title: GlassFish v3 Prelude - admin questions
body: <p>I've been mucking around with GlassFish v3 prelude this evening. A couple of things I'm not sure about is how the security works.</p>
  
  <p>It installed like a dream, so the first thing I did was remove the anonymous account and setup an "admin" account with "mysecretpassword" and specified the asadmin group for this user in the admin realm.</p>
  
  <p>At that point the <strong>stop-domain</strong> command stopped working from the console (and/or start menu shortcut). Fair enough, but the stop-domain command accepts a --user argument but then wants a --passwordfile path supplied which I didn't know where it was.</p>
  
  <p>After some googling I chanced upon <strong>asaadmin login -p 4848</strong> which created a password file in my documents and then stop-domain started working!</p>
  
  <p>So the questions:</p>
  
  <p>1) Is it possible to get stop-domain to prompt for a user/password?</p>
  
  <p>2) This whole business of having a file with a (hashed) password doesn't sound great to me - why did they do it this way, and is it transferable, can it be disabled and if it can, how then do I stop the domain?</p>
  
  <p>3) How do security realms work - as in what are they, and how do they differ?</p>
  
  <p>4) What's the best resource (book, website, whatever) on GF v3?</p>