Chapter 4. User Management
4.1. User Creation
4.1.1. Add the Initial User for the Management Interfaces
The management interfaces in JBoss EAP 6 are secured by default as there are no user accounts initially available, unless you have installed the platform using the graphical installer. This is a security precaution to prevent security breaches from remote systems due to simple configuration errors. Local non-HTTP access is protected by a SASL mechanism, with a negotiation happening between the client and server each time the client connects for the first time from the localhost.
Procedure 4.1. Create the Initial Administrative User for the Remote Management Interfaces
add-user.batscript.Change to the
EAP_HOME/bin/directory. Invoke the appropriate script for your operating system.
- Red Hat Enterprise Linux
- Microsoft Windows Server
Choose to add a Management user.Select option
ato add a Management user. This user is added to the
ManagementRealmand is authorized to perform management operations using the web-based Management Console or command-line based Management CLI. The other choice,
b, adds a user to the
ApplicationRealm, and provides no particular permissions. That realm is provided for use with applications.
Choose the realm for the user.The next prompt refers to the realm where the user will be added. For a user with permissions to manage JBoss EAP 6, choose the default, which is
Enter the desired username and password.When prompted, enter the security realm, username and password. Pressing ENTER selects the default realm of
ManagementRealm, which allows the user to administer JBoss EAP 6 using the management interfaces. You must add at least one user to this realm. You are prompted to confirm the information. If you are satisfied, type
Choose whether the user represents a remote JBoss EAP 6 server instance.Besides administrators, the other type of user which occasionally needs to be added to JBoss EAP 6 in the
ManagementRealmis a user representing another instance of JBoss EAP 6, which needs to be able to authenticate to join a cluster as a member. The next prompt allows you to designate your added user for this purpose. If you select
yes, you will be given a hashed
secretvalue, representing the user's password, which would need to be added to a different configuration file. For the purposes of this task, answer
noto this question.
Enter additional users.You can enter additional users if desired, by repeating the procedure. You can also add them at any time on a running system. Instead of choosing the default security realm, you can add users to other realms to fine-tune their authorizations.
Create users non-interactively.You can create users non-interactively, by passing in each parameter at the command line. This approach is not recommended on shared systems, because the passwords will be visible in log and history files. The syntax for the command, using the management realm, is:
[user@host bin]$./add-user.sh username passwordTo use the application realm, use the
[user@host bin]$./add-user.sh -a username password
- You can suppress the normal output of the add-user script by passing the
--silentparameter. This applies only if the minimum parameters if
passwordhave been specified. Error messages will still be shown.
Any users you add are activated within the security realms you have specified. Users active within the
ManagementRealm realm are able to manage JBoss EAP 6 from remote systems.