What does local tag indicates in EAP6 security realm ?

Issue

• What does the <local default-user="$local"/> tag specifies which is defined in the "security-realm" as following:

            <security-realm name="ManagementRealm">
                <authentication>
                    <local default-user="$local"/>
                    <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
                </authentication>
                .
                .
            </security-realm>

• How to force authentication for the local users as well who try to connect to EAP6 via "native-interface" ?

• Explain how to enable or disable authentication for local or remote connectivity to EAP6 when connecting to it from "jboss-cli .sh" or using CLI Management APIs?

• Explain why the following error is encountered while connecting to EAP6 from a JBoss CLI API based java code?

Authenticating against security realm: ManagementRealm
Username: 
[DEBUG] [Remoting "cli-client" task-2] [ClientConnectionOpenListener.java:639] - Client authentication failed for mechanism DIGEST-MD5: javax.security.sasl.SaslException: DIGEST-MD5: Error acquiring realm, authentication ID or password [Caused by javax.security.sasl.SaslException: No username supplied.]
[ERROR] [Remoting "cli-client" read-1] [RemoteConnection.java:105] - JBREM000200: Remote connection failed: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed
[DEBUG] [main] [ActiveOperationSupport.java:336] - cancelled operation (519033) attachment: (org.jboss.as.controller.client.impl.AbstractModelControllerClient$OperationExecutionContext@e79839) this: org.jboss.as.protocol.mgmt.ManagementChannelHandler@bac9b9.
org.jboss.as.cli.CommandLineException: Unable to authenticate against controller at 10.10.10.10:9999
    at org.jboss.as.cli.impl.CommandContextImpl.tryConnection(CommandContextImpl.java:956)
    at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:808)