[ https://issues.jboss.org/browse/JBIDE-9211?page=com.atlassian.jira.plugin... ] Andre Dietisheim edited comment on JBIDE-9211 at 7/22/11 10:19 AM: ------------------------------------------------------------------- there's a documentation that lists the supported transport level mechanisms for authentication in the management API: http://community.jboss.org/wiki/ManagementAPISecurityTransportAuthentication A slightly more extensive discussion is found here: http://community.jboss.org/wiki/ManagementAPISecurityAuthenticationMechan... There's also a (possible) sample config here: http://community.jboss.org/wiki/ManagementAPISecurityPossibleConfiguratio... The default configuration that is shipped with as7 uses a properties file: {code} <security-realms> <security-realm name="PropertiesMgmtSecurityRealm"> <authentication> <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" /> </authentication> </security-realm> </security-realms> {code} The referenced properties file (mgmt-users.properties) has no entries and therefore allows anybody to log in. {code} #Format: username=password # #admin=admin {code} was (Author: adietish): there's a documentation that lists the supported transport level mechanisms for authentication in the management API: http://community.jboss.org/wiki/ManagementAPISecurityTransportAuthentication There's also a (possible) sample config here: http://community.jboss.org/wiki/ManagementAPISecurityPossibleConfiguratio... The default configuration that is shipped with as7 uses a properties file: {code} <security-realms> <security-realm name="PropertiesMgmtSecurityRealm"> <authentication> <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" /> </authentication> </security-realm> </security-realms> {code} The referenced properties file (mgmt-users.properties) has no entries and therefore allows anybody to log in. -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/JBIDE-9211?page=com.atlassian.jira.plugin... ] Darran Lofthouse commented on JBIDE-9211: ----------------------------------------- Hi Andre, I understand from Max that you are away this week so feel free to ping me when you return so we can discuss the authentication options for AS7 (Due to be expanded on for AS7.1 as well). The reason the properties file is empty is so that we do not ship a default user that gets enabled in such a way that anyone with basic JBoss knowledge can guess the admin user. To enable the actual security the management interface being used needs to be associated with the security realm i.e. {code:xml} <management-interfaces> <native-interface interface="management" port="9999" security-realm="PropertiesMgmtSecurityRealm" /> <http-interface interface="management" port="9990" security-realm="PropertiesMgmtSecurityRealm"/> </management-interfaces> {code} -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/JBIDE-9211?page=com.atlassian.jira.plugin... ] Andre Dietisheim commented on JBIDE-9211: ----------------------------------------- we ran out of time for this issue in M4 (rush for JBIDE-9793). Moving it to Beta1 -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/JBIDE-9211?page=com.atlassian.jira.plugin... ] Max Rydahl Andersen resolved JBIDE-9211. ---------------------------------------- Resolution: Done basics implemented. open new jiras if found issues. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira