[QPID-7292] Qpid clients should verify the server-final message when using SCRAM-* authentication

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: qpid-java-client-0-x-6.3.0
• Component/s: JMS AMQP 0-x
• Assignee: Unassigned
• Reporter: Robert Godfrey
• Created: 03/Jun/16 12:48
• Updated: 22/Nov/17 09:30
• Resolved: 14/Jul/17 13:39

Description

QPID-7282 addressed the issue that the Java Broker was not sending the server-final message in the SCRAM-* SASL exchange, however this omission was not causing the clients to fail, since they blindly accept the server's acceptance of their credentials.

Clients implementing SCRAM-* or similar protocols which include a client verification step, should perform the verification of the server and fail or warn (to be configured by a system property) if the verification does not occur or it fails.

Issue Links

• is related to: QPIDJMS-260 SCRAM SASL should verify the server-final message