[[saslExternal]]
= Configuration of SASL EXTERNAL
:author: Bartosz Malkowski <bmalkowski@tigase.pl>
:version: v2.1, June 2017: Reformatted for Kernel/DSL

In order to enable SASL External add following line to the  `config.tdsl` file

[source,dsl]
-----
c2s {
    clientCertCA = '/path/to/cacert.pem'
}
-----

File `cacert.pem` contains Certificate Authority certificate which is used to sign clients certificate.

Client certificate must include user's Jabber ID as `XmppAddr` in `subjectAltName`:
__________________________
As specified in RFC 3920 and updated in RFC 6120, during the stream negotiation process an XMPP client can present a certificate (a “client certificate”). If a JabberID is included in a client certificate, it is encapsulated as an id-on-xmppAddr Object Identifier (“xmppAddr”), i.e., a subjectAltName entry of type otherName with an ASN.1 Object Identifier of “id-on-xmppAddr” as specified in Section 13.7.1.4 of RFC 6120, link:http://xmpp.org/extensions/xep-0178.html#c2s[XEP-0178].
__________________________

It is possible to make client certificate required:

[source,bash]
-----
c2s {
    clientCertRequired = true
}
-----

If this option will be enabled, then client must provide certificate. This certificate will be verified against `clientCertCA`. If client does not provide certificate or certificate will be invalid, TLS handshake will be interrupted and client will be disconnected.

Using this options does not force client to use SASL EXTERNAL. Client still may authenticate with other SASL mechanisms.
