[id='hotrod_endpoint_sasl_policies-{context}']
= SASL Policies
SASL policies let you control which authentication mechanisms Hot Rod
connectors can use.

[%header%autowidth]
|===
| Policy | Description | Default value

| `forward-secrecy`
| Use only SASL mechanisms that support forward secrecy between sessions. This means that breaking into one session does not automatically provide information for breaking into future sessions.
| false

| `pass-credentials`
| Use only SASL mechanisms that require client credentials.
| false

| `no-plain-text`
| Do not use SASL mechanisms that are susceptible to simple plain passive attacks.
| false

| `no-active`
| Do not use SASL mechanisms that are susceptible to active, non-dictionary, attacks.
| false

| `no-dictionary`
| Do not use SASL mechanisms that are susceptible to passive dictionary attacks.
| false

| `no-anonymous`
| Do not use SASL mechanisms that accept anonymous logins.
| true
|===

[TIP]
====
{brandname} cache authorization restricts access to caches based on roles and
permissions. If you configure cache authorization, you can then set
`<no-anonymous value=false />` to allow anonymous login and delegate access
logic to cache authorization.
====

.Hot Rod connector with SASL policy configuration

[source,xml,options="nowrap",subs=attributes+]
----
include::config_examples/hotrod_connector_policies.xml[]
----

<1> Specifies multiple SASL authentication mechanisms for the Hot Rod connector.
<2> Defines policies for SASL mechanisms.

As a result of the preceding configuration, the Hot Rod connector uses the
`GSSAPI` mechanism because it is the only mechanism that complies with all
policies.
