Appendix A. Reference Material A.1. Elytron subsystem components reference Table A.1. add-prefix-role-mapper Attributes Attribute Description prefix The prefix to add to each role. Table A.2. add-suffix-role-mapper Attributes Attribute Description suffix The suffix to add to each role. Table A.3. aggregate-http-server-mechanism-factory Attributes Attribute Description http-server-mechanism-factories The list of HTTP server factories to aggregate. Table A.4. aggregate-principal-decoder Attributes Attribute Description principal-decoders The list of principal decoders to aggregate. Table A.5. aggregate-principal-transformer Attributes Attribute Description principal-transformers The list of principal transformers to aggregate. Table A.6. aggregate-providers Attributes Attribute Description providers The list of referenced Provider[] resources to aggregate. Table A.7. aggregate-realm Attributes Attribute Description authentication-realm Reference to the security realm to use for authentication steps. This is used for obtaining or validating credentials. authorization-realm Reference to the security realm to use for loading the identity for authorization steps. authorization-realms Reference to the security realms to aggregate for loading the identity for authorization steps. For information about using multiple authorization realms, see Configure Authentication and Authorization Using Multiple Identity Stores in the How to Configure Identity Management guide. Note The authorization-realm and authorization-realms attributes are mutually exclusive. Define only one of the two attributes in a realm. Table A.8. aggregate-role-mapper Attributes Attribute Description role-mappers The list of role mappers to aggregate. Table A.9. aggregate-sasl-server-factory Attributes Attribute Description sasl-server-factories The list of SASL server factories to aggregate. Table A.10. authentication-configuration Attributes Attribute Description anonymous If true anonymous authentication is allowed. The default is false . authentication-name The authentication name to use. authorization-name The authorization name to use. credential-reference The credential to use for authentication. This can be in clear text or as a reference to a credential stored in a credential-store . extends An existing authentication configuration to extend. host The host to use. kerberos-security-factory Reference to a kerberos security factory used to obtain a GSS kerberos credential. mechanism-properties Configuration properties for the SASL authentication mechanism. port The port to use. protocol The protocol to use. realm The realm to use. sasl-mechanism-selector The SASL mechanism selector string. For more information about the grammar required for the sasl-mechanism-selector , see sasl-mechanism-selector Grammar in How to Configure Server Security for JBoss EAP. security-domain Reference to a security domain to obtain a forwarded identity. Table A.11. authentication-context Attributes Attribute Description extends An existing authentication context to extend. match-rules The rules to match against for this authentication context. Table A.12. authentication-context match-rules Attributes Attribute Description authentication-configuration Reference to the authentication configuration to use for a successful match. match-abstract-type The abstract type to match against. match-abstract-type-authority The abstract type authority to match against. match-host The host to match against. match-local-security-domain The local security domain to match against. match-no-user If true , rule will match against no user. match-path The patch to match against. match-port The port to match against. match-protocol The protocol to match against. match-urn The URN to match against. match-user The user to match against. ssl-context Reference to the ssl-context to use for a successful match. Table A.13. caching-realm Attributes Attribute Description maximum-age The time in milliseconds that an item can stay in the cache. A value of -1 keeps items indefinitely. This defaults to -1 . maximum-entries The maximum number of entries to keep in the cache. This defaults to 16 . realm A reference to a cacheable security realm such as jdbc-realm , ldap-realm , filesystem-realm or a custom security realm. Table A.14. case-principal-transformer attributes Attribute Description upper-case An optional attribute that converts a principal transformer's name to uppercase characters when set as true , which is the default setting. Set the attribute to false to convert the principal transformer's name to lowercase characters. Table A.15. certificate-authority-account Attributes Attribute Description alias The alias of certificate authority account key in the keystore. If the alias does not already exist in the keystore, a certificate authority account key will be automatically generated and stored as a PrivateKeyEntry under the alias. certificate-authority The name of the certificate authority to use. The default, and only allowed value, is LetsEncrypt . contact-urls A list of URLs that the certificate authority can contact about any issues related to this account. credential-reference The credential to be used when accessing the certificate authority account key. key-store The keystore that contains the certificate authority account key. Table A.16. chained-principal-transformer Attributes Attribute Description principal-transformers List of principal transformers to chain. Table A.17. client-ssl-context Attributes Attribute Description cipher-suite-filter The filter to apply to specify the enabled cipher suites. This filter takes a list of items delimited by colons, commas, or spaces. Each item may be a OpenSSL-style cipher suite name, a standard SSL/TLS cipher suite name, or a keyword such as TLSv1.2 or DES . A full list of keywords as well as additional details on creating a filter can be found in the Javadoc for the CipherSuiteSelector class. The default value is DEFAULT , which corresponds to all known cipher suites that do not have NULL encryption and excludes any cipher suites that have no authentication. key-manager Reference to the key-manager to use within the SSLContext . protocols The enabled protocols. Allowed options: SSLv2 , SSLv3 , TLSv1 , TLSv1.1 , TLSv1.2 , TLSv1.3 . This defaults to enabling TLSv1 , TLSv1.1 , TLSv1.2 , and TLSv1.3 . Warning Red Hat recommends that SSLv2, SSLv3, and TLSv1.0 be explicitly disabled in favor of TLSv1.1 or TLSv1.2 in all affected packages. provider-name The name of the provider to use. If not specified, all providers from providers will be passed to the SSLContext. providers The name of the providers to obtain the Provider[] to use to load the SSLContext . session-timeout The timeout for SSL sessions. trust-manager Reference to the trust-manager to use within the SSLContext . Table A.18. concatenating-principal-decoder Attributes Attribute Description joiner The string that will be used to join the values in the principal-decoders attribute. principal-decoders The list of principal decoders to concatenate. Table A.19. configurable-http-server-mechanism-factory Attributes Attribute Description filters The list of filters to be applied in order to enable or disable mechanisms based on the name. http-server-mechanism-factory Reference to the http server factory to be wrapped. properties Custom properties to be passed in to the HTTP server factory calls. Table A.20. configurable-http-server-mechanism-factory filters Attributes Attribute Description pattern-filter Filter based on a regular expression pattern. enabling If true the filter will be enabled if the mechanism matches. This defaults to true . Table A.21. configurable-sasl-server-factory Attributes Attribute Description filters List of filters to be evaluated sequentially and combined using or . properties Custom properties to be passed in to the SASL server factory calls. protocol The protocol passed into the factory when creating the mechanism. sasl-server-factory Reference to the SASL server factory to be wrapped. server-name The server name passed into the factory when creating the mechanism. Table A.22. configurable-sasl-server-factory filters Attributes Attribute Description enabling If true the filter will be enabled if the factory matches. This defaults to true . predefined-filter A predefined filter to use to filter the mechanism name. Allowed values are HASH_MD5 , HASH_SHA , HASH_SHA_256 , HASH_SHA_384 , HASH_SHA_512 , GS2 , SCRAM , DIGEST , IEC_ISO_9798 , EAP , MUTUAL , BINDING , and RECOMMENDED . pattern-filter A filter for the mechanism name based on a regular expression. Table A.23. constant-permission-mapper Attributes Attribute Description permission-sets The permission sets to assign in the event of a match. Permission sets can be used to assign permissions to an identity. permission-sets can take the following attribute: permission-set A reference to a permission set. Note The permissions attribute is deprecated, and is replaced by permission-sets . Table A.24. constant-principal-decoder Attributes Attribute Description constant The constant value the principal decoder will always return. Table A.25. constant-principal-transformer Attributes Attribute Description constant The constant value this principal transformer will always return. Table A.26. constant-realm-mapper Attributes Attribute Description realm-name Reference to the realm that will be returned. Table A.27. constant-role-mapper Attributes Attribute Description roles The list of roles that will be returned. Table A.28. credential-store Attributes Attribute Description create Specifies whether the credential store should create storage when it does not exist. The default values is false . credential-reference The reference to the credential used to create protection parameter. This can be in clear text or as a reference to a credential stored in a credential-store . implementation-properties Map of credentials store implementation-specific properties. modifiable Whether you can modify the credential store. The default value is true . other-providers The name of the providers to obtain the providers to search for the one that can create the required Jakarta Connectors objects within the credential store. This is valid only for keystore-based credential store. If this is not specified, then the global list of providers is used instead. path The file name of the credential store. provider-name The name of the provider to use to instantiate the CredentialStoreSpi . If the provider is not specified, then the first provider found that can create an instance of the specified type will be used. providers The name of the providers to obtain the providers to search for the one that can create the required credential store type. If this is not specified, then the global list of providers is used instead. relative-to The base path this credential store path is relative to. type Type of the credential store, for example, KeyStoreCredentialStore . Table A.29. credential-store alias Attribute Description entry-type Type of credential entry stored in the credential store. secret-value Secret value such as password. Table A.30. credential-store KeyStoreCredentialStore implementation properties Attribute Description cryptoAlg Cryptographic algorithm name to be used to encrypt decrypt entries at external storage. This attribute is only valid if external is enabled. Defaults to AES . external Whether data is stored to external storage and encrypted by the keyAlias . Defaults to false . externalPath Specifies path to external storage. This attribute is only valid if external is enabled. keyAlias The secret key alias within the credential store that is used to encrypt or decrypt data to the external storage. keyStoreType The keystore type, such as PKCS11 . Defaults to KeyStore.getDefaultType() . Table A.31. custom-credential-security-factory Attributes Attribute Description class-name The class name of the implementation of the custom security factory. configuration The optional key and value configuration for the custom security factory. module The module to use to load the custom security factory. Table A.32. custom-modifiable-realm Attributes Attribute Description class-name The class name of the implementation of the custom realm. configuration The optional key and value configuration for the custom realm. module The module to use to load the custom realm. Table A.33. custom-permission-mapper Attributes Attribute Description class-name Fully qualified class name of the permission mapper. configuration The optional key and value configuration for the permission mapper. module Name of the module to use to load the permission mapper. Table A.34. custom-principal-decoder Attributes Attribute Description class-name Fully qualified class name of the principal decoder. configuration The optional key and value configuration for the principal decoder. module Name of the module to use to load the principal decoder. Table A.35. custom-principal-transformer Attributes Attribute Description class-name Fully qualified class name of the principal transformer. configuration The optional key and value configuration for the principal transformer. module Name of the module to use to load the principal transformer. Table A.36. custom-realm Attributes Attribute Description class-name Fully qualified class name of the custom realm. configuration The optional key and value configuration for the custom realm. module Name of the module to use to load the custom realm. Table A.37. custom-realm-mapper Attributes Attribute Description class-name Fully qualified class name of the realm mapper. configuration The optional key and value configuration for the realm mapper. module Name of the module to use to load the realm mapper. Table A.38. custom-role-decoder Attributes Attribute Description class-name Fully qualified class name of the role decoder. configuration The optional key and value configuration for the role decoder. module Name of the module to use to load the role decoder. Table A.39. custom-role-mapper Attributes Attribute Description class-name Fully qualified class name of the role mapper. configuration The optional key and value configuration for the role mapper. module Name of the module to use to load the role mapper. Table A.40. dir-context Attributes Attribute Description authentication-context The authentication context to obtain login credentials to connect to the LDAP server. Can be omitted if authentication-level is none , which is equivalent to anonymous authentication. authentication-level The authentication level, meaning security level or authentication mechanism, to use. Corresponds to SECURITY_AUTHENTICATION or java.naming.security.authentication environment property. Allowed values are none , simple and sasl_mech format. The sasl_mech format is a space-separated list of SASL mechanism names. connection-timeout The timeout for connecting to the LDAP server in milliseconds. credential-reference The credential reference to authenticate and connect to the LDAP server. This can be omitted if authentication-level is none , which is equivalent to anonymous authentication. enable-connection-pooling If true connection pooling is enabled. This defaults to false . module Name of module that will be used as the class loading base. principal The principal to authenticate and connect to the LDAP server. This can be omitted if authentication-level is none which is equivalent to anonymous authentication. properties The additional connection properties for the DirContext . read-timeout The read timeout for an LDAP operation in milliseconds. referral-mode The mode used to determine if referrals should be followed. Allowed values are FOLLOW , IGNORE , and THROW . This defaults to IGNORE . ssl-context The name of the SSL context used to secure connection to the LDAP server. url The connection URL. Table A.41. expression=encryption Attributes Attribute Description default-resolver Optional attribute. The resolver to use when an encrypted expression is defined without one. For example if you set "exampleResolver" as the default-resolver and you create an encrypted expression with the command /subsystem=elytron/expression=encryption:create-expression(clear-text=TestPassword) , Elytron uses "exampleResolver" as the resolver for this encrypted expression. prefix The prefix to use within an encrypted expression. Default is ENC . This attribute is provided for those cases where ENC might already be defined. You shouldn't change this value unless it conflicts with an already defined ENC prefix. resolvers A list of defined resolvers. A resolver has the following attributes: name - The name of the individual configuration used to reference it. credential-store - Reference to the credential store instance that contains the secret key this resolver uses. secret-key - The alias of the secret key Elytron should use from within a given credential store. Table A.42. filesystem-realm Attributes Attribute Description encoded Whether the identity names should be stored encoded (Base32) in file names. levels The number of levels of directory hashing to apply. The default value is 2 . path The path to the file containing the realm. relative-to The predefined relative path to use with path . For example jboss.server.config.dir . Table A.43. filtering-key-store Attributes Attribute Description alias-filter A filter to apply to the aliases returned from the key-store . It can either be a comma-separated list of aliases to return or one of the following formats: ALL:-alias1:-alias2 NONE:+alias1:+alias2 Note The alias-filter attribute is case sensitive. Because the use of mixed-case or uppercase aliases, such as elytronAppServer , might not be recognized by some keystore providers, it is recommended to use lowercase aliases, such as elytronappserver . key-store Reference to the key-store to filter. Table A.44. generate-key-pair attributes Attribute Description algorithm Specifies the encryption algorithm, such as RSA, DSA, or EC. The default value is RSA. size Specifies the size of the private key in bits. The default size values in bits for the key pair types are as follows: RSA is 2048 ; DSA is 2048 ; and EC is 256 . Table A.45. http-authentication-factory Attributes Attribute Description http-server-mechanism-factory The HttpServerAuthenticationMechanismFactory to associate with this resource. mechanism-configurations The list of mechanism-specific configurations. security-domain The security domain to associate with this resource. Table A.46. http-authentication-factory mechanism-configurations Attributes Attribute Description credential-security-factory The security factory to use to obtain a credential as required by the mechanism. final-principal-transformer A final principal transformer to apply for this mechanism realm. host-name The host name this configuration applies to. mechanism-name This configuration will only apply where a mechanism with the name specified is used. If this attribute is omitted then this will match any mechanism name. mechanism-realm-configurations The list of definitions of the realm names as understood by the mechanism. pre-realm-principal-transformer A principal transformer to apply before the realm is selected. post-realm-principal-transformer A principal transformer to apply after the realm is selected. protocol The protocol this configuration applies to. realm-mapper The realm mapper to be used by the mechanism. Table A.47. http-authentication-factory mechanism-configurations mechanism-realm-configurations Attributes Attribute Description final-principal-transformer A final principal transformer to apply for this mechanism realm. post-realm-principal-transformer A principal transformer to apply after the realm is selected. pre-realm-principal-transformer A principal transformer to apply before the realm is selected. realm-mapper The realm mapper to be used by the mechanism. realm-name The name of the realm to be presented by the mechanism. Table A.48. identity-realm Attributes Attribute Description attribute-name The name of the attribute associated with this identity. attribute-values The list of values associated with the identities attribute. identity The identity available from the security realm. Table A.49. import-key-pair attributes Attribute Description key-passphrase Optional attribute. Sets the passphrase to decrypt the private key. private-key-location The path to a file containing a private key. Only specify if you have not already specified the private-key-string attribute. private-key-string Sets the private key as a string. Only specify if you have not already specified the private-key-location attribute. public-key-location Required if private key is in any format other than OpenSSH. The path to a file containing a public key. Only specify if you have not already specified the public-key-string attribute. public-key-string Required if private key is in any format other than OpenSSH. Sets the public key as a string. Only specify if you have not already specified the public-key-location attribute. Table A.50. jaspi-configuration Attributes Attribute Description application-context Used when registering this configuration with the AuthConfigFactory . Can be omitted to allow wildcard matching. description Is used to provide a description to the AuthConfigFactory . layer Used when registering this configuration with the AuthConfigFactory . Can be omitted to allow wildcard matching. name A name that allows the resource to be referenced in the management model. Table A.51. jaspi-configuration server-auth-module Attributes Attribute Description class-name The fully qualified class name of the ServerAuthModule . flag The control flag to indicate how this module operates in relation to the other modules. module The module to load the ServerAuthModule from. options Configuration options to be passed into the ServerAuthModule on initialization. Table A.52. jdbc-realm Attributes Attribute Description principal-query The list of authentication queries used to authenticate users based on specific key types. Table A.53. jdbc-realm principal-query Attributes Attribute Description attribute-mapping The list of attribute mappings defined for this resource. bcrypt-mapper A key mapper that maps a column returned from a SQL query to a Bcrypt key type. clear-password-mapper A key mapper that maps a column returned from a SQL query to a clear password key type. This has a password-index child element that is the column index from an authentication query that represents the user password. data-source The name of the datasource used to connect to the database. salted-simple-digest-mapper A key mapper that maps a column returned from a SQL query to a Salted Simple Digest key type. scram-mapper A key mapper that maps a column returned from a SQL query to a SCRAM key type. simple-digest-mapper A key mapper that maps a column returned from a SQL query to a Simple Digest key type. sql The SQL statement used to obtain the keys as table columns for a specific user and map them accordingly with their type. Table A.54. jdbc-realm principal-query attribute-mapping Attributes Attribute Description index The column index from a query that representing the mapped attribute. to The name of the identity attribute mapped from a column returned from a SQL query. Table A.55. jdbc-realm principal-query bcrypt-mapper Attributes Attribute Description iteration-count-index The column index from an authentication query that represents the password's iteration count, if supported. password-index The column index from an authentication query that represents the user password. salt-index The column index from an authentication query that represents the password's salt, if supported. Table A.56. jdbc-realm principal-query salted-simple-digest-mapper Attributes Attribute Description algorithm The algorithm for a specific password key mapper. Allowed values are password-salt-digest-md5 , password-salt-digest-sha-1 , password-salt-digest-sha-256 , password-salt-digest-sha-384 , password-salt-digest-sha-512 , salt-password-digest-md5 , salt-password-digest-sha-1 , salt-password-digest-sha-256 , salt-password-digest-sha-384 , and salt-password-digest-sha-512 . The default is password-salt-digest-md5 . password-index The column index from an authentication query that represents the user password. salt-index The column index from an authentication query that represents the password's salt, if supported. Table A.57. jdbc-realm principal-query simple-digest-mapper Attributes Attribute Description algorithm The algorithm for a specific password key mapper. Allowed values are simple-digest-md2 , simple-digest-md5 , simple-digest-sha-1 , simple-digest-sha-256 , simple-digest-sha-384 , and simple-digest-sha-512 . The default is simple-digest-md5 . password-index The column index from an authentication query that represents the user password. Table A.58. jdbc-realm principal-query scram-mapper Attributes Attribute Description algorithm The algorithm for a specific password key mapper. The allowed values are scram-sha-1 and scram-sha-256 . The default value is scram-sha-256 . iteration-count-index The column index from an authentication query that represents the password's iteration count, if supported. password-index The column index from an authentication query that represents the user password. salt-index The column index from an authentication query that represents the password's salt, if supported. Table A.59. kerberos-security-factory Attributes Attribute Description debug If true the JAAS step of obtaining the credential will have debug logging enabled. Defaults to false . mechanism-names The mechanism names the credential should be usable with. Names will be converted to OIDs and used together with OIDs from mechanism-oids attribute. mechanism-oids The list of mechanism OIDs the credential should be usable with. minimum-remaining-lifetime The amount of time in seconds a cached credential can have before it is recreated. obtain-kerberos-ticket Should the KerberosTicket also be obtained and associated with the credential. This is required to be true where credentials are delegated to the server. options The Krb5LoginModule additional options. path The path of the keytab to load to obtain the credential. principal The principal represented by the keytab. relative-to The relative path to the keytab. request-lifetime How much lifetime should be requested for newly created credentials. required Whether the keytab file with an adequate principal is required to exist at the time the service starts. server If true this factory is used for the server-side portion of Kerberos authentication. If false it is used for the client-side. Defaults to true wrap-gss-credential Whether generated GSS credentials should be wrapped to prevent improper disposal. Table A.60. key-manager Attributes Attribute Description algorithm The name of the algorithm to use to create the underlying KeyManagerFactory . This is provided by the JDK. For example, a JDK that uses SunJSSE provides the PKIX and SunX509 algorithms. More details on SunJSSE can be found in the Java Secure Socket Extension (JSSE) Reference Guide . alias-filter A filter to apply to the aliases returned from the keystore. This can either be a comma-separated list of aliases to return or one of the following formats: ALL:-alias1:-alias2 NONE:+alias1:+alias2 credential-reference The credential reference to decrypt keystore item. This can be specified in clear text or as a reference to a credential stored in a credential-store . This is not a password of the keystore. key-store Reference to the key-store to use to initialize the underlying KeyManagerFactory . provider-name The name of the provider to use to create the underlying KeyManagerFactory . providers Reference to obtain the Provider[] to use when creating the underlying KeyManagerFactory . Table A.61. key-store Attributes Attribute Description alias-filter A filter to apply to the aliases returned from the keystore, can either be a comma separated list of aliases to return or one of the following formats: ALL:-alias1:-alias2 NONE:+alias1:+alias2 Note The alias-filter attribute is case sensitive. Because the use of mixed-case or uppercase aliases, such as elytronAppServer , might not be recognized by some keystore providers, it is recommended to use lowercase aliases, such as elytronappserver . credential-reference The password to use to access the keystore. This can be specified in clear text or as a reference to a credential stored in a credential-store . path The path to the keystore file. provider-name The name of the provider to use to load the keystore. Setting this attribute disables searching for the first provider that can create a keystore of the specified type. providers A reference to the providers that should be used to obtain the list of provider instances to search. If not specified, the global list of providers will be used instead. relative-to The base path this store is relative to. This can be a full path or predefined path such as jboss.server.config.dir . required If true the keystore file referenced is required to exist at the time the keystore service starts. The default value is false . type The type of the keystore, for example, JKS . Note The following keystore types are detected automatically: JKS JCEKS PKCS12 BKS BCFKS UBER You must manually specify the other keystore types. A full list of keystore types can be found in the Java Cryptography Architecture Standard Algorithm Name Documentation for JDK 8 . Table A.62. key-store-realm Attributes Attribute Description key-store Reference to the keystore used to back this security realm. Table A.63. ldap-key-store Attributes Attribute Description alias-attribute The name of LDAP attribute where the item alias will be stored. certificate-attribute The name of LDAP attribute where the certificate will be stored. certificate-chain-attribute The name of LDAP attribute where the certificate chain will be stored. certificate-chain-encoding The encoding of the certificate chain. certificate-type The type of the certificate. dir-context The name of the dir-context which will be used to communication with LDAP server. filter-alias The LDAP filter for obtaining an item in the keystore by alias. filter-certificate The LDAP filter for obtaining an item in the keystore by certificate. filter-iterate The LDAP filter for iterating over all items of the keystore. key-attribute The name of LDAP attribute where the key will be stored. key-type The type of keystore that is stored in a serialized manner in the LDAP attribute. For example, JKS . A full list of keystore types can be found in the Java Cryptography Architecture Standard Algorithm Name Documentation for JDK 8 . new-item-template Configuration for item creation. This defines how the LDAP entry of newly created keystore item will look. search-path The path in LDAP where the keystore items will be searched. search-recursive If the LDAP search should be recursive. search-time-limit The time limit in milliseconds for obtaining keystore items from LDAP. Defaults to 10000 . Table A.64. ldap-key-store new-item-template Attributes Attribute Description new-item-attributes The LDAP attributes which will be set for newly created items. This takes a list of items with name and value pairs. new-item-path The path in LDAP where the newly created keystore items will be stored. new-item-rdn The name of LDAP RDN for the newly created items. Table A.65. ldap-realm Attributes Attribute Description allow-blank-password Whether this realm supports blank password direct verification. A blank password attempt will be rejected otherwise. dir-context The name of the dir-context which will be used to connect to the LDAP server. direct-verification If true this realm supports verification of credentials by directly connecting to LDAP as the account being authenticated; otherwise, the password is retrieved from the LDAP server and verified in JBoss EAP. If enabled, the JBoss EAP server must be able to obtain the plain user password from the client, which requires either the PLAIN SASL or BASIC HTTP mechanism be used for authentication. Defaults to false . identity-mapping The configuration options that define how principals are mapped to their corresponding entries in the underlying LDAP server. Table A.66. ldap-realm identity-mapping Attributes Attribute Description attribute-mapping List of attribute mappings defined for this resource. filter-name The LDAP filter for getting identity by name. iterator-filter The LDAP filter for iterating over identities of the realm. new-identity-attributes The list of attributes of newly created identities and is required for modifiability of the realm. This is a list of name and value pair objects. otp-credential-mapper The credential mapping for OTP credential. new-identity-parent-dn The DN of parent of newly created identities. Required for modifiability of the realm. rdn-identifier The RDN part of the principal's DN to be used to obtain the principal's name from an LDAP entry. This is also used when creating new identities. search-base-dn The base DN to search for identities. use-recursive-search If true identity search queries are recursive. Defaults to false . user-password-mapper The credential mapping for a credential similar to userPassword. x509-credential-mapper The configuration allowing to use LDAP as storage of X509 credentials. If none of the -from child attributes are defined, then this configuration will be ignored. If more than one -from child attribute is defined, then the user certificate must match all the defined criteria. Table A.67. ldap-realm identity-mapping attribute-mapping Attributes Attribute Description extract-rdn The RDN key to use as the value for an attribute, in case the value in its raw form is in X.500 format. filter The filter to use to obtain the values for a specific attribute. filter-base-dn The name of the context where the filter should be performed. from The name of the LDAP attribute to map to an identity attribute. If not defined, DN of entry is used. reference The name of LDAP attribute containing DN of entry to obtain value from. role-recursion Maximum depth for recursive role assignment. Use 0 to specify no recursion. Defaults to 0 . role-recursion-name Determine the LDAP attribute of role entry which will be a substitute for "{0}" in filter-name when searching roles of role. search-recursive If true attribute LDAP search queries are recursive. Defaults to true . to The name of the identity attribute mapped from a specific LDAP attribute. If not provided, the name of the attribute is the same as define in from . If the from is not defined too, value dn is used. Table A.68. ldap-realm identity-mapping user-password-mapper Attributes Attribute Description from The name of the LDAP attribute to map to an identity attribute. If not defined, DN of entry is used. verifiable If true password can be used to verify the user. Defaults to true . writable If true password can be changed. Defaults to false . Table A.69. ldap-realm identity-mapping otp-credential-mapper Attributes Attribute Description algorithm-from The name of the LDAP attribute of OTP algorithm. hash-from The name of the LDAP attribute of OTP hash function. seed-from The name of the LDAP attribute of OTP seed. sequence-from The name of the LDAP attribute of OTP sequence number. Table A.70. ldap-realm identity-mapping x509-credential-mapper Attributes Attribute Description certificate-from The name of the LDAP attribute to map to an encoded user certificate. If not defined, encoded certificate will not be checked. digest-algorithm The digest algorithm, which is the hash function, used to compute digest of the user certificate. Will be used only if digest-from has been defined. digest-from The name of the LDAP attribute to map to a user certificate digest. If not defined, certificate digest will not be checked. serial-number-from The name of the LDAP attribute to map to a serial number of user certificate. If not defined, serial number will not be checked. subject-dn-from The name of the LDAP attribute to map to a subject DN of user certificate. If not defined, subject DN will not be checked. Table A.71. logical-permission-mapper Attributes Attribute Description left Reference to the permission mapper to use to the left of the operation. logical-operation The logical operation to use to combine the permission mappers. Allowed values are and , or , xor , and unless . right Reference to the permission mapper to use to the right of the operation. Table A.72. logical-role-mapper Attributes Attribute Description left Reference to a role mapper to be used on the left side of the operation. logical-operation The logical operation to be performed on the role mapper mappings. Allowed values are: and , minus , or , and xor . right Reference to a role mapper to be used on the right side of the operation. Table A.73. mapped-regex-realm-mapper Attributes Attribute Description delegate-realm-mapper The realm mapper to delegate to if there is no match using the pattern. pattern The regular expression which must contain at least one capture group to extract the realm from the name. realm-map Mapping of realm name extracted using the regular expression to a defined realm name. Table A.74. mechanism-provider-filtering-sasl-server-factory Attributes Attribute Description enabling If true no provider loaded mechanisms are enabled unless matched by one of the filters. This defaults to true . filters The list of filters to apply when comparing the mechanisms from the providers. A filter matches when all of the specified values match the mechanism and provider pair. sasl-server-factory Reference to a SASL server factory to be wrapped by this definition. Table A.75. mechanism-provider-filtering-sasl-server-factory filters Attributes Attribute Description mechanism-name The name of the SASL mechanism this filter matches with. provider-name The name of the provider this filter matches. provider-version The version to use when comparing the provider's version. version-comparison The equality to use when evaluating the Provider's version. The allowed values are less-than and greater-than . The default value is less-than . Table A.76. online-certificate-status-protocol Attributes Attribute Description responder Override the OCSP Responder URI resolved from the certificate. responder-certificate Alias for responder certificate located in responder-keystore or trust-manager keystore if responder-keystore is not defined. responder-keystore Alternative keystore for responder certificate. responder-certificate must be defined. prefer-crls When both OCSP and CRL mechanisms are configured, OCSP mechanism is called first. When prefer-crls is set to true , the CRL mechanism is called first. Table A.77. permission-set permission Attributes Attribute Description action The action to pass to the permission as it is constructed. class-name The fully qualified class name of the permission. module The module to use to load the permission. target-name The target name to pass to the permission as it is constructed. Table A.78. periodic-rotating-file-audit-log Attributes Attribute Description autoflush Specifies if the output stream requires flushing after every audit event. If you do not define the attribute, the value of the synchronized is the default value. format Use SIMPLE for human readable text format, or JSON for storing individual events in JSON . path Defines the location of the log files. relative-to Optional attribute. Defines the location of the log files. suffix Optional attribute. Adds a date suffix to a rotated log. You must use the java.time.format.DateTimeFormatter format. For example .yyyy-MM-dd . synchronized Default value is true . Specifies that the file descriptor gets synchronized after every audit event. Table A.79. properties-realm Attributes Attribute Description groups-attribute The name of the attribute in the returned AuthorizationIdentity that should contain the group membership information for the identity. groups-properties The properties file containing the users and their groups. users-properties The properties file containing the users and their passwords. Table A.80. properties-realm users-properties Attributes Attribute Description digest-realm-name The default realm name to use for digested passwords if one is not discovered in the properties file. path The path to the file containing the users and their passwords. The file should contain realm name declaration. plain-text If true the passwords in properties file stored in plain text. If false they are pre-hashed, taking the form of HEX( MD5( username \":\" realm \":\" password))) . Defaults to false . relative-to The predefined path the path is relative to. Table A.81. properties-realm groups-properties Attributes Attribute Description path The path to the file containing the users and their groups. relative-to The predefined path the path is relative to. Table A.82. provider-http-server-mechanism-factory Attributes providers The providers to use to locate the factories. If not specified, the globally registered list of providers will be used. Table A.83. provider-loader Attributes Attribute Description argument An argument to be passed into the constructor as the Provider is instantiated. class-names The list of the fully qualified class names of providers to load. These are loaded after the service-loader discovered providers, and any duplicates will be skipped. configuration The key and value configuration to be passed to the provider to initialize it. module The name of the module to load the provider from. path The path of the file to use to initialize the providers. relative-to The base path of the configuration file. Table A.84. provider-sasl-server-factory Attributes Attribute Description providers The providers to use to locate the factories. If not specified, the globally registered list of providers will be used. Table A.85. regex-principal-transformer Attributes Attribute Description pattern The regular expression to use to locate the portion of the name to be replaced. replace-all If true all occurrences of the pattern matched are replaced. If false only the first occurrence. is replaced. Defaults to false . replacement The value to be used as the replacement. Table A.86. regex-role-mapper Attributes Attribute Description pattern The regular expression to use to match roles. You can use group capturing if you want to use a portion of the original role in the replacement. For example, to capture a string after a hyphen in roles such as "app-admin", "batch-admin", use the pattern .*-([a-z]*)USD . replacement The string to replace the match. You can use a fixed string or refer to captured groups from the regular expression specified in the pattern attribute. For the example, in the pattern above, you can use USD1 to refer to the first captured group - which is the string "admin", for the roles "app-admin" and "batch-admin". keep-non-mapped Set the value to true to preserve the roles that do not match the regular expression specified in the pattern attribute. Table A.87. regex-validating-principal-transformer Attributes Attribute Description match If true the name must match the given pattern to make validation successful. If false the name must not match the given pattern to make validation successful. This defaults to true . pattern The regular expression to use for the principal transformer. Table A.88. sasl-authentication-factory Attributes Attribute Description mechanism-configurations The list of mechanism specific configurations. sasl-server-factory The SASL server factory to associate with this resource. security-domain The security domain to associate with this resource. Table A.89. sasl-authentication-factory mechanism-configurations Attributes Attribute Description credential-security-factory The security factory to use to obtain a credential as required by the mechanism. final-principal-transformer A final principal transformer to apply for this mechanism realm. host-name The host name this configuration applies to. mechanism-name This configuration will only apply where a mechanism with the name specified is used. If this attribute is omitted then this will match any mechanism name. mechanism-realm-configurations The list of definitions of the realm names as understood by the mechanism. protocol The protocol this configuration applies to. post-realm-principal-transformer A principal transformer to apply after the realm is selected. pre-realm-principal-transformer A principal transformer to apply before the realm is selected. realm-mapper The realm mapper to be used by the mechanism. Table A.90. sasl-authentication-factory mechanism-configurations mechanism-realm-configurations Attributes Attribute Description final-principal-transformer A final principal transformer to apply for this mechanism realm. post-realm-principal-transformer A principal transformer to apply after the realm is selected. pre-realm-principal-transformer A principal transformer to apply before the realm is selected. realm-mapper The realm mapper to be used by the mechanism. realm-name The name of the realm to be presented by the mechanism. Table A.91. secret-key-credential-store Attributes Attribute Description create Set the value to false if you do not want ELytron to create one if it doesn't already exist. Defaults to true . default-alias The alias name for a key generated by default. The default value is key . key-size The size of a generated key. The default size is 256 bits. You can set the value to one of the following: 128 192 256 path The path to the credential store. populate If a credential store does not contain a default-alias , this attribute indicates whether Elytron should create one. The default is true . relative-to A reference to a previously defined path that the attribute path is relative to. Table A.92. server-ssl-context Attributes Attribute Description authentication-optional If true rejecting of the client certificate by the security domain will not prevent the connection. This allows a fall through to use other authentication mechanisms, such as form login, when the client certificate is rejected by security domain. This has an effect only when the security domain is set. This defaults to false . cipher-suite-filter The filter to apply to specify the enabled cipher suites. This filter takes a list of items delimited by colons, commas, or spaces. Each item may be an OpenSSL-style cipher suite name, a standard SSL/TLS cipher suite name, or a keyword such as TLSv1.2 or DES . A full list of keywords as well as additional details on creating a filter can be found in the Javadoc for the CipherSuiteSelector class. The default value is DEFAULT , which corresponds to all known cipher suites that do not have NULL encryption and excludes any cipher suites that have no authentication. final-principal-transformer A final principal transformer to apply for this mechanism realm. key-manager Reference to the key managers to use within the SSLContext . maximum-session-cache-size The maximum number of SSL/TLS sessions to be cached. need-client-auth If true a client certificate is required on SSL handshake. Connection without trusted client certificate will be rejected. This defaults to false . post-realm-principal-transformer A principal transformer to apply after the realm is selected. pre-realm-principal-transformer A principal transformer to apply before the realm is selected. protocols The enabled protocols. Allowed options are SSLv2 , SSLv3 , TLSv1 , TLSv1.1 , TLSv1.2 , TLSv1.3 . This defaults to enabling TLSv1 , TLSv1.1 , TLSv1.2 , and TLSv1.3 . Warning Red Hat recommends that SSLv2, SSLv3, and TLSv1.0 be explicitly disabled in favor of TLSv1.1 or TLSv1.2 in all affected packages. provider-name The name of the provider to use. If not specified, all providers from providers will be passed to the SSLContext . providers The name of the providers to obtain the Provider[] to use to load the SSLContext . realm-mapper The realm mapper to be used for SSL authentication. security-domain The security domain to use for authentication during SSL/TLS session establishment. session-timeout The timeout for SSL/TLS sessions. trust-manager Reference to the trust-manager to use within the SSLContext. use-cipher-suites-order If true the cipher suites order defined on the server will be used. If false the cipher suites order presented by the client will be used. Defaults to true . want-client-auth If true a client certificate will be requested, but not required, on SSL handshake. If a security domain is referenced and supports X509 evidence, this will be set to true automatically. This is ignored when need-client-auth is set. This defaults to false . wrap If true , the returned SSLEngine , SSLSocket , and SSLServerSocket instances will be wrapped to protect against further modification. This defaults to false . Note The realm mapper and principal transformer attributes for a server-ssl-context apply only for the SASL EXTERNAL mechanism, where the certificate is verified by the trust manager. HTTP CLIENT-CERT authentication settings are configured in an http-authentication-factory . Table A.93. service-loader-http-server-mechanism-factory Attributes Attribute Description module The module to use to obtain the class loader to load the factories. If not specified the class loader to load the resource will be used instead. Table A.94. service-loader-sasl-server-factory Attributes Attribute Description module The module to use to obtain the class loader to load the factories. If not specified the class loader to load the resource will be used instead. Table A.95. simple-permission-mapper Attributes Attribute Description mapping-mode The mapping mode that should be used in the event of multiple matches. Allowed values are , and , or , xor , unless , and first . The default is first . permission-mappings The list of defined permission mappings. Table A.96. simple-permission-mapper permission-mappings Attributes Attribute Description permission-sets The permission sets to assign in the event of a match. Permission sets can be used to assign permissions to an identity. permission-sets can take the following attribute: permission-set A reference to a permission set. Important The permissions attribute is deprecated, and is replaced by permission-sets . principals The list of principals to compare when mapping permissions, if the identities principal matches any one in the list it is a match. roles The list of roles to compare when mapping permissions, if the identity is a member of any one in the list it is a match. Table A.97. simple-regex-realm-mapper Attributes Attribute Description delegate-realm-mapper The realm mapper to delegate to if there is no match using the pattern. pattern The regular expression which must contain at least one capture group to extract the realm from the name. Table A.98. simple-role-decoder Attributes Attribute Description attribute The name of the attribute from the identity to map directly to roles. Table A.99. source-address-role-decoder Attributes Attribute Description pattern A regular expression that specifies the IP address of a client or the IP addresses of clients to match. source-address Specifies the IP address of the client. roles Provides the list of roles to assign to a user if the IP address of the client matches the values specified in the pattern attribute or the source-address attribute. Note You must specify at least one IP address in either the source-address attribute or the pattern attribute. Otherwise, you cannot make authorization decisions based on the IP address of a client. Table A.100. syslog-audit-log Attributes Attribute Description format The format that audit events should be recorded in. Supported values: JSON SIMPLE Default value: SIMPLE host-name The host name to be be embedded into all events sent to the syslog server. port The listening port on the syslog server. reconnect-attempts The maximum number of times that Elytron will attempt to send successive messages to a syslog server before closing the connection. The value of this attribute is only valid when the transmission protocol used is UDP. Supported values: Any positive integer value. -1 indicates infinite reconnect attempts. Default value: 0 server-address IP address of the syslog server, or a name that can be resolved by Java's InetAddress.getByName() method. ssl-context The SSL context to use when connecting to the syslog server. This attribute is only required if transport is set to SSL_TCP . syslog-format The RFC format to be used for describing the audit event. Supported values: RFC3164 RFC5424 Default value: RFC5424 transport The transport layer protocol to use to connect to the syslog server. Supported values: SSL_TCP TCP UDP Default value: TCP Table A.101. File audit logger attributes Attribute Description autoflush Specifies if the output stream requires flushing after every audit event. If you do not define the attribute, the value of the synchronized is the default value. format Default value is SIMPLE . Use SIMPLE for human readable text format, or JSON for storing individual events in JSON . path Defines the location of the log files relative-to Optional attribute. Defines the location of the log files synchronized Default value is true . Specifies that the file descriptor gets synchronized after every audit event. Table A.102. Size rotating file audit logging attributes Attribute Description autoflush Specifies if the output stream requires flushing after every audit event. If you do not define the attribute, the value of the synchronized is the default value. format Default value is SIMPLE . Use SIMPLE for human readable text format, or JSON for storing individual events in JSON . max-backup-index The maximum number of files to back up when rotating. The default value is 1 . path Defines the location of the log files. relative-to Optional attribute. Defines the location of the log files. rotate-on-boot By default, Elytron does not create a new log file when you restart a server. Set this attribute to true to rotate the log on server restart. rotate-size The maximum size that the log file can reach before Elytron rotates the log. The default is 10m for 10 megabytes. You can also define the maximum size of the log with k, g, b, or t units. You can specify units in either uppercase or lowercase characters. suffix Optional attribute. Adds a date suffix to a rotated log. You must use the java.text.format.DateTimeFormatter format. For example .yyyy-MM-dd-HH . synchronized Default value is true . Specifies that the file descriptor gets synchronized after every audit event. Table A.103. token-realm Attributes Attribute Description jwt A token validator to be used in conjunction with a token-based realm that handles security tokens based on the JWT/JWS standard. oauth2-introspection A token validator to be used in conjunction with a token-based realm that handles OAuth2 Access Tokens and validates them using an endpoint compliant with the RFC-7662 OAuth2 Token Introspection specification. principal-claim The name of the claim that should be used to obtain the principal's name. The default is username . Table A.104. token-realm jwt Attributes Attribute Description audience A list of strings representing the audiences supported by this configuration. During validation JWT tokens must have an aud claim that contains one of the values defined here. certificate The name of the certificate with a public key to load from the keystore that is defined by the key-store attribute. client-ssl-context The SSL context to use for a remote JSON Web Key (JWK) . This enables you to use the URL from the jku (JSON Key URL) header parameter to fetch public keys for token verification. host-name-verification-policy A policy that defines how host names should be verified when using remote JSON Web Keys. You can set either of the following values for the attribute: ANY , which disables hostname verification. DEFAULT , which denies connections where a certificate mismatch occurs between a server name from the certificate and the connecting host. issuer A list of strings representing the issuers supported by this configuration. During validation JWT tokens must have an iss claim that contains one of the values defined here. key-store The keystore from which the certificate with a public key should be loaded. This attribute, along with the certificate attribute, can also be used as an alternative to the public-key . public-key A public key in PEM Format. During validation, if a public key is provided, the signature will be verified based on the key value provided by this attribute. Alternatively, you can define a key-store and a certificate to configure the public key. This alternative key is used to verify tokens without the kid (Key ID) claim. Table A.105. token-realm oauth2-introspection Attributes Attribute Description client-id The identifier of the client on the OAuth2 Authorization Server. client-secret The secret of the client. client-ssl-context The SSL context to be used if the introspection endpoint is using HTTPS. host-name-verification-policy A policy that defines how host names should be verified when using HTTPS. You can set either of the following values for the attribute: ANY , which disables hostname verification. DEFAULT , which denies connections where a certificate mismatch occurs between a server name from the certificate and the connecting host. introspection-url The URL of token introspection endpoint. Table A.106. trust-manager Attributes Attribute Description algorithm The name of the algorithm to use to create the underlying TrustManagerFactory . This is provided by the JDK. For example, a JDK that uses SunJSSE provides the PKIX and SunX509 algorithms. More details on SunJSSE can be found in the Java Secure Socket Extension (JSSE) Reference Guide . alias-filter A filter to apply to the aliases returned from the keystore. This can either be a comma-separated list of aliases to return or one of the following formats: ALL:-alias1:-alias2 NONE:+alias1:+alias2 certificate-revocation-list Enables the certificate revocation list that can be checked by a trust manager. The attributes of certificate-revocation-list are: maximum-cert-path - The maximum number of non-self-issued intermediate certificates that can exist in a certification path. The default value is 5 . (Deprecated. Use maximum-cert-path in trust-manager ). path - The path to the configuration file that is used to initialize the provider. relative-to - The base path of the certificate revocation list file. See Using a Certificate Revocation List for more information. key-store Reference to the key-store to use to initialize the underlying TrustManagerFactory . maximum-cert-path The maximum number of non-self-issued intermediate certificates that can exist in a certification path. The default value is 5 . This attribute has been moved to trust-manager from certificate-revocation-list inside trust-manager in JBoss EAP 7.3. For backward compatibility, the attribute is also present in certificate-revocation-list . Going forward, use maximum-cert-path in trust-manager . Note Define maximum-cert-path in either trust-manager or in certificate-revocation-list not in both. only-leaf-cert Check revocation status of only the leaf certificate. This is an optional attribute. The default values is false . provider-name The name of the provider to use to create the underlying TrustManagerFactory . providers Reference to obtain the Provider[] to use when creating the underlying TrustManagerFactory . soft-fail When set to true , certificates with an unknown revocation status are accepted. This is an optional attribute. The default value is false . Table A.107. x500-attribute-principal-decoder Attributes Attribute Description attribute-name The name of the X.500 attribute to map. This can also be defined using the oid attribute. convert When set to true , the principal decoder will attempt to convert a principal to a X500Principal , if it is not already of that type. If the conversion fails, the original value is used as the principal. joiner The joining string. The default value is a period ( . ). maximum-segments The maximum number of occurrences of the attribute to map. The default value is 2147483647 . oid The OID of the X.500 attribute to map. This can also be defined using the attribute-name attribute. required-attributes The list of attribute names of the attributes that must be present in the principal required-oids The list of OIDs of the attributes that must be present in the principal. reverse If true the attribute values will be processed and returned in reverse order. The default value is false . start-segment The starting occurrence of the attribute you want to map. This uses a zero-based index and the default value is 0 . Table A.108. x509-subject-alternative-name-evidence-decoder Attributes Attribute Description alt-name-type The subject alternative name type. Must be one of the following subject alternative name types: directoryName dNSName iPAddress registeredID rfc822Name uniformResourceIdentifier This is a required attribute. segment The 0-based occurrence of the subject alternative name to map. This attribute is used when there is more than one subject alternative name of the given type. The default value is 0 . A.2. Configure Your Environment to use the BouncyCastle Provider You can configure your JBoss EAP installation to use a BouncyCastle provider. The Bouncy Castle JARs are not provided by Red Hat, and must be obtained directly from Bouncy Castle. Important Java 8 must be used when the BouncyCastle providers are specified, as the BouncyCastle APIs are only certified up to Java 8. Include both BouncyCastle JARs, beginning with bc-fips and bctls-fips , on your JDK's classpath. For Java 8 this is accomplished by placing the JAR files in USDJAVA_HOME/lib/ext . Using either of the following methods, include the BouncyCastle providers in your Java security configuration file: A default configuration file, java.security , is provided in your JDK, and can be updated to include the BouncyCastle providers. This file is used if no other security configuration files are specified. See the JDK vendor's documentation for the location of this file. Define a custom Java security configuration file and reference it by adding the -Djava.security.properties== /path/to/ java.security.properties system property. When referenced using two equal signs the default policy is overwritten, and only the providers defined in the referenced file are used. When a single equal sign is used, as in -Djava.security.properties= /path/to/ java.security.properties , then the providers are appended to the default security file, preferring to use the file passed in the argument when keys are specified in both files. This option is useful when having multiple JVMs running on the same host that require different security settings. An example configuration file that defines these providers is seen below. Example: BouncyCastle Security Policy Important If the default configuration file is updated, then every other security.provider.X line in this file, for example security.provider.2 , must increase its value of X to ensure that this provider is given priority. Each provider must have a unique priority. Configure the elytron subsystem to exclusively use the BouncyCastle providers. By default, the system is configured to use both the elytron and openssl providers. Because it also includes a TLS implementation, it is recommended to disable the OpenSSL provider to ensure the TLS implementation from Bouncy Castle is used. Reload the server for the changes to take effect. A.3. SASL Authentication Mechanisms Reference A.3.1. Support Level for SASL Authentication Mechanisms Name Support Level Comments ANONYMOUS Supported DIGEST-SHA-512 Technology Preview Supported but name not currently IANA registered. DIGEST-SHA-256 Technology Preview Supported but name not currently IANA registered. DIGEST-SHA Technology Preview Supported but name not currently IANA registered. DIGEST-MD5 Supported EXTERNAL Supported GS2-KRB5 Supported GS2-KRB5-PLUS Supported GSSAPI Supported JBOSS-LOCAL-USER Supported Supported but name not currently IANA registered. OAUTHBEARER Supported OTP Not supported PLAIN Supported SCRAM-SHA-1 Supported SCRAM-SHA-1-PLUS Supported SCRAM-SHA-256 Supported SCRAM-SHA-256-PLUS Supported SCRAM-SHA-384 Supported SCRAM-SHA-384-PLUS Supported SCRAM-SHA-512 Supported SCRAM-SHA-512-PLUS Supported 9798-U-RSA-SHA1-ENC Not supported 9798-M-RSA-SHA1-ENC Not supported 9798-U-DSA-SHA1 Not supported 9798-M-DSA-SHA1 Not supported 9798-U-ECDSA-SHA1 Not supported 9798-M-ECDSA-SHA1 Not supported A.3.2. SASL Authentication Mechanism Properties You can see a list of standard Java SASL authentication mechanism properties in the Java documentation . Other JBoss EAP-specific SASL authentication mechanism properties are listed in the following tables. Table A.109. SASL Properties Used During SASL Mechanism Negotiation or Authentication Exchange Property Client / Server Description com.sun.security.sasl.digest.realm Server Used by some SASL mechanisms, including the DIGEST-MD5 algorithm supplied with most Oracle JDKs, to provide the list of possible server realms to the mechanism. Each realm name must be separated by a space character ( U+0020 ). com.sun.security.sasl.digest.utf8 Client, server Used by some SASL mechanisms, including the DIGEST-MD5 algorithm supplied with most Oracle JDKs, to indicate that information exchange should take place using UTF-8 character encoding instead of the default Latin-1/ISO-8859-1 encoding. The default value is true . wildfly.sasl.authentication-timeout Server The amount of time, in seconds, after which a server should terminate an authentication attempt. The default value is 150 seconds. wildfly.sasl.channel-binding-required Client, server Indicates that a mechanism which supports channel binding is required. A value of true indicates that channel binding is required. Any other value, or lack of this property, indicates that channel binding is not required. wildfly.sasl.digest.alternative_protocols Server Supplies a separated list of alternative protocols that are acceptable in responses received from the client. The list can be space, comma, tab, or new line separated. wildfly.sasl.gssapi.client.delegate-credential Client Specifies if the GSSAPI mechanism supports credential delegation. If set to true , the credential is delegated from the client to the server. This property defaults to true if a GSSCredential is provided using the javax.security.sasl.credentials property. Otherwise, the default value is false . wildfly.sasl.gs2.client.delegate-credential Client Specifies if the GS2 mechanism supports credential delegation. If set to true , the credential is delegated from the client to the server. This property defaults to true if a GSSCredential is provided using a CredentialCallback . Otherwise, the default value is false . wildfly.sasl.local-user.challenge-path Server Specifies the directory in which the server generates the challenge file. The default value is the java.io.tmpdir system property. wildfly.sasl.local-user.default-user Server The user name to use for silent authentication. wildfly.sasl.local-user.quiet-auth Client Enables silent authentication for a local user. The default value is true . Note that the Jakarta Enterprise Beans client and naming client disables silent local authentication if this property is not explicitly defined and a callback handler or user name was specified in the client configuration. wildfly.sasl.local-user.use-secure-random Server Specifies whether the server uses a secure random number generator when creating the challenge. The default value is true . wildfly.sasl.mechanism-query-all Client, server Indicates that all possible supported mechanism names should be returned, regardless of the presence or absence of any other properties. This property is only effective on calls to SaslServerFactory#getMechanismNames(Map) or SaslClientFactory#getMechanismNames(Map) for Elytron-provided SASL factories. wildfly.sasl.otp.alternate-dictionary Client Provides an alternate dictionary to the OTP SASL mechanism. Each dictionary word must be separated by a space character ( U+0020 ). wildfly.sasl.relax-compliance Server The specifications for the SASL mechanisms mandate certain behavior and verification of that behavior at the opposite side of the connection. When interacting with other SASL mechanism implementations, some of these requirements are interpreted loosely. If this property is set to true , checking is relaxed where differences in specification interpretation has been identified. The default value is false . wildfly.sasl.scram.min-iteration-count Client, server The minimum iteration count to use for SCRAM. The default value is 4096 . wildfly.sasl.scram.max-iteration-count Client, server The maximum iteration count to use for SCRAM. The default value is 32786 . wildfly.sasl.secure-rng Client, server The algorithm name of a SecureRandom implementation to use. Using this property can improve security, at the cost of performance. wildfly.security.sasl.digest.ciphers Client, server Comma-separated list of supported ciphers that directly limits the set of supported ciphers for SASL mechanisms. Table A.110. SASL Properties Used After Authentication Property Client / Server Description wildfly.sasl.principal Client Contains the negotiated client principal after a successful SASL client-side authentication. wildfly.sasl.security-identity Server Contains the negotiated security identity after a successful SASL server-side authentication. A.4. Security Authorization Arguments Arguments to the security commands in JBoss EAP are determined by the defined mechanism. Each mechanism requires different properties, and it is recommended to use tab completion to examine the various requirements for the defined mechanism. Table A.111. Universal Arguments Attribute Description --mechanism Specifies the mechanism to enable or disable. A list of supported SASL mechanisms is available at Support Level for SASL Authentication Mechanisms , and the BASIC , CLIENT_CERT , DIGEST , DIGEST-SHA-256 , and FORM HTTP authentication mechanisms are currently supported. --no-reload If specified, then the server is not reloaded after the security command is completed. Mechanism Specific Attributes The following attributes are only eligible for specific mechanisms. They are grouped below based on their function. Table A.112. key-store Realm Attribute Description --key-store-name The name of the truststore as an existing keystore. This must be specified if --key-store-realm-name is not used for the EXTERNAL SASL mechanism or the CLIENT_CERT HTTP mechanism. --key-store-realm-name The name of the truststore as an existing keystore realm. This must be specified if --key-store-name is not used for the EXTERNAL SASL mechanism or the CLIENT_CERT HTTP mechanism. --roles An optional argument that defines a comma separated list of roles associated with the current identity. If no existing role mapper contains the specified list of roles, then a role mapper will be generated and assigned. Table A.113. file-system Realm Attribute Description --exposed-realm The realm exposed to the user. --file-system-realm-name The name of the filesystem realm. --user-role-decoder The name of the role decoder used to extract the roles from the user's repository. This attribute is only used if --file-system-realm-name is specified. Table A.114. Properties Realm Attribute Description --exposed-realm The realm exposed to the user. This value must match the realm-name defined in the user's properties file. --groups-properties-file A path to the properties file that contains the groups attribute for management operations, or the roles for the undertow server. --properties-realm-name The name of an existing properties realm. --relative-to Adjusts the paths of --group-properties-file and --users-properties-file to be relative to a system property. --users-properties-file A path to the properties file that contains the user details. Table A.115. Miscellaneous Properties Attribute Description --management-interface The management interface to configure for management authentication commands. This defaults to the http-interface . --new-auth-factory-name Used to specify a name for the authentication factory. If not defined, a name is automatically created. --new-realm-name Used to specify a name for the properties file realm resource. If not defined, a name is automatically created. --new-security-domain Used to specify a name for the security domain. If not defined, a name is automatically created. --super-user Configures a local user with super-user permissions. Usable with the JBOSS-LOCAL-USER mechanism. A.5. Elytron Client Side One Way Example After configuring a server SSL context, it is important to test the configuration if possible. An Elytron client SSL context can be placed in a configuration file and then executed from the management CLI, allowing functional testing of the server configuration. These steps assume that the server-side configuration is completed, and the server has been reloaded if necessary. If the server keystore already exists, then proceed to the step; otherwise, create the server keystore. If the server certificate has already been exported, then proceed to the step; otherwise, export the server certificate. Import the server certificate into the client's truststore. Define the client-side SSL context inside of example-security.xml . This configuration file contains an Elytron authentication-client that defines the authentication and SSL configuration for outbound connections. The following file demonstrates defining a client SSL context and keystore. <?xml version="1.0" encoding="UTF-8"?> <configuration> <authentication-client xmlns="urn:elytron:client:1.2"> <key-stores> <key-store name="clientStore" type="jks" > <file name="/path/to/client.truststore.jks"/> <key-store-clear-password password="secret" /> </key-store> </key-stores> <ssl-contexts> <ssl-context name="client-SSL-context"> <trust-store key-store-name="clientStore" /> </ssl-context> </ssl-contexts> <ssl-context-rules> <rule use-ssl-context="client-SSL-context" /> </ssl-context-rules> </authentication-client> </configuration> Using the management CLI, reference the newly created file and attempt to access the server. The following command accesses the management interface and executes the whoami command. A.6. Elytron Client Side Two Way Example After configuring a server SSL context, it is important to test the configuration if possible. An Elytron client SSL context can be placed in a configuration file and then executed from the management CLI, allowing functional testing of the server configuration. These steps assume that the server-side configuration is completed, and the server has been reloaded if necessary. If the server and client keystores already exist, then proceed to the step; otherwise, create the server and client keystores. If the server and client certificates have already been exported, then proceed to the step; otherwise, export the server and client certificates. Import the server certificate into the client's truststore. Import the client certificate into the server's truststore. Define the client-side SSL context inside of example-security.xml . This configuration file contains an Elytron authentication-client that defines the authentication and SSL configuration for outbound connections. The following file demonstrates defining a client SSL context and keystore. <?xml version="1.0" encoding="UTF-8"?> <configuration> <authentication-client xmlns="urn:elytron:client:1.2"> <key-stores> <key-store name="clientStore" type="jks" > <file name="/path/to/client.truststore.jks"/> <key-store-clear-password password="secret" /> </key-store> </key-stores> <key-store name="clientKeyStore" type="jks" > <file name="/path/to/client.keystore.jks"/> <key-store-clear-password password="secret" /> </key-store> <ssl-contexts> <ssl-context name="client-SSL-context"> <trust-store key-store-name="clientStore" /> <key-store-ssl-certificate key-store-name="clientKeyStore" alias="client"> <key-store-clear-password password="secret" /> </key-store-ssl-certificate> </ssl-context> </ssl-contexts> <ssl-context-rules> <rule use-ssl-context="client-SSL-context" /> </ssl-context-rules> </authentication-client> </configuration> Using the management CLI, reference the newly created file and attempt to access the server. The following command accesses the management interface and executes the whoami command. Revised on 2024-01-17 05:25:10 UTC

Commands:
We can override the values in the JRE_HOME/lib/security/java.security file here. If both properties files specify values for the same key, the value from the command-line properties file is selected, as it is the last one loaded. We can reorder and change security providers in this file. security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS security.provider.3=sun.security.provider.Sun security.provider.4=com.sun.crypto.provider.SunJCE This is a comma-separated list of algorithm and/or algorithm:provider entries. # securerandom.strongAlgorithms=DEFAULT:BCFIPS
/subsystem=elytron:write-attribute(name=final-providers,value=elytron)
reload
keytool -genkeypair -alias localhost -keyalg RSA -keysize 1024 -validity 365 -keystore server.keystore.jks -dname "CN=localhost" -keypass secret -storepass secret
keytool -exportcert -keystore server.keystore.jks -alias localhost -keypass secret -storepass secret -file server.cer
keytool -importcert -keystore client.truststore.jks -storepass secret -alias localhost -trustcacerts -file server.cer
<?xml version="1.0" encoding="UTF-8"?> <configuration> <authentication-client xmlns="urn:elytron:client:1.2"> <key-stores> <key-store name="clientStore" type="jks" > <file name="/path/to/client.truststore.jks"/> <key-store-clear-password password="secret" /> </key-store> </key-stores> <ssl-contexts> <ssl-context name="client-SSL-context"> <trust-store key-store-name="clientStore" /> </ssl-context> </ssl-contexts> <ssl-context-rules> <rule use-ssl-context="client-SSL-context" /> </ssl-context-rules> </authentication-client> </configuration>
EAP_HOME /bin/jboss-cli.sh -c --controller=remote+https://127.0.0.1:9993 -Dwildfly.config.url=/path/to/example-security.xml :whoami
keytool -genkeypair -alias localhost -keyalg RSA -keysize 1024 -validity 365 -keystore server.keystore.jks -dname "CN=localhost" -keypass secret -storepass secret keytool -genkeypair -alias client -keyalg RSA -keysize 1024 -validity 365 -keystore client.keystore.jks -dname "CN=client" -keypass secret -storepass secret
keytool -exportcert -keystore server.keystore.jks -alias localhost -keypass secret -storepass secret -file server.cer keytool -exportcert -keystore client.keystore.jks -alias client -keypass secret -storepass secret -file client.cer
keytool -importcert -keystore client.truststore.jks -storepass secret -alias localhost -trustcacerts -file server.cer
keytool -importcert -keystore server.truststore.jks -storepass secret -alias client -trustcacerts -file client.cer
<?xml version="1.0" encoding="UTF-8"?> <configuration> <authentication-client xmlns="urn:elytron:client:1.2"> <key-stores> <key-store name="clientStore" type="jks" > <file name="/path/to/client.truststore.jks"/> <key-store-clear-password password="secret" /> </key-store> </key-stores> <key-store name="clientKeyStore" type="jks" > <file name="/path/to/client.keystore.jks"/> <key-store-clear-password password="secret" /> </key-store> <ssl-contexts> <ssl-context name="client-SSL-context"> <trust-store key-store-name="clientStore" /> <key-store-ssl-certificate key-store-name="clientKeyStore" alias="client"> <key-store-clear-password password="secret" /> </key-store-ssl-certificate> </ssl-context> </ssl-contexts> <ssl-context-rules> <rule use-ssl-context="client-SSL-context" /> </ssl-context-rules> </authentication-client> </configuration>
EAP_HOME /bin/jboss-cli.sh -c --controller=remote+https://127.0.0.1:9993 -Dwildfly.config.url=/path/to/example-security.xml :whoami