</span></code></td>
-<td><p class="first">Sets the Distinguished Name (DN) for the service
-account to use for LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication and an <code class="docutils literal"><span class="pre">LDAP.Host</span></code>
-must also be specified.</p>
-<p class="last">This parameter defaults to an empty string.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">LDAP.ServiceAccountPasswordFile</span></code></td>
-<td><p class="first">Sets a file from which to read the password for the
-service account to use for LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication and an <code class="docutils literal"><span class="pre">LDAP.Host</span></code>
-must also be specified.</p>
-<p class="last">This parameter defaults to an empty string, which
-specifies that no password will be provided.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p><strong>General Options</strong></p>
-<table border="1" class="docutils" id="id18">
-<caption><span class="caption-text"><em>General policy options for Multimechanism Authentication</em></span><a class="headerlink" href="#id18" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AllowAnonymous</span></code></td>
-<td><p class="first">When set to <code class="docutils literal"><span class="pre">enabled</span></code>, allows users to logon
-without providing a password. In this case, however,
-the authenticated username will be set to an empty
-string.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">disabled</span></code></p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">DefaultAuthenticationMechanism</span></code></td>
-<td><p class="first">When provided, sets the authentication mechanism to
-use if AMPS cannot identify the type of authentication
-token provided by the connection.</p>
-<p>In this release, the value for this parameter can be
-either <code class="docutils literal"><span class="pre">Kerberos</span></code> or <code class="docutils literal"><span class="pre">LDAP</span></code>.</p>
-<p class="last">There is no default for this option. If no
-<code class="docutils literal"><span class="pre">DefaultAuthenticationMechanism</span></code> is configured and
-AMPS cannot identify the type of authentication token
-provided by a connection, AMPS reports an error for
-that logon.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>The module must be configured with at least one authentication method. Otherwise, the module fails to initialize and AMPS will halt the startup process.</p>
-<p>For example, the following configuration loads the module and configures
-the module to use LDAP authentication by contacting the server
-<code class="docutils literal"><span class="pre">myenterprise-auth-server</span></code> on port <code class="docutils literal"><span class="pre">9389</span></code>. In this case, the
-LDAP server does not require authentication. Otherwise, the
-configuration would provide the service account DN and
-password for the server.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>multi-auth<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_multi_authentication.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-        ...
-    <span class="nt">&lt;/Modules&gt;</span>
-    <span class="nt">&lt;Authentication&gt;</span>
-        <span class="nt">&lt;Module&gt;</span>multi-auth<span class="nt">&lt;/Module&gt;</span>
-        <span class="nt">&lt;Options&gt;</span>
-           <span class="nt">&lt;LDAP.Host&gt;</span>myenterprise-auth-server<span class="nt">&lt;/LDAP.Host&gt;</span>
-           <span class="nt">&lt;LDAP.Port&gt;</span>9389<span class="nt">&lt;/LDAP.Port&gt;</span>
-        <span class="nt">&lt;/Options&gt;</span>
-    <span class="nt">&lt;/Authentication&gt;</span>
-    <span class="c">&lt;!-- The Admin module uses the LDAP server configured above for</span>
-<span class="c">         authentication. --&gt;</span>
-    <span class="nt">&lt;Admin&gt;</span>
-        <span class="nt">&lt;InetAddr&gt;</span>localhost:8085<span class="nt">&lt;/InetAddr&gt;</span>
-    <span class="nt">&lt;/Admin&gt;</span>
-    <span class="c">&lt;!-- Both of these transports use the LDAP server configured above</span>
-<span class="c">         for authentication. --&gt;</span>
-    <span class="nt">&lt;Transports&gt;</span>
-        <span class="nt">&lt;Transport&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>json-tcp<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Type&gt;</span>tcp<span class="nt">&lt;/Type&gt;</span>
-            <span class="nt">&lt;InetAddr&gt;</span>9007<span class="nt">&lt;/InetAddr&gt;</span>
-            <span class="nt">&lt;MessageType&gt;</span>json<span class="nt">&lt;/MessageType&gt;</span>
-            <span class="nt">&lt;Protocol&gt;</span>amps<span class="nt">&lt;/Protocol&gt;</span>
-        <span class="nt">&lt;/Transport&gt;</span>
-        <span class="nt">&lt;Transport&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>any-tcp<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Type&gt;</span>tcp<span class="nt">&lt;/Type&gt;</span>
-            <span class="nt">&lt;InetAddr&gt;</span>9090<span class="nt">&lt;/InetAddr&gt;</span>
-            <span class="nt">&lt;Protocol&gt;</span>amps<span class="nt">&lt;/Protocol&gt;</span>
-        <span class="nt">&lt;/Transport&gt;</span>
-    <span class="nt">&lt;/Transports&gt;</span>
- <span class="c">&lt;!-- other configuration here --&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-<p>The configuration below loads the module and configures the module
-to use Kerberos for clients that provide a Kerberos token on logon.
-For Kerberos, AMPS will use the SPN <cite>AMPS/host.domain.com</cite> and the
-keytab file at <cite>/path/to/amps.keytab</cite>.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>multi-auth<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_multi_authentication.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-        ...
-    <span class="nt">&lt;/Modules&gt;</span>
-    <span class="nt">&lt;Authentication&gt;</span>
-        <span class="nt">&lt;Module&gt;</span>multi-auth<span class="nt">&lt;/Module&gt;</span>
-        <span class="nt">&lt;Options&gt;</span>
-            <span class="nt">&lt;Kerberos.SPN&gt;</span>AMPS/host.domain.com<span class="nt">&lt;/Kerberos.SPN&gt;</span>
-            <span class="nt">&lt;Kerberos.Keytab&gt;</span>/path/to/amps.keytab<span class="nt">&lt;/Kerberos.Keytab&gt;</span>
-       <span class="nt">&lt;/Options&gt;</span>
-    <span class="nt">&lt;/Authentication&gt;</span>
-    <span class="c">&lt;!-- The Admin module uses the Kerberos configuration</span>
-<span class="c">         above for authentication. --&gt;</span>
-    <span class="nt">&lt;Admin&gt;</span>
-        <span class="nt">&lt;InetAddr&gt;</span>localhost:8085<span class="nt">&lt;/InetAddr&gt;</span>
-    <span class="nt">&lt;/Admin&gt;</span>
-    <span class="c">&lt;!-- Both of these transports use the Kerberos</span>
-<span class="c">         configuration above for authentication. --&gt;</span>
-    <span class="nt">&lt;Transports&gt;</span>
-        <span class="nt">&lt;Transport&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>json-tcp<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Type&gt;</span>tcp<span class="nt">&lt;/Type&gt;</span>
-            <span class="nt">&lt;InetAddr&gt;</span>9007<span class="nt">&lt;/InetAddr&gt;</span>
-            <span class="nt">&lt;MessageType&gt;</span>json<span class="nt">&lt;/MessageType&gt;</span>
-            <span class="nt">&lt;Protocol&gt;</span>amps<span class="nt">&lt;/Protocol&gt;</span>
-        <span class="nt">&lt;/Transport&gt;</span>
-        <span class="nt">&lt;Transport&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>any-tcp<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Type&gt;</span>tcp<span class="nt">&lt;/Type&gt;</span>
-            <span class="nt">&lt;InetAddr&gt;</span>9090<span class="nt">&lt;/InetAddr&gt;</span>
-            <span class="nt">&lt;Protocol&gt;</span>amps<span class="nt">&lt;/Protocol&gt;</span>
-        <span class="nt">&lt;/Transport&gt;</span>
-    <span class="nt">&lt;/Transports&gt;</span>
- <span class="c">&lt;!-- other configuration here --&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-</div>
-</div>
-<div class="section" id="entitlement-with-the-simple-access-module">
-<span id="ug-simple-access"></span><h2>Entitlement with the Simple Access Module<a class="headerlink" href="#entitlement-with-the-simple-access-module" title="Permalink to this headline">¶</a></h2>
-<p>The AMPS distribution includes a module that provides access to
-resources that meet specific patterns. In this release, the simple
-access entitlement module is provided with AMPS, but is not loaded by
-default. This module is an optional extension to the AMPS product, and
-while it is included with the AMPS distribution, the module must be
-explicitly loaded, enabled, and configured.</p>
-<p>When using this module, AMPS grants and denies permissions to resources
-based on the name of the resource. The name of the user is not
-considered by this module, so when this module is used every user has
-the same set of permissions for the transport.</p>
-<div class="section" id="when-to-use-the-simple-access-module">
-<h3>When to Use the Simple Access Module<a class="headerlink" href="#when-to-use-the-simple-access-module" title="Permalink to this headline">¶</a></h3>
-<p>The AMPS Simple Access module can be a good option when:</p>
-<ul class="simple">
-<li>There are specific topics for a transport that are allowed or denied,
-but no other restrictions on the transport.</li>
-<li>There is no other entitlement system in use for the installation.</li>
-</ul>
-<p>Most often, the simple access module is used to allow access to the
-parts of the Admin console that do not modify the state of an AMPS
-instance, while refusing access to the parts of the Admin console that
-affect the instance state.</p>
-</div>
-<div class="section" id="configuring-amps-to-use-the-simple-access-module">
-<h3>Configuring AMPS to use the Simple Access Module<a class="headerlink" href="#configuring-amps-to-use-the-simple-access-module" title="Permalink to this headline">¶</a></h3>
-<p>The simple access entitlement module is included in the AMPS
-distribution, but is not loaded in AMPS by default. To load the module,
-add the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code> block in your AMPS
-configuration:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Module&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>simple-access<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;Library&gt;</span>libamps_simple_access_entitlement.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="c">&lt;!-- This module does not require options when loaded. --&gt;</span>
-    <span class="nt">&lt;/Module&gt;</span>
-    ...
-<span class="nt">&lt;/Modules&gt;</span>
-</pre></div>
-</div>
-<p>Options for the module are set when the module is used for <code class="docutils literal"><span class="pre">Entitlement</span></code>.
-When used in an <code class="docutils literal"><span class="pre">Entitlement</span></code> block, the module requires the <code class="docutils literal"><span class="pre">AllowedTopics</span></code>
-and/or <code class="docutils literal"><span class="pre">DeniedTopics</span></code> options to be specified.</p>
-<table border="1" class="docutils" id="id19">
-<caption><span class="caption-text"><em>Entitlement block options for Simple Access Entitlement Module</em></span><a class="headerlink" href="#id19" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">AllowedTopics</span></code></td>
-<td><p class="first">A regular expression that matches
-the topics that the module will
-allow access to. The module will
-grant access only to topics that
-match this regular expression and
-do not match the <code class="docutils literal"><span class="pre">DeniedTopics</span></code>
-regular expression.</p>
-<p class="last">Defaults to <code class="docutils literal"><span class="pre">.*</span></code>, matching all
-topics in the instance.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">DeniedTopics</span></code></td>
-<td><p class="first">A regular expression that matches
-the topics that the module will deny
-access to. The module will grant
-access only to topics that do not
-match this regular expression.</p>
-<p class="last">There is no default for this
-parameter. If not provided, the
-module does not consider any topics
-to be explicitly denied and will
-grant access to any topic that
-matches the <code class="docutils literal"><span class="pre">AllowedTopics</span></code>
-parameter.</p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">GrantedPermissions</span></code></td>
-<td><p class="first">When set, this option directs the
-module to grant only read or write
-permissions when a topic is allowed.</p>
-<p>This option accepts a value of
-<code class="docutils literal"><span class="pre">read</span></code> or <code class="docutils literal"><span class="pre">write</span></code>, specifying
-which permission the module will
-grant.</p>
-<p>There is no default for this
-parameter. If not provided, the
-module will grant both read and
-write permissions to any allowed
-topic.</p>
-<div class="last admonition tip">
-<p class="first admonition-title">Tip</p>
-<p class="last">When using this option for
-the <code class="docutils literal"><span class="pre">Admin</span></code> transport, notice
-that the <code class="docutils literal"><span class="pre">administrator</span></code>
-actions use an HTTP <code class="docutils literal"><span class="pre">GET</span></code>,
-so they are considered read
-operations.</p>
-</div>
-</td>
-</tr>
-</tbody>
-</table>
-<p>For example, the following configuration loads the module, uses the
-module for entitlements on the administrative console, and explicitly
-refuses access to paths beneath <code class="docutils literal"><span class="pre">/amps/administrator</span></code> &#8211; the paths
-that might modify the state of the instance. Since <code class="docutils literal"><span class="pre">AllowedTopics</span></code>
-defaults to <code class="docutils literal"><span class="pre">.*</span></code>, all other topics are allowed.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>simple-access<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_simple_access_entitlement.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-        ...
-    <span class="nt">&lt;/Modules&gt;</span>
-    <span class="nt">&lt;Admin&gt;</span>
-        <span class="nt">&lt;InetAddr&gt;</span>localhost:8085<span class="nt">&lt;/InetAddr&gt;</span>
-        <span class="c">&lt;!-- Use the simple-access module to deny access to topics under</span>
-<span class="c">            /amps/administrator. --&gt;</span>
-        <span class="nt">&lt;Entitlement&gt;</span>
-            <span class="nt">&lt;Module&gt;</span>simple-access<span class="nt">&lt;/Module&gt;</span>
-            <span class="nt">&lt;Options&gt;</span>
-                <span class="c">&lt;!-- Deny all topics under /amps/administrator --&gt;</span>
-                <span class="nt">&lt;DeniedTopics&gt;</span>^/amps/administrator<span class="nt">&lt;/DeniedTopics&gt;</span>
-                <span class="c">&lt;!-- Allowed topics defaults to .* , so no need</span>
-<span class="c">                    to set that explicitly. --&gt;</span>
-            <span class="nt">&lt;/Options&gt;</span>
-        <span class="nt">&lt;/Entitlement&gt;</span>
-    <span class="nt">&lt;/Admin&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-</div>
-</div>
-<div class="section" id="providing-replication-credentials-with-the-amps-multimechanism-authenticator-module">
-<span id="ug-multimechanism-authenticator"></span><span id="ug-multi-authenticator"></span><h2>Providing Replication Credentials with the AMPS Multimechanism Authenticator Module<a class="headerlink" href="#providing-replication-credentials-with-the-amps-multimechanism-authenticator-module" title="Permalink to this headline">¶</a></h2>
-<p>AMPS includes a module that can provide credentials for outgoing replication
-connections, that is designed for use when the multimechanism authenticator module
-is in use for the destination AMPS instance.</p>
-<p>In this release, this module can provide credentials for both LDAP and
-Kerberos authenticator mechanisms. This module is provided with AMPS,
-but it is not loaded by default. This module is an optional extension to
-the AMPS product and while it is included with the AMPS distribution,
-the module must be explicitly loaded, enabled, and configured.</p>
-<div class="section" id="when-to-use-the-multimechanism-authenticator-module">
-<h3>When to Use the Multimechanism Authenticator Module<a class="headerlink" href="#when-to-use-the-multimechanism-authenticator-module" title="Permalink to this headline">¶</a></h3>
-<p>60East recommends using this module when a replication connection is
-authenticated and uses the AMPS multimechanism module with Kerberos
-configured. This module can also be useful when LDAP is configured,
-however, in many environments the password capabilities of the
-<code class="docutils literal"><span class="pre">amps-default-authenticator</span></code> module can be sufficient for LDAP
-authentication.</p>
-</div>
-<div class="section" id="id2">
-<h3>Setting Authentication Mechanisms<a class="headerlink" href="#id2" title="Permalink to this headline">¶</a></h3>
-<p>To enable a particular authentication mechanism in the
-multimechanism authenticator module, you simply provide
-configuration parameters for that mechanism.</p>
-<p>For example, if you provide configuration parameters for an
-LDAP server, the module will enable LDAP. If you provide
-configuration parameters for Kerberos, the module will enable
-Kerberos.</p>
-</div>
-<div class="section" id="configuring-amps-to-use-the-multimechanism-authenticator-module">
-<h3>Configuring AMPS to use the Multimechanism Authenticator Module<a class="headerlink" href="#configuring-amps-to-use-the-multimechanism-authenticator-module" title="Permalink to this headline">¶</a></h3>
-<p>The multimechanism authenticator module is included in the AMPS
-distribution, but is not loaded in AMPS by default. To load the
-module, add the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code>
-block in your AMPS configuration:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Module&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>multimech-authenticator<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;Library&gt;</span>libamps_multi_authenticator.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;/Module&gt;</span>
-    ...
-<span class="nt">&lt;/Modules&gt;</span>
-</pre></div>
-</div>
-<p>This module does not require any options as a part of the module configuration
-and ignores any options provided when the module is loaded.</p>
-<p>This module supports the following options when used in an <code class="docutils literal"><span class="pre">Authenticator</span></code>
-block:</p>
-<p><strong>Kerberos Options</strong></p>
-<table border="1" class="docutils">
-<colgroup>
-<col width="40%" />
-<col width="60%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">Kerberos.Keytab</span></code></td>
-<td><p class="first">Sets a keytab file to use for Kerberos authentication.
-This option must be set to the path of the file, which
-can be either an absolute path or a relative path
-based on the current working directory of the AMPS
-server process.</p>
-<p>When this option is specified, the module will provide
-Kerberos authentication and a <code class="docutils literal"><span class="pre">Kerberos.SPN</span></code> must
-be specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">Kerberos.SPN</span></code></td>
-<td><p class="first">Sets the Service Principal Name (SPN) to use for
-Kerberos authentication.</p>
-<p>When this option is specified, the module will provide
-Kerberos authentication and a <code class="docutils literal"><span class="pre">Kerberos.Keytab</span></code> must
-be specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p><em>Kerberos options for the Multimechanism Authenticator</em></p>
-<p><strong>LDAP Options</strong></p>
-<table border="1" class="docutils">
-<colgroup>
-<col width="40%" />
-<col width="60%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">LDAP.Username</span></code></td>
-<td><p class="first">Sets the username to provide when authenticating to
-a destination that uses LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication. This parameter is
-required if the <code class="docutils literal"><span class="pre">LDAP.PasswordFile</span></code> parameter is
-specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">LDAP.PasswordFile</span></code></td>
-<td><p class="first">Specifies the file name from which to read the
-password to provide when authenticating to a
-destination that uses LDAP authentication.</p>
-<p>When this option is specified, the module will
-provide LDAP authentication and an <code class="docutils literal"><span class="pre">LDAP.Username</span></code>
-must also be specified.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p><em>LDAP options for the Multimechanism Authenticator</em></p>
-<p>The module must be configured with at least one method for providing credentials. Otherwise, the module fails to initialize and AMPS will halt the startup process.</p>
-<p>For example, the following configuration loads the module and configures
-the module to provide Kerberos tokens to the destination at <code class="docutils literal"><span class="pre">my-failover-partner:4000</span></code>.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>multi-authenticator<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_multi_authenticator.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-        ...
-    <span class="nt">&lt;/Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Replication&gt;</span>
-        ...
-        <span class="nt">&lt;Destination&gt;</span>
-            <span class="nt">&lt;Transport&gt;</span>
-              <span class="nt">&lt;Type&gt;</span>amps-replication<span class="nt">&lt;/Type&gt;</span>
-              <span class="nt">&lt;InetAddr&gt;</span>my-failover-partner:4000<span class="nt">&lt;/InetAddr&gt;</span>
-              <span class="nt">&lt;Authenticator&gt;</span>
-                   <span class="nt">&lt;Module&gt;</span>multi-authenticator<span class="nt">&lt;/Module&gt;</span>
-                   <span class="nt">&lt;Options&gt;</span>
-                         <span class="nt">&lt;Kerberos.SPN&gt;</span>AMPS/host.domain.com<span class="nt">&lt;/Kerberos.SPN&gt;</span>
-                         <span class="nt">&lt;Kerberos.Keytab&gt;</span>/path/to/amps.keytab<span class="nt">&lt;/Kerberos.Keytab&gt;</span>
-                   <span class="nt">&lt;/Options&gt;</span>
-              <span class="nt">&lt;/Authenticator&gt;</span>
-            <span class="nt">&lt;/Transport&gt;</span>
-        <span class="nt">&lt;/Destination&gt;</span>
-     <span class="nt">&lt;/Replication&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-</div>
-</div>
-<div class="section" id="providing-replication-credentials-with-the-amps-exec-authenticator-module">
-<span id="ug-exec-authenticator-using"></span><span id="ug-exec-authenticator"></span><h2>Providing Replication Credentials with the AMPS Exec Authenticator Module<a class="headerlink" href="#providing-replication-credentials-with-the-amps-exec-authenticator-module" title="Permalink to this headline">¶</a></h2>
-<p>AMPS includes a module that can provide credentials for outgoing replication
-connections using the results of an external process. This is designed
-for cases where a site has an authentication system that requires
-short-lived tokens, and where the installation does not use
-Kerberos, so the multimechanism authentication module cannot be used.</p>
-<p>In this release, the exec authenticator module is provided with AMPS,
-but is not loaded by default. This module is an optional extension to
-the AMPS product, and while it is included with the AMPS distribution,
-the module must be explicitly loaded, enabled, and configured.</p>
-<div class="admonition tip">
-<p class="first admonition-title">Tip</p>
-<p class="last">This module runs an external application with the
-credentials of the AMPS server itself. Avoid using
-this module unless you fully trust the application,
-have verified that the command line provided is
-correct and cannot use another module (or a
-custom module) for authentication.</p>
-</div>
-<div class="section" id="when-to-use-the-exec-authenticator-module">
-<h3>When to Use the Exec Authenticator Module<a class="headerlink" href="#when-to-use-the-exec-authenticator-module" title="Permalink to this headline">¶</a></h3>
-<p>60East recommends using this module when a replication connection is
-authenticated, when a system other than Kerberos is in use,
-when the credentials to be used cannot be provided in the
-configuration file or stored in the filesystem and when
-an executable program or script is available that can
-produce the credentials to use for a replication connection.</p>
-<ul class="simple">
-<li>If the credentials can be provided in the configuration file
-or stored in a file in the file system, use the
-<code class="docutils literal"><span class="pre">amps-default-authenticator-module</span></code>.</li>
-<li>If Kerberos is in use, use the <a class="reference internal" href="#ug-multi-authenticator"><span class="std std-ref">AMPS Multimechanism Authenticator Module</span></a>.</li>
-</ul>
-</div>
-<div class="section" id="configuring-amps-to-use-the-exec-authenticator-module">
-<h3>Configuring AMPS to use the Exec Authenticator Module<a class="headerlink" href="#configuring-amps-to-use-the-exec-authenticator-module" title="Permalink to this headline">¶</a></h3>
-<p>The exec authenticator module is included in the AMPS
-distribution, but is not loaded in AMPS by default. To load the
-module, add the following configuration item to the <code class="docutils literal"><span class="pre">Modules</span></code>
-block in your AMPS configuration:</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Module&gt;</span>
-        <span class="nt">&lt;Name&gt;</span>exec-authenticator<span class="nt">&lt;/Name&gt;</span>
-        <span class="nt">&lt;Library&gt;</span>libamps_exec_authenticator.so<span class="nt">&lt;/Library&gt;</span>
-    <span class="nt">&lt;/Module&gt;</span>
-    ...
-<span class="nt">&lt;/Modules&gt;</span>
-</pre></div>
-</div>
-<p>This module does not require any options as a part of the module configuration
-and ignores any options provided when the module is loaded.</p>
-<p>This module supports the following options when used in an <code class="docutils literal"><span class="pre">Authenticator</span></code>
-block:</p>
-<table border="1" class="docutils" id="id20">
-<caption><span class="caption-text"><em>Options for the Exec Authenticator</em></span><a class="headerlink" href="#id20" title="Permalink to this table">¶</a></caption>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead valign="bottom">
-<tr class="row-odd"><th class="head">Option</th>
-<th class="head">Description</th>
-</tr>
-</thead>
-<tbody valign="top">
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">Command</span></code></td>
-<td><p class="first">Sets the command to run.</p>
-<p>This can be either an absolute path or a relative
-path based on the current working directory of the
-AMPS server process.</p>
-<p>The command supports the following expansions
-when the command runs:</p>
-<ul>
-<li><p class="first"><code class="docutils literal"><span class="pre">AMPS_USER_NAME</span></code> The user name that the
-authenticator will provide to the remote server.</p>
-<p>For example, the following <code class="docutils literal"><span class="pre">Command</span></code> runs the
-script <code class="docutils literal"><span class="pre">give_me_a_token.sh</span></code> from the path
-<code class="docutils literal"><span class="pre">/opt/site/gateways/</span></code>, passing the user name
-as a parameter:</p>
-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="o">&lt;</span><span class="n">Command</span><span class="o">&gt;/</span><span class="n">opt</span><span class="o">/</span><span class="n">site</span><span class="o">/</span><span class="n">gateways</span><span class="o">/</span><span class="n">give_me_a_token</span><span class="o">.</span><span class="n">sh</span>
-<span class="s2">&quot;{{AMPS_USER_NAME}}&quot;</span><span class="o">&lt;/</span><span class="n">Command</span><span class="o">&gt;</span>
-</pre></div>
-</div>
-</li>
-</ul>
-<p>The authenticator will read the stdout of that
-command and provide the result as the authentication
-token for the connection.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-<tr class="row-odd"><td><code class="docutils literal"><span class="pre">MaxLength</span></code></td>
-<td><p class="first">Sets the maximum number of bytes to read from the
-command.</p>
-<p class="last">Default: <code class="docutils literal"><span class="pre">1024</span></code></p>
-</td>
-</tr>
-<tr class="row-even"><td><code class="docutils literal"><span class="pre">UserName</span></code></td>
-<td><p class="first">Sets the user name to provide on this connection.</p>
-<p class="last">There is no default for this parameter.</p>
-</td>
-</tr>
-</tbody>
-</table>
-<p>The module must be configured with a <code class="docutils literal"><span class="pre">Command</span></code> and <code class="docutils literal"><span class="pre">UserName</span></code>. Otherwise,
-the module fails to initialize and AMPS will halt the startup process.</p>
-<p>For example, the following configuration loads and configures the module to
-run the <code class="docutils literal"><span class="pre">auth-widget</span></code> program, in the current working directory of the AMPS process,
-in order to provide credentials. The UserName provided to AMPS, as well as on the
-command line for <code class="docutils literal"><span class="pre">auth-widget</span></code>, is sourced from the <code class="docutils literal"><span class="pre">USER</span></code> environment variable used
-during AMPS startup. The options provided on the <code class="docutils literal"><span class="pre">auth-widget</span></code> command line are needed
-for the program to generate the token and write it to standard output.</p>
-<div class="highlight-xml"><div class="highlight"><pre><span></span><span class="nt">&lt;AMPSConfig&gt;</span>
-    <span class="nt">&lt;Modules&gt;</span>
-        ...
-        <span class="nt">&lt;Module&gt;</span>
-            <span class="nt">&lt;Name&gt;</span>run-proc-authenticator<span class="nt">&lt;/Name&gt;</span>
-            <span class="nt">&lt;Library&gt;</span>libamps_exec_authenticator.so<span class="nt">&lt;/Library&gt;</span>
-        <span class="nt">&lt;/Module&gt;</span>
-        ...
-    <span class="nt">&lt;/Modules&gt;</span>
-    ...
-    <span class="nt">&lt;Replication&gt;</span>
-        ...
-        <span class="nt">&lt;Destination&gt;</span>
-           <span class="nt">&lt;Transport&gt;</span>
-              <span class="nt">&lt;Type&gt;</span>amps-replication<span class="nt">&lt;/Type&gt;</span>
-              <span class="nt">&lt;InetAddr&gt;</span>my-failover-partner:4000<span class="nt">&lt;/InetAddr&gt;</span>
-              <span class="nt">&lt;Authenticator&gt;</span>
-                   <span class="nt">&lt;Module&gt;</span>run-proc-authenticator<span class="nt">&lt;/Module&gt;</span>
-                   <span class="nt">&lt;Options&gt;</span>
-                         <span class="nt">&lt;UserName&gt;</span>${USER}<span class="nt">&lt;/UserName&gt;</span>
-                         <span class="nt">&lt;Command&gt;</span>./auth-widget --user &quot;{{AMPS_USER_NAME}}&quot; --output=stdout<span class="nt">&lt;/Command&gt;</span>
-                   <span class="nt">&lt;/Options&gt;</span>
-              <span class="nt">&lt;/Authenticator&gt;</span>
-            <span class="nt">&lt;/Transport&gt;</span>
-        <span class="nt">&lt;/Destination&gt;</span>
-     <span class="nt">&lt;/Replication&gt;</span>
-<span class="nt">&lt;/AMPSConfig&gt;</span>
-</pre></div>
-</div>
-</div>
-</div>
-</div>
-          </div>
-        </div>
-      </div>
-    <div class="clearer"></div>
-  </div>
-    <div class="footer">
-      &copy;2023 60East Technologies, Inc. (version develop).
-      |
-      Powered by <a href="http://sphinx-doc.org/">Sphinx 1.5.3</a>
-      &amp; <a href="https://github.com/bitprophet/alabaster">Alabaster 0.7.10</a>
-    </div>
-  </body>
-</html>

amps-python-client 5.3.4.1__zip → 5.3.4.3__zip

amps-python-client 5.3.4.1zip → 5.3.4.3zip