Chapter 3. Configuring Elytron with identity realm to allow easy authentication and authorization for local users
Chapter 3. Configuring Elytron with identity realm to allow easy authentication and authorization for local users You can use an identity-realm provided by Elytron to allow local users to connect to JBoss EAP management interfaces. The JBoss EAP management CLI is preconfigured to use an identity-realm named local . This allows local users to connect without having to provide credentials. An identity realm can only be used with the JBOSS-LOCAL-USER mechanism. 3.1. Securing a management interface with an identity realm You can secure a management interface by using an identity-realm security realm with the JBOSS-LOCAL-USER mechanism. Prerequisites JBoss EAP is running. Procedure Create a local identity-realm . Syntax Example Optional If you want to use a name for your local identity-realm other than USDlocal , change the value of wildfly.sasl.local-user.default-user property in the attribute configurable-sasl-server-factory= <sasl_server_factory> . Syntax Example Create a security domain that references the identity-realm that you created. Syntax Example Add SASL Authentication factory. Syntax Example Enable SASL Authentication factory for your management interface. Syntax Example Reload your management interface. Additional resources identity-realm attributes security-domain attributes sasl-authentication-factory attributes
/subsystem=elytron/identity-realm=<local_identity_realm_name>:add(identity="USDlocal",attribute-name= <attribute_name> ,attribute-values= <attribute_value> ) /subsystem=elytron/identity-realm=exampleLocalIdentityRealm:add(identity="USDlocal",attribute-name=AttributeName,attribute-values=Value) /subsystem=elytron/configurable-sasl-server-factory= <sasl_server_factory> :write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => " <new_local_username> ", "wildfly.sasl.local-user.challenge-path" => expression "USD{jboss.server.temp.dir}/auth"}) /subsystem=elytron/configurable-sasl-server-factory=configured:write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => "john", "wildfly.sasl.local-user.challenge-path" => expression "USD{jboss.server.temp.dir}/auth"}) /subsystem=elytron/security-domain=<security_domain_name>:add(default-realm=<local_identity_realm_name>,permission-mapper= <permission_mapper_name> ,realms=[{realm=<Local_identity_realm_name>}]) /subsystem=elytron/security-domain=exampleSecurityDomain:add(default-realm=exampleLocalIdentityRealm,permission-mapper=default-permission-mapper,realms=[{realm=exampleLocalIdentityRealm}]) /subsystem=elytron/sasl-authentication-factory=<sasl_auth_factory_name>:add(security-domain=<security_domain_name>,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}]) /subsystem=elytron/sasl-authentication-factory=exampleSaslAuthenticationFactory:add(security-domain=exampleSecurityDomain,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}]) /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=<sasl_auth_factory_name>}) /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=exampleSaslAuthenticationFactory}) reload