How does the local authentication with $local work?

[b.eckenfels]

I wonder how the authenticator of type "local" is actually detecting if a client is local. I was expecting that the server is generating a random credential somewhere and only local users with read access can authenticate. However I cant find that file. A command in the "mgmt-users.properties" files of 7.1 talk about "on start-up the server will automatically add a user $local", but it does not do that as far as I can see.

So currently asuming it is checking only for 127.0.0.1 originator, is this true? I played around with some login options for jboss-cli, but it never failed and alwasys defaulted to $local even when I specified a different user.

[b.eckenfels]

BTW: the admin guide tells me, that it works only for JBoss remoting (not http) and that it "This mechanism makes the use of tokens exchanged on the filesystem to prove that the client is local to the AS installation and has the appropriate file permissions to read a token written by the AS to file". Unfortunatelly it is not giving details (like where and when the token file is created).

[jaikiran]

Take a look at the "Local Clients" section here https://community.jboss.org/wiki/AS710Beta1-SecurityEnabledByDefault

[dlofthouse]

The location is {jboss.home}/standalone/tmp/auth or {jboss.home}/domain/tmp/auth depending on the mode you are running and the file is created at the time the client is challenged and deleted once the authentication is complete.

[b.eckenfels]

Thank you all for the answers. I also found out, that the <local> configuration for the realm was added after 7.1.1. So I wont observe the behaviour of the jboss-cli in conenction with usernames and passwords too closely until I have upgraded.