Permission
lastmod 2021-04-30created 2021-04-303 edits
Notes on permissions.
JBoss EAP Standard Roles (The Standard Roles)
- Monitor
- Users with the Monitor role have the fewest permissions and can only read the current configuration and state of the server. This role is intended for users who need to track and report on server performance.
- Monitors cannot modify the server configuration and cannot access sensitive data or operations.
- Operator
- The Operator role extends the Monitor role by adding the ability to modify the runtime state of the server. This means that Operators can reload and shut down the server as well as pause and resume JMS destinations. The Operator role is ideal for users who are responsible for the physical or virtual hosts of the application server, so they can shut down and restart servers when needed.
- Operators cannot modify the server configuration or access sensitive data or operations.
- Maintainer
- The Maintainer role has access to view and modify all runtime state and configuration except sensitive data and operations. The Maintainer role is a general-purpose role that does not have access to sensitive data and operations. The Administrator role allows users to be granted almost complete access to manage the server without giving them access to passwords and other sensitive information.
- Maintainers cannot access sensitive data or operations.
- Administrator
- The Administrator role has unrestricted access to all resources and operations on the server except the audit logging system. The Administrator role can access sensitive data and operations. This role can also configure the access control system. The Administrator role is only required when handling sensitive data or configuring users and roles.
- Administrators cannot access the audit logging system and cannot change themselves to the Auditor or SuperUser role.
- SuperUser
- The SuperUser role has no restrictions and has complete access to all resources and operations on the server, including the audit logging system. This role is equivalent to the administrator user of earlier versions of JBoss EAP 6 (6.0 and 6.1). If RBAC is disabled, all management users have permissions equivalent to the SuperUser role.
- Deployer
- The Deployer role has the same permissions as the Monitor, but can modify the configuration and state of deployments and any other resource type enabled as an application resource.
- Auditor
- The Auditor role has all the permissions of the Monitor role and can view (but not modify) sensitive data, and has full access to the audit logging system. The Auditor role is the only role other than SuperUser that can access the audit logging system.
- Auditors cannot modify sensitive data or resources. Only read access is permitted.