Broker启用安全认证，需要用户名和密码验证

Broker需要在配置文件中开安全认证，客户端或者其他Broker连接时，需要通过对应的用户名和密码来访问，默认没有安全认证。配置样例如下：

（1）、指定加密的环境变量：

删除

<!-- Allows us to use system properties as variables in this configuration file -->

<bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"/>

增加

<!-- Allows us to use encrypted system properties as variables in this configuration file -->

<!-- Define authentication configure =begin= -->

<bean id="environmentVariablesConfiguration" class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">

<property name="algorithm" value="PBEWithMD5AndDES" />

<property name="passwordEnvName" value="EMQ_ENCRYPTION_PASSWORD" />

</bean>                                                                    

<bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">

<property name="config" ref="environmentVariablesConfiguration" />

</bean>

<bean id="propertyConfigurer" class="org.jasypt.spring.properties.EncryptablePropertyPlaceholderConfigurer">

<constructor-arg ref="configurationEncryptor" />

<!--如果使用明文的属性文件，则引用可改为credentials.properties，有时明文的属性文件可以启动成功，但不安全-->

<property name="location" value="file:${emq.home}/conf/credentials-enc.properties"/>

</bean>

<!-- Define authentication configure =end= -->

注意：不能同时使用，前者是使用一般系统变量，后者是使用加密的系统变量；

（2）、引入简单认证插件

<broker>

...

<plugins>

<simpleAuthenticationPlugin>

<users>

<authenticationUser username="system" password="${emq.password}"  groups="users,admins"/>

<authenticationUser username="user" password="${guest.password}"  groups="users"/>

<authenticationUser username="guest" password="${guest.password}"  groups="guests"/>

</users>

</simpleAuthenticationPlugin>

</plugins>



</broker>

（3）、访问方式的调整：

Ø jms客户端方式：

failover:(tcp://cnd:61616)?jms.userName=system&jms.password=manager




Ø NC方式配置如下：

<networkConnector uri="static:(tcp://10.3.20.205:61616?socketBufferSize=131072&amp;ioBufferSize=16384&amp;wireFormat.cacheSize=2048)"

                            name="bridge_src_epserver1"

                            dynamicOnly="false"

                            conduitSubscriptions="false"

                                           staticBridge="false"

                            networkTTL="10"

                            duplex="true"

                           userName="system"

                           password="manager" 

                            decreaseNetworkConsumerPriority="false">

</networkConnector>