// Module included in the following assemblies:
//
// assembly-auth-services.adoc

[id='ref-external-auth-service-example-allow-overrides-{context}']
= External authentication service example allowing overrides

The following example shows an authentication service of type `external` that allows overrides to the host name, port number, and realm by the messaging tenant:

[source,yaml,options="nowrap"]
----
apiVersion: admin.enmasse.io/v1beta1
kind: AuthenticationService
metadata:
  name: my-external-2
spec:
  type: external
  realm: myrealm <1>
  external:
    host: example.org <2>
    port: 5671 <3>
    caCertSecret: <4>
      name: my-ca-cert
    allowOverride: true <5>
----
<1> (Optional) The `realm` is passed in the authentication request. If not specified, an identifier in the form of _namespace-addressspace_ is used as the realm.
<2> The host name of the external authentication server.
<3> The port number of the external authentication server.
<4> (Optional) The CA certificate to trust when connecting to the authentication server.
<5> (Optional) Specifies whether address space overrides are allowed to the host name, port number, realm, and CA certificate. Valid values are `true` or `false`. If not specified, the default value is `false`.

The external authentication server must implement the API described in the link:{BookUrlBase}{BaseProductVersion}{BookNameUrl}#con-external-authentication-server-api-messaging[External authentication server API].


