Show Table of Contents
Chapter 14. Configuring JAAS Security
14.1. Alternative JAAS Realms
Overview
The Java Authentication and Authorization Service (JAAS) is a pluggable authentication service, which is implemented by a login module. A particular instance of a JAAS service is known as a JAAS realm and is identified by a realm name.
Applications integrated with JAAS must be configured to use a specific realm, by specifying the realm name.
Default realm
The default realm in Red Hat JBoss Fuse is identified by the
karaf realm name. The standard administration services in JBoss Fuse (SSH remote console, JMX port, and so on) are all configured to use the karaf realm by default.
Available realm implementations
JBoss Fuse provides the following alternative JAAS realm implementations:
Standalone JAAS realm
In a standalone container, the
karaf realm installs two JAAS login modules, which are used in parallel:
PropertiesLoginModule- Authenticates username/password credentials and stores the secure user data in the
InstallDir/etc/users.propertiesfile. PublickeyLoginModule- Authenticates SSH key-based credentials (consisting of a username and a public/private key pair). Secure user data is stored in the
InstallDir/etc/keys.propertiesfile.
Fabric JAAS realm
In a fabric, a
karaf realm based on the ZookeeperLoginModule login module is automatically installed in every container (the fabric-jaas feature is included in the default profile) and is responsible for securing the SSH remote console and other administrative services. The Zookeeper login module stores the secure user data in the Fabric Registry.
Note
In containers where the standalone JAAS realm and the Fabric JAAS realm are both installed, the Fabric JAAS realm takes precedence, because it defines a
karaf realm with a higher rank.
LDAP JAAS realm
It is also possible to configure a container to use an LDAP login module with JAAS. For details of how to set this up, see LDAP Authentication Tutorial.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.