[PROTON-1008] Using a blank mech_list disables authentication

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: proton-0.11.0
• Fix Version/s: proton-0.11.0
• Component/s: python-binding
• Assignee: Gordon Sim
• Reporter: Ted Ross
• Created: 25/Sep/15 20:59
• Updated: 18/Nov/15 17:24
• Resolved: 02/Oct/15 19:05

Description

This bug was introduced in commit
https://github.com/apache/qpid-proton/commit/14956b07edc3de93f67179c753bbedcd9eba51a6
If the client leaves allowed_mechs as None, the SASL protocol is not even executed. I claim that allowed_mechs is used to restrict the set of acceptable mechanisms. If it is None, then all available mechanisms may be used.
This bug causes a failure in the Qpid Dispatch test suite (system_tests_qdstat). The failure is when the server requires authentication and will accept EXTERNAL and the client has a valid client-certificate but doesn't use the sasl protocol because qdstat doesn't (and can't) set the allowed_mechs.