4.2. User Creation
4.2.1. Add the User for the Management Interfaces
Procedure 4.1. Create the Initial Administrative User for the Remote Management Interfaces
add-user.batscript.Change to the
EAP_HOME/bin/directory. Invoke the appropriate script for your operating system.
- Red Hat Enterprise Linux
- Microsoft Windows Server
Choose to add a Management user.Press ENTER to select the default option
ato add a Management user.This user is added to the
ManagementRealmand is authorized to perform management operations using the web-based Management Console or command-line based Management CLI. The other choice,
b, adds a user to the
ApplicationRealm, and provides no particular permissions. That realm is provided for use with applications.
Enter the desired username and password.When prompted, enter the username and password. You will be prompted to confirm the password.
Enter group information.Add the group or groups to which the user belongs. If the user belongs to multiple groups, enter a comma-separated list. Leave it blank if you do not want the user to belong to any groups.
Review the information and confirm.You are prompted to confirm the information. If you are satisfied, type
Choose whether the user represents a remote JBoss EAP 6 server instance.Besides administrators, the other type of user which occasionally needs to be added to JBoss EAP 6 in the
ManagementRealmis a user representing another instance of JBoss EAP 6, which must be able to authenticate to join a cluster as a member. The next prompt allows you to designate your added user for this purpose. If you select
yes, you will be given a hashed
secretvalue, representing the user's password, which would need to be added to a different configuration file. For the purposes of this task, answer
noto this question.
Enter additional users.You can enter additional users if desired, by repeating the procedure. You can also add them at any time on a running system. Instead of choosing the default security realm, you can add users to other realms to fine-tune their authorizations.
Create users non-interactively.You can create users non-interactively, by passing in each parameter at the command line. This approach is not recommended on shared systems, because the passwords will be visible in log and history files. The syntax for the command, using the management realm, is:
[user@host bin]$./add-user.sh username passwordTo use the application realm, use the
[user@host bin]$./add-user.sh -a username password
- You can suppress the normal output of the add-user script by passing the
--silentparameter. This applies only if the minimum parameters
passwordhave been specified. Error messages will still be shown.
Any users you add are activated within the security realms you have specified. Users active within the
ManagementRealm realm are able to manage JBoss EAP 6 from remote systems.
4.2.2. Pass Arguments to the User Management add-user Script
add-user.batcommand interactively or you can pass the arguments on the command line. This section describes the options available when passing command line arguments to the add-user script.
add-user.batcommand. see Section 4.2.3, “Add-user Command Arguments” .
add-user.batcommand, see Section 4.3.1, “Create a User Belonging to a Single Group Using the Default Properties Files”, Section 4.3.2, “Create a User Belonging to Multiple Groups Using the Default Properties Files”, Section 4.3.3, “Create a User With Administrator Privileges in the Default Realm Using the Default Properties Files” and Section 4.3.4, “Create a User Belonging to Single Group Using Alternate Properties Files to Store the Information”. .
4.2.3. Add-user Command Arguments
Table 4.1. Add-user Command Arguments
|Command Line Argument||Argument Value||Description|
This argument specifies to create a user in the application realm. If omitted, the default is to create a user in the management realm.
This argument specifies the domain configuration directory that will contain the properties files. If it is omitted, the default directory is
This argument specifies an alternate standalone server configuration directory that will contain the properties files. If it is omitted, the default directory is
This argument specifies the name of the alternate user properties file. It can be an absolute path or it can be a file name used in conjunction with the
A comma-separated list of groups to assign to this user.
This argument specifies the name of the alternate group properties file. It can be an absolute path or it can be a file name used in conjunction with the
The password of the user. The password must satisfy the following requirements:
The name of the user. Only alphanumeric characters and the following symbols are valid: ,./=@\.
The name of the realm used to secure the management interfaces. If omitted, the default is
Run the add-user script with no output to the console.
Display usage information for the add-user script.
4.2.4. Specify Alternate Properties Files for User Management Information
By default, user and role information created using the
add-user.bat script are stored in properties files located in the server configuration directory. The server configuration information is stored in the
EAP_HOME/standalone/configuration/ directory and the domain configuration information is stored in the
EAP_HOME/domain/configuration/ directory. This topic describes how to override the default file names and locations.
- To specify an alternate directory for the server configuration, use the
-scargument. This argument specifies an alternate directory that will contain the server configuration properties files.
- To specify an alternate directory for the domain configuration, use the
-dcargument. This argument specifies an alternate directory that will contain the domain configuration properties files.
- To specify an alternate user configuration properties file, use the
--user-propertiesargument. It can be an absolute path or it can be a file name used in conjunction with the
-dcargument that specifies the alternate configuration directory.
- To specify an alternate group configuration properties file, use the
--group-propertiesargument. It can be an absolute path or it can be a file name used in conjunction with the
-dcargument that specifies the alternate configuration directory.
add-usercommand is intended to operate on existing properties files. Any alternate properties files specified in command line arguments must exist or you will see the following error:
JBAS015234: No appusers.properties files found