11.8. Permissions and Setup for JBoss ON Users

Every CLI script, either for a logged in user or through the rhq.login method, is run on the JBoss ON server by a JBoss ON user.

The JBoss ON CLI does enforce access controls to resources touched by JBoss ON CLI scripts. This means that the script's user must meet the same authorization requirements as a GUI user to perform the given operation.

Additionally, any user who runs a CLI script must already exist in JBoss ON as a user. When the JBoss ON server is configured to create LDAP users, these users are created automatically the first time the LDAP user logs into the JBoss ON web UI. The same account creation does not occur when logging in with the CLI. Therefore, LDAP users must log into the web UI before they can run the JBoss ON CLI.