wildfly/eap domain mode remoting ldap authentification - jboss

Question

i have a problem with Wildlfy 10/11/12. I sucessfully set wf in domain mode with http management, using complete AD authentification. I can not set remoting port 4447 for use AD auth. I tested it with local mgmt-users.properties and mgmt-groups.properties and everything worked fine.
Now I'm testing this:
1) Ldap works for http://127.0.0.1:9990/console/ (me user have all ad groups)
2) Ldap works with jconsole service:jmx:remote+http://127.0.0.1:9990 (Domain Controller)
3) Not working AD auth, with local mgmt-users everything works fine:
service:jmx:remote+http://127.0.0.1:4447
service:jmx:remote://127.0.0.1:4447
Why i need this? I need to monitor datasource stats from each server. Monitoring over HC does not give me these datas. This config uses 2 ldaps: one for http management and another for testing remoting port (RemotingRealm). Can you please help me to set use both ldaps?
I used this howto for Enable remoting in Domain mode:
https://kb.novaordis.com/index.php/JMX_Access_to_Domain_Mode_EAP_7_Server_Node
Coplete domain and host files:
https://tomashermanek.cz/download/domain.xml
https://tomashermanek.cz/download/host.xml
domain.xml
...
<management>
<access-control provider="rbac">
<role-mapping>
<role name="SuperUser">
<include>
<group name="_wildfly_adm"/>
</include>
</role>
<role name="Administrator">
<include>
<group name="_wildfly_adm"/>
</include>
</role>
<role name="Auditor">
<include>
<group name="_wildfly_audit"/>
</include>
</role>
<role name="Deployer">
<include>
<group name="_wildfly_deploy"/>
</include>
</role>
<role name="Maintainer">
<include>
<group name="_wildfly_maintain"/>
</include>
</role>
<role name="Monitor">
<include>
<group name="_wildfly_monit"/>
</include>
</role>
<role name="Operator">
<include>
<group name="_wildfly_ops"/>
</include>
</role>
</role-mapping>
</access-control>
</management>
...
<subsystem xmlns="urn:jboss:domain:jmx:1.3">
<expose-resolved-model/>
<expose-expression-model/>
<remoting-connector use-management-endpoint="false"/>
<sensitivity non-core-mbeans="true"/>
</subsystem>
<subsystem xmlns
...
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
<connector name="remoting-connector" socket-binding="remoting" security-realm="RemotingRealm"/>
<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
</subsystem>
...
<socket-binding-groups>
<socket-binding-group name="ha-sockets" default-interface="public">
<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
<socket-binding name="http" port="${jboss.http.port:8080}"/>
<socket-binding name="https" port="${jboss.https.port:8443}"/>
<socket-binding name="jgroups-mping" interface="private" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45700"/>
<socket-binding name="jgroups-tcp" interface="private" port="7600"/>
<socket-binding name="jgroups-udp" interface="private" port="55200" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45688"/>
<socket-binding name="modcluster" multicast-address="${jboss.modcluster.multicast.address:224.0.1.105}" multicast-port="23364"/>
<socket-binding name="txn-recovery-environment" port="4712"/>
<socket-binding name="txn-status-manager" port="4713"/>
<socket-binding name="remoting" port="4447"/>
<outbound-socket-binding name="mail-smtp">
<remote-destination host="localhost" port="25"/>
</outbound-socket-binding>
</socket-binding-group>
host.xml
...
<security-realm name="LdapRealm">
<authentication>
<ldap connection="ldap" base-dn="DC=example,DC=com" recursive="true">
<username-filter attribute="sAMAccountName"/>
</ldap>
</authentication>
<authorization>
<ldap connection="ldap">
<group-search group-dn-attribute="cn" group-name-attribute="cn">
<group-to-principal search-by="DISTINGUISHED_NAME" base-dn="OU=Groups,OU=Corp-Restricted,DC=example,DC=internal">
<membership-filter principal-attribute="member"/>
</group-to-principal>
</group-search>
</ldap>
</authorization>
</security-realm>
<security-realm name="RemotingRealm">
<authentication>
<ldap connection="ldap" base-dn="DC=example,DC=com" recursive="true">
<username-filter attribute="sAMAccountName"/>
</ldap>
</authentication>
<authorization>
<ldap connection="ldap">
<group-search group-dn-attribute="cn" group-name-attribute="cn">
<group-to-principal search-by="DISTINGUISHED_NAME" base-dn="OU=Groups,OU=Corp-Restricted,DC=example,DC=internal">
<membership-filter principal-attribute="member"/>
</group-to-principal>
</group-search>
</ldap>
</authorization>
</security-realms>
<outbound-connections>
<ldap name="ldap" url="ldap://ldap.server.one">
<properties>
<property name="java.naming.security.principal" value="search_user"/>
<property name="java.naming.security.credentials" value="password" />
<property name="java.naming.security.authentication" value="simple" />
</properties>
</ldap>
</outbound-connections>
...
<management-interfaces>
<native-interface security-realm="ManagementRealm">
<socket interface="management" port="${jboss.management.native.port:9999}"/>
</native-interface>
<http-interface security-realm="LdapRealm">
<http-upgrade enabled="true"/>
<socket interface="management" port="${jboss.management.http.port:9990}"/>
</http-interface>
</management-interfaces>
LOG From server dev-001
2018-04-06 15:26:16,598 TRACE [org.wildfly.security] (default task-1) Handling NameCallback: authenticationName = tomas.hermanek
2018-04-06 15:26:16,598 TRACE [org.jboss.as.domain.management.security] (default task-1) Non caching search for 'tomas.hermanek'
2018-04-06 15:26:16,598 TRACE [org.jboss.as.domain.management.security] (default task-1) Performing recursive search
2018-04-06 15:26:16,598 TRACE [org.jboss.as.domain.management.security] (default task-1) Searching for user 'tomas.hermanek' using filter '(sAMAccountName={0})'.
2018-04-06 15:26:16,598 TRACE [org.jboss.as.domain.management.security] (default task-1) Connecting to LDAP with properties ({java.naming.provider.url=ldap://10.1.31.10, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.referral=ignore})
2018-04-06 15:26:16,621 TRACE [org.wildfly.security] (default task-1) Principal assigning: [tomas.hermanek], pre-realm rewritten: [tomas.hermanek#RemotingRealm], realm name: [PLAIN], post-realm rewritten: [tomas.hermanek#RemotingRealm], realm rewritten: [tomas.hermanek#RemotingRealm]
2018-04-06 15:26:16,621 TRACE [org.jboss.as.domain.management.security] (default task-1) Non caching search for 'tomas.hermanek'
2018-04-06 15:26:16,621 TRACE [org.jboss.as.domain.management.security] (default task-1) Performing recursive search
2018-04-06 15:26:16,621 TRACE [org.jboss.as.domain.management.security] (default task-1) Searching for user 'tomas.hermanek' using filter '(sAMAccountName={0})'.
2018-04-06 15:26:16,621 TRACE [org.jboss.as.domain.management.security] (default task-1) Connecting to LDAP with properties ({java.naming.provider.url=ldap://10.1.31.10, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.referral=ignore})
2018-04-06 15:26:16,641 TRACE [org.wildfly.security] (default task-1) Handling AuthenticationCompleteCallback: fail
2018-04-06 15:26:16,641 TRACE [org.jboss.remoting.remote.server] (default task-1) Server sending authentication rejected: javax.security.sasl.SaslException: ELY05013: Authentication mechanism password not verified
at org.wildfly.security.sasl.plain.PlainSaslServer.evaluateResponse(PlainSaslServer.java:127)
at org.wildfly.security.sasl.util.AuthenticationCompleteCallbackSaslServerFactory$1.evaluateResponse(AuthenticationCompleteCallbackSaslServerFactory.java:58)
at org.wildfly.security.sasl.util.AuthenticationTimeoutSaslServerFactory$DelegatingTimeoutSaslServer.evaluateResponse(AuthenticationTimeoutSaslServerFactory.java:106)
at org.wildfly.security.sasl.util.SecurityIdentitySaslServerFactory$1.evaluateResponse(SecurityIdentitySaslServerFactory.java:59)
at org.xnio.sasl.SaslUtils.evaluateResponse(SaslUtils.java:245)
at org.xnio.sasl.SaslUtils.evaluateResponse(SaslUtils.java:217)
at org.jboss.remoting3.remote.ServerConnectionOpenListener$AuthStepRunnable.run(ServerConnectionOpenListener.java:486)
at org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:926)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:745)
2018-04-06 15:26:16,641 TRACE [org.jboss.remoting.remote.server] (default task-1) No more authentication attempts allowed, closing the connection

Answer 1

If LdapRealm an RemotingRealm are the same. And this does not work even when you replace RemotingRealm for LdapRealm, then this seems as bug.