WildFly Management API Configuration

In process migration from https://home.feodorov.com:9443/wiki/Wiki.jsp?page=JBoss7ManagementConfiguration

Internal

• WildFly Configuration
• WildFly Security Realms
• Managment Interfaces

Relevance

• EAP 6

Overview

    ...

    <management>

        <security-realms>

            <security-realm name="ManagementRealm">
                <authentication>
                    <local default-user="$local" skip-group-loading="true"/>
                    <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
                </authentication>
                <authorization map-groups-to-roles="false">
                    <properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
                </authorization>
            </security-realm>

            <security-realm name="ApplicationRealm">
                <authentication>
                    <local default-user="$local" allowed-users="*" skip-group-loading="true"/>
                    <properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
                </authentication>
                <authorization>
                    <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
                </authorization>
            </security-realm>

        </security-realms>

        <audit-log>
            <formatters>
                <json-formatter name="json-formatter"/>
            </formatters>
            <handlers>
                <file-handler name="file" formatter="json-formatter" relative-to="jboss.server.data.dir" path="audit-log.log"/>
            </handlers>
            <logger log-boot="true" log-read-only="false" enabled="false">
                <handlers>
                    <handler name="file"/>
                </handlers>
            </logger>
        </audit-log>

        <management-interfaces>

            <http-interface security-realm="ManagementRealm" http-upgrade-enabled="true">
                <socket-binding http="management-http"/>
            </http-interface>

            <!-- Optional -->
            <!--
            <native-interface security-realm="ManagementRealm">
                <socket-binding native="management-native"/>
            </native-interface>
            -->

        </management-interfaces>

        <access-control provider="simple">
            <role-mapping>
                <role name="SuperUser">
                    <include>
                        <user name="$local"/>
                    </include>
                </role>
            </role-mapping>
        </access-control>
    </management>

   ...

Corresponding interfaces:

    ...
    <interfaces>
        <interface name="management">
            <inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
        </interface>
        ...
    </interfaces>
    ...

Corresponding socket bindings:

    ...
    <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
        <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
        <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
        <socket-binding name="management-native" interface="management" port="${jboss.management.native.port:9999}"/>
    </socket-binding-group>
    ...

Management Realm Configuration Files

The security information is maintained in flat files. The files are configured with <security-realm><authentication><properties> configuration element and their location is relative to jboss.server.config.dir, which could be $JBOSS_HOME/standalone/configuration or $JBOSS_HOME/domain/configuration, depending on the mode WildFly is run in (standalone or domain). For more details, see jboss.server.config.dir. The files can be modified at any time, updates after the server has started will be automatically detected.

mgmt-users.properties

mgmt-users.properties stores usernames and hashed passwords. By default, the realm expects the entries to be in the format

username=HEX(MD5(username ':' realm':' password))

Users can be added with the utility scripts bin/add-user.sh, bin/add-user.bat.

Example:

#
admin=2a0923285184943425d1f53ddd58ec7a

mgmt-roles.properties

mgmt-roles.properties stores user-to-role mappings.

mgmt-groups.properties

This is an optional file. It stores user-to-group mappings and it is only used when Role-based Access Control (RBAC) is enabled. For more details about RBAC, see https://home.feodorov.com:9443/wiki/Wiki.jsp?page=JBoss7SecurityConcepts#section-JBoss7SecurityConcepts-RoleBasedAccessControl

Groups membership information is used to assign the user specific management roles. This is used for domain management. The format of this file is as follows:

username=role1,role2,role3,

Groups can be managed with the utility scripts bin/add-user.sh, bin/add-user.bat.

Application Realm Configuration Files

The security information is maintained in flat files. The application realm stores authentication and authorization information. The realm files can be modified at any time, updates after the server has started will be automatically detected. The files are configured with <security-realm><authentication><properties> configuration element and their location is relative to jboss.server.config.dir, which could be $JBOSS_HOME/standalone/configuration or $JBOSS_HOME/domain/configuration, depending on the mode WildFly is run in (standalone or domain).

application-users.properties

application-users.properties stores usernames and hashed password.

application-roles.properties

application-roles.properties stores user-to-role mappings.

Enabling SSL/TSL for the Management Interfaces

Enabling SSL/TSL for the Native Management Interface

• Enabling SSL/TSL for the Native Management Interface in EAP 7 Domain Mode