Red Hat JBoss Enterprise Application Platform Administration I

Red Hat JBoss Enterprise Application Platform (JBoss EAP) uses two security subsystems: the legacy security subsystem, based on the PicketBox open source project, and the elytron security subsystem, based on the Wildfly Elytron open source project.

The legacy and the elytron security domains use security domains to define how applications are authenticated and authorized.

There are four security domains in the legacy security subsystem defined by default: jboss-ejb-policy, jboss-web-policy, other, and jaspitest. The elytron security subsystem defines two security domains: ManagementDomain, and ApplicationDomain.

A database login module is a legacy security domain backed by a database, which stores the user names and role mapping to secure authentication for an application.

A security domain can be backed by an LDAP server to be used for authorization and authentication in an application.

The messaging subsystem uses, by default the other security domain and the ApplicationRealm security realm in the legacy security subsystem.

You can restrict access and authorization for queues and topics based on roles by adjusting the security-settings section of the messaging-activemq subsystem.

There are two ways for obscuring sensitive data in the server configuration files: the elytron credential store, and the JBoss EAP vault.

The process for storing a password into the vault is accomplished by creating a keystore, initializing the vault, storing sensitive information in the vault, and configuring the JBoss EAP servers to use the vault and its secured data.

You can create and manage the vault by running the $JBOSS_HOME/bin/vault.sh tool.