Chapter 3. Configuring Elytron with identity realm to allow easy authentication and authorization for local users You can use an identity-realm provided by Elytron to allow local users to connect to JBoss EAP management interfaces. The JBoss EAP management CLI is preconfigured to use an identity-realm named local . This allows local users to connect without having to provide credentials. An identity realm can only be used with the JBOSS-LOCAL-USER mechanism. 3.1. Securing a management interface with an identity realm You can secure a management interface by using an identity-realm security realm with the JBOSS-LOCAL-USER mechanism. Prerequisites JBoss EAP is running. Procedure Create a local identity-realm . Syntax Example Optional If you want to use a name for your local identity-realm other than USDlocal , change the value of wildfly.sasl.local-user.default-user property in the attribute configurable-sasl-server-factory= <sasl_server_factory> . Syntax Example Create a security domain that references the identity-realm that you created. Syntax Example Add SASL Authentication factory. Syntax Example Enable SASL Authentication factory for your management interface. Syntax Example Reload your management interface. Additional resources identity-realm attributes security-domain attributes sasl-authentication-factory attributes

Commands:
/subsystem=elytron/identity-realm=<local_identity_realm_name>:add(identity="USDlocal",attribute-name= <attribute_name> ,attribute-values= <attribute_value> )
/subsystem=elytron/identity-realm=exampleLocalIdentityRealm:add(identity="USDlocal",attribute-name=AttributeName,attribute-values=Value)
/subsystem=elytron/configurable-sasl-server-factory= <sasl_server_factory> :write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => " <new_local_username> ", "wildfly.sasl.local-user.challenge-path" => expression "USD{jboss.server.temp.dir}/auth"})
/subsystem=elytron/configurable-sasl-server-factory=configured:write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => "john", "wildfly.sasl.local-user.challenge-path" => expression "USD{jboss.server.temp.dir}/auth"})
/subsystem=elytron/security-domain=<security_domain_name>:add(default-realm=<local_identity_realm_name>,permission-mapper= <permission_mapper_name> ,realms=[{realm=<Local_identity_realm_name>}])
/subsystem=elytron/security-domain=exampleSecurityDomain:add(default-realm=exampleLocalIdentityRealm,permission-mapper=default-permission-mapper,realms=[{realm=exampleLocalIdentityRealm}])
/subsystem=elytron/sasl-authentication-factory=<sasl_auth_factory_name>:add(security-domain=<security_domain_name>,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}])
/subsystem=elytron/sasl-authentication-factory=exampleSaslAuthenticationFactory:add(security-domain=exampleSecurityDomain,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}])
/core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=<sasl_auth_factory_name>})
/core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=exampleSaslAuthenticationFactory})
reload