Connect to Management Interface

[coelhu]

Hello

After enabling RBAC authentication (/core-service=management/access=authorization:write-attribute(name=provider,value=rbac) when I access the Domain Controller web interface it shows the image below.

I have added several management interfaces but none worked, and I can connect to the DC using CLI remotely (connect 192.168.253.54:9999)

My wildfly is "wildfly-10.0.0.Final" using Domain Mode

My host.xml interesting part:

        <management-interfaces>

            <native-interface security-realm="ManagementRealm">

                <socket interface="management" port="${jboss.management.native.port:9999}"/>

            </native-interface>

            <http-interface security-realm="ManagementRealm" http-upgrade-enabled="true" allowed-origins="https://srv-wildflydc-tst-01 https://srv-wildflydc-tst-01:9993 http://127.0.0.1:9990 https://srv-wildflydc-tst-01:9993 192.168.253.54:9999">

                <socket interface="management" secure-port="${jboss.management.http.port:9993}"/>

            </http-interface>

        </management-interfaces>

If I change from RBAC to simple again I can access normally the Web Interface, so the management interface is OK while rbac is not active.

Nothing wrong shows in the logs.... so I'm asking for helping.

The Documentation about RBAC does not mention this screen.

Someone knows how to fix this?

Thanks

[ctomc]

as the screen says, you are missing one origin in your configuration.

add the one that console says is missing to your config, restart server and it should work

[coelhu]

Yes, I did

/host=master/core-service=management/management-interface=http-interface:list-add(name=allowed-origins,value=https://srv-wildflydc-tst-01:9993)

I added others since the above didn't worked. (wildfly/domain/configuration/host.xml)

        <management-interfaces>

            <native-interface security-realm="ManagementRealm">

                <socket interface="management" port="${jboss.management.native.port:9999}"/>

            </native-interface>

            <http-interface security-realm="ManagementRealm" http-upgrade-enabled="true" allowed-origins="https://srv-wildflydc-tst-01 https://srv-wildflydc-tst-01:9993 http://127.0.0.1:9990 https://srv-wildflydc-tst-01:9993 192.168.253.54:9999">

                <socket interface="management" secure-port="${jboss.management.http.port:9993}"/>

            </http-interface>

        </management-interfaces>

So the problem persists, I restarted the server with reload --host=master and service wildfly restart.

I have tested multiple connections settings like the image below but no one worked (remember, I can connect to the Domain Controller from another host using jboss.cli with "connect 192.168.253.54:9999"

I don't understand why enabling RBAC authentications causes this error. I need to enable other interface in the domain.xml?

[dlofthouse]

Have you assigned any roles for the user connecting to the server?  I am wondering if the error message is misleading.

[coelhu]

Yes, I added a user in the Administrator role before enabling rbac. I added this user first using the add_user script as "Management User" and then added it with the same username using web interface in "Access Control -> Users -> User -> Add" but I don't know if this is the right way because when you add a new user there is no drop-down list of users already in the system, so I typed the same username added using the script.

[bonadonna]

hi there, did you find a solution for your issue? I've exactly the same problem!

Thanks

[urbandroid]

I don't know is this what you are looking for but at simple create user @ManagementRealm then change to rbac and try to acces.

[talk2gupta]

Dear Sir,

1. Pls. suggest me how to resolve “Connect to Management Interface” Issue in wildfly10 (standalone) Server running on Ubuntu 14.04 Server
2. I am using standalone-full.xml file.

Thanks,

Sonu Kumar Gupta

[mayerw01]

I'd suggest that you open a new case for this issue.

But you should check your server.log also.

There you should find there an entry like: WFLYSRV0051: Admin console listening on http://<your-ip-address>:9990

[talk2gupta]

Hi Team JBoss Developer,

In my server.log file entry is:

*2016-12-15 13:04:44,965 INFO  [org.jboss.as <http://org.jboss.as>]

(Controller Boot Thread) WFLYSRV0051: Admin console listening on

http://0.0.0.0:9990 <http://0.0.0.0:9990>*

Regards,

Sonu Kumar Gupta

[mayerw01]

Did you also make sure that this port is used by Wildfly, like?

fuser -n tcp 9990

ps -ef | grep <process-Id>

[garysamuelson]

I was also having some issue getting RBAC up and running within my WildFly v10.1 server.

I narrowed the issue down to the CLI command - it appears there's either some session and/or caching issue.

Steps:

1) follow instructions, using CLI, and enable RBAC.

2) the error then appears as described above

I hacked away on this for a few hours - then I stepped back and thought it may be a CLI related issue.

So... I applied the manual, direct XML config file editing approach. This worked!

see:

at end of page: "If the server is off-line the XML configuration can be edited to enabled or disable RBAC."

11.8.2. Enabling Role-Based Access Control

And, now I'm able to use the "access control" features from the admin console.

Here's the URL listed in the browser:

http://centosw02:9990/console/App.html#rbac         <<<  note the "#rbac"

[gary_samuelson]

Need to add the following details to the above.

Here is the full configuration section under "access-control"

```

       <access-control provider="rbac">

            <role-mapping>

                <role name="SuperUser">

                    <include>

                        <user name="$local"/>

                        <user alias="admin" name="admin"/>   <<<< this being the important bit. 1) add user via "add-user.sh"   2) update this section with name

                    </include>

                </role>

            </role-mapping>

        </access-control>

```

[kostas.g.papadopoulos]

Had the same problem with Wildfly 11.

The solution was to use the console to re-create an admin user with SuperUser role in ManagementRealm realm before I enabled rbac.

Hope this helps

kostas

[scanales]

This worked for me! Thx

gary_samuelson  wrote:

Need to add the following details to the above.

Here is the full configuration section under "access-control"

```

       <access-control provider="rbac">

            <role-mapping>

                <role name="SuperUser">

                    <include>

                        <user name="$local"/>

                        <user alias="admin" name="admin"/>   <<<< this being the important bit. 1) add user via "add-user.sh"   2) update this section with name

                    </include>

                </role>

            </role-mapping>

        </access-control>

```