# Batch script to enable the elytron JAAS integration for the quickstart application in the JBoss EAP server

# Start batching commands
batch

# Add the legacy security domain and export an elytron-compatible realm that delegates authentication and authorization decisions to this domain
/subsystem=security/security-domain=quickstart-domain:add(cache-type=default)
/subsystem=security/security-domain=quickstart-domain/authentication=classic:add(login-modules=[{code=Remoting,flag=optional,module-options={password-stacking=useFirstPass}},{code=UsersRoles,flag=required,module-options={usersProperties=${jboss.server.config.dir}/users.properties,rolesProperties=${jboss.server.config.dir}/roles.properties,password-stacking=useFirstPass}}])
/subsystem=security/security-domain=quickstart-domain/mapping=classic:add(mapping-modules=[{code=SimpleRoles,type=role,module-options={quickstartUser=admin}}])
/subsystem=security/elytron-realm=LegacyRealm:add(legacy-jaas-config=quickstart-domain,apply-role-mappers=false)

# Add an elytron security domain that uses the exported realm
/subsystem=elytron/security-domain=LegacyDomain:add(default-realm=LegacyRealm,permission-mapper=default-permission-mapper,security-event-listener=local-audit,realms=[{realm=LegacyRealm}])

# Add an http-authentication-factory that will handle requests coming from the Web layer
/subsystem=elytron/http-authentication-factory=quickstart-http-authentication:add(security-domain=LegacyDomain,http-server-mechanism-factory=global,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name="Legacy Realm"}]}])

# Make undertow use the http-authentication-factory for the quickstart application
/subsystem=undertow/application-security-domain=legacy-domain:add(http-authentication-factory=quickstart-http-authentication)

# Add a sasl-authentication-factory that will handle requests from remote EJB clients
/subsystem=elytron/sasl-authentication-factory=quickstart-sasl-authentication:add(sasl-server-factory=configured,security-domain=LegacyDomain,mechanism-configurations=[{mechanism-name=PLAIN}])

# Update the http-remoting-connector to use the sasl-authentication-factory
/subsystem=remoting/http-connector=http-remoting-connector:write-attribute(name=sasl-authentication-factory,value=quickstart-sasl-authentication)

# Add security domain mapping in the ejb3 subsystem to enable elytron for the quickstart EJBs
/subsystem=ejb3/application-security-domain=legacy-domain:add(security-domain=LegacyDomain)

# Run the batch commands
run-batch

# Reload the server configuration
reload


