Chapter 3. Configuring Elytron with identity realm to allow easy authentication and authorization for local users

Procedure

1. Create a local identity-realm.

   Syntax

   /subsystem=elytron/identity-realm=<local_identity_realm_name>:add(identity="$local",attribute-name=<attribute_name>,attribute-values=<attribute_value>)

   Example

   /subsystem=elytron/identity-realm=exampleLocalIdentityRealm:add(identity="$local",attribute-name=AttributeName,attribute-values=Value)

   1. Optional If you want to use a name for your local identity-realm other than $local, change the value of wildfly.sasl.local-user.default-user property in the attribute configurable-sasl-server-factory=<sasl_server_factory>.

      Syntax

      /subsystem=elytron/configurable-sasl-server-factory=<sasl_server_factory>:write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => "<new_local_username>", "wildfly.sasl.local-user.challenge-path" => expression "${jboss.server.temp.dir}/auth"})

      Example

      /subsystem=elytron/configurable-sasl-server-factory=configured:write-attribute(name=properties,value={"wildfly.sasl.local-user.default-user" => "john", "wildfly.sasl.local-user.challenge-path" => expression "${jboss.server.temp.dir}/auth"})

2. Create a security domain that references the identity-realm that you created.

   Syntax

   /subsystem=elytron/security-domain=<security_domain_name>:add(default-realm=<local_identity_realm_name>,permission-mapper=<permission_mapper_name>,realms=[{realm=<Local_identity_realm_name>}])

   Example

   /subsystem=elytron/security-domain=exampleSecurityDomain:add(default-realm=exampleLocalIdentityRealm,permission-mapper=default-permission-mapper,realms=[{realm=exampleLocalIdentityRealm}])

3. Add SASL Authentication factory.

   Syntax

   /subsystem=elytron/sasl-authentication-factory=<sasl_auth_factory_name>:add(security-domain=<security_domain_name>,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}])

   Example

   /subsystem=elytron/sasl-authentication-factory=exampleSaslAuthenticationFactory:add(security-domain=exampleSecurityDomain,sasl-server-factory=configured,mechanism-configurations=[{mechanism-name=JBOSS-LOCAL-USER}])

4. Enable SASL Authentication factory for your management interface.

   Syntax

   /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=<sasl_auth_factory_name>})

   Example

   /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true,sasl-authentication-factory=exampleSaslAuthenticationFactory})

5. Reload your management interface.

   $ reload