Přeskočit na hlavní obsah

Enable Elytron in WildFly

Steps to enable Elytron in WildFly nightly builds.

There is an ongoing effort to bring a new security subsystem Elytron to WildFly and JBoss EAP. For some time a custom server profile named standalone-elytron.xml existed beside other profiles in standalone/configuration directory. It was possible to use it for playing with Elytron.

The custom Elytron profile was removed now.  The Elytron subsystem is newly introduced to all standard server profiles. The thing is, the Elytron is not used by default and users have to enable it in the subsystems themselves.

Let's look into how you can enable it.

Get WildFly nightly build

# Download WildFly nightly build
wget --user=guest --password=guest https://ci.wildfly.org/httpAuth/repository/downloadAll/WF_Nightly/.lastSuccessful/artifacts.zip
# unzip build artifacts zip. It contains WildFly distribution ZIP
unzip artifacts.zip
# get the WildFly distribution ZIP name as property
WILDFLY_DIST_ZIP=$(ls wildfly-*-SNAPSHOT.zip)
# unzip WildFly
unzip -q $WILDFLY_DIST_ZIP

Configure Elytron (default profile)

Use JBoss CLI to configure Elytron in subsystems.

wildfly-*-SNAPSHOT/bin/jboss-cli.sh << EOT
embed-server
/subsystem=undertow/application-security-domain=other:add(http-authentication-factory=application-http-authentication)
/subsystem=ejb3/application-security-domain=other:add(security-domain=ApplicationDomain)
/subsystem=batch-jberet:write-attribute(name=security-domain, value=ApplicationDomain)
/subsystem=remoting/http-connector=http-remoting-connector:write-attribute(name=sasl-authentication-factory, value=application-sasl-authentication)
/subsystem=remoting/http-connector=http-remoting-connector:undefine-attribute(name=security-realm)
/core-service=management/access=identity:add(security-domain=ManagementDomain)
/core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true, sasl-authentication-factory=management-sasl-authentication})
/core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory,value=management-http-authentication)
/core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm)
reload

/core-service=management/security-realm=ManagementRealm:remove
/core-service=management/security-realm=ApplicationRealm/authentication=local:remove
/core-service=management/security-realm=ApplicationRealm/authentication=properties:remove
/core-service=management/security-realm=ApplicationRealm/authorization=properties:remove

stop-embedded-server
EOT

Configure Elytron (full profile)

The full profile contains messaging, so we can enable Elytron in there too:

wildfly-*-SNAPSHOT/bin/jboss-cli.sh << EOT
embed-server --server-config=standalone-full.xml
/subsystem=undertow/application-security-domain=other:add(http-authentication-factory=application-http-authentication)
/subsystem=ejb3/application-security-domain=other:add(security-domain=ApplicationDomain)
/subsystem=batch-jberet:write-attribute(name=security-domain, value=ApplicationDomain)
/subsystem=messaging-activemq/server=default:undefine-attribute(name=security-domain)
/subsystem=messaging-activemq/server=default:write-attribute(name=elytron-domain, value=ApplicationDomain)
/subsystem=remoting/http-connector=http-remoting-connector:write-attribute(name=sasl-authentication-factory, value=application-sasl-authentication)
/subsystem=remoting/http-connector=http-remoting-connector:undefine-attribute(name=security-realm)
/core-service=management/access=identity:add(security-domain=ManagementDomain)
/core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade,value={enabled=true, sasl-authentication-factory=management-sasl-authentication})
/core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory,value=management-http-authentication)
/core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm)
reload

/core-service=management/security-realm=ManagementRealm:remove
/core-service=management/security-realm=ApplicationRealm/authentication=local:remove
/core-service=management/security-realm=ApplicationRealm/authentication=properties:remove
/core-service=management/security-realm=ApplicationRealm/authorization=properties:remove

stop-embedded-server
EOT

New issue (WFLY-7949) was reported to add a possibility to enable the Elytron in a single step.

Happy elytroning!

Komentáře

Populární příspěvky z tohoto blogu

Simple TLS certificates in WildFly 18

It's just 2 weeks when WildFly 18 was released. It includes nice improvements in TLS certificates handling through ACME protocol (Automatic Certificate Management Environment), it greatly simplifies obtaining valid HTTPS certificates.

There was already a support for the Let's Encrypt CA in WildFly 14 as Farah Juma described in her blog post last year.

New WildFly version allows using other CA-s with ACME protocol support.
It also adds new switch --lets-encrypt to interactive mode of security enable-ssl-http-server JBoss CLI commands. Let's try it.

Before we jump on WildFly configuration, let's just mention the HTTPs can be used even in the default configuration and a self-signed certificate is generated on the fly. Nevertheless, it's not secure and you should not use it for any other purpose than testing.

Use Let's Encrypt signed certificate for HTTPs application interfaceStart WildFly on a machine with the public IP address. Run it on the default HTTP(80) and…

Zipujeme efektivně

Jedna ze základních vlastností Javy je práce se ZIP archívy, ať už jsou to knihovny tříd a spustitelné JARy, webové aplikace (war), nebo třeba JEE bumbrlíčci (ear). Není tedy divu, že i přímo v základním API je implementována práce s těmito archívy. Slouží k tomu třídy v balíku java.util.zip a nejzajímavější z nich jsou ZipOutputStream a ZipInputStream. Příkladem budiž vytvoření zipu: //Vytvorime Zip ZipOutputStream zos = new ZipOutputStream(new FileOutputStream("javlog.zip")); //V Zipu chceme mit jeden textovy soubor zos.putNextEntry(new ZipEntry("priznani.txt")); //naplnime obsah textoveho souboru zos.write("Máme rádi Javu!".getBytes()); //zavrem entry (priznani.txt) zos.closeEntry(); //zavrem stream zos.close(); a jeho rozbalení: ZipInputStream zis = new ZipInputStream(new FileInputStream("javlog.zip")); ZipEntry zipEntry; //budem predpokladat, ze v ZIPu mame jen textove soubory a tak je vypisem do konzole while ((zipEntry = zis.getNextE…

jd-cli – Command line Java Decompiler

Kdo by neznal jd-gui Java Decompiler (z free.fr) a jeho sourozence, pluginy pro IDE – Eclipse a IntelliJ. Ale nechyběla vám také někdy možnost rychle decompilovat celý JAR nebo WAR do adresáře, případně zobrazit si decompilovanou třídu jen v konzoli bez nutnosti spouštění GUI?
Jestliže ano, pak se zkuste podívat na utilitku jd-cli, která toto všechno umožňuje. Tato aplikace je jednoduchý wrapper nad nativní knihovnou pro jd-gui InelliJ plugin.

Kde všude tato java aplikace běží?
WindowsLinuxMac OSX Kompilace Potřebujete git a Maven.
git clone git@github.com:kwart/jd-cmd.git cd jd-cmd mvn clean package
Rozbalte jd-cli-[version].zip (.tar.gz) někam, kam odkazuje systémová PATH proměnná (C:\Windows nebo $HOME/bin) - distribuce obsahuje i spouštěcí skripty (shell a batch), takže pak už jen vesele voláte
jd-cli [aParametry] Příklady použitíjd-cli HelloWorld.class Zobrazí dekompilovanou třídu v konzoli

jd-cli --skipResources -n -g ALL app.jar Dekompiluje obsah archivu app.jar do souboru app…