Chapter 3. Configuring Elytron with identity realm to allow easy authentication and authorization for local users

You can use an identity-realm provided by Elytron to allow local users to connect to JBoss EAP management interfaces.

The JBoss EAP management CLI is preconfigured to use an identity-realm named local. This allows local users to connect without having to provide credentials. An identity realm can only be used with the JBOSS-LOCAL-USER mechanism.

3.1. Securing a management interface with an identity realm

You can secure a management interface by using an identity-realm security realm with the JBOSS-LOCAL-USER mechanism.

Prerequisites

  • JBoss EAP is running.

Procedure

  1. Create a local identity-realm.

    Syntax

    /subsystem=elytron/identity-realm=<local_identity_realm_name>:add(identity="$local",attribute-name=<attribute_name>,attribute-values=<attribute_value>)

    Example

    /subsystem=elytron/identity-realm=exampleLocalIdentityRealm:add(identity="$local",attribute-name=AttributeName,attribute-values=Value)

    1. Optional If you want to use a name for your local identity-realm other than $local, change the value of wildfly.sasl.local-user.default-user property in the attribute configurable-sasl-server-factory=<sasl_server_factory>.

      Syntax

      /subsystem=elytron/configurable-sasl-server-factory=<sasl_server_factory>:write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => "<new_local_username>", "wildfly.sasl.local-user.challenge-path" => expression "${jboss.server.temp.dir}/auth"})

      Example

      /subsystem=elytron/configurable-sasl-server-factory=configured:write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => "john", "wildfly.sasl.local-user.challenge-path" => expression "${jboss.server.temp.dir}/auth"})

  2. Create a security domain that references the identity-realm that you created.

    Syntax

    /subsystem=elytron/security-domain=<security_domain_name>:add(default-realm=<local_identity_realm_name>,permission-mapper=<permission_mapper_name>,realms=[{realm=<Local_identity_realm_name>}])

    Example

    /subsystem=elytron/security-domain=exampleSecurityDomain:add(default-realm=exampleLocalIdentityRealm,permission-mapper=default-permission-mapper,realms=[{realm=exampleLocalIdentityRealm}])

  3. Add SASL Authentication factory.

    Syntax

    /subsystem=elytron/sasl-authentication-factory=<sasl_auth_factory_name>:add(security-domain=<security_domain_name>,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}])

    Example

    /subsystem=elytron/sasl-authentication-factory=exampleSaslAuthenticationFactory:add(security-domain=exampleSecurityDomain,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}])

  4. Enable SASL Authentication factory for your management interface.

    Syntax

    /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=<sasl_auth_factory_name>})

    Example

    /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=exampleSaslAuthenticationFactory})

  5. Reload your management interface. 

    $ reload

Additional resources