WildFly 13 domain mode + Elytron security domains

[sergiu_pienar]

I tried deploying an app when WildFly was started in domain mode but even though I had defined the security domain, under the elytron subsystem of the profile that I was starting the server group with WIldFly failed to recognize them.

It was only when I deployed the same security domain under the legacy security system that the deployment was successful.

Under the standalone mode this works without such issues. Is there a difference in how the elytron subsystem should be configured on the domain mode ?

[dlofthouse]

There should not be a difference but do your ejb and undertow subsystems also have the application-security-domain mappings defined?

[sergiu_pienar]

On the http-invoker I was still using the legacy realm by using <http-invoker securityRealm="acmeRealm"/> instead of the Elytron one <http-invoker http-authentication-factory="http-db-auth"/>.

However the undertow system still defines a https-listener

<https-listener name="https" socket-binding="https" security-realm="acmeRealm" enable-http2="true"/>

that seems to be making use of the legacy security configuration. Can this be upgraded to use elytron ?

I'm attaching my domain.xml.

Thanks

[mchoma]

Sergiu, this seems as bug. Your configuration seems ok. Please could you prepare smallest possible reproducer of the problem?

[sergiu_pienar]

Hi Martin,

I do not think this is a bug but only me not knowing what attribute replaces (that relates to elytron) the security realm attribute which I understand redirects to the legacy security system.