diff --git a/core/pom.xml b/core/pom.xml
index 111b8ac..ff047fe 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -105,7 +105,12 @@
             <version>${jetty.version}</version>
             <scope>test</scope>
         </dependency>
-
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-security</artifactId>
+            <version>${jetty.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
   <!-- add maxmind geo-ip library; exact copy of source included as required by LGPL2 -->
diff --git a/core/src/main/java/brooklyn/event/feed/http/HttpFeed.java b/core/src/main/java/brooklyn/event/feed/http/HttpFeed.java
index 06081a6..0ac2150 100644
--- a/core/src/main/java/brooklyn/event/feed/http/HttpFeed.java
+++ b/core/src/main/java/brooklyn/event/feed/http/HttpFeed.java
@@ -13,8 +13,12 @@
 import java.util.concurrent.Callable;
 import java.util.concurrent.TimeUnit;
 
+import com.google.common.base.Optional;
 import org.apache.http.HttpEntity;
 import org.apache.http.HttpResponse;
+import org.apache.http.auth.AuthScope;
+import org.apache.http.auth.Credentials;
+import org.apache.http.auth.UsernamePasswordCredentials;
 import org.apache.http.client.ClientProtocolException;
 import org.apache.http.client.HttpClient;
 import org.apache.http.client.methods.HttpGet;
@@ -23,6 +27,7 @@
 import org.apache.http.conn.ssl.SSLSocketFactory;
 import org.apache.http.conn.ssl.TrustStrategy;
 import org.apache.http.entity.ByteArrayEntity;
+import org.apache.http.impl.client.AbstractHttpClient;
 import org.apache.http.impl.client.DefaultHttpClient;
 import org.apache.http.util.EntityUtils;
 import org.slf4j.Logger;
@@ -108,8 +113,9 @@
         private Map<String, String> baseUriVars = Maps.newLinkedHashMap();
         private Map<String, String> headers = Maps.newLinkedHashMap();
         private boolean suspended = false;
+        private Credentials credentials;
         private volatile boolean built;
-        
+
         public Builder entity(EntityLocal val) {
             this.entity = val;
             return this;
@@ -167,6 +173,10 @@
             this.suspended = startsSuspended;
             return this;
         }
+        public Builder credentials(String username, String password) {
+            this.credentials = new UsernamePasswordCredentials(username, password);
+            return this;
+        }
         public HttpFeed build() {
             built = true;
             HttpFeed result = new HttpFeed(this);
@@ -185,15 +195,20 @@
         final Supplier<URI> uriProvider;
         final Map<String,String> headers;
         final byte[] body;
+        final Optional<Credentials> credentials;
 
-        private HttpPollIdentifier(String method, URI uri, Map<String,String> headers, byte[] body) {
-            this(method, Suppliers2.ofInstance(uri), headers, body);
+        private HttpPollIdentifier(String method, URI uri, Map<String,String> headers, byte[] body,
+                                   Optional<Credentials> credentials) {
+            this(method, Suppliers2.ofInstance(uri), headers, body, credentials);
         }
-        private HttpPollIdentifier(String method, Supplier<URI> uriProvider, Map<String,String> headers, byte[] body) {
+
+        private HttpPollIdentifier(String method, Supplier<URI> uriProvider, Map<String, String> headers, byte[] body,
+                                   Optional<Credentials> credentials) {
             this.method = checkNotNull(method, "method").toLowerCase();
             this.uriProvider = checkNotNull(uriProvider, "uriProvider");
             this.headers = checkNotNull(headers, "headers");
             this.body = body;
+            this.credentials = checkNotNull(credentials, "credentials");
             
             if (!(this.method.equals("get") || this.method.equals("post"))) {
                 throw new IllegalArgumentException("Unsupported HTTP method (only supports GET and POST): "+method);
@@ -205,7 +220,7 @@
 
         @Override
         public int hashCode() {
-            return Objects.hashCode(method, uriProvider, headers, body);
+            return Objects.hashCode(method, uriProvider, headers, body, credentials);
         }
         
         @Override
@@ -217,7 +232,8 @@
             return Objects.equal(method, o.method) &&
                     Objects.equal(uriProvider, o.uriProvider) &&
                     Objects.equal(headers, o.headers) &&
-                    Objects.equal(body, o.body);
+                    Objects.equal(body, o.body) &&
+                    Objects.equal(credentials, o.credentials);
         }
     }
     
@@ -235,6 +251,8 @@
             String method = config.getMethod();
             Map<String,String> headers = config.buildHeaders(baseHeaders);
             byte[] body = config.getBody();
+
+            Optional<Credentials> credentials = Optional.fromNullable(builder.credentials);
             
             Supplier<URI> baseUriProvider = builder.baseUriProvider;
             if (builder.baseUri!=null) {
@@ -248,13 +266,21 @@
             }
             checkNotNull(baseUriProvider);
 
-            polls.put(new HttpPollIdentifier(method, baseUriProvider, headers, body), configCopy);
+            polls.put(new HttpPollIdentifier(method, baseUriProvider, headers, body, credentials), configCopy);
         }
     }
 
     @Override
     protected void preStart() {
         for (final HttpPollIdentifier pollInfo : polls.keySet()) {
+            // Though HttpClients are thread safe and can take advantage of connection pooling
+            // and authentication caching, the httpcomponents documentation says:
+            //    "While HttpClient instances are thread safe and can be shared between multiple
+            //     threads of execution, it is highly recommended that each thread maintains its
+            //     own dedicated instance of HttpContext.
+            //  http://hc.apache.org/httpcomponents-client-ga/tutorial/html/connmgmt.html
+            final HttpClient httpClient = createHttpClient(pollInfo);
+
             Set<HttpPollConfig<?>> configs = polls.get(pollInfo);
             long minPeriod = Integer.MAX_VALUE;
             Set<AttributePollHandler<? super HttpPollValue>> handlers = Sets.newLinkedHashSet();
@@ -263,21 +289,6 @@
                 handlers.add(new AttributePollHandler<HttpPollValue>(config, entity, this));
                 if (config.getPeriod() > 0) minPeriod = Math.min(minPeriod, config.getPeriod());
             }
-            
-            final DefaultHttpClient httpClient = new DefaultHttpClient();
-            URI uri = pollInfo.uriProvider.get();
-            // TODO if supplier returns null, we may wish to defer initialization until url available?
-            if (uri!=null && "https".equalsIgnoreCase(uri.getScheme())) {
-                try {
-                    int port = (uri.getPort() >= 0) ? uri.getPort() : 443;
-                    SSLSocketFactory socketFactory = new SSLSocketFactory(new TrustAllStrategy(), SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
-                    Scheme sch = new Scheme("https", port, socketFactory);
-                    httpClient.getConnectionManager().getSchemeRegistry().register(sch);
-                } catch (Exception e) {
-                    log.warn("Error in HTTP Feed of {}, setting trust for uri {}", entity, uri);
-                    throw Exceptions.propagate(e);
-                }
-            }
 
             Callable<HttpPollValue> pollJob;
             
@@ -301,6 +312,35 @@
         }
     }
 
+    private HttpClient createHttpClient(HttpPollIdentifier pollIdentifier) {
+        final DefaultHttpClient httpClient = new DefaultHttpClient();
+
+        URI uri = pollIdentifier.uriProvider.get();
+        // TODO if supplier returns null, we may wish to defer initialization until url available?
+        if (uri != null && "https".equalsIgnoreCase(uri.getScheme())) {
+            try {
+                int port = (uri.getPort() >= 0) ? uri.getPort() : 443;
+                SSLSocketFactory socketFactory = new SSLSocketFactory(
+                        new TrustAllStrategy(), SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
+                Scheme sch = new Scheme("https", port, socketFactory);
+                httpClient.getConnectionManager().getSchemeRegistry().register(sch);
+            } catch (Exception e) {
+                log.warn("Error in HTTP Feed of {}, setting trust for uri {}", entity, uri);
+                throw Exceptions.propagate(e);
+            }
+        }
+
+        // Set credentials
+        if (uri != null && pollIdentifier.credentials.isPresent()) {
+            String hostname = uri.getHost();
+            int port = uri.getPort();
+            httpClient.getCredentialsProvider().setCredentials(
+                    new AuthScope(hostname, port), pollIdentifier.credentials.get());
+        }
+
+        return httpClient;
+    }
+
     @SuppressWarnings("unchecked")
     private Poller<HttpPollValue> getPoller() {
         return (Poller<HttpPollValue>) poller;
@@ -311,7 +351,7 @@
         for (Map.Entry<String,String> entry : headers.entrySet()) {
             httpGet.addHeader(entry.getKey(), entry.getValue());
         }
-        
+
         long startTime = System.currentTimeMillis();
         HttpResponse httpResponse = httpClient.execute(httpGet);
         try {
diff --git a/core/src/test/java/brooklyn/event/feed/http/HttpFeedIntegrationTest.java b/core/src/test/java/brooklyn/event/feed/http/HttpFeedIntegrationTest.java
new file mode 100644
index 0000000..6f8911d
--- /dev/null
+++ b/core/src/test/java/brooklyn/event/feed/http/HttpFeedIntegrationTest.java
@@ -0,0 +1,137 @@
+package brooklyn.event.feed.http;
+
+import brooklyn.entity.basic.ApplicationBuilder;
+import brooklyn.entity.basic.Entities;
+import brooklyn.entity.basic.EntityLocal;
+import brooklyn.entity.proxying.EntitySpecs;
+import brooklyn.event.AttributeSensor;
+import brooklyn.event.basic.BasicAttributeSensor;
+import brooklyn.location.Location;
+import brooklyn.location.basic.LocalhostMachineProvisioningLocation;
+import brooklyn.location.basic.PortRanges;
+import brooklyn.test.Asserts;
+import brooklyn.test.EntityTestUtils;
+import brooklyn.test.HttpService;
+import brooklyn.test.entity.TestApplication;
+import brooklyn.test.entity.TestEntity;
+import com.google.common.base.Functions;
+import com.google.common.collect.ImmutableList;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import java.net.URI;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+
+public class HttpFeedIntegrationTest {
+
+    final static AttributeSensor<String> SENSOR_STRING = new BasicAttributeSensor<String>(String.class, "aString", "");
+    final static AttributeSensor<Integer> SENSOR_INT = new BasicAttributeSensor<Integer>(Integer.class, "aLong", "");
+
+    private HttpService httpService;
+
+    private Location loc;
+    private TestApplication app;
+    private EntityLocal entity;
+    private HttpFeed feed;
+    
+    @BeforeMethod(alwaysRun=true)
+    public void setUp() throws Exception {
+        loc = new LocalhostMachineProvisioningLocation();
+        app = ApplicationBuilder.newManagedApp(TestApplication.class);
+        entity = app.createAndManageChild(EntitySpecs.spec(TestEntity.class));
+        app.start(ImmutableList.of(loc));
+    }
+
+    @AfterMethod(alwaysRun=true)
+    public void tearDown() throws Exception {
+        if (feed != null) feed.stop();
+        if (httpService != null) httpService.shutdown();
+        if (app != null) Entities.destroyAll(app);
+    }
+
+    @Test(groups = {"Integration"})
+    public void testPollsAndParsesHttpGetResponseWithSsl() throws Exception {
+        httpService = new HttpService(PortRanges.fromString("9000+"), true).start();
+        URI baseUrl = new URI(httpService.getUrl());
+
+        assertEquals(baseUrl.getScheme(), "https", "baseUrl="+baseUrl);
+        
+        feed = HttpFeed.builder()
+                .entity(entity)
+                .baseUri(baseUrl)
+                .poll(new HttpPollConfig<Integer>(SENSOR_INT)
+                        .period(100)
+                        .onSuccess(HttpValueFunctions.responseCode()))
+                .poll(new HttpPollConfig<String>(SENSOR_STRING)
+                        .period(100)
+                        .onSuccess(HttpValueFunctions.stringContentsFunction()))
+                .build();
+        
+        EntityTestUtils.assertAttributeEqualsEventually(entity, SENSOR_INT, 200);
+        Asserts.succeedsEventually(new Runnable() {
+            public void run() {
+                String val = entity.getAttribute(SENSOR_STRING);
+                assertTrue(val != null && val.contains("Hello, World"), "val="+val);
+            }});
+    }
+
+    @Test(groups = {"Integration"})
+    public void testPollsAndParsesHttpGetResponseWithBasicAuthentication() throws Exception {
+        final String username = "brooklyn";
+        final String password = "hunter2";
+        httpService = new HttpService(PortRanges.fromString("9000+"))
+                .basicAuthentication(username, password)
+                .start();
+        URI baseUrl = new URI(httpService.getUrl());
+        assertEquals(baseUrl.getScheme(), "http", "baseUrl="+baseUrl);
+
+        feed = HttpFeed.builder()
+                .entity(entity)
+                .baseUri(baseUrl)
+                .credentials(username, password)
+                .poll(new HttpPollConfig<Integer>(SENSOR_INT)
+                        .period(100)
+                        .onSuccess(HttpValueFunctions.responseCode()))
+                .poll(new HttpPollConfig<String>(SENSOR_STRING)
+                        .period(100)
+                        .onSuccess(HttpValueFunctions.stringContentsFunction()))
+                .build();
+
+        EntityTestUtils.assertAttributeEqualsEventually(entity, SENSOR_INT, 200);
+        Asserts.succeedsEventually(new Runnable() {
+            public void run() {
+                String val = entity.getAttribute(SENSOR_STRING);
+                assertTrue(val != null && val.contains("Hello, World"), "val="+val);
+            }});
+    }
+
+    @Test(groups = {"Integration"})
+    public void testPollWithInvalidCredentialsFails() throws Exception {
+        httpService = new HttpService(PortRanges.fromString("9000+"))
+                .basicAuthentication("brooklyn", "hunter2")
+                .start();
+
+        feed = HttpFeed.builder()
+                .entity(entity)
+                .baseUri(httpService.getUrl())
+                .credentials("brooklyn", "9876543210")
+                .poll(new HttpPollConfig<Integer>(SENSOR_INT)
+                        .period(100)
+                        .onSuccess(HttpValueFunctions.responseCode()))
+                .poll(new HttpPollConfig<String>(SENSOR_STRING)
+                        .period(100)
+                        .onSuccess(HttpValueFunctions.stringContentsFunction()))
+                .build();
+
+        EntityTestUtils.assertAttributeEqualsEventually(entity, SENSOR_INT, 401);
+        Asserts.succeedsEventually(new Runnable() {
+            public void run() {
+                String val = entity.getAttribute(SENSOR_STRING);
+                assertTrue(val != null && val.contains("Error 401 Unauthorized"), "val=" + val);
+            }
+        });
+    }
+}
diff --git a/core/src/test/java/brooklyn/event/feed/http/HttpFeedSslIntegrationTest.java b/core/src/test/java/brooklyn/event/feed/http/HttpFeedSslIntegrationTest.java
deleted file mode 100644
index 7b367cc..0000000
--- a/core/src/test/java/brooklyn/event/feed/http/HttpFeedSslIntegrationTest.java
+++ /dev/null
@@ -1,85 +0,0 @@
-package brooklyn.event.feed.http;
-
-import static brooklyn.test.TestUtils.executeUntilSucceeds;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertTrue;
-
-import java.net.URI;
-import java.util.concurrent.Callable;
-
-import org.testng.annotations.AfterMethod;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import brooklyn.entity.basic.ApplicationBuilder;
-import brooklyn.entity.basic.Entities;
-import brooklyn.entity.basic.EntityLocal;
-import brooklyn.entity.proxying.EntitySpecs;
-import brooklyn.event.basic.BasicAttributeSensor;
-import brooklyn.location.Location;
-import brooklyn.location.basic.LocalhostMachineProvisioningLocation;
-import brooklyn.location.basic.PortRanges;
-import brooklyn.test.EntityTestUtils;
-import brooklyn.test.HttpService;
-import brooklyn.test.entity.TestApplication;
-import brooklyn.test.entity.TestEntity;
-
-import com.google.common.collect.ImmutableList;
-
-public class HttpFeedSslIntegrationTest {
-
-    final static BasicAttributeSensor<String> SENSOR_STRING = new BasicAttributeSensor<String>(String.class, "aString", "");
-    final static BasicAttributeSensor<Integer> SENSOR_INT = new BasicAttributeSensor<Integer>(Integer.class, "aLong", "");
-
-    private static final long TIMEOUT_MS = 10*1000;
-    
-    private HttpService httpService;
-    private URI baseUrl;
-    
-    private Location loc;
-    private TestApplication app;
-    private EntityLocal entity;
-    private HttpFeed feed;
-    
-    @BeforeMethod(alwaysRun=true)
-    public void setUp() throws Exception {
-        httpService = new HttpService(PortRanges.fromString("9000+"), true);
-        baseUrl = new URI(httpService.getUrl());
-
-        loc = new LocalhostMachineProvisioningLocation();
-        app = ApplicationBuilder.newManagedApp(TestApplication.class);
-        entity = app.createAndManageChild(EntitySpecs.spec(TestEntity.class));
-        app.start(ImmutableList.of(loc));
-    }
-
-    @AfterMethod(alwaysRun=true)
-    public void tearDown() throws Exception {
-        if (feed != null) feed.stop();
-        if (httpService != null) httpService.shutdown();
-        if (app != null) Entities.destroyAll(app);
-    }
-    
-    @Test
-    public void testPollsAndParsesHttpGetResponse() throws Exception {
-        assertEquals(baseUrl.getScheme(), "https", "baseUrl="+baseUrl);
-        
-        feed = HttpFeed.builder()
-                .entity(entity)
-                .baseUri(baseUrl)
-                .poll(new HttpPollConfig<Integer>(SENSOR_INT)
-                        .period(100)
-                        .onSuccess(HttpValueFunctions.responseCode()))
-                .poll(new HttpPollConfig<String>(SENSOR_STRING)
-                        .period(100)
-                        .onSuccess(HttpValueFunctions.stringContentsFunction()))
-                .build();
-        
-        EntityTestUtils.assertAttributeEqualsEventually(entity, SENSOR_INT, 200);
-        executeUntilSucceeds(new Callable<Void>() {
-            public Void call() {
-                String val = entity.getAttribute(SENSOR_STRING);
-                assertTrue(val != null && val.contains("Hello, World"), "val="+val);
-                return null;
-            }});
-    }
-}
diff --git a/core/src/test/java/brooklyn/test/HttpService.java b/core/src/test/java/brooklyn/test/HttpService.java
index 266cf07..bd665e5 100644
--- a/core/src/test/java/brooklyn/test/HttpService.java
+++ b/core/src/test/java/brooklyn/test/HttpService.java
@@ -5,10 +5,19 @@
 import java.net.InetAddress;
 import java.security.KeyStore;
 
+import com.google.common.base.Optional;
+import org.eclipse.jetty.security.HashLoginService;
+import org.eclipse.jetty.security.authentication.BasicAuthenticator;
+import org.eclipse.jetty.security.authentication.DigestAuthenticator;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
+import org.eclipse.jetty.security.SecurityHandler;
 import org.eclipse.jetty.server.Connector;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ssl.SslSocketConnector;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.eclipse.jetty.util.security.Credential;
+import org.eclipse.jetty.util.security.Constraint;
 import org.eclipse.jetty.webapp.WebAppContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -40,17 +49,51 @@
     private final Server server;
     private volatile Thread shutdownHook;
 
-    public HttpService(PortRange portRange, boolean httpsEnabled) throws Exception {
+    private Optional<? extends SecurityHandler> securityHandler = Optional.absent();
+
+    public HttpService(PortRange portRange) {
+        this(portRange, false);
+    }
+
+    public HttpService(PortRange portRange, boolean httpsEnabled) {
         this.httpsEnabled = httpsEnabled;
         addr = LocalhostMachineProvisioningLocation.getLocalhostInetAddress();
         actualPort = LocalhostMachineProvisioningLocation.obtainPort(addr, portRange);
         server = new Server(actualPort);
-        
+    }
+
+    /**
+     * Enables basic HTTP authentication on the server.
+     */
+    public HttpService basicAuthentication(String username, String password) {
+        HashLoginService l = new HashLoginService();
+        l.putUser(username, Credential.getCredential(password), new String[]{"user"});
+        l.setName("test-realm");
+
+        Constraint constraint = new Constraint(Constraint.__BASIC_AUTH, "user");
+        constraint.setAuthenticate(true);
+
+        ConstraintMapping constraintMapping = new ConstraintMapping();
+        constraintMapping.setConstraint(constraint);
+        constraintMapping.setPathSpec("/*");
+
+        ConstraintSecurityHandler csh = new ConstraintSecurityHandler();
+        csh.setAuthenticator(new BasicAuthenticator());
+        csh.setRealmName("test-realm");
+        csh.addConstraintMapping(constraintMapping);
+        csh.setLoginService(l);
+
+        this.securityHandler = Optional.of(csh);
+
+        return this;
+    }
+
+    public HttpService start() throws Exception {
         try {
-            if(httpsEnabled){
+            if (httpsEnabled) {
                 //by default the server is configured with a http connector, this needs to be removed since we are going
                 //to provide https
-                for(Connector c: server.getConnectors()) {
+                for (Connector c: server.getConnectors()) {
                     server.removeConnector(c);
                 }
     
@@ -84,6 +127,10 @@
             context.setContextPath("/");
             context.setParentLoaderPriority(true);
 
+            if (securityHandler.isPresent()) {
+                context.setSecurityHandler(securityHandler.get());
+            }
+
             server.setHandler(context);
             server.start();
     
@@ -97,6 +144,8 @@
                 throw e;
             }
         }
+
+        return this;
     }
     
     public void shutdown() throws Exception {
@@ -139,4 +188,5 @@
             }
         });
     }
+
 }
diff --git a/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7Server.java b/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7Server.java
index 8dd8c1d..b1b427e 100644
--- a/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7Server.java
+++ b/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7Server.java
@@ -1,6 +1,7 @@
 package brooklyn.entity.webapp.jboss;
 
 import brooklyn.catalog.Catalog;
+import brooklyn.config.ConfigKey;
 import brooklyn.entity.basic.SoftwareProcess;
 import brooklyn.entity.proxying.ImplementedBy;
 import brooklyn.entity.trait.HasShortName;
@@ -64,4 +65,15 @@
 
     BasicAttributeSensor<Integer> MANAGEMENT_STATUS =
             new BasicAttributeSensor<Integer>(Integer.class, "webapp.jboss.managementStatus", "HTTP response code for the management server");
+
+    @SetFromFlag("managementUser")
+    ConfigKey<String> MANAGEMENT_USER = new BasicConfigKey<String>(String.class,
+            "webapp.jboss.managementUser",
+            "A user to be placed in the management realm. Brooklyn will use this user to poll sensors",
+            "brooklyn");
+
+    @SetFromFlag("managementPassword")
+    ConfigKey<String> MANAGEMENT_PASSWORD =
+            new BasicConfigKey<String>(String.class, "webapp.jboss.managementPassword", "Password for MANAGEMENT_USER.");
+
 }
diff --git a/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7ServerImpl.java b/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7ServerImpl.java
index 661bc0d..6b6bf24 100644
--- a/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7ServerImpl.java
+++ b/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7ServerImpl.java
@@ -64,6 +64,7 @@
                 .entity(this)
                 .period(200)
                 .baseUri(managementUri)
+                .credentials(getConfig(MANAGEMENT_USER), getConfig(MANAGEMENT_PASSWORD))
                 .poll(new HttpPollConfig<Integer>(MANAGEMENT_STATUS)
                         .onSuccess(HttpValueFunctions.responseCode()))
                 .poll(new HttpPollConfig<Boolean>(SERVICE_UP)
diff --git a/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7SshDriver.java b/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7SshDriver.java
index 8e615fb..b32695b 100644
--- a/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7SshDriver.java
+++ b/software/webapp/src/main/java/brooklyn/entity/webapp/jboss/JBoss7SshDriver.java
@@ -1,29 +1,38 @@
 package brooklyn.entity.webapp.jboss;
 
-import static java.lang.String.format;
-
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-
 import brooklyn.entity.basic.SoftwareProcess;
-import brooklyn.entity.basic.lifecycle.CommonCommands;
 import brooklyn.entity.drivers.downloads.DownloadResolver;
 import brooklyn.entity.webapp.JavaWebAppSshDriver;
 import brooklyn.location.basic.SshMachineLocation;
 import brooklyn.util.MutableMap;
 import brooklyn.util.NetworkUtils;
 import brooklyn.util.ResourceUtils;
+import brooklyn.util.ssh.CommonCommands;
 
+import com.google.common.base.Charsets;
 import com.google.common.base.Preconditions;
+import com.google.common.base.Strings;
+import com.google.common.hash.Hashing;
+
+import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import static java.lang.String.format;
 
 public class JBoss7SshDriver extends JavaWebAppSshDriver implements JBoss7Driver {
 
+    public static final Logger LOG = LoggerFactory.getLogger(JBoss7SshDriver.class);
+
     /*
       * TODO
-      * - security for stats access (see below)
       * - expose log file location, or even support accessing them dynamically
       * - more configurability of config files, java memory, etc
       */
@@ -31,7 +40,9 @@
     public static final String SERVER_TYPE = "standalone";
     private static final String CONFIG_FILE = "standalone-brooklyn.xml";
     private static final String KEYSTORE_FILE = ".keystore";
-    
+
+    private static final String MANAGEMENT_REALM = "ManagementRealm";
+
     private String expandedInstallDir;
     
     public JBoss7SshDriver(JBoss7ServerImpl entity, SshMachineLocation machine) {
@@ -79,6 +90,14 @@
         return entity.getAttribute(JBoss7Server.MANAGEMENT_NATIVE_PORT);
     }
 
+    private String getManagementUsername() {
+        return entity.getConfig(JBoss7Server.MANAGEMENT_USER);
+    }
+
+    private String getManagementPassword() {
+        return entity.getConfig(JBoss7Server.MANAGEMENT_PASSWORD);
+    }
+
     private Integer getPortIncrement() {
         return entity.getAttribute(JBoss7Server.PORT_INCREMENT);
     }
@@ -123,6 +142,15 @@
      */
     @Override
     public void customize() {
+        // Check that a password was set for the management user
+        Preconditions.checkState(!Strings.isNullOrEmpty(getManagementUsername()), "User for management realm required");
+        String managementPassword = getManagementPassword();
+        if (Strings.isNullOrEmpty(managementPassword)) {
+            LOG.warn("No password given for "+JBoss7Server.MANAGEMENT_PASSWORD.getName()+". Using a random string instead.");
+            entity.setConfig(JBoss7Server.MANAGEMENT_PASSWORD, UUID.randomUUID().toString());
+        }
+        String hashedPassword = hashPassword(getManagementUsername(), getManagementPassword(), MANAGEMENT_REALM);
+
         // Check that ports are all configured
         Map<String,Integer> ports = MutableMap.<String,Integer>builder()
                 .put("managementHttpPort", getManagementHttpPort()) 
@@ -141,10 +169,13 @@
         String hostname = entity.getAttribute(SoftwareProcess.HOSTNAME);
         Preconditions.checkNotNull(hostname, "AS 7 entity must set hostname otherwise server will only be visible on localhost");
         
-        // Copy the install files to the run-dir
+        // Copy the install files to the run-dir and add the management user
         newScript(CUSTOMIZING)
-                .body.append(format("cp -r %s/%s . || exit $!", getExpandedInstallDir(), SERVER_TYPE))
-                .execute();
+                .body.append(
+                    format("cp -r %s/%s . || exit $!", getExpandedInstallDir(), SERVER_TYPE),
+                    format("echo -e '\n%s=%s' >> %s/%s/configuration/mgmt-users.properties",
+                            getManagementUsername(), hashedPassword, getRunDir(), SERVER_TYPE)
+                ).execute();
 
         // Copy the keystore across, if there is one
         if (isProtocolEnabled("HTTPS")) {
@@ -169,8 +200,8 @@
     @Override
     public void launch() {
         Map flags = MutableMap.of("usePidFile", false);
-        
-        // We wait for evidence of tomcat running because, using 
+
+        // We wait for evidence of tomcat running because, using
         // brooklyn.ssh.config.tool.class=brooklyn.util.internal.ssh.cli.SshCliTool,
         // we saw the ssh session return before the tomcat process was fully running 
         // so the process failed to start.
@@ -223,4 +254,27 @@
         return options;
     }
 
+    /**
+     * Creates a hash of a username, password and security realm that is suitable for use
+     * with AS7 and Wildfire.
+     * <p/>
+     * Although AS7 has an <code>add-user.sh</code> script it is unsuitable for use in
+     * non-interactive modes. (See AS7-5061 for details.) Versions 7.1.2+ (EAP) accept
+     * a <code>--silent</code> flag. When this entity is updated past 7.1.1 we should
+     * probably use that instead.
+     * <p/>
+     * This method mirrors AS7 and Wildfire's method of hashing user's passwords. Refer
+     * to its class <code>UsernamePasswordHashUtil.generateHashedURP</code> for their
+     * implementation.
+     *
+     * @see <a href="https://issues.jboss.org/browse/AS7-5061">AS7-5061</a>
+     * @see <a href="https://github.com/jboss-remoting/jboss-sasl/blob/master/src/main/java/org/jboss/sasl/util/UsernamePasswordHashUtil.java">
+     *     UsernamePasswordHashUtil.generateHashedURP</a>
+     * @return <code>HEX(MD5(username ':' realm ':' password))</code>
+     */
+    public static String hashPassword(String username, String password, String realm) {
+        String concat = username + ":" + realm + ":" + password;
+        byte[] hashed = Hashing.md5().hashString(concat, Charsets.UTF_8).asBytes();
+        return Hex.encodeHexString(hashed);
+    }
 }
diff --git a/software/webapp/src/main/resources/brooklyn/entity/webapp/jboss/jboss7-standalone.xml b/software/webapp/src/main/resources/brooklyn/entity/webapp/jboss/jboss7-standalone.xml
index 4763a2a..714de2c 100644
--- a/software/webapp/src/main/resources/brooklyn/entity/webapp/jboss/jboss7-standalone.xml
+++ b/software/webapp/src/main/resources/brooklyn/entity/webapp/jboss/jboss7-standalone.xml
@@ -44,15 +44,9 @@
             <native-interface security-realm="ManagementRealm">
                 <socket-binding native="management-native"/>
             </native-interface>
-            [#if entity.httpManagementInterfaceSecurityRealm != ""]
-            <http-interface security-realm="${entity.httpManagementInterfaceSecurityRealm}">
+            <http-interface security-realm="ManagementRealm">
                 <socket-binding http="management-http"/>
             </http-interface>
-            [#else]
-            <http-interface>
-                <socket-binding http="management-http"/>
-            </http-interface>
-            [/#if]
         </management-interfaces>
     </management>
     <profile>
diff --git a/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/JBoss7PasswordHashingTest.java b/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/JBoss7PasswordHashingTest.java
new file mode 100644
index 0000000..aabc6a6
--- /dev/null
+++ b/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/JBoss7PasswordHashingTest.java
@@ -0,0 +1,42 @@
+package brooklyn.entity.webapp.jboss;
+
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertEquals;
+
+/**
+ * Expected values in tests were generated by AS7's add-user.sh script and copied here.
+ */
+public class JBoss7PasswordHashingTest {
+
+    @Test
+    public void testPasswordForManagementRealm() {
+        assertEquals(
+                JBoss7SshDriver.hashPassword("username", "password", "ManagementRealm"),
+                "8959126dd54df47f694cd762a51a1a6f");
+        assertEquals(
+                JBoss7SshDriver.hashPassword("test", "123", "ManagementRealm"),
+                "090d846d31185e54a5e8811a2ccb43ee");
+    }
+
+    @Test
+    public void testPasswordForApplicationRealm() {
+        assertEquals(
+                JBoss7SshDriver.hashPassword("username", "password", "ApplicationRealm"),
+                "888a0504c559a34b1c3e919dcec6d941");
+        assertEquals(
+                JBoss7SshDriver.hashPassword("test", "321", "ApplicationRealm"),
+                "a0fdaa45e2d509ac2d390ff6820e2a10");
+    }
+
+    @Test
+    public void testPasswordForCustomRealm() {
+        assertEquals(
+                JBoss7SshDriver.hashPassword("abcdef", "ghijkl", "BrooklynRealm"),
+                "a65be1ba2eb88b9b9edc6a2a7105af72");
+        assertEquals(
+                JBoss7SshDriver.hashPassword("username", "password", "BrooklynRealm"),
+                "161124b73591a1483330f496311b0692");
+    }
+
+}
diff --git a/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/Jboss7ServerIntegrationTest.java b/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/Jboss7ServerIntegrationTest.java
index 6634198..ffa5c25 100644
--- a/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/Jboss7ServerIntegrationTest.java
+++ b/software/webapp/src/test/java/brooklyn/entity/webapp/jboss/Jboss7ServerIntegrationTest.java
@@ -1,7 +1,22 @@
 package brooklyn.entity.webapp.jboss;
 
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
+import brooklyn.entity.basic.ApplicationBuilder;
+import brooklyn.entity.basic.Entities;
+import brooklyn.entity.proxying.EntitySpecs;
+import brooklyn.entity.webapp.HttpsSslConfig;
+import brooklyn.location.basic.LocalhostMachineProvisioningLocation;
+import brooklyn.test.Asserts;
+import brooklyn.test.HttpTestUtils;
+import brooklyn.test.entity.TestApplication;
+import brooklyn.util.crypto.FluentKeySigner;
+import brooklyn.util.crypto.SecureKeys;
+import com.google.common.collect.ImmutableList;
+import com.google.common.io.Closeables;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
 
 import java.io.File;
 import java.io.FileOutputStream;
@@ -9,26 +24,8 @@
 import java.security.KeyStore;
 import java.security.cert.Certificate;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.testng.annotations.AfterMethod;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import brooklyn.entity.basic.ApplicationBuilder;
-import brooklyn.entity.basic.Entities;
-import brooklyn.entity.proxying.EntitySpecs;
-import brooklyn.entity.webapp.HttpsSslConfig;
-import brooklyn.location.basic.LocalhostMachineProvisioningLocation;
-import brooklyn.test.HttpTestUtils;
-import brooklyn.test.TestUtils;
-import brooklyn.test.entity.TestApplication;
-import brooklyn.util.crypto.FluentKeySigner;
-import brooklyn.util.crypto.SecureKeys;
-import brooklyn.util.internal.TimeExtras;
-
-import com.google.common.collect.ImmutableList;
-import com.google.common.io.Closeables;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
 
 /**
  * TODO re-write this like WebAppIntegrationTest, rather than being jboss7 specific.
@@ -36,8 +33,6 @@
 public class Jboss7ServerIntegrationTest {
     private static final Logger LOG = LoggerFactory.getLogger(Jboss7ServerIntegrationTest.class);
     
-    static { TimeExtras.init(); }
-
     private URL warUrl;
     private LocalhostMachineProvisioningLocation localhostProvisioningLocation;
     private TestApplication app;
@@ -96,7 +91,7 @@
         
         HttpTestUtils.assertUrlUnreachable(httpsUrl);
 
-        TestUtils.executeUntilSucceeds(new Runnable() {
+        Asserts.succeedsEventually(new Runnable() {
             public void run() {
                 assertNotNull(server.getAttribute(JBoss7Server.REQUEST_COUNT));
                 assertNotNull(server.getAttribute(JBoss7Server.ERROR_COUNT));
@@ -168,7 +163,7 @@
         //HttpTestUtils.assertHttpStatusCodeEventuallyEquals(httpsUrl, 200);
         //HttpTestUtils.assertContentContainsText(httpsUrl, "Hello");
         
-        TestUtils.executeUntilSucceeds(new Runnable() {
+        Asserts.succeedsEventually(new Runnable() {
             public void run() {
                 assertNotNull(server.getAttribute(JBoss7Server.REQUEST_COUNT));
                 assertNotNull(server.getAttribute(JBoss7Server.ERROR_COUNT));
@@ -178,4 +173,20 @@
                 assertNotNull(server.getAttribute(JBoss7Server.BYTES_SENT));
             }});
     }
+
+    @Test(groups = {"Integration"})
+    public void testUsingPortOffsets() throws Exception {
+        final JBoss7Server serverA = app.createAndManageChild(EntitySpecs.spec(JBoss7Server.class)
+                .configure("portIncrement", 100));
+        final JBoss7Server serverB = app.createAndManageChild(EntitySpecs.spec(JBoss7Server.class)
+                .configure("portIncrement", 200));
+        app.start(ImmutableList.of(localhostProvisioningLocation));
+
+        Asserts.succeedsEventually(new Runnable() {
+            public void run() {
+                assertNotNull(serverA.getAttribute(JBoss7Server.BYTES_SENT));
+                assertNotNull(serverB.getAttribute(JBoss7Server.BYTES_SENT));
+            }});
+    }
+
 }
diff --git a/usage/rest/src/main/java/brooklyn/rest/security/BrooklynPropertiesSecurityFilter.java b/usage/rest/src/main/java/brooklyn/rest/security/BrooklynPropertiesSecurityFilter.java
index 6458504..2a41d84 100644
--- a/usage/rest/src/main/java/brooklyn/rest/security/BrooklynPropertiesSecurityFilter.java
+++ b/usage/rest/src/main/java/brooklyn/rest/security/BrooklynPropertiesSecurityFilter.java
@@ -20,6 +20,9 @@
 
 import com.sun.jersey.core.util.Base64;
 
+/**
+ * Provides basic HTTP authentication.
+ */
 public class BrooklynPropertiesSecurityFilter implements Filter {
     
     /** session attribute set for authenticated users; for reference