4 Replies Latest reply on Jan 24, 2018 2:48 PM by tstiemerling

wildfly Elytron Security-Domain with multiple Security-Realm

costajlmpp Oct 16, 2017 10:25 AM

I am trying to implement an wildfly Elytron Security-Domain which will have multiple Security-Realm.

It is required that the security-realm should work like a Stack, that is, the authentication request will be made in order for each Security-Realm until one of them results in successful.

I wonder if this is a possible scenario using wildfly 11 with Eleytro subsystem.

1. Re: wildfly Elytron Security-Domain with multiple Security-Realm

dlofthouse Oct 16, 2017 10:29 AM (in response to costajlmpp)

Using them like a stack is not currently supported, this is actually one scenario we are trying to gather more information on real world scenarios to cover further.

Generally is is the responsibility of the realm mapper(s) to select the realm.

Could you please describe further the scenario you are trying to cover?
Actions
2. Re: wildfly Elytron Security-Domain with multiple Security-Realm

costajlmpp Oct 17, 2017 11:27 AM (in response to dlofthouse)

Hello Darran, thank you for your attention.

The idea is to do something similar to what you can find in this link (password stacking): https://samaxes.com/2007/05/jboss-stacking-login-modules/

Is there something newer I can use to achieve this or am I stuck with JAAS?
Actions
3. Re: wildfly Elytron Security-Domain with multiple Security-Realm

dlofthouse Oct 23, 2017 5:22 AM (in response to costajlmpp)

For that situation you would want to use an aggregate security realm definition to chain two security realms together, that way one will be used for the authentication step and the other for loading the authorization information.
Actions
4. Re: wildfly Elytron Security-Domain with multiple Security-Realm

tstiemerling Jan 24, 2018 2:48 PM (in response to dlofthouse)

Hi Darran, I want to have users authenticate either using file based or db based realm in same domain. Is this possible? From your comment it seems like it currently isnt.
Actions

Go to original post