[jboss-jira] [JBoss JIRA] (WFLY-3223) Configuration of individual contexts for http management interface.

Darran Lofthouse created WFLY-3223: -------------------------------------- Summary: Configuration of individual contexts for http management interface. Key: WFLY-3223 URL: https://issues.jboss.org/browse/WFLY-3223 Project: WildFly Issue Type: Sub-task Security Level: Public (Everyone can see) Components: Domain Management Reporter: Darran Lofthouse Assignee: Darran Lofthouse Fix For: 9.0.0.CR1 At the moment all management requests are handled over the '/management' context, we also have a '/console' context to serve up the files for the admin console. The '/management' context is secured using standard HTTP mechanisms, this decision was taken so that clients could be written in different languages and all they would need to know is how to use standard authentication mechanisms. Due to problems where web browsers could run malicious scripts cross origin resource sharing is completely disabled for this context. We need to start to open up the handling of cross origin requests for a couple of reasons: - - Enabling Keycloak SSO support. - Alternative console distribution options The '/management' context is going to be retained as-is for legacy clients, possibly even switched off by default. A new context can then be added using non-browser based authentication, this could be SSO Keycloak or could be a form of Digest authentication where the response is handled by the console and not the web browser - either way as the browser is bypassed it is no longer at risk of sending malicious cross origin requests. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira