[id='server_endpoint_auth-{context}']
= {brandname} Server Authentication
{brandname} servers automatically configure authentication mechanisms based on
the security realm that you assign to endpoints.

.SASL Authentication Mechanisms

The following SASL authentication mechanisms apply to Hot Rod endpoints:

|===
|Security Realm |SASL Authentication Mechanism

|Property Realms and LDAP Realms
|SCRAM-+*+, DIGEST-+*+, CRAM-MD5

|Token Realms
|OAUTHBEARER

|Trust Realms
|EXTERNAL

|Kerberos Identities
|GSSAPI, GS2-KRB5

|SSL/TLS Identities
|PLAIN
|===


.HTTP Authentication Mechanisms

The following HTTP authentication mechanisms apply to REST endpoints:

|===
|Security Realm |HTTP Authentication Mechanism

|Property Realms and LDAP Realms
|DIGEST

|Token Realms
|BEARER_TOKEN

|Trust Realms
|CLIENT_CERT

|Kerberos Identities
|SPNEGO

|SSL/TLS Identities
|BASIC
|===

.Default Configuration

{brandname} servers provide a security realm named "default" that uses a
property realm with plain text credentials defined in `{server_home}/server/
conf/users.properties`, as shown in the following snippet:

[source,xml,options="nowrap",subs=attributes+]
----
<security-realm name="default">
  <properties-realm groups-attribute="Roles">
    <user-properties path="users.properties"
                     relative-to="infinispan.server.config.path"
                     plain-text="true"/>
    <group-properties path="groups.properties"
                      relative-to="infinispan.server.config.path" />
  </properties-realm>
</security-realm>
----

The `endpoints` configuration assigns the "default" security realm to the Hot
Rod and REST connectors, as follows:

[source,xml,options="nowrap",subs=attributes+]
----
<endpoints socket-binding="default" security-realm="default">
  <hotrod-connector name="hotrod"/>
  <rest-connector name="rest"/>
</endpoints>
----

As a result of the preceding configuration, {brandname} servers require
authentication with a mechanism that the property realm supports.
