I've added an attribute flag="required" into the security domain configuration example (AS7-4598).
flag="required"