[id='hotrod_authentication']
= Configuring Authentication Mechanisms for Hot Rod Clients
{brandname} servers use different mechanisms to authenticate Hot Rod client
connections.

.Procedure

* Specify the authentication mechanisms that {brandname} server uses with the `saslMechanism()` method from the `SecurityConfigurationBuilder` class.

.SCRAM

[source,java]
----
include::code_examples/HotRodScram.java[]
----

.DIGEST

[source,java]
----
include::code_examples/HotRodDigest.java[]
----

.PLAIN

[source,java]
----
include::code_examples/HotRodPlain.java[]
----

.OAUTHBEARER

[source,java]
----
include::code_examples/HotRodOAuthBearer.java[]
----

.OAUTHBEARER authentication with TokenCallbackHandler

You can configure clients with a `TokenCallbackHandler` to refresh OAuth2 tokens before they expire, as in the following example:

[source,java]
----
include::code_examples/HotRodOAuthBearerTokenCBH.java[]
----

.EXTERNAL

[source,java]
----
include::code_examples/HotRodExternal.java[]
----

.GSSAPI

[source,java]
----
include::code_examples/HotRodGSSAPI.java[]
----

The preceding configuration uses the `BasicCallbackHandler` to retrieve the
client subject and handle authentication. However, this actually invokes
different callbacks:

* `NameCallback` and `PasswordCallback` construct the client subject.

* `AuthorizeCallback` is called during SASL authentication.


.Custom CallbackHandler
Hot Rod clients set up a default `CallbackHandler` to pass credentials to SASL
mechanisms. In some cases, you might need to provide a custom `CallbackHandler`.

[NOTE]
====
Your `CallbackHandler` needs to handle callbacks that are specific to the
authentication mechanism that you use. However, it is beyond the scope of this
document to provide examples for each possible callback type.
====

[source,java]
----
include::code_examples/HotRodCustomCBH.java[]
----
