[id='hotrod_endpoint_auth-{context}']
= Hot Rod Endpoint Authentication Mechanisms

{brandname} supports the following SASL authentications mechanisms with the Hot
Rod connector:

|===
| Authentication mechanism | Description | Related details

| `PLAIN`
| Uses credentials in plain-text format. You should use `PLAIN` authentication with encrypted connections only.
| Similar to the `Basic` HTTP mechanism.

| `+DIGEST-*+`
| Uses hashing algorithms and nonce values. Hot Rod connectors support `DIGEST-MD5`, `DIGEST-SHA`, `DIGEST-SHA-256`, `DIGEST-SHA-384`, and `DIGEST-SHA-512` hashing algorithms, in order of strength.
| Similar to the `Digest` HTTP mechanism.

| `+SCRAM-*+`
| Uses _salt_ values in addition to hashing algorithms and nonce values. Hot Rod connectors support `SCRAM-SHA`, `SCRAM-SHA-256`, `SCRAM-SHA-384`, and `SCRAM-SHA-512` hashing algorithms, in order of strength.
| Similar to the `Digest` HTTP mechanism.

| `GSSAPI`
| Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding `kerberos` server identity in the realm configuration. In most cases, you also specify an `ldap-realm` to provide user membership information.
| Similar to the `SPNEGO` HTTP mechanism.

| `GS2-KRB5`
| Uses Kerberos tickets and requires a Kerberos Domain Controller. You must add a corresponding `kerberos` server identity in the realm configuration. In most cases, you also specify an `ldap-realm` to provide user membership information.
| Similar to the `SPNEGO` HTTP mechanism.

| `EXTERNAL`
| Uses client certificates.
| Similar to the `CLIENT_CERT` HTTP mechanism.

| `OAUTHBEARER`
| Uses OAuth tokens and requires a `token-realm` configuration.
| Similar to the `BEARER_TOKEN` HTTP mechanism.
|===
