You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by jb...@apache.org on 2016/04/28 17:27:59 UTC
svn commit: r1741454 [34/41] - in
/karaf/site/production/manual/latest-3.0.x: ./ developer-guide/ images/
user-guide/
Added: karaf/site/production/manual/latest-3.0.x/security.html
URL: http://svn.apache.org/viewvc/karaf/site/production/manual/latest-3.0.x/security.html?rev=1741454&view=auto
==============================================================================
--- karaf/site/production/manual/latest-3.0.x/security.html (added)
+++ karaf/site/production/manual/latest-3.0.x/security.html Thu Apr 28 15:27:56 2016
@@ -0,0 +1,1345 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<!--[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge"><![endif]-->
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="generator" content="Asciidoctor 1.5.2">
+<title>Security</title>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400">
+<style>
+/* Asciidoctor default stylesheet | MIT License | http://asciidoctor.org */
+/* Remove the comments around the @import statement below when using this as a custom stylesheet */
+/*@import "https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400";*/
+article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary{display:block}
+audio,canvas,video{display:inline-block}
+audio:not([controls]){display:none;height:0}
+[hidden],template{display:none}
+script{display:none!important}
+html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}
+body{margin:0}
+a{background:transparent}
+a:focus{outline:thin dotted}
+a:active,a:hover{outline:0}
+h1{font-size:2em;margin:.67em 0}
+abbr[title]{border-bottom:1px dotted}
+b,strong{font-weight:bold}
+dfn{font-style:italic}
+hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0}
+mark{background:#ff0;color:#000}
+code,kbd,pre,samp{font-family:monospace;font-size:1em}
+pre{white-space:pre-wrap}
+q{quotes:"\201C" "\201D" "\2018" "\2019"}
+small{font-size:80%}
+sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}
+sup{top:-.5em}
+sub{bottom:-.25em}
+img{border:0}
+svg:not(:root){overflow:hidden}
+figure{margin:0}
+fieldset{border:1px solid silver;margin:0 2px;padding:.35em .625em .75em}
+legend{border:0;padding:0}
+button,input,select,textarea{font-family:inherit;font-size:100%;margin:0}
+button,input{line-height:normal}
+button,select{text-transform:none}
+button,html input[type="button"],input[type="reset"],input[type="submit"]{-webkit-appearance:button;cursor:pointer}
+button[disabled],html input[disabled]{cursor:default}
+input[type="checkbox"],input[type="radio"]{box-sizing:border-box;padding:0}
+input[type="search"]{-webkit-appearance:textfield;-moz-box-sizing:content-box;-webkit-box-sizing:content-box;box-sizing:content-box}
+input[type="search"]::-webkit-search-cancel-button,input[type="search"]::-webkit-search-decoration{-webkit-appearance:none}
+button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}
+textarea{overflow:auto;vertical-align:top}
+table{border-collapse:collapse;border-spacing:0}
+*,*:before,*:after{-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box}
+html,body{font-size:100%}
+body{background:#fff;color:rgba(0,0,0,.8);padding:0;margin:0;font-family:"Noto Serif","DejaVu Serif",serif;font-weight:400;font-style:normal;line-height:1;position:relative;cursor:auto}
+a:hover{cursor:pointer}
+img,object,embed{max-width:100%;height:auto}
+object,embed{height:100%}
+img{-ms-interpolation-mode:bicubic}
+#map_canvas img,#map_canvas embed,#map_canvas object,.map_canvas img,.map_canvas embed,.map_canvas object{max-width:none!important}
+.left{float:left!important}
+.right{float:right!important}
+.text-left{text-align:left!important}
+.text-right{text-align:right!important}
+.text-center{text-align:center!important}
+.text-justify{text-align:justify!important}
+.hide{display:none}
+.antialiased,body{-webkit-font-smoothing:antialiased}
+img{display:inline-block;vertical-align:middle}
+textarea{height:auto;min-height:50px}
+select{width:100%}
+p.lead,.paragraph.lead>p,#preamble>.sectionbody>.paragraph:first-of-type p{font-size:1.21875em;line-height:1.6}
+.subheader,.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{line-height:1.45;color:#7a2518;font-weight:400;margin-top:0;margin-bottom:.25em}
+div,dl,dt,dd,ul,ol,li,h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6,pre,form,p,blockquote,th,td{margin:0;padding:0;direction:ltr}
+a{color:#2156a5;text-decoration:underline;line-height:inherit}
+a:hover,a:focus{color:#1d4b8f}
+a img{border:none}
+p{font-family:inherit;font-weight:400;font-size:1em;line-height:1.6;margin-bottom:1.25em;text-rendering:optimizeLegibility}
+p aside{font-size:.875em;line-height:1.35;font-style:italic}
+h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{font-family:"Open Sans","DejaVu Sans",sans-serif;font-weight:300;font-style:normal;color:#ba3925;text-rendering:optimizeLegibility;margin-top:1em;margin-bottom:.5em;line-height:1.0125em}
+h1 small,h2 small,h3 small,#toctitle small,.sidebarblock>.content>.title small,h4 small,h5 small,h6 small{font-size:60%;color:#e99b8f;line-height:0}
+h1{font-size:2.125em}
+h2{font-size:1.6875em}
+h3,#toctitle,.sidebarblock>.content>.title{font-size:1.375em}
+h4,h5{font-size:1.125em}
+h6{font-size:1em}
+hr{border:solid #ddddd8;border-width:1px 0 0;clear:both;margin:1.25em 0 1.1875em;height:0}
+em,i{font-style:italic;line-height:inherit}
+strong,b{font-weight:bold;line-height:inherit}
+small{font-size:60%;line-height:inherit}
+code{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;font-weight:400;color:rgba(0,0,0,.9)}
+ul,ol,dl{font-size:1em;line-height:1.6;margin-bottom:1.25em;list-style-position:outside;font-family:inherit}
+ul,ol,ul.no-bullet,ol.no-bullet{margin-left:1.5em}
+ul li ul,ul li ol{margin-left:1.25em;margin-bottom:0;font-size:1em}
+ul.square li ul,ul.circle li ul,ul.disc li ul{list-style:inherit}
+ul.square{list-style-type:square}
+ul.circle{list-style-type:circle}
+ul.disc{list-style-type:disc}
+ul.no-bullet{list-style:none}
+ol li ul,ol li ol{margin-left:1.25em;margin-bottom:0}
+dl dt{margin-bottom:.3125em;font-weight:bold}
+dl dd{margin-bottom:1.25em}
+abbr,acronym{text-transform:uppercase;font-size:90%;color:rgba(0,0,0,.8);border-bottom:1px dotted #ddd;cursor:help}
+abbr{text-transform:none}
+blockquote{margin:0 0 1.25em;padding:.5625em 1.25em 0 1.1875em;border-left:1px solid #ddd}
+blockquote cite{display:block;font-size:.9375em;color:rgba(0,0,0,.6)}
+blockquote cite:before{content:"\2014 \0020"}
+blockquote cite a,blockquote cite a:visited{color:rgba(0,0,0,.6)}
+blockquote,blockquote p{line-height:1.6;color:rgba(0,0,0,.85)}
+@media only screen and (min-width:768px){h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2}
+h1{font-size:2.75em}
+h2{font-size:2.3125em}
+h3,#toctitle,.sidebarblock>.content>.title{font-size:1.6875em}
+h4{font-size:1.4375em}}table{background:#fff;margin-bottom:1.25em;border:solid 1px #dedede}
+table thead,table tfoot{background:#f7f8f7;font-weight:bold}
+table thead tr th,table thead tr td,table tfoot tr th,table tfoot tr td{padding:.5em .625em .625em;font-size:inherit;color:rgba(0,0,0,.8);text-align:left}
+table tr th,table tr td{padding:.5625em .625em;font-size:inherit;color:rgba(0,0,0,.8)}
+table tr.even,table tr.alt,table tr:nth-of-type(even){background:#f8f8f7}
+table thead tr th,table tfoot tr th,table tbody tr td,table tr td,table tfoot tr td{display:table-cell;line-height:1.6}
+h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2;word-spacing:-.05em}
+h1 strong,h2 strong,h3 strong,#toctitle strong,.sidebarblock>.content>.title strong,h4 strong,h5 strong,h6 strong{font-weight:400}
+.clearfix:before,.clearfix:after,.float-group:before,.float-group:after{content:" ";display:table}
+.clearfix:after,.float-group:after{clear:both}
+*:not(pre)>code{font-size:.9375em;font-style:normal!important;letter-spacing:0;padding:.1em .5ex;word-spacing:-.15em;background-color:#f7f7f8;-webkit-border-radius:4px;border-radius:4px;line-height:1.45;text-rendering:optimizeSpeed}
+pre,pre>code{line-height:1.45;color:rgba(0,0,0,.9);font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;font-weight:400;text-rendering:optimizeSpeed}
+.keyseq{color:rgba(51,51,51,.8)}
+kbd{display:inline-block;color:rgba(0,0,0,.8);font-size:.75em;line-height:1.4;background-color:#f7f7f7;border:1px solid #ccc;-webkit-border-radius:3px;border-radius:3px;-webkit-box-shadow:0 1px 0 rgba(0,0,0,.2),0 0 0 .1em white inset;box-shadow:0 1px 0 rgba(0,0,0,.2),0 0 0 .1em #fff inset;margin:-.15em .15em 0 .15em;padding:.2em .6em .2em .5em;vertical-align:middle;white-space:nowrap}
+.keyseq kbd:first-child{margin-left:0}
+.keyseq kbd:last-child{margin-right:0}
+.menuseq,.menu{color:rgba(0,0,0,.8)}
+b.button:before,b.button:after{position:relative;top:-1px;font-weight:400}
+b.button:before{content:"[";padding:0 3px 0 2px}
+b.button:after{content:"]";padding:0 2px 0 3px}
+p a>code:hover{color:rgba(0,0,0,.9)}
+#header,#content,#footnotes,#footer{width:100%;margin-left:auto;margin-right:auto;margin-top:0;margin-bottom:0;max-width:62.5em;*zoom:1;position:relative;padding-left:.9375em;padding-right:.9375em}
+#header:before,#header:after,#content:before,#content:after,#footnotes:before,#footnotes:after,#footer:before,#footer:after{content:" ";display:table}
+#header:after,#content:after,#footnotes:after,#footer:after{clear:both}
+#content{margin-top:1.25em}
+#content:before{content:none}
+#header>h1:first-child{color:rgba(0,0,0,.85);margin-top:2.25rem;margin-bottom:0}
+#header>h1:first-child+#toc{margin-top:8px;border-top:1px solid #ddddd8}
+#header>h1:only-child,body.toc2 #header>h1:nth-last-child(2){border-bottom:1px solid #ddddd8;padding-bottom:8px}
+#header .details{border-bottom:1px solid #ddddd8;line-height:1.45;padding-top:.25em;padding-bottom:.25em;padding-left:.25em;color:rgba(0,0,0,.6);display:-ms-flexbox;display:-webkit-flex;display:flex;-ms-flex-flow:row wrap;-webkit-flex-flow:row wrap;flex-flow:row wrap}
+#header .details span:first-child{margin-left:-.125em}
+#header .details span.email a{color:rgba(0,0,0,.85)}
+#header .details br{display:none}
+#header .details br+span:before{content:"\00a0\2013\00a0"}
+#header .details br+span.author:before{content:"\00a0\22c5\00a0";color:rgba(0,0,0,.85)}
+#header .details br+span#revremark:before{content:"\00a0|\00a0"}
+#header #revnumber{text-transform:capitalize}
+#header #revnumber:after{content:"\00a0"}
+#content>h1:first-child:not([class]){color:rgba(0,0,0,.85);border-bottom:1px solid #ddddd8;padding-bottom:8px;margin-top:0;padding-top:1rem;margin-bottom:1.25rem}
+#toc{border-bottom:1px solid #efefed;padding-bottom:.5em}
+#toc>ul{margin-left:.125em}
+#toc ul.sectlevel0>li>a{font-style:italic}
+#toc ul.sectlevel0 ul.sectlevel1{margin:.5em 0}
+#toc ul{font-family:"Open Sans","DejaVu Sans",sans-serif;list-style-type:none}
+#toc a{text-decoration:none}
+#toc a:active{text-decoration:underline}
+#toctitle{color:#7a2518;font-size:1.2em}
+@media only screen and (min-width:768px){#toctitle{font-size:1.375em}
+body.toc2{padding-left:15em;padding-right:0}
+#toc.toc2{margin-top:0!important;background-color:#f8f8f7;position:fixed;width:15em;left:0;top:0;border-right:1px solid #efefed;border-top-width:0!important;border-bottom-width:0!important;z-index:1000;padding:1.25em 1em;height:100%;overflow:auto}
+#toc.toc2 #toctitle{margin-top:0;font-size:1.2em}
+#toc.toc2>ul{font-size:.9em;margin-bottom:0}
+#toc.toc2 ul ul{margin-left:0;padding-left:1em}
+#toc.toc2 ul.sectlevel0 ul.sectlevel1{padding-left:0;margin-top:.5em;margin-bottom:.5em}
+body.toc2.toc-right{padding-left:0;padding-right:15em}
+body.toc2.toc-right #toc.toc2{border-right-width:0;border-left:1px solid #efefed;left:auto;right:0}}@media only screen and (min-width:1280px){body.toc2{padding-left:20em;padding-right:0}
+#toc.toc2{width:20em}
+#toc.toc2 #toctitle{font-size:1.375em}
+#toc.toc2>ul{font-size:.95em}
+#toc.toc2 ul ul{padding-left:1.25em}
+body.toc2.toc-right{padding-left:0;padding-right:20em}}#content #toc{border-style:solid;border-width:1px;border-color:#e0e0dc;margin-bottom:1.25em;padding:1.25em;background:#f8f8f7;-webkit-border-radius:4px;border-radius:4px}
+#content #toc>:first-child{margin-top:0}
+#content #toc>:last-child{margin-bottom:0}
+#footer{max-width:100%;background-color:rgba(0,0,0,.8);padding:1.25em}
+#footer-text{color:rgba(255,255,255,.8);line-height:1.44}
+.sect1{padding-bottom:.625em}
+@media only screen and (min-width:768px){.sect1{padding-bottom:1.25em}}.sect1+.sect1{border-top:1px solid #efefed}
+#content h1>a.anchor,h2>a.anchor,h3>a.anchor,#toctitle>a.anchor,.sidebarblock>.content>.title>a.anchor,h4>a.anchor,h5>a.anchor,h6>a.anchor{position:absolute;z-index:1001;width:1.5ex;margin-left:-1.5ex;display:block;text-decoration:none!important;visibility:hidden;text-align:center;font-weight:400}
+#content h1>a.anchor:before,h2>a.anchor:before,h3>a.anchor:before,#toctitle>a.anchor:before,.sidebarblock>.content>.title>a.anchor:before,h4>a.anchor:before,h5>a.anchor:before,h6>a.anchor:before{content:"\00A7";font-size:.85em;display:block;padding-top:.1em}
+#content h1:hover>a.anchor,#content h1>a.anchor:hover,h2:hover>a.anchor,h2>a.anchor:hover,h3:hover>a.anchor,#toctitle:hover>a.anchor,.sidebarblock>.content>.title:hover>a.anchor,h3>a.anchor:hover,#toctitle>a.anchor:hover,.sidebarblock>.content>.title>a.anchor:hover,h4:hover>a.anchor,h4>a.anchor:hover,h5:hover>a.anchor,h5>a.anchor:hover,h6:hover>a.anchor,h6>a.anchor:hover{visibility:visible}
+#content h1>a.link,h2>a.link,h3>a.link,#toctitle>a.link,.sidebarblock>.content>.title>a.link,h4>a.link,h5>a.link,h6>a.link{color:#ba3925;text-decoration:none}
+#content h1>a.link:hover,h2>a.link:hover,h3>a.link:hover,#toctitle>a.link:hover,.sidebarblock>.content>.title>a.link:hover,h4>a.link:hover,h5>a.link:hover,h6>a.link:hover{color:#a53221}
+.audioblock,.imageblock,.literalblock,.listingblock,.stemblock,.videoblock{margin-bottom:1.25em}
+.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{text-rendering:optimizeLegibility;text-align:left;font-family:"Noto Serif","DejaVu Serif",serif;font-size:1rem;font-style:italic}
+table.tableblock>caption.title{white-space:nowrap;overflow:visible;max-width:0}
+.paragraph.lead>p,#preamble>.sectionbody>.paragraph:first-of-type p{color:rgba(0,0,0,.85)}
+table.tableblock #preamble>.sectionbody>.paragraph:first-of-type p{font-size:inherit}
+.admonitionblock>table{border-collapse:separate;border:0;background:none;width:100%}
+.admonitionblock>table td.icon{text-align:center;width:80px}
+.admonitionblock>table td.icon img{max-width:none}
+.admonitionblock>table td.icon .title{font-weight:bold;font-family:"Open Sans","DejaVu Sans",sans-serif;text-transform:uppercase}
+.admonitionblock>table td.content{padding-left:1.125em;padding-right:1.25em;border-left:1px solid #ddddd8;color:rgba(0,0,0,.6)}
+.admonitionblock>table td.content>:last-child>:last-child{margin-bottom:0}
+.exampleblock>.content{border-style:solid;border-width:1px;border-color:#e6e6e6;margin-bottom:1.25em;padding:1.25em;background:#fff;-webkit-border-radius:4px;border-radius:4px}
+.exampleblock>.content>:first-child{margin-top:0}
+.exampleblock>.content>:last-child{margin-bottom:0}
+.sidebarblock{border-style:solid;border-width:1px;border-color:#e0e0dc;margin-bottom:1.25em;padding:1.25em;background:#f8f8f7;-webkit-border-radius:4px;border-radius:4px}
+.sidebarblock>:first-child{margin-top:0}
+.sidebarblock>:last-child{margin-bottom:0}
+.sidebarblock>.content>.title{color:#7a2518;margin-top:0;text-align:center}
+.exampleblock>.content>:last-child>:last-child,.exampleblock>.content .olist>ol>li:last-child>:last-child,.exampleblock>.content .ulist>ul>li:last-child>:last-child,.exampleblock>.content .qlist>ol>li:last-child>:last-child,.sidebarblock>.content>:last-child>:last-child,.sidebarblock>.content .olist>ol>li:last-child>:last-child,.sidebarblock>.content .ulist>ul>li:last-child>:last-child,.sidebarblock>.content .qlist>ol>li:last-child>:last-child{margin-bottom:0}
+.literalblock pre,.listingblock pre:not(.highlight),.listingblock pre[class="highlight"],.listingblock pre[class^="highlight "],.listingblock pre.CodeRay,.listingblock pre.prettyprint{background:#f7f7f8}
+.sidebarblock .literalblock pre,.sidebarblock .listingblock pre:not(.highlight),.sidebarblock .listingblock pre[class="highlight"],.sidebarblock .listingblock pre[class^="highlight "],.sidebarblock .listingblock pre.CodeRay,.sidebarblock .listingblock pre.prettyprint{background:#f2f1f1}
+.literalblock pre,.literalblock pre[class],.listingblock pre,.listingblock pre[class]{-webkit-border-radius:4px;border-radius:4px;word-wrap:break-word;padding:1em;font-size:.8125em}
+.literalblock pre.nowrap,.literalblock pre[class].nowrap,.listingblock pre.nowrap,.listingblock pre[class].nowrap{overflow-x:auto;white-space:pre;word-wrap:normal}
+@media only screen and (min-width:768px){.literalblock pre,.literalblock pre[class],.listingblock pre,.listingblock pre[class]{font-size:.90625em}}@media only screen and (min-width:1280px){.literalblock pre,.literalblock pre[class],.listingblock pre,.listingblock pre[class]{font-size:1em}}.literalblock.output pre{color:#f7f7f8;background-color:rgba(0,0,0,.9)}
+.listingblock pre.highlightjs{padding:0}
+.listingblock pre.highlightjs>code{padding:1em;-webkit-border-radius:4px;border-radius:4px}
+.listingblock pre.prettyprint{border-width:0}
+.listingblock>.content{position:relative}
+.listingblock code[data-lang]:before{display:none;content:attr(data-lang);position:absolute;font-size:.75em;top:.425rem;right:.5rem;line-height:1;text-transform:uppercase;color:#999}
+.listingblock:hover code[data-lang]:before{display:block}
+.listingblock.terminal pre .command:before{content:attr(data-prompt);padding-right:.5em;color:#999}
+.listingblock.terminal pre .command:not([data-prompt]):before{content:"$"}
+table.pyhltable{border-collapse:separate;border:0;margin-bottom:0;background:none}
+table.pyhltable td{vertical-align:top;padding-top:0;padding-bottom:0}
+table.pyhltable td.code{padding-left:.75em;padding-right:0}
+pre.pygments .lineno,table.pyhltable td:not(.code){color:#999;padding-left:0;padding-right:.5em;border-right:1px solid #ddddd8}
+pre.pygments .lineno{display:inline-block;margin-right:.25em}
+table.pyhltable .linenodiv{background:none!important;padding-right:0!important}
+.quoteblock{margin:0 1em 1.25em 1.5em;display:table}
+.quoteblock>.title{margin-left:-1.5em;margin-bottom:.75em}
+.quoteblock blockquote,.quoteblock blockquote p{color:rgba(0,0,0,.85);font-size:1.15rem;line-height:1.75;word-spacing:.1em;letter-spacing:0;font-style:italic;text-align:justify}
+.quoteblock blockquote{margin:0;padding:0;border:0}
+.quoteblock blockquote:before{content:"\201c";float:left;font-size:2.75em;font-weight:bold;line-height:.6em;margin-left:-.6em;color:#7a2518;text-shadow:0 1px 2px rgba(0,0,0,.1)}
+.quoteblock blockquote>.paragraph:last-child p{margin-bottom:0}
+.quoteblock .attribution{margin-top:.5em;margin-right:.5ex;text-align:right}
+.quoteblock .quoteblock{margin-left:0;margin-right:0;padding:.5em 0;border-left:3px solid rgba(0,0,0,.6)}
+.quoteblock .quoteblock blockquote{padding:0 0 0 .75em}
+.quoteblock .quoteblock blockquote:before{display:none}
+.verseblock{margin:0 1em 1.25em 1em}
+.verseblock pre{font-family:"Open Sans","DejaVu Sans",sans;font-size:1.15rem;color:rgba(0,0,0,.85);font-weight:300;text-rendering:optimizeLegibility}
+.verseblock pre strong{font-weight:400}
+.verseblock .attribution{margin-top:1.25rem;margin-left:.5ex}
+.quoteblock .attribution,.verseblock .attribution{font-size:.9375em;line-height:1.45;font-style:italic}
+.quoteblock .attribution br,.verseblock .attribution br{display:none}
+.quoteblock .attribution cite,.verseblock .attribution cite{display:block;letter-spacing:-.05em;color:rgba(0,0,0,.6)}
+.quoteblock.abstract{margin:0 0 1.25em 0;display:block}
+.quoteblock.abstract blockquote,.quoteblock.abstract blockquote p{text-align:left;word-spacing:0}
+.quoteblock.abstract blockquote:before,.quoteblock.abstract blockquote p:first-of-type:before{display:none}
+table.tableblock{max-width:100%;border-collapse:separate}
+table.tableblock td>.paragraph:last-child p>p:last-child,table.tableblock th>p:last-child,table.tableblock td>p:last-child{margin-bottom:0}
+table.spread{width:100%}
+table.tableblock,th.tableblock,td.tableblock{border:0 solid #dedede}
+table.grid-all th.tableblock,table.grid-all td.tableblock{border-width:0 1px 1px 0}
+table.grid-all tfoot>tr>th.tableblock,table.grid-all tfoot>tr>td.tableblock{border-width:1px 1px 0 0}
+table.grid-cols th.tableblock,table.grid-cols td.tableblock{border-width:0 1px 0 0}
+table.grid-all *>tr>.tableblock:last-child,table.grid-cols *>tr>.tableblock:last-child{border-right-width:0}
+table.grid-rows th.tableblock,table.grid-rows td.tableblock{border-width:0 0 1px 0}
+table.grid-all tbody>tr:last-child>th.tableblock,table.grid-all tbody>tr:last-child>td.tableblock,table.grid-all thead:last-child>tr>th.tableblock,table.grid-rows tbody>tr:last-child>th.tableblock,table.grid-rows tbody>tr:last-child>td.tableblock,table.grid-rows thead:last-child>tr>th.tableblock{border-bottom-width:0}
+table.grid-rows tfoot>tr>th.tableblock,table.grid-rows tfoot>tr>td.tableblock{border-width:1px 0 0 0}
+table.frame-all{border-width:1px}
+table.frame-sides{border-width:0 1px}
+table.frame-topbot{border-width:1px 0}
+th.halign-left,td.halign-left{text-align:left}
+th.halign-right,td.halign-right{text-align:right}
+th.halign-center,td.halign-center{text-align:center}
+th.valign-top,td.valign-top{vertical-align:top}
+th.valign-bottom,td.valign-bottom{vertical-align:bottom}
+th.valign-middle,td.valign-middle{vertical-align:middle}
+table thead th,table tfoot th{font-weight:bold}
+tbody tr th{display:table-cell;line-height:1.6;background:#f7f8f7}
+tbody tr th,tbody tr th p,tfoot tr th,tfoot tr th p{color:rgba(0,0,0,.8);font-weight:bold}
+p.tableblock>code:only-child{background:none;padding:0}
+p.tableblock{font-size:1em}
+td>div.verse{white-space:pre}
+ol{margin-left:1.75em}
+ul li ol{margin-left:1.5em}
+dl dd{margin-left:1.125em}
+dl dd:last-child,dl dd:last-child>:last-child{margin-bottom:0}
+ol>li p,ul>li p,ul dd,ol dd,.olist .olist,.ulist .ulist,.ulist .olist,.olist .ulist{margin-bottom:.625em}
+ul.unstyled,ol.unnumbered,ul.checklist,ul.none{list-style-type:none}
+ul.unstyled,ol.unnumbered,ul.checklist{margin-left:.625em}
+ul.checklist li>p:first-child>.fa-square-o:first-child,ul.checklist li>p:first-child>.fa-check-square-o:first-child{width:1em;font-size:.85em}
+ul.checklist li>p:first-child>input[type="checkbox"]:first-child{width:1em;position:relative;top:1px}
+ul.inline{margin:0 auto .625em auto;margin-left:-1.375em;margin-right:0;padding:0;list-style:none;overflow:hidden}
+ul.inline>li{list-style:none;float:left;margin-left:1.375em;display:block}
+ul.inline>li>*{display:block}
+.unstyled dl dt{font-weight:400;font-style:normal}
+ol.arabic{list-style-type:decimal}
+ol.decimal{list-style-type:decimal-leading-zero}
+ol.loweralpha{list-style-type:lower-alpha}
+ol.upperalpha{list-style-type:upper-alpha}
+ol.lowerroman{list-style-type:lower-roman}
+ol.upperroman{list-style-type:upper-roman}
+ol.lowergreek{list-style-type:lower-greek}
+.hdlist>table,.colist>table{border:0;background:none}
+.hdlist>table>tbody>tr,.colist>table>tbody>tr{background:none}
+td.hdlist1{padding-right:.75em;font-weight:bold}
+td.hdlist1,td.hdlist2{vertical-align:top}
+.literalblock+.colist,.listingblock+.colist{margin-top:-.5em}
+.colist>table tr>td:first-of-type{padding:0 .75em;line-height:1}
+.colist>table tr>td:last-of-type{padding:.25em 0}
+.thumb,.th{line-height:0;display:inline-block;border:solid 4px #fff;-webkit-box-shadow:0 0 0 1px #ddd;box-shadow:0 0 0 1px #ddd}
+.imageblock.left,.imageblock[style*="float: left"]{margin:.25em .625em 1.25em 0}
+.imageblock.right,.imageblock[style*="float: right"]{margin:.25em 0 1.25em .625em}
+.imageblock>.title{margin-bottom:0}
+.imageblock.thumb,.imageblock.th{border-width:6px}
+.imageblock.thumb>.title,.imageblock.th>.title{padding:0 .125em}
+.image.left,.image.right{margin-top:.25em;margin-bottom:.25em;display:inline-block;line-height:0}
+.image.left{margin-right:.625em}
+.image.right{margin-left:.625em}
+a.image{text-decoration:none}
+span.footnote,span.footnoteref{vertical-align:super;font-size:.875em}
+span.footnote a,span.footnoteref a{text-decoration:none}
+span.footnote a:active,span.footnoteref a:active{text-decoration:underline}
+#footnotes{padding-top:.75em;padding-bottom:.75em;margin-bottom:.625em}
+#footnotes hr{width:20%;min-width:6.25em;margin:-.25em 0 .75em 0;border-width:1px 0 0 0}
+#footnotes .footnote{padding:0 .375em;line-height:1.3;font-size:.875em;margin-left:1.2em;text-indent:-1.2em;margin-bottom:.2em}
+#footnotes .footnote a:first-of-type{font-weight:bold;text-decoration:none}
+#footnotes .footnote:last-of-type{margin-bottom:0}
+#content #footnotes{margin-top:-.625em;margin-bottom:0;padding:.75em 0}
+.gist .file-data>table{border:0;background:#fff;width:100%;margin-bottom:0}
+.gist .file-data>table td.line-data{width:99%}
+div.unbreakable{page-break-inside:avoid}
+.big{font-size:larger}
+.small{font-size:smaller}
+.underline{text-decoration:underline}
+.overline{text-decoration:overline}
+.line-through{text-decoration:line-through}
+.aqua{color:#00bfbf}
+.aqua-background{background-color:#00fafa}
+.black{color:#000}
+.black-background{background-color:#000}
+.blue{color:#0000bf}
+.blue-background{background-color:#0000fa}
+.fuchsia{color:#bf00bf}
+.fuchsia-background{background-color:#fa00fa}
+.gray{color:#606060}
+.gray-background{background-color:#7d7d7d}
+.green{color:#006000}
+.green-background{background-color:#007d00}
+.lime{color:#00bf00}
+.lime-background{background-color:#00fa00}
+.maroon{color:#600000}
+.maroon-background{background-color:#7d0000}
+.navy{color:#000060}
+.navy-background{background-color:#00007d}
+.olive{color:#606000}
+.olive-background{background-color:#7d7d00}
+.purple{color:#600060}
+.purple-background{background-color:#7d007d}
+.red{color:#bf0000}
+.red-background{background-color:#fa0000}
+.silver{color:#909090}
+.silver-background{background-color:#bcbcbc}
+.teal{color:#006060}
+.teal-background{background-color:#007d7d}
+.white{color:#bfbfbf}
+.white-background{background-color:#fafafa}
+.yellow{color:#bfbf00}
+.yellow-background{background-color:#fafa00}
+span.icon>.fa{cursor:default}
+.admonitionblock td.icon [class^="fa icon-"]{font-size:2.5em;text-shadow:1px 1px 2px rgba(0,0,0,.5);cursor:default}
+.admonitionblock td.icon .icon-note:before{content:"\f05a";color:#19407c}
+.admonitionblock td.icon .icon-tip:before{content:"\f0eb";text-shadow:1px 1px 2px rgba(155,155,0,.8);color:#111}
+.admonitionblock td.icon .icon-warning:before{content:"\f071";color:#bf6900}
+.admonitionblock td.icon .icon-caution:before{content:"\f06d";color:#bf3400}
+.admonitionblock td.icon .icon-important:before{content:"\f06a";color:#bf0000}
+.conum[data-value]{display:inline-block;color:#fff!important;background-color:rgba(0,0,0,.8);-webkit-border-radius:100px;border-radius:100px;text-align:center;font-size:.75em;width:1.67em;height:1.67em;line-height:1.67em;font-family:"Open Sans","DejaVu Sans",sans-serif;font-style:normal;font-weight:bold}
+.conum[data-value] *{color:#fff!important}
+.conum[data-value]+b{display:none}
+.conum[data-value]:after{content:attr(data-value)}
+pre .conum[data-value]{position:relative;top:-.125em}
+b.conum *{color:inherit!important}
+.conum:not([data-value]):empty{display:none}
+h1,h2{letter-spacing:-.01em}
+dt,th.tableblock,td.content{text-rendering:optimizeLegibility}
+p,td.content{letter-spacing:-.01em}
+p strong,td.content strong{letter-spacing:-.005em}
+p,blockquote,dt,td.content{font-size:1.0625rem}
+p{margin-bottom:1.25rem}
+.sidebarblock p,.sidebarblock dt,.sidebarblock td.content,p.tableblock{font-size:1em}
+.exampleblock>.content{background-color:#fffef7;border-color:#e0e0dc;-webkit-box-shadow:0 1px 4px #e0e0dc;box-shadow:0 1px 4px #e0e0dc}
+.print-only{display:none!important}
+@media print{@page{margin:1.25cm .75cm}
+*{-webkit-box-shadow:none!important;box-shadow:none!important;text-shadow:none!important}
+a{color:inherit!important;text-decoration:underline!important}
+a.bare,a[href^="#"],a[href^="mailto:"]{text-decoration:none!important}
+a[href^="http:"]:not(.bare):after,a[href^="https:"]:not(.bare):after{content:"(" attr(href) ")";display:inline-block;font-size:.875em;padding-left:.25em}
+abbr[title]:after{content:" (" attr(title) ")"}
+pre,blockquote,tr,img{page-break-inside:avoid}
+thead{display:table-header-group}
+img{max-width:100%!important}
+p,blockquote,dt,td.content{font-size:1em;orphans:3;widows:3}
+h2,h3,#toctitle,.sidebarblock>.content>.title{page-break-after:avoid}
+#toc,.sidebarblock,.exampleblock>.content{background:none!important}
+#toc{border-bottom:1px solid #ddddd8!important;padding-bottom:0!important}
+.sect1{padding-bottom:0!important}
+.sect1+.sect1{border:0!important}
+#header>h1:first-child{margin-top:1.25rem}
+body.book #header{text-align:center}
+body.book #header>h1:first-child{border:0!important;margin:2.5em 0 1em 0}
+body.book #header .details{border:0!important;display:block;padding:0!important}
+body.book #header .details span:first-child{margin-left:0!important}
+body.book #header .details br{display:block}
+body.book #header .details br+span:before{content:none!important}
+body.book #toc{border:0!important;text-align:left!important;padding:0!important;margin:0!important}
+body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-break-before:always}
+.listingblock code[data-lang]:before{display:block}
+#footer{background:none!important;padding:0 .9375em}
+#footer-text{color:rgba(0,0,0,.6)!important;font-size:.9em}
+.hide-on-print{display:none!important}
+.print-only{display:block!important}
+.hide-for-print{display:none!important}
+.show-for-print{display:inherit!important}}
+</style>
+<style>
+/* Stylesheet for CodeRay to match GitHub theme | MIT License | http://foundation.zurb.com */
+/*pre.CodeRay {background-color:#f7f7f8;}*/
+.CodeRay .line-numbers{border-right:1px solid #d8d8d8;padding:0 0.5em 0 .25em}
+.CodeRay span.line-numbers{display:inline-block;margin-right:.5em;color:rgba(0,0,0,.3)}
+.CodeRay .line-numbers strong{font-weight: normal}
+table.CodeRay{border-collapse:separate;border-spacing:0;margin-bottom:0;border:0;background:none}
+table.CodeRay td{vertical-align: top}
+table.CodeRay td.line-numbers{text-align:right}
+table.CodeRay td.line-numbers>pre{padding:0;color:rgba(0,0,0,.3)}
+table.CodeRay td.code{padding:0 0 0 .5em}
+table.CodeRay td.code>pre{padding:0}
+.CodeRay .debug{color:#fff !important;background:#000080 !important}
+.CodeRay .annotation{color:#007}
+.CodeRay .attribute-name{color:#000080}
+.CodeRay .attribute-value{color:#700}
+.CodeRay .binary{color:#509}
+.CodeRay .comment{color:#998;font-style:italic}
+.CodeRay .char{color:#04d}
+.CodeRay .char .content{color:#04d}
+.CodeRay .char .delimiter{color:#039}
+.CodeRay .class{color:#458;font-weight:bold}
+.CodeRay .complex{color:#a08}
+.CodeRay .constant,.CodeRay .predefined-constant{color:#008080}
+.CodeRay .color{color:#099}
+.CodeRay .class-variable{color:#369}
+.CodeRay .decorator{color:#b0b}
+.CodeRay .definition{color:#099}
+.CodeRay .delimiter{color:#000}
+.CodeRay .doc{color:#970}
+.CodeRay .doctype{color:#34b}
+.CodeRay .doc-string{color:#d42}
+.CodeRay .escape{color:#666}
+.CodeRay .entity{color:#800}
+.CodeRay .error{color:#808}
+.CodeRay .exception{color:inherit}
+.CodeRay .filename{color:#099}
+.CodeRay .function{color:#900;font-weight:bold}
+.CodeRay .global-variable{color:#008080}
+.CodeRay .hex{color:#058}
+.CodeRay .integer,.CodeRay .float{color:#099}
+.CodeRay .include{color:#555}
+.CodeRay .inline{color:#00}
+.CodeRay .inline .inline{background:#ccc}
+.CodeRay .inline .inline .inline{background:#bbb}
+.CodeRay .inline .inline-delimiter{color:#d14}
+.CodeRay .inline-delimiter{color:#d14}
+.CodeRay .important{color:#555;font-weight:bold}
+.CodeRay .interpreted{color:#b2b}
+.CodeRay .instance-variable{color:#008080}
+.CodeRay .label{color:#970}
+.CodeRay .local-variable{color:#963}
+.CodeRay .octal{color:#40e}
+.CodeRay .predefined{color:#369}
+.CodeRay .preprocessor{color:#579}
+.CodeRay .pseudo-class{color:#555}
+.CodeRay .directive{font-weight:bold}
+.CodeRay .type{font-weight:bold}
+.CodeRay .predefined-type{color:inherit}
+.CodeRay .reserved,.CodeRay .keyword {color:#000;font-weight:bold}
+.CodeRay .key{color:#808}
+.CodeRay .key .delimiter{color:#606}
+.CodeRay .key .char{color:#80f}
+.CodeRay .value{color:#088}
+.CodeRay .regexp .delimiter{color:#808}
+.CodeRay .regexp .content{color:#808}
+.CodeRay .regexp .modifier{color:#808}
+.CodeRay .regexp .char{color:#d14}
+.CodeRay .regexp .function{color:#404;font-weight:bold}
+.CodeRay .string{color:#d20}
+.CodeRay .string .string .string{background:#ffd0d0}
+.CodeRay .string .content{color:#d14}
+.CodeRay .string .char{color:#d14}
+.CodeRay .string .delimiter{color:#d14}
+.CodeRay .shell{color:#d14}
+.CodeRay .shell .delimiter{color:#d14}
+.CodeRay .symbol{color:#990073}
+.CodeRay .symbol .content{color:#a60}
+.CodeRay .symbol .delimiter{color:#630}
+.CodeRay .tag{color:#008080}
+.CodeRay .tag-special{color:#d70}
+.CodeRay .variable{color:#036}
+.CodeRay .insert{background:#afa}
+.CodeRay .delete{background:#faa}
+.CodeRay .change{color:#aaf;background:#007}
+.CodeRay .head{color:#f8f;background:#505}
+.CodeRay .insert .insert{color:#080}
+.CodeRay .delete .delete{color:#800}
+.CodeRay .change .change{color:#66f}
+.CodeRay .head .head{color:#f4f}
+</style>
+</head>
+<body class="article">
+<div id="header">
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel2">
+<li><a href="#_security">Security</a></li>
+</ul>
+</div>
+</div>
+<div id="content">
+<div class="sect2">
+<h3 id="_security">Security</h3>
+<div class="paragraph">
+<p>Apache Karaf provides an advanced and flexible security system, powered by JAAS (Java Authentication and Authorization
+Service) in an OSGi compliant way.</p>
+</div>
+<div class="paragraph">
+<p>It provides a dynamic security system.</p>
+</div>
+<div class="paragraph">
+<p>The Apache Karaf security framework is used internally to control the access to:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>the OSGi services (described in the developer guide)</p>
+</li>
+<li>
+<p>the console commands</p>
+</li>
+<li>
+<p>the JMX layer</p>
+</li>
+<li>
+<p>the WebConsole</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>Your applications can also use the security framework (see the developer guide for details).</p>
+</div>
+<div class="sect3">
+<h4 id="_realms">Realms</h4>
+<div class="paragraph">
+<p>Apache Karaf is able to manage multiple realms. A realm contains the definition of the login modules to use for the
+authentication and/or authorization on this realm. The login modules define the authentication and authorization for
+the realm.</p>
+</div>
+<div class="paragraph">
+<p>The <code>jaas:realm-list</code> command list the current defined realms:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:realm-list
+Index | Realm Name | Login Module Class Name
+-----------------------------------------------------------------------------------
+1 | karaf | org.apache.karaf.jaas.modules.properties.PropertiesLoginModule
+2 | karaf | org.apache.karaf.jaas.modules.publickey.PublickeyLoginModule</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You can see that the Apache Karaf provides a default realm named <code>karaf</code>.</p>
+</div>
+<div class="paragraph">
+<p>This realm has two login modules:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>the <code>PropertiesLoginModule</code> uses the <code>etc/users.properties</code> file as backend for users, groups, roles and password.
+This login module authenticates the users and returns the users' roles.</p>
+</li>
+<li>
+<p>the <code>PublickeyLoginModule</code> is especially used by the SSHd. It uses the <code>etc/keys.properties</code> file. This file contains
+the users and a public key associated to each user.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>Apache Karaf provides additional login modules (see the developer guide for details):</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>JDBCLoginModule uses a database as backend</p>
+</li>
+<li>
+<p>LDAPLoginModule uses a LDAP server as backend</p>
+</li>
+<li>
+<p>SyncopeLoginModule uses Apache Syncope as backend</p>
+</li>
+<li>
+<p>OsgiConfigLoginModule uses a configuration as backend</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>You can manage an existing realm, login module, or create your own realm using the <code>jaas:realm-manage</code> command.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="_users_groups_roles_and_passwords">Users, groups, roles, and passwords</h4>
+<div class="paragraph">
+<p>As we saw, by default, Apache Karaf uses a PropertiesLoginModule.</p>
+</div>
+<div class="paragraph">
+<p>This login module uses the <code>etc/users.properties</code> file as storage for the users, groups, roles and passwords.</p>
+</div>
+<div class="paragraph">
+<p>The initial <code>etc/users.properties</code> file contains:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>################################################################################
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+#
+# This file contains the users, groups, and roles.
+# Each line has to be of the format:
+#
+# USER=PASSWORD,ROLE1,ROLE2,...
+# USER=PASSWORD,_g_:GROUP,...
+# _g_\:GROUP=ROLE1,ROLE2,...
+#
+# All users, grousp, and roles entered in this file are available after Karaf startup
+# and modifiable via the JAAS command group. These users reside in a JAAS domain
+# with the name "karaf".
+#
+karaf = karaf,_g_:admingroup
+_g_\:admingroup = group,admin,manager,viewer</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>We can see in this file, that we have one user by default: <code>karaf</code>.
+The default password is <code>karaf</code>.</p>
+</div>
+<div class="paragraph">
+<p>The <code>karaf</code> user is member of one group: the <code>admingroup</code>.</p>
+</div>
+<div class="paragraph">
+<p>A group is always prefixed by <code><em>g</em>:</code>. An entry without this prefix is an user.</p>
+</div>
+<div class="paragraph">
+<p>A group defines a set of roles. By default, the <code>admingroup</code> defines <code>group</code>, <code>admin</code>, <code>manager</code>, and <code>viewer</code>
+roles.</p>
+</div>
+<div class="paragraph">
+<p>It means that the <code>karaf</code> user will have the roles defined by the <code>admingroup</code>.</p>
+</div>
+<div class="sect4">
+<h5 id="_commands">Commands</h5>
+<div class="paragraph">
+<p>The <code>jaas:*</code> commands manage the realms, users, groups, roles in the console.</p>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_realm_list_code"><code>jaas:realm-list</code></h6>
+<div class="paragraph">
+<p>We already used the <code>jaas:realm-list</code> previously in this section.</p>
+</div>
+<div class="paragraph">
+<p>The <code>jaas:realm-list</code> command list the realm and the login modules for each realm:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:realm-list
+Index | Realm Name | Login Module Class Name
+-----------------------------------------------------------------------------------
+1 | karaf | org.apache.karaf.jaas.modules.properties.PropertiesLoginModule
+2 | karaf | org.apache.karaf.jaas.modules.publickey.PublickeyLoginModule</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>We have here one realm (<code>karaf</code>) containing two login modules (<code>PropertiesLoginModule</code> and <code>PublickeyLoginModule</code>).</p>
+</div>
+<div class="paragraph">
+<p>The <code>index</code> is used by the <code>jaas:realm-manage</code> command to easily identify the realm/login module that we want to manage.</p>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_realm_manage_code"><code>jaas:realm-manage</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:realm-manage</code> command switch in realm/login module edit mode, where you can manage the users, groups, and roles in the login module.</p>
+</div>
+<div class="paragraph">
+<p>To identify the realm and login module that you want to manage, you can use the <code>--index</code> option.
+The indexes are displayed by the <code>jaas:realm-list</code> command:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:realm-manage --index 1</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>Another way is to use the <code>--realm</code> and <code>--module</code> options. The <code>--realm</code> option expects the realm name, and the <code>--module</code>
+option expects the login module class name:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:realm-manage --realm karaf --module org.apache.karaf.jaas.modules.properties.PropertiesLoginModule</pre>
+</div>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_user_list_code"><code>jaas:user-list</code></h6>
+<div class="paragraph">
+<p>When you are in edit mode, you can list the users in the login module using the <code>jaas:user-list</code>:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:user-list
+User Name | Group | Role
+--------------------------------
+karaf | admingroup | admin
+karaf | admingroup | manager
+karaf | admingroup | viewer</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You can see the user name and the group by role.</p>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_user_add_code"><code>jaas:user-add</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:user-add</code> command adds a new user (and the password) in the currently edited login module:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:user-add foo bar</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>To "commit" your change (here the user addition), you have to execute the <code>jaas:update</code> command:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:update
+karaf@root()> jaas:realm-manage --index 1
+karaf@root()> jaas:user-list
+User Name | Group | Role
+--------------------------------
+karaf | admingroup | admin
+karaf | admingroup | manager
+karaf | admingroup | viewer
+foo | |</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>On the other hand, if you want to rollback the user addition, you can use the <code>jaas:cancel</code> command.</p>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_user_delete_code"><code>jaas:user-delete</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:user-delete</code> command deletes an user from the currently edited login module:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:user-delete foo</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>Like for the <code>jaas:user-add</code> command, you have to use the <code>jaas:update</code> to commit your change (or <code>jaas:cancel</code> to rollback):</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:update
+karaf@root()> jaas:realm-manage --index 1
+karaf@root()> jaas:user-list
+User Name | Group | Role
+--------------------------------
+karaf | admingroup | admin
+karaf | admingroup | manager
+karaf | admingroup | viewer</pre>
+</div>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_group_add_code"><code>jaas:group-add</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:group-add</code> command assigns a group (and eventually creates the group) to an user in the currently edited login module:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:group-add karaf mygroup</pre>
+</div>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_group_delete_code"><code>jaas:group-delete</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:group-delete</code> command removes an user from a group in the currently edited login module:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:group-delete karaf mygroup</pre>
+</div>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_group_role_add_code"><code>jaas:group-role-add</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:group-role-add</code> command adds a role in a group in the currently edited login module:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:group-role-add mygroup myrole</pre>
+</div>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_group_role_delete_code"><code>jaas:group-role-delete</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:group-role-delete</code> command removes a role from a group in the currently edited login module:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> jaas:group-role-delete mygroup myrole</pre>
+</div>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_update_code"><code>jaas:update</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:update</code> command commits your changes in the login module backend. For instance, in the case of the PropertiesLoginModule,
+the <code>etc/users.properties</code> will be updated only after the execution of the <code>jaas:update</code> command.</p>
+</div>
+</div>
+<div class="sect5">
+<h6 id="__code_jaas_cancel_code"><code>jaas:cancel</code></h6>
+<div class="paragraph">
+<p>The <code>jaas:cancel</code> command rollback your changes and doesn’t update the login module backend.</p>
+</div>
+</div>
+</div>
+</div>
+<div class="sect3">
+<h4 id="_passwords_encryption">Passwords encryption</h4>
+<div class="paragraph">
+<p>By default, the passwords are stored in clear form in the <code>etc/users.properties</code> file.</p>
+</div>
+<div class="paragraph">
+<p>It’s possible to enable encryption in the <code>etc/org.apache.karaf.jaas.cfg</code> configuration file:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>################################################################################
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+#
+# Boolean enabling / disabling encrypted passwords
+#
+encryption.enabled = false
+
+#
+# Encryption Service name
+# the default one is 'basic'
+# a more powerful one named 'jasypt' is available
+# when installing the encryption feature
+#
+encryption.name =
+
+#
+# Encryption prefix
+#
+encryption.prefix = {CRYPT}
+
+#
+# Encryption suffix
+#
+encryption.suffix = {CRYPT}
+
+#
+# Set the encryption algorithm to use in Karaf JAAS login module
+# Supported encryption algorithms follow:
+# MD2
+# MD5
+# SHA-1
+# SHA-256
+# SHA-384
+# SHA-512
+#
+encryption.algorithm = MD5
+
+#
+# Encoding of the encrypted password.
+# Can be:
+# hexadecimal
+# base64
+#
+encryption.encoding = hexadecimal</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>If the <code>encryption.enabled</code> property is set to true, the password encryption is enabled.</p>
+</div>
+<div class="paragraph">
+<p>With encryption enabled, the password are encrypted at the first time an user logs in. The encrypted passwords are
+prefixed and suffixed with <code>\{CRYPT\</code>}. To re-encrypt the password, you can reset the password in clear (in <code>etc/users.properties</code>
+file), without the <code>\{CRYPT\</code>} prefix and suffix. Apache Karaf will detect that this password is in clear (because it’s not
+prefixed and suffixed with <code>\{CRYPT\</code>}) and encrypt it again.</p>
+</div>
+<div class="paragraph">
+<p>The <code>etc/org.apache.karaf.jaas.cfg</code> configuration file allows you to define advanced encryption behaviours:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>the <code>encryption.prefix</code> property defines the prefix to "flag" a password as encrypted. The default is <code>\{CRYPT\</code>}.</p>
+</li>
+<li>
+<p>the <code>encryption.suffix</code> property defines the suffix to "flag" a password as encrypted. The default is <code>\{CRYPT\</code>}.</p>
+</li>
+<li>
+<p>the <code>encryption.algorithm</code> property defines the algorithm to use for encryption (digest). The possible values are <code>MD2</code>, <code>MD5</code>,
+<code>SHA-1</code>, <code>SHA-256</code>, <code>SHA-384</code>, <code>SHA-512</code>. The default is <code>MD5</code>.</p>
+</li>
+<li>
+<p>the <code>encryption.encoding</code> property defines the encoding of the encrypted password. The possible values are <code>hexadecimal</code>
+or <code>base64</code>. The default value is <code>hexadecimal</code>.</p>
+</li>
+</ul>
+</div>
+</div>
+<div class="sect3">
+<h4 id="_managing_authentication_by_key">Managing authentication by key</h4>
+<div class="paragraph">
+<p>For the SSH layer, Karaf supports the authentication by key, allowing to login without providing the password.</p>
+</div>
+<div class="paragraph">
+<p>The SSH client (so bin/client provided by Karaf itself, or any ssh client like OpenSSH) uses a public/private keys pair that
+will identify himself on Karaf SSHD (server side).</p>
+</div>
+<div class="paragraph">
+<p>The keys allowed to connect are stored in <code>etc/keys.properties</code> file, following the format:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>user=key,role</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>By default, Karaf allows a key for the karaf user:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre># karaf=AAAAB3NzaC1kc3MAAACBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAAAAFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QAAAIEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoAAACBAKKSU2PFl/qOLxIwmBZPPIcJshVe7bVUpFvyl3BbJDow8rXfskl8wO63OzP/qLmcJM0+JbcRU/53JjTuyk31drV2qxhIOsLDC9dGCWj47Y7TyhPdXh/0dthTRBy6bqGtRPxGa7gJov1xm/UuYYXPIUR/3x9MAZvZ5xvE0kYXO+rx,admin</pre>
+</div>
+</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<div class="title">Note</div>
+</td>
+<td class="content">
+<div class="paragraph">
+<p>For security reason, this key is disabled. We encourage to create the keys pair per client and update the <code>etc/keys.properties</code> file.</p>
+</div>
+</td>
+</tr>
+</table>
+</div>
+<div class="paragraph">
+<p>The easiest way to create key pair is to use OpenSSH.</p>
+</div>
+<div class="paragraph">
+<p>You can create a key pair using:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>ssh-keygen -t dsa -f karaf.id_dsa -N karaf</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You have now the public and private keys:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>-rw------- 1 jbonofre jbonofre 771 Jul 25 22:05 karaf.id_dsa
+-rw-r--r-- 1 jbonofre jbonofre 607 Jul 25 22:05 karaf.id_dsa.pub</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You can copy in the content of the <code>karaf.id_dsa.pub</code> file in the <code>etc/keys.properties</code>:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf=AAAAB3NzaC1kc3MAAACBAJLj9vnEhu3/Q9Cvym2jRDaNWkATgQiHZxmErCmiLRuD5Klfv+HT/+8WoYdnvj0YaXFP80phYhzZ7fbIO2LRFhYhPmGLa9nSeOsQlFuX5A9kY1120yB2kxSIZI0fU2hy1UCgmTxdTQPSYtdWBJyvO/vczoX/8I3FziEfss07Hj1NAAAAFQD1dKEzkt4e7rBPDokPOMZigBh4kwAAAIEAiLnpbGNbKm8SNLUEc/fJFswg4G4VjjngjbPZAjhkYe4+H2uYmynry6V+GOTS2kaFQGZRf9XhSpSwfdxKtx7vCCaoH9bZ6S5Pe0voWmeBhJXi/Sww8f2stpitW2Oq7V7lDdDG81+N/D7/rKDD5PjUyMsVqc1n9wCTmfqmi6XPEw8AAACAHAGwPn/Mv7P9Q9+JZRWtGq+i4pL1zs1OluiStCN9e/Ok96t3gRVKPheQ6IwLacNjC9KkSKrLtsVyepGA+V5j/N+Cmsl6csZilnLvMUTvL/cmHDEEhTIQnPNrDDv+tED2BFqkajQqYLgMWeGVqXsBU6IT66itZlYtrq4v6uDQG/o=,admin</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>and specify to the client to use the <code>karaf.id_dsa</code> private key:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>bin/client -k ~/karaf.id_dsa</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>or to ssh</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>ssh -p 8101 -i ~/karaf.id_dsa karaf@localhost</pre>
+</div>
+</div>
+</div>
+<div class="sect3">
+<h4 id="_rbac">RBAC</h4>
+<div class="paragraph">
+<p>Apache Karaf uses the roles to control the access to the resources: it’s a RBAC (Role Based Access Control) system.</p>
+</div>
+<div class="paragraph">
+<p>The roles are used to control:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>access to OSGi services</p>
+</li>
+<li>
+<p>access to the console (control the execution of the commands)</p>
+</li>
+<li>
+<p>access to JMX (MBeans and/or operations)</p>
+</li>
+<li>
+<p>access to the WebConsole</p>
+</li>
+</ul>
+</div>
+<div class="sect4">
+<h5 id="_osgi_services">OSGi services</h5>
+<div class="paragraph">
+<p>The details about OSGi services RBAC support is explained in the developer guide.</p>
+</div>
+</div>
+<div class="sect4">
+<h5 id="_console">Console</h5>
+<div class="paragraph">
+<p>Console RBAC supports is a specialization of the OSGi service RBAC. Actually, in Apache Karaf, all console commands are
+defined as OSGi services.</p>
+</div>
+<div class="paragraph">
+<p>The console command name follows the <code>scope:name</code> format.</p>
+</div>
+<div class="paragraph">
+<p>The ACL (Access Lists) are defined in <code>etc/org.apache.karaf.command.acl.<scope>.cfg</code> configuration files, where <code><scope></code>
+is the commands scope.</p>
+</div>
+<div class="paragraph">
+<p>For instance, we can define the ACL to the <code>feature:*</code> commands by creating a <code>etc/org.apache.karaf.command.acl.feature.cfg</code>
+configuration file. In this <code>etc/org.apache.karaf.command.acl.feature.cfg</code> configuration file, we can set:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>list = viewer
+info = viewer
+install = admin
+uninstall = admin</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>Here, we define that <code>feature:list</code> and <code>feature:info</code> commands can be executed by users with <code>viewer</code> role, whereas
+the <code>feature:install</code> and <code>feature:uninstall</code> commands can only be executed by users with <code>admin</code> role.
+Note that users in the admin group will also have viewer role, so will be able to do everything.</p>
+</div>
+<div class="paragraph">
+<p>Apache Karaf command ACLs can control access using (inside a given command scope):</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>the command name regex (e.g. <code>name = role</code>)</p>
+</li>
+<li>
+<p>the command name and options or arguments values regex (e.g. <code>name[/.<strong>[0-9][0-9][0-9]+.</strong>/] = role</code> to execute name only with argument value above 100)</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>Both command name and options/arguments support exact matching or regex matching.</p>
+</div>
+<div class="paragraph">
+<p>By default, Apache Karaf defines the following commands ACLs:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><code>etc/org.apache.karaf.command.acl.bundle.cfg</code> configuration file defines the ACL for <code>bundle:*</code> commands.
+This ACL limits the execution of <code>bundle:*</code> commands for system bundles only to the users with <code>admin</code> role, whereas
+<code>bundle:*</code> commands for non-system bundles can be executed by the users with <code>manager</code> role.</p>
+</li>
+<li>
+<p><code>etc/org.apache.karaf.command.acl.config.cfg</code> configuration file defines the ACL for <code>config:*</code> commands.
+This ACL limits the execution of <code>config:*</code> commands with <code>jmx.acl.<strong></code>, <code>org.apache.karaf.command.acl.</strong></code>, and
+<code>org.apache.karaf.service.acl.<strong></code> configuration PID to the users with <code>admin</code> role. For the other configuration PID,
+the users with the <code>manager</code> role can execute <code>config:</strong></code> commands.</p>
+</li>
+<li>
+<p><code>etc/org.apache.karaf.command.acl.feature.cfg</code> configuration file defines the ACL for <code>feature:*</code> commands.
+Only the users with <code>admin</code> role can execute <code>feature:install</code> and <code>feature:uninstall</code> commands. The other <code>feature:*</code>
+commands can be executed by any user.</p>
+</li>
+<li>
+<p><code>etc/org.apache.karaf.command.acl.jaas.cfg</code> configuration file defines the ACL for <code>jaas:*</code> commands.
+Only the users with <code>admin</code> role can execute <code>jaas:update</code> command. The other <code>jaas:*</code> commands can be executed by any
+user.</p>
+</li>
+<li>
+<p><code>etc/org.apache.karaf.command.acl.kar.cfg</code> configuration file defines the ACL for <code>kar:*</code> commands.
+Only the users with <code>admin</code> role can execute <code>kar:install</code> and <code>kar:uninstall</code> commands. The other <code>kar:*</code> commands
+can be executed by any user.</p>
+</li>
+<li>
+<p><code>etc/org.apache.karaf.command.acl.shell.cfg</code> configuration file defines the ACL for <code>shell:*</code> and "direct" commands.
+Only the users with <code>admin</code> role can execute <code>shell:edit</code>, <code>shell:exec</code>, <code>shell:new</code>, and <code>shell:java</code> commands.
+The other <code>shell:*</code> commands can be executed by any user.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>You can change these default ACLs, and add your own ACLs for additional command scopes (for instance <code>etc/org.apache.karaf.command.acl.cluster.cfg</code> for
+Apache Karaf Cellar, <code>etc/org.apache.karaf.command.acl.camel.cfg</code> from Apache Camel, …​).</p>
+</div>
+<div class="paragraph">
+<p>You can fine tuned the command RBAC support by editing the <code>karaf.secured.services</code> property in <code>etc/system.properties</code>:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>#
+# By default, only Karaf shell commands are secured, but additional services can be
+# secured by expanding this filter
+#
+karaf.secured.services = (&(osgi.command.scope=*)(osgi.command.function=*))</pre>
+</div>
+</div>
+</div>
+<div class="sect4">
+<h5 id="_jmx">JMX</h5>
+<div class="paragraph">
+<p>Like for the console commands, you can define ACL (AccessLists) to the JMX layer.</p>
+</div>
+<div class="paragraph">
+<p>The JMX ACL are defined in <code>etc/jmx.acl<ObjectName>.cfg</code> configuration file, where <code><ObjectName></code> is a MBean object name
+(for instance <code>org.apache.karaf.bundle</code> represents <code>org.apache.karaf;type=Bundle</code> MBean).</p>
+</div>
+<div class="paragraph">
+<p>The <code>etc/jmx.acl.cfg</code> is the most generic configuration file and is used when no specific ones are found.
+It contains the "global" ACL definition.</p>
+</div>
+<div class="paragraph">
+<p>JMX ACLs can control access using (inside a JMX MBean):</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>the operation name regex (e.g. <code>operation* = role</code>)</p>
+</li>
+<li>
+<p>the operation arguments value regex (e.g. <code>operation(java.lang.String, int)[/([1-4])?[0-9]/,/.*/] = role</code>)</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>By default, Apache Karaf defines the following JMX ACLs:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><code>etc/jmx.acl.org.apache.karaf.bundle.cfg</code> configuration file defines the ACL for the <code>org.apache.karaf:type=bundle</code>
+MBean. This ACL limits the <code>setStartLevel()</code>, <code>start()</code>, <code>stop()</code>, and <code>update()</code> operations for system bundles for
+only users with <code>admin</code> role. The other operations can be performed by users with the <code>manager</code> role.</p>
+</li>
+<li>
+<p><code>etc/jmx.acl.org.apache.karaf.config.cfg</code> configuration file defines the ACL for the <code>org.apache.karaf:type=config</code>
+MBean. This ACL limits the change on <code>jmx.acl*</code>, <code>org.apache.karaf.command.acl*</code>, and <code>org.apache.karaf.service.acl*</code>
+configuration PIDs for only users with <code>admin</code> role. The other operations can be performed by users with the <code>manager</code> role.</p>
+</li>
+<li>
+<p><code>etc/jmx.acl.org.apache.karaf.security.jmx.cfg</code> configuration file defines the ACL for the <code>org.apache.karaf:type=security,area=jmx</code>
+MBean. This ACL limits the invocation of the <code>canInvoke()</code> operation for the users with <code>viewer</code> role.</p>
+</li>
+<li>
+<p><code>etc/jmx.acl.osgi.compendium.cm.cfg</code> configuration file defines the ACL for the <code>osgi.compendium:type=cm</code> MBean.
+This ACL limits the changes on <code>jmx.acl*</code>, <code>org.apache.karaf.command.acl*</code>, and <code>org.apache.karaf.service.acl*</code>
+configuration PIDs for only users with <code>admin</code> role. The other operations can be performed by users with the <code>manager</code> role.</p>
+</li>
+<li>
+<p><code>etc/jmx.acl.java.lang.Memory.cfg</code> configuration file defines the ACL for the core JVM Memory MBean.
+This ACL limits the invocation of the <code>gc</code> operation for only users with the <code>manager</code> role.</p>
+</li>
+<li>
+<p><code>etc/jmx.acl.cfg</code> configuration file is the most generic file. The ACLs defined here are used when no other specific
+ACLs match (by specific ACL, it’s an ACL defined in another MBean specific <code>etc/jmx.acl.<strong>.cfg</code> configuration file).
+The <code>list</strong>()</code>, <code>get*()</code>, <code>is*()</code> operations can be performed by users with the <code>viewer</code> role.
+The <code>set*()</code> and all other <code>*()</code> operations can be performed by users with the <code>admin</code> role.</p>
+</li>
+</ul>
+</div>
+</div>
+<div class="sect4">
+<h5 id="_webconsole">WebConsole</h5>
+<div class="paragraph">
+<p>The Apache Karaf WebConsole is not available by default. To enable it, you have to install the <code>webconsole</code> feature:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>karaf@root()> feature:install webconsole</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>The WebConsole doesn’t support fine grained RBAC like console or JMX for now.</p>
+</div>
+<div class="paragraph">
+<p>All users with the <code>admin</code> role can logon the WebConsole and perform any operations.</p>
+</div>
+</div>
+</div>
+<div class="sect3">
+<h4 id="_securitymbean">SecurityMBean</h4>
+<div class="paragraph">
+<p>Apache Karaf provides a JMX MBean to check if the current user can invoke a given MBean and/or operation.</p>
+</div>
+<div class="paragraph">
+<p>The <code>canInvoke()</code> operation gets the roles of the current user, and check if one the roles can invoke the MBean and/or the
+operation, eventually with a given argument value.</p>
+</div>
+<div class="sect4">
+<h5 id="_operations">Operations</h5>
+<div class="ulist">
+<ul>
+<li>
+<p><code>canInvoke(objectName)</code> returns <code>true</code> if the current user can invoke the MBean with the <code>objectName</code>, <code>false</code> else.</p>
+</li>
+<li>
+<p><code>canInvoke(objectName, methodName)</code> returns <code>true</code> if the current user can invoke the operation <code>methodName</code> on the MBean
+with the <code>objectName</code>, <code>false</code> else.</p>
+</li>
+<li>
+<p><code>canInvoke(objectName, methodName, argumentTypes)</code> returns <code>true</code> if the current user can invoke the operation <code>methodName</code>
+with the array of arguments types <code>argumentTypes</code> on the MBean with <code>objectName</code>, <code>false</code> else.</p>
+</li>
+<li>
+<p><code>canInvoke(bulkQuery)</code> returns a tabular data containing for each operation in the <code>bulkQuery</code> tabular data if <code>canInvoke</code>
+is <code>true</code> or <code>false</code>.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect3">
+<h4 id="_security_providers">Security providers</h4>
+<div class="paragraph">
+<p>Some applications require specific security providers to be available, such as [BouncyCastle|http://www.bouncycastle.org].</p>
+</div>
+<div class="paragraph">
+<p>The JVM imposes some restrictions about the use of such jars: they have to be signed and be available on the boot classpath.</p>
+</div>
+<div class="paragraph">
+<p>One way to deploy those providers is to put them in the JRE folder at <code>$JAVA_HOME/jre/lib/ext</code> and modify the security
+policy configuration (<code>$JAVA_HOME/jre/lib/security/java.security</code>) in order to register such providers.</p>
+</div>
+<div class="paragraph">
+<p>While this approach works fine, it has a global effect and requires you to configure all your servers accordingly.</p>
+</div>
+<div class="paragraph">
+<p>Apache Karaf offers a simple way to configure additional security providers:
+* put your provider jar in <code>lib/ext</code>
+* modify the <code>etc/config.properties</code> configuration file to add the following property</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>org.apache.karaf.security.providers = xxx,yyy</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>The value of this property is a comma separated list of the provider class names to register.</p>
+</div>
+<div class="paragraph">
+<p>For instance, to add the bouncycastle security provider, you define:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>org.apache.karaf.security.providers = org.bouncycastle.jce.provider.BouncyCastleProvider</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>In addition, you may want to provide access to the classes from those providers from the system bundle so that all bundles
+can access those.</p>
+</div>
+<div class="paragraph">
+<p>It can be done by modifying the <code>org.osgi.framework.bootdelegation</code> property in the same configuration file:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>org.osgi.framework.bootdelegation = ...,org.bouncycastle*</pre>
+</div>
+</div>
+</div>
+</div>
+</div>
+<div id="footer">
+<div id="footer-text">
+Last updated 2016-04-27 13:59:28 CEST
+</div>
+</div>
+</body>
+</html>
\ No newline at end of file