[jboss-jira] [JBoss JIRA] (WFLY-3223) Configuration of individual contexts for http management interface.

[Darran Lofthouse (JIRA)]

Darran Lofthouse created WFLY-3223:
--------------------------------------

             Summary: Configuration of individual contexts for http management interface.
                 Key: WFLY-3223
                 URL: https://issues.jboss.org/browse/WFLY-3223
             Project: WildFly
          Issue Type: Sub-task
      Security Level: Public (Everyone can see)
          Components: Domain Management
            Reporter: Darran Lofthouse
            Assignee: Darran Lofthouse
             Fix For: 9.0.0.CR1


At the moment all management requests are handled over the '/management' context, we also have a '/console' context to serve up the files for the admin console.

The '/management' context is secured using standard HTTP mechanisms, this decision was taken so that clients could be written in different languages and all they would need to know is how to use standard authentication mechanisms.  Due to problems where web browsers could run malicious scripts cross origin resource sharing is completely disabled for this context.

We need to start to open up the handling of cross origin requests for a couple of reasons: -
 - Enabling Keycloak SSO support.
 - Alternative console distribution options

The '/management' context is going to be retained as-is for legacy clients, possibly even switched off by default.

A new context can then be added using non-browser based authentication, this could be SSO Keycloak or could be a form of Digest authentication where the response is handled by the console and not the web browser - either way as the browser is bypassed it is no longer at risk of sending malicious cross origin requests.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira