3.3. 使用域集群模式

流程

1. 运行 domain.sh 脚本两次，以启动两个独立的主机控制器。

   第一个是启动域控制器、HTTP 负载均衡器和一个红帽单点登录身份验证服务器实例的主主机控制器。第二个是从属主机控制器，仅启动身份验证服务器实例。

2. 配置从属主机控制器，以使其安全地与域控制器通信。执行以下步骤：

   如果省略这些步骤，则从属主机无法从域控制器获取集中配置。

   1. 通过创建一个服务器 admin 用户和一个在主服务器和从卷之间共享的 secret 来设置安全连接。

      运行 …​/bin/add-user.sh 脚本。

   2. 当脚本询问要添加的用户类型时，选择 Management User。

      这个选择会生成一个 secret，供您剪切并粘贴到 …​/domain/configuration/host-slave.xml 文件中。

      添加 App Server Admin

      $ add-user.sh
       What type of user do you wish to add?
        a) Management User (mgmt-users.properties)
        b) Application User (application-users.properties)
       (a): a
       Enter the details of the new user to add.
       Using realm 'ManagementRealm' as discovered from the existing property files.
       Username : admin
       Password recommendations are listed below. To modify these restrictions edit the add-user.properties configuration file.
        - The password should not be one of the following restricted values {root, admin, administrator}
        - The password should contain at least 8 characters, 1 alphabetic character(s), 1 digit(s), 1 non-alphanumeric symbol(s)
        - The password should be different from the username
       Password :
       Re-enter Password :
       What groups do you want this user to belong to? (Please enter a comma separated list, or leave blank for none)[ ]:
       About to add user 'admin' for realm 'ManagementRealm'
       Is this correct yes/no? yes
       Added user 'admin' to file '/.../standalone/configuration/mgmt-users.properties'
       Added user 'admin' to file '/.../domain/configuration/mgmt-users.properties'
       Added user 'admin' with groups to file '/.../standalone/configuration/mgmt-groups.properties'
       Added user 'admin' with groups to file '/.../domain/configuration/mgmt-groups.properties'
       Is this new user going to be used for one AS process to connect to another AS process?
       e.g. for a slave host controller connecting to the master or for a Remoting connection for server to server EJB calls.
       yes/no? yes
       To represent the user add the following to the server-identities definition <secret value="bWdtdDEyMyE=" />

      Copy to Clipboard Toggle word wrap

      注意

      add-user.sh 脚本不会将用户添加到红帽单点登录服务器，而是添加到底层 JBoss 企业应用平台中。这个脚本中使用的和生成的凭证仅用于演示目的。请使用在您的系统中生成的它们。

3. 将 secret 值剪切并粘贴到 …​/domain/configuration/host-slave.xml 文件中，如下所示：

        <management>
            <security-realms>
                <security-realm name="ManagementRealm">
                    <server-identities>
                        <secret value="bWdtdDEyMyE="/>
                    </server-identities>

   Copy to Clipboard Toggle word wrap

4. 在 …​/domain/configuration/host-slave.xml 文件中添加创建用户的用户名：

        <remote security-realm="ManagementRealm" username="admin">

   Copy to Clipboard Toggle word wrap

5. 运行引导脚本两次，以在一个开发机器中模拟两个节点集群。

   引导 master

   $ domain.sh --host-config=host-master.xml

   Copy to Clipboard Toggle word wrap

   启动从卷

   $ domain.sh --host-config=host-slave.xml

   Copy to Clipboard Toggle word wrap

6. 打开浏览器，再转到 http://localhost:8080/auth 以试用。