1.2.15. 使用红帽单点登录保护管理控制台

RHSSO_HOME/bin/standalone.sh -Djboss.socket.binding.port-offset=100

$ RHSSO_HOME/bin/standalone.sh -Djboss.socket.binding.port-offset=100

EAP_HOME/bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli

$ EAP_HOME/bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli

Create a realm for both JBoss EAP console and mgmt interface
Create a secure-deployment in order to protect mgmt interface
Protect HTTP mgmt interface with Keycloak adapter
Enable RBAC where roles are obtained from the identity
Create a secure-server in order to publish the JBoss EAP console configuration via mgmt interface
reload

# Create a realm for both JBoss EAP console and mgmt interface
/subsystem=keycloak/realm=wildfly-infra:add(auth-server-url=http://localhost:8180/auth,realm-public-key=REALM_PUBLIC_KEY)

# Create a secure-deployment in order to protect mgmt interface
/subsystem=keycloak/secure-deployment=wildfly-management:add(realm=wildfly-infra,resource=wildfly-management,principal-attribute=preferred_username,bearer-only=true,ssl-required=EXTERNAL)

# Protect HTTP mgmt interface with Keycloak adapter
/core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm)
/subsystem=elytron/http-authentication-factory=keycloak-mgmt-http-authentication:add(security-domain=KeycloakDomain,http-server-mechanism-factory=wildfly-management,mechanism-configurations=[{mechanism-name=KEYCLOAK,mechanism-realm-configurations=[{realm-name=KeycloakOIDCRealm,realm-mapper=keycloak-oidc-realm-mapper}]}])
/core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory,value=keycloak-mgmt-http-authentication)
/core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade, value={enabled=true, sasl-authentication-factory=management-sasl-authentication})

# Enable RBAC where roles are obtained from the identity
/core-service=management/access=authorization:write-attribute(name=provider,value=rbac)
/core-service=management/access=authorization:write-attribute(name=use-identity-roles,value=true)

# Create a secure-server in order to publish the JBoss EAP console configuration via mgmt interface
/subsystem=keycloak/secure-server=wildfly-console:add(realm=wildfly-infra,resource=wildfly-console,public-client=true)

# reload
reload

EAP_HOME/bin/standalone.sh

$ EAP_HOME/bin/standalone.sh

EAP_HOME/bin/jboss-cli.sh --connect --file=protect-eap-mgmt-services.cli

$ EAP_HOME/bin/jboss-cli.sh --connect --file=protect-eap-mgmt-services.cli