Add ADH as default transport

[jamoore]

The primary challenge is testing that the configuration can gracefully fail (if permitted)
If SSL cannot be enabled at all times (because of plugins, etc?) then the following changes may be necessary:

• strip the "ssl ..." section out of Ice.Default.Router
• check for null ports in createSession
• check client(string) constructor argument for starts with "tcp " or "ssl "

[jmoore]

A few points:

• For both clients and the invocation of bin/omero admin start, it's necessary to have (DY)LD_LIBRARY_PATH properly set in order to find the IceSSL shared library (e.g. /opt/local/lib/ under mac ports)
• The initial implementation will be to have SSL/port 4064 as the only connection available for Glacier2
• Communication between Glacier2 and the servers is still unencrypted
• When connecting to a non-SSL Glacier2 instance, it is necessary to pass 4063 as the port:

  In [1]: import omero
  In [2]: c = omero.client("localhost")
  
  In [3]: print c.ic.getProperties()
  ...
  Ice.Default.Router=OMERO.Glacier2/router:ssl -p 4064 -h localhost:tcp -p 4064 -h localhost
  ...
  In [4]: s = c.createSession("root","ome")
  ---------------------------------------------------------------------------
  ConnectionRefusedException                Traceback (most recent call last)
  
  /Users/omero/GlencoeSoftware.git/git/omero.git/dist/<ipython console> 
  
  /Users/omero/GlencoeSoftware.git/git/omero.git/dist/lib/python/omero/clients.pyc in createSession(self, username, password)
      382                     "%s - createSession retry: %s"% (reason, retries) )
      383                 try:
  --> 384                     prx = self.getRouter(self.__ic).createSession(username, password)
      385                     break
      386                 except omero.WrappedCreateSessionException, wrapped:
  
  /opt/local/Library/Frameworks/Python.framework/Versions/2.4/lib/python2.4/site-packages/Glacier2_Router_ice.pyc in createSession(self, userId, password, _ctx)
      102 
      103         def createSession(self, userId, password, _ctx=None):
  --> 104             return _M_Glacier2.Router._op_createSession.invoke(self, ((userId, password), _ctx))
      105 
      106         def createSessionFromSecureConnection(self, _ctx=None):
  
  ConnectionRefusedException: Ice.ConnectionRefusedException:
  Connection refused
  
  In [6]: c = omero.client("localhost", 4063)
  
  In [7]: s = c.createSession("root","ome")
  
  In [8]: s.ice_getRouter()
  
  Out[8]: OMERO.Glacier2/router -t:ssl -h localhost -p 4063:tcp -h localhost -p 4063
  
  

[jmoore]

(In [6339]) see #1937 - forcing use of ADH for Glacier. backwards compatible (for now)

[jmoore]

(In [6347]) see #1937 - typos in client.java caused unknown property warnings for VerifyPeer and Ciphers

[jmoore]

(In [6355]) see #1937 - s/none (DH_anon)/NONE (DH_anon)/

[jmoore]

(In [6423]) see #1937 - updating change_ports.py for port 4064

[jmoore]

From a security perspective, ADH is working fine, and for 4.2 we probably don't want to get into certificate based authentication, however it is too slow, described in #2099, which is scheduled for the next iteration.