WildFly Full 20 Model Reference

  1. home
  2. subsystem=elytron

The Elytron Subsystem

Children (85)

  • add-prefix-role-mapper A role mapper definition for a role mapper that adds a prefix to each provided.
  • add-suffix-role-mapper A role mapper definition for a role mapper that adds a suffix to each provided.
  • aggregate-evidence-decoder An evidence decoder that is an aggregation of other evidence decoders. Given evidence, these evidence decoders will be attempted in order until one returns a non-null principal or until there are no more evidence decoders left to try.
  • aggregate-http-server-mechanism-factory A http server factory definition where the http server factory is an aggregation of other http server factories.
  • aggregate-principal-decoder A principal decoder definition where the principal decoder is an aggregation of other principal decoders.
  • aggregate-principal-transformer A principal transformer aggregating more principal transformers. Original principal is tried to be transformed by individual transformers until one return non-null principal - that is returned.
  • aggregate-providers An aggregation of two or more Provider[] resources.
  • aggregate-realm A realm definition that is an aggregation of two realms, one for the authentication steps and one for loading the identity for the authorization steps.
  • aggregate-role-decoder Definition of a RoleDecoder that is an aggregation of other role decoders.
  • aggregate-role-mapper A role mapper definition where the role mapper is an aggregation of other role mappers.
  • aggregate-sasl-server-factory A sasl server factory definition where the sasl server factory is an aggregation of other sasl server factories.
  • aggregate-security-event-listener An aggregation of two or more security event listener resources.
  • authentication-configuration An individual authentication configuration definition.
  • authentication-context An individual authentication context definition.
  • caching-realm A realm definition that enables caching to another security realm. Caching strategy is LRU (Least Recently Used) where least accessed entries are discarded when maximum number of entries is reached.
  • certificate-authority A certificate authority definition.
  • certificate-authority-account A certificate authority account definition.
  • chained-principal-transformer A principal transformer definition where the principal transformer is a chaining of other principal transformers.
  • client-ssl-context An SSLContext for use on the client side of a connection.
  • concatenating-principal-decoder A principal decoder definition where the principal decoder is a concatenation of other principal decoders.
  • configurable-http-server-mechanism-factory A HTTP server factory definition that wraps another HTTP server factory and applies the specified configuration and filtering.
  • configurable-sasl-server-factory A SaslServerFactory definition that wraps another SaslServerFactory and applies the specified configuration and filtering.
  • constant-permission-mapper Definition of a permission mapper that always returns the same constant.
  • constant-principal-decoder Definition of a principal decoder that always returns the same constant.
  • constant-principal-transformer A principal transformer definition for a PrincipalTransformer that always returns the same constant.
  • constant-realm-mapper Definition of a constant RealmMapper that always returns the same value.
  • constant-role-mapper A role mapper definition where a constant set of roles is always returned.
  • credential-store Credential store to keep alias for sensitive information such as passwords for external services.
  • custom-credential-security-factory A custom credential SecurityFactory definition.
  • custom-evidence-decoder Definition of a custom evidence decoder.
  • custom-modifiable-realm Custom realm configured as being modifiable will be expected to implement the ModifiableSecurityRealm interface. By configuring a realm as being modifiable management operations will be made available to manipulate the realm.
  • custom-permission-mapper Definition of a custom permission mapper.
  • custom-principal-decoder Definition of a custom principal decoder
  • custom-principal-transformer A custom principal transformer definition.
  • custom-realm A custom realm definitions can implement either the SecurityRealm interface or the ModifiableSecurityRealm interface. Regardless of which interface is implemented management operations will not be exposed to manage the realm. However other services that depend on the realm will still be able to perform a type check and cast to gain access to the modification API.
  • custom-realm-mapper Definition of a custom RealmMapper
  • custom-role-decoder Definition of a custom RoleDecoder
  • custom-role-mapper Definition of a custom RoleMapper
  • custom-security-event-listener A custom security event listener. (Audit logger for example.)
  • dir-context The configuration to connect to a directory (LDAP) server.
  • file-audit-log An audit logger that logs to a local file.
  • filesystem-realm A simple security realm definition backed by the filesystem.
  • filtering-key-store A filtering KeyStore definition.
  • http-authentication-factory Resource containing the association of a SecurityDomain with a HttpServerAuthenticationMechanismFactory.
  • identity-realm Realm definition for a realm which contains a single pre-defined identity.
  • jaspi-configuration Resource containing the JASPI ServerAuthModule configuration for the servlet profile.
  • jdbc-realm A security realm definition backed by database using JDBC.
  • kerberos-security-factory A security factory for obtaining a GSSCredential for use during authentication.
  • key-manager A key manager definition for creating the KeyManager as used to create an SSLContext.
  • key-store A KeyStore definition.
  • key-store-realm A security realm definition backed by a key store.
  • ldap-key-store A LdapKeyStore definition.
  • ldap-realm A security realm definition backed by LDAP.
  • logical-permission-mapper Definition of a logical permission mapper.
  • logical-role-mapper A RoleMapper definition for a RoleMapper that performs a logical operation using two referenced RoleMappers.
  • mapped-regex-realm-mapper Definition of a RealmMapper implementation that first uses a regular expression to extract the realm name, this is then converted using the configured mapping of realm names.
  • mapped-role-mapper A RoleMapper definition for a RoleMapper that performs a mapping based on configured map.
  • mechanism-provider-filtering-sasl-server-factory A SaslServerFactory definition that wraps another SaslServerFactory and enables filtering of mechanisms based on the mechanism name and Provider name and version. Any mechanisms loaded by factories not located using a Provider will not be filtered by this definition.
  • periodic-rotating-file-audit-log An audit log definition for persisting an audit log to a local files rotating the log after a time period derived from the given suffix string, which should be in a format understood by java.time.format.DateTimeFormatter.
  • permission-set Definition of a permission set.
  • policy A definition that sets up a policy provider.
  • properties-realm A security realm definition backed by properties files.
  • provider-http-server-mechanism-factory A http server factory definition where the http server factory is an aggregation of factories from the Provider[]
  • provider-loader A definition for a Provider loader.
  • provider-sasl-server-factory A sasl server factory definition where the sasl server factory is an aggregation of factories from the Provider[]
  • regex-principal-transformer A regular expression based principal transformer
  • regex-role-mapper A RoleMapper definition for a RoleMapper that performs a mapping based on regex and replaces matching roles with replacement pattern.
  • regex-validating-principal-transformer A regular expression based principal transformer which uses the regular expression to validate the name.
  • sasl-authentication-factory Resource containing the association of a SecurityDomain with a SaslServerFactory.
  • security-domain A security domain definition.
  • server-ssl-context An SSLContext for use on the server side of a connection.
  • server-ssl-sni-context A server side SNI Aware SSLContext that selects between an underlying context based on the provided SNI name
  • service-loader-http-server-mechanism-factory A http server factory definition where the http server factory is an aggregation of factories identified using a ServiceLoader
  • service-loader-sasl-server-factory A sasl server factory definition where the sasl server factory is an aggregation of factories identified using a ServiceLoader
  • simple-permission-mapper Definition of a simple configured permission mapper.
  • simple-regex-realm-mapper Definition of a simple RealmMapper that attempts to extract the realm name using the capture group from the regular expression, if that does not provide a match then the delegate RealmMapper is used instead.
  • simple-role-decoder Definition of a simple RoleDecoder that takes a single attribute and maps it directly to roles.
  • size-rotating-file-audit-log An audit log definition for persisting an audit log to a local files rotating the log after the size of the file grows beyond a certain point and keeping a fixed number of backups.
  • source-address-role-decoder Definition of a RoleDecoder that maps roles based on the IP address of a remote client.
  • syslog-audit-log An audit logger that sends audit events to a remote syslog server.
  • token-realm A security realm definition capable of validating and extracting identities from security tokens.
  • trust-manager A trust manager definition for creating the TrustManager[] as used to create an SSLContext.
  • x500-attribute-principal-decoder Definition of a X.500 attribute based principal decoder
  • x500-subject-evidence-decoder An evidence decoder that derives the principal associated with the given evidence from the subject from the first certificate in the given evidence.
  • x509-subject-alt-name-evidence-decoder An evidence decoder that derives the principal associated with the given evidence from an X.509 subject alternative name from the first certificate in the given evidence.

Provided capabilities(1)

Name Dynamic Other provider points
org.wildfly.security.elytron false

none

Attributes (7)

Operations (2)

  • add Operation adds the Elytron subsystem
    Request Parameter Type Required Expressions Allowed Default value Description
    default-authentication-context STRING false false The default authentication context to be associated with all deployments.
    default-ssl-context STRING false false Reference to the SSLContext which should be globally registered as the default.
    disallowed-providers LIST false true A list of providers that are not allowed, and will be removed from the providers list.
    final-providers STRING false false Reference to the Providers that should be registered after all existing Providers.
    initial-providers STRING false false Reference to the Providers that should be registered ahead of all existing Providers.
    register-jaspi-factory BOOLEAN false true true Should the Elytron JASPI factory be globally registered?
    security-properties OBJECT false false Security properties to be set.
  • remove Operation removes the Elytron subsystem