<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
Management API Security Possible Configuration Samples
</h3>
<span style="margin-bottom: 10px;">
modified by <a href="http://community.jboss.org/people/dlofthouse">Darran Lofthouse</a> in <i>JBoss AS7 Development</i> - <a href="http://community.jboss.org/docs/DOC-16576">View the full document</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><h1>Management API Security Possible Configuration Samples</h1><p>For domain management security we are looking to achieve the following: -</p><ul><li>Simplified configuration without need to understand inner workings of JAAS</li><li>Configuration and implementation compatible with both SASL negotiated connections and the simpler single challenge / response we are used to.</li><li>Option to still make use of JAAS if desired.</li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Sample Configuration</h2><p>The following sample configuration shows the extent of the configuration to be made possible in the context of the standalone.xml descriptor.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><pre class="jive-pre"><code class="jive-code jive-xml"><span class="jive-xml-tag"><server xmlns="urn:jboss:domain:1.0"
...
    <management></span>
       <span class="jive-xml-tag"><security-realms></span>
          <span class="jive-xml-tag"><security-realm name="Management Realm"></span>
             <span class="jive-xml-tag"><server-identities></span>
                <span class="jive-xml-tag"><certificate></span><span class="jive-xml-tag"></certificate></span>
                <span class="jive-xml-tag"><kerberos></span><span class="jive-xml-tag"></kerberos></span>
             <span class="jive-xml-tag"></server-identities></span>
              <span class="jive-xml-tag"><authentication useDomainController="true|false"></span>
                 <span class="jive-xml-tag"><user-properties location="" /></span>
                 <span class="jive-xml-tag"><user-database connection="UsersDatabase" query="select password from Users where username=%1" /></span>
                 <span class="jive-xml-tag"><user-ldap connection="UsersDirectory"></span>
                    <span class="jive-xml-tag"><simple userDNPrefix="..." userDNSuffix="... /></span>
                    <span class="jive-xml-tag"><advanced userSearch="..." /></span>                   
                 <span class="jive-xml-tag"></user-ldap></span>
                 <span class="jive-xml-tag"><jaas></span>
                    <span class="jive-xml-tag"><login-module ></span><span class="jive-xml-tag"></login-module></span>
                 <span class="jive-xml-tag"></jaas
              </authentication></span>
              <span class="jive-xml-tag"><authorization useDomainController="true|false"></span>
                 <span class="jive-xml-tag"><role-properties location="" /></span>
                 <span class="jive-xml-tag"><role-database connection="UsersDatabase" query="select RoleName from Rolers where User=%1" /></span>
                 <span class="jive-xml-tag"><role-ldap connection="UsersDirectory"></span>
                    <span class="jive-xml-tag"><simple userDNPrefix="..." userDNSuffix="... /></span>
                    <span class="jive-xml-tag"><advanced userSearch="..." /></span>                   
                 <span class="jive-xml-tag"></role-ldap></span>
                 <span class="jive-xml-tag"><jaas></span>
                    <span class="jive-xml-tag"><login-module ></span><span class="jive-xml-tag"></login-module></span>
                 <span class="jive-xml-tag"></jaas
              </authorization></span>
          <span class="jive-xml-tag"></security-realm></span>
       <span class="jive-xml-tag"></security-realms></span>
        <span class="jive-xml-tag"><connections></span>
           <span class="jive-xml-tag"><database name="UsersDatabase"></span><span class="jive-xml-tag"><connection-properties/></span><span class="jive-xml-tag"></database></span>
           <span class="jive-xml-tag"><ldap name="UsersDirectory"></span><span class="jive-xml-tag"><connection-properties/></span><span class="jive-xml-tag"></ldap></span>
        <span class="jive-xml-tag"></connections></span>
       <span class="jive-xml-tag"><authorization-control></span><span class="jive-xml-tag"></authorization-control></span>
    <span class="jive-xml-tag"></management></span>
    <span class="jive-xml-tag"><management-apis></span>
        <span class="jive-xml-tag"><native-api interface="public" port="9991" realm="Management Realm"/></span>
        <span class="jive-xml-tag"><http-api interface="public" port="9992" realm="Management Realm" /></span>
    <span class="jive-xml-tag"></management-apis></span>
...
<span class="jive-xml-tag"></server></span>
</code></pre><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Description</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>If security is enabled the management element will hold one or more security realms, the security realm will contain 3 sub sections: -</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h3>server-identities</h3><p>There are a couple of places where a server requires an identity of it's own a couple of examples are the server certificate used for SSL or a Kerberos identity when used with GSSAPI.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The identities will not be named as they are nested in the security realm, instead there will be some form of ServerIdentityManager with methods such as getX509Idenity or getKerberosIdentity.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h3>authentication</h3><p>The SASL mechanisms being used require a number of callbacks to be made available whilst the connection is negotiated, for consistency the HTTP API will follow the same approach although SASL will not be directly used.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The authentication element will list one or more 'components' for accessing user stores.  These components will advertise their capabilities so that their suitability with the currently selected SASL / HPP authentication mechanism can be verified.</p><p>  e.g. The User-Database component is expected to be able to return a password so it can be used with both Plan and Digest_MD5, the User-LDAP component will only be able to verify a password it is provided so will only work with Plain.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>To allow for legacy modules a JAAS component will also be provided, this allow a list of login modules to be specified and is intended for Plain or External for the scenarios previously covered up to AS6.  </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>It is not intended for new modules to be supported for other negotiated mechanisms.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>In the future if we choose to publish an SPI for these components we may allow for custom components to be defined.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The useDomainController attribute is to specify if the requests should be delegated to the domain controller.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h3>authorization</h3><p>The purpose of this element is to define how additional information relating to the customers identity will be loaded so that it can be used later for authorization checks - generally this would be a list of roles but other information could be added.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>As for authentication this will define a number of components to access user repositories, these will be queried to load the identity information.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>A JAAS option will also be available to use existing login modules for role queries.  (We will ensure these login modules are only loading the roles and not attempting authentication.)</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The useDomainController attribute is to specify if the requests should be delegated to the domain controller.</p><h3>connections</h3><p>At a higher level a connections element will be defined, this will be used to configure all connections to external systems during the security processing - as authentication and authorization has been split this will allow for connection information to be shared with both parts.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h3>management-apis</h3><p>Within the management APIs itwill be possible to specify the security-realm that should be used for that connection.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>It will be possible once the security-realm has been identified to query the server-identities and the authentication components to identify what capabilities we have.  We could decide to support the list of available mechanisms or define additional configuration on the API definition to specify the supported mechanisms.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h3>authorization-control</h3><p>This is not being defined at this stage but this is where the authorization requirements will be defined.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Domain Management</h2><p>For managing a domain it will be expected that the <management> element will be defined within the domain.xml and the <management-apis> element will be defined in the host.xml.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>It will also be possible to add a <management> element within the host.xml - this will allow any parts of the <management> element from the master domain controller to be overriden, possible needs for this are: -</p><ul><li>Host specific server identities.</li><li>Host specific connection definitions e.g. Using a different database or different connection to same database.</li><li>Different authentication requirements for host direct connections.</li></ul></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Comment by <a href="http://community.jboss.org/docs/DOC-16576">going to Community</a></p>
<p style="margin: 0;">Create a new document in JBoss AS7 Development at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=102&containerType=14&container=2225">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>