WildFly 38 Model Reference

The Elytron Subsystem

Children (93)

add-prefix-role-mapper A role mapper definition for a role mapper that adds a prefix to each provided.
add-suffix-role-mapper A role mapper definition for a role mapper that adds a suffix to each provided.
aggregate-evidence-decoder An evidence decoder that is an aggregation of other evidence decoders. Given the evidence, these evidence decoders will be attempted in order until one returns a non-null principal or until there are no more evidence decoders left to try.
aggregate-http-server-mechanism-factory A http server factory definition where the http server factory is an aggregation of other http server factories.
aggregate-principal-decoder A principal decoder definition where the principal decoder is an aggregation of other principal decoders.
aggregate-principal-transformer A principal transformer aggregating more principal transformers. Original principal is tried to be transformed by individual transformers until one return non-null principal - that is returned.
aggregate-providers An aggregation of two or more Provider[] resources.
aggregate-realm A realm definition that is an aggregation of two realms, one for the authentication steps and one for loading the identity for the authorization steps.
aggregate-role-decoder Definition of a RoleDecoder that is an aggregation of other role decoders.
aggregate-role-mapper A role mapper definition where the role mapper is an aggregation of other role mappers.
aggregate-sasl-server-factory A sasl server factory definition where the sasl server factory is an aggregation of other sasl server factories.
aggregate-security-event-listener An aggregation of two or more security event listener resources.
authentication-configuration An individual authentication configuration definition.
authentication-context An individual authentication context definition.
caching-realm A realm definition that enables caching to another security realm. The caching strategy is LRU (Least Recently Used) where least accessed entries are discarded when the maximum number of entries is reached.
case-principal-transformer A principal transformer where the principal is adjusted to upper or lower case.
certificate-authority A certificate authority definition.
certificate-authority-account A certificate authority account definition.
chained-principal-transformer A principal transformer definition where the principal transformer is a chaining of other principal transformers.
client-ssl-context An SSLContext for use on the client side of a connection.
concatenating-principal-decoder A principal decoder definition where the principal decoder is a concatenation of other principal decoders.
configurable-http-server-mechanism-factory A HTTP server factory definition that wraps another HTTP server factory and applies the specified configuration and filtering.
configurable-sasl-server-factory A SaslServerFactory definition that wraps another SaslServerFactory and applies the specified configuration and filtering.
constant-permission-mapper Definition of a permission mapper that always returns the same constant.
constant-principal-decoder Definition of a principal decoder that always returns the same constant.
constant-principal-transformer A principal transformer definition for a PrincipalTransformer that always returns the same constant.
constant-realm-mapper Definition of a constant RealmMapper that always returns the same value.
constant-role-mapper A role mapper definition where a constant set of roles is always returned.
credential-store Credential store to keep alias for sensitive information such as passwords for external services.
custom-credential-security-factory A custom credential SecurityFactory definition.
custom-evidence-decoder Definition of a custom evidence decoder.
custom-modifiable-realm Custom realm configured as being modifiable will be expected to implement the ModifiableSecurityRealm interface. By configuring a realm as being modifiable management operations will be made available to manipulate the realm.
custom-permission-mapper Definition of a custom permission mapper.
custom-principal-decoder Definition of a custom principal decoder
custom-principal-transformer A custom principal transformer definition.
custom-realm A custom realm definition can implement either the SecurityRealm interface or the ModifiableSecurityRealm interface. Regardless of which interface is implemented management operations will not be exposed to manage the realm. However other services that depend on the realm will still be able to perform a type check and cast to gain access to the modification API.
custom-realm-mapper Definition of a custom RealmMapper
custom-role-decoder Definition of a custom RoleDecoder
custom-role-mapper Definition of a custom RoleMapper
custom-security-event-listener A custom security event listener. (Audit logger for example.)
dir-context The configuration to connect to a directory (LDAP) server.
distributed-realm A realm definition for authentication and authorization of identities distributed between multiple realms.
dynamic-client-ssl-context A Dynamic SSL context for use on the client side of a connection. It makes it possible to choose the SSL context to use based on the peer's host and port information
expression Definition of an expression resolver to decrypt encrypted expressions.

encryption Definition of an expression resolver to decrypt encrypted expressions.

failover-realm A realm definition that wraps two realms. One for default operation and the second to fail over to in case the first one is unavailable.
file-audit-log An audit logger that logs to a local file.
filesystem-realm A simple security realm definition backed by the filesystem.
filtering-key-store A filtering KeyStore definition.
http-authentication-factory Resource containing the association of a SecurityDomain with a HttpServerAuthenticationMechanismFactory.
identity-realm Realm definition for a realm which contains a single pre-defined identity.
jaas-realm A JAAS security realm definition. It uses a Login Context to verify the user's credentials.
jaspi-configuration Resource containing the JASPI ServerAuthModule configuration for the servlet profile.
jdbc-realm A security realm definition backed by database using JDBC.
kerberos-security-factory A security factory for obtaining a GSSCredential for use during authentication.
key-manager A key manager definition for creating the KeyManager is used to create an SSLContext.
key-store A KeyStore definition.
key-store-realm A security realm definition backed by a key store.
ldap-key-store A LdapKeyStore definition.
ldap-realm A security realm definition backed by LDAP.
logical-permission-mapper Definition of a logical permission mapper.
logical-role-mapper A RoleMapper definition for a RoleMapper that performs a logical operation using two referenced RoleMappers.
mapped-regex-realm-mapper Definition of a RealmMapper implementation that first uses a regular expression to extract the realm name, this is then converted using the configured mapping of realm names.
mapped-role-mapper A RoleMapper definition for a RoleMapper that performs a mapping based on configured map.
mechanism-provider-filtering-sasl-server-factory A SaslServerFactory definition that wraps another SaslServerFactory and enables filtering of mechanisms based on the mechanism name and Provider name and version. Any mechanisms loaded by factories not located using a Provider will not be filtered by this definition.
periodic-rotating-file-audit-log An audit log definition for persisting an audit log to a local file rotating the log after a time period derived from the given suffix string, which should be in a format understood by java.time.format.DateTimeFormatter.
permission-set Definition of a permission set.
policy A definition that sets up a policy provider.
properties-realm A security realm definition backed by properties files.
provider-http-server-mechanism-factory A http server factory definition where the http server factory is an aggregation of factories from the Provider[]
provider-loader A definition for a Provider loader.
provider-sasl-server-factory A sasl server factory definition where the sasl server factory is an aggregation of factories from the Provider[]
regex-principal-transformer A regular expression based principal transformer
regex-role-mapper A RoleMapper definition for a RoleMapper that performs a mapping based on regex and replaces matching roles with replacement pattern.
regex-validating-principal-transformer A regular expression based principal transformer which uses the regular expression to validate the name.
sasl-authentication-factory Resource containing the association of a SecurityDomain with a SaslServerFactory.
secret-key-credential-store A simple credential store to manage secret keys store clearly.
security-domain A security domain definition.
server-ssl-context An SSLContext for use on the server side of a connection.
server-ssl-sni-context A server side SNI Aware SSLContext that selects between an underlying context based on the provided SNI name
service-loader-http-server-mechanism-factory A http server factory definition where the http server factory is an aggregation of factories identified using a ServiceLoader
service-loader-sasl-server-factory A sasl server factory definition where the sasl server factory is an aggregation of factories identified using a ServiceLoader
simple-permission-mapper Definition of a simple configured permission mapper.
simple-regex-realm-mapper Definition of a simple RealmMapper that attempts to extract the realm name using the capture group from the regular expression, if that does not provide a match then the delegate RealmMapper is used instead.
simple-role-decoder Definition of a simple RoleDecoder that takes a single attribute and maps it directly to roles.
size-rotating-file-audit-log An audit log definition for persisting an audit log to a local file rotating the log after the size of the file grows beyond a certain point and keeping a fixed number of backups.
source-address-role-decoder Definition of a RoleDecoder that maps roles based on the IP address of a remote client.
syslog-audit-log An audit logger that sends audit events to a remote syslog server.
token-realm A security realm definition capable of validating and extracting identities from security tokens.
trust-manager A trust manager definition for creating the TrustManager[] as used to create an SSLContext.
virtual-security-domain A virtual security domain definition.
x500-attribute-principal-decoder Definition of a X.500 attribute based principal decoder
x500-subject-evidence-decoder An evidence decoder that derives the principal associated with the given evidence from the subject from the first certificate in the given evidence.
x509-subject-alt-name-evidence-decoder An evidence decoder that derives the principal associated with the given evidence from an X.509 subject alternative name from the first certificate in the given evidence.

Name	Dynamic	Other provider points
org.wildfly.security.elytron	false	none

Attributes (7)

default-authentication-context The default authentication context to be associated with all deployments.

Attribute	Value
Capability reference	/subsystem=elytron/authentication-context=*
Type	STRING
Nillable	true
Expressions Allowed	false
Storage	configuration
Access Type	read-write
Restart Required	all-services
Stability	default

default-ssl-context Reference to the SSLContext which should be globally registered as the default.

Attribute	Value
Capability reference	/subsystem=elytron/server-ssl-context=* /subsystem=elytron/server-ssl-sni-context=* /subsystem=elytron/dynamic-client-ssl-context=* /subsystem=elytron/client-ssl-context=*
Type	STRING
Nillable	true
Expressions Allowed	false
Storage	configuration
Access Type	read-write
Restart Required	all-services
Stability	default

disallowed-providers A list of providers that are not allowed, and will be removed from the providers list.

Attribute	Value
Type	LIST
Nillable	true
Expressions Allowed	true
Storage	configuration
Access Type	read-write
Restart Required	jvm
Stability	default

final-providers Reference to the Providers that should be registered after all existing Providers.

Attribute	Value
Capability reference	/subsystem=elytron/provider-loader=* /subsystem=elytron/aggregate-providers=*
Type	STRING
Nillable	true
Expressions Allowed	false
Storage	configuration
Access Type	read-write
Restart Required	all-services
Stability	default

initial-providers Reference to the Providers that should be registered ahead of all existing Providers.

Attribute	Value
Capability reference	/subsystem=elytron/provider-loader=* /subsystem=elytron/aggregate-providers=*
Type	STRING
Nillable	true
Expressions Allowed	false
Storage	configuration
Access Type	read-write
Restart Required	all-services
Stability	default

Attribute	Value
Default Value	true
Type	BOOLEAN
Nillable	true
Expressions Allowed	true
Storage	configuration
Access Type	read-write
Restart Required	all-services
Stability	default

security-properties Security properties to be set.

Attribute	Value
Type	OBJECT
Nillable	true
Expressions Allowed	false
Storage	configuration
Access Type	read-write
Restart Required	no-services
Stability	default

Operations (2)

add Operation adds the Elytron subsystem

Request Parameter	Type	Required	Expressions Allowed	Default value	Description
default-authentication-context	STRING	false	false		The default authentication context to be associated with all deployments.
default-ssl-context	STRING	false	false		Reference to the SSLContext which should be globally registered as the default.
disallowed-providers	LIST	false	true		A list of providers that are not allowed, and will be removed from the providers list.
final-providers	STRING	false	false		Reference to the Providers that should be registered after all existing Providers.
initial-providers	STRING	false	false		Reference to the Providers that should be registered ahead of all existing Providers.
register-jaspi-factory	BOOLEAN	false	true	true	Should the Elytron JASPI factory be globally registered?
security-properties	OBJECT	false	false		Security properties to be set.

remove Operation removes the Elytron subsystem

WildFly 38 Model Reference

Children (93)

Provided capabilities(1)

Attributes (7)

Operations (2)