[id='sasl-policies-hot-rod-authentication_{context}']
= SASL policies

SASL policies provide fine-grain control over Hot Rod authentication mechanisms.

[TIP]
====
{brandname} cache authorization restricts access to caches based on roles and
permissions.
Configure cache authorization and then set `<no-anonymous value=false />` to allow anonymous login and delegate access logic to cache authorization.
====

[%autowidth,cols="1,1,1",stripes=even]
|===
| Policy | Description | Default value

| `forward-secrecy`
| Use only SASL mechanisms that support forward secrecy between sessions. This means that breaking into one session does not automatically provide information for breaking into future sessions.
| false

| `pass-credentials`
| Use only SASL mechanisms that require client credentials.
| false

| `no-plain-text`
| Do not use SASL mechanisms that are susceptible to simple plain passive attacks.
| false

| `no-active`
| Do not use SASL mechanisms that are susceptible to active, non-dictionary, attacks.
| false

| `no-dictionary`
| Do not use SASL mechanisms that are susceptible to passive dictionary attacks.
| false

| `no-anonymous`
| Do not use SASL mechanisms that accept anonymous logins.
| true
|===

[discrete]
== SASL policy configuration

In the following configuration the Hot Rod endpoint uses the `GSSAPI` mechanism for authentication because it is the only mechanism that complies with all SASL policies:

.XML
[source,xml,options="nowrap",subs=attributes+,role="primary"]
----
include::xml/hotrod_connector_policies.xml[]
----

.JSON
[source,json,options="nowrap",subs=attributes+,role="secondary"]
----
include::json/hotrod_connector_policies.json[]
----

.YAML
[source,yaml,options="nowrap",subs=attributes+,role="secondary"]
----
include::yaml/hotrod_connector_policies.yaml[]
----
