第 3 章 保护受管域


除了保护管理接口外,您还可以保护受管域中的 JBoss EAP 实例之间的通信。

有关受管域工作模式的概念和常规配置的详情,请参考 JBoss EAP 配置指南中的域管理部分https://access.redhat.com/documentation/zh-cn/red_hat_jboss_enterprise_application_platform/7.0/html-single/configuration_guide/#domain_management

在配置受管域时,默认情况下,主域控制器配置为需要连接它的每个从控制器进行身份验证。要使用正确的凭证配置从控制器,您必须执行以下操作:

  1. 将用户添加到 master 域控制器

    您需要使用 add-user 脚本将用户添加到 master 域控制器。特别是,您需要确保用户被添加到 master 用来保护其管理界面的同一域中,默认为 ManagementRealm。您还需要确保回答" 是",该新用户是否将用于一个 AS 进程连接到另一个 AS 进程? 问题。

    重要

    添加用户后,该脚本将输出一个 &lt ;secret > 元素,该元素将在下一步中使用。您必须保留这个值才能在下一步中使用。

    Adding a Slave User 示例

    $ EAP_HOME/bin/add-user.sh
    
    What type of user do you wish to add?
     a) Management User (mgmt-users.properties)
     b) Application User (application-users.properties)
    (a): a
    
    Enter the details of the new user to add.
    Using realm 'ManagementRealm' as discovered from the existing property files.
    Username : slave-user
    Password recommendations are listed below. To modify these restrictions edit the add-user.properties configuration file.
     - The password should be different from the username
     - The password should not be one of the following restricted values {root, admin, administrator}
     - The password should contain at least 8 characters, 1 alphabetic character(s), 1 digit(s), 1 non-alphanumeric symbol(s)
    Password :
    Re-enter Password :
    What groups do you want this user to belong to? (Please enter a comma separated list, or leave blank for none)[  ]:
    About to add user 'slave-user' for realm 'ManagementRealm'
    Is this correct yes/no? yes
    Added user 'slave-user' to file '/home/user/EAP-7.0.0/jboss-eap-7.0/standalone/configuration/mgmt-users.properties'
    Added user 'slave-user' to file '/home/user/EAP-7.0.0/jboss-eap-7.0/domain/configuration/mgmt-users.properties'
    Added user 'slave-user' with groups  to file '/home/user/EAP-7.0.0/jboss-eap-7.0/standalone/configuration/mgmt-groups.properties'
    Added user 'slave-user' with groups  to file '/home/user/EAP-7.0.0/jboss-eap-7.0/domain/configuration/mgmt-groups.properties'
    Is this new user going to be used for one AS process to connect to another AS process?
    e.g. for a slave host controller connecting to the master or for a Remoting connection for server to server EJB calls.
    yes/no? yes
    To represent the user add the following to the server-identities definition <secret value="ABCzc3dv11Qx" />
    Copy to Clipboard Toggle word wrap

  2. 将从属控制器配置为使用凭据。

    在主域控制器上创建用户后,您需要更新每个从属控制器,以便在主机配置文件中使用该凭据,如 host. xml 或 host -slave.xml。要做到这一点,您需要将用户名添加到 域控制器 配置的 &lt ;remote > 元素中。您还需要将 < secret&gt; 添加到用于保护 < remote> 元素的域的 服务器身份。当用户添加到上一步中的 master 域控制器时,会获取 username 和 < secret >。

    Example

    ...
    <security-realm name="ManagementRealm">
        <server-identities>
            <!-- Replace this with either a base64 password of your own, or use a vault with a vault expression -->
            <secret value="ABCzc3dv11Qx"/>
        </server-identities>
    ...
    <domain-controller>
      <remote security-realm="ManagementRealm" username="slave-user">
          <discovery-options>
              <static-discovery name="primary" protocol="${jboss.domain.master.protocol:remote}" host="${jboss.domain.master.address}" port="${jboss.domain.master.port:9999}"/>
          </discovery-options>
      </remote>
    </domain-controller>
    Copy to Clipboard Toggle word wrap

返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务,以及可以信赖的内容,帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

Theme

© 2026 Red Hat