Potential simplification of FileSystemSecurityRealm --------------------------------------------------- Key: ELY-320 URL: https://issues.jboss.org/browse/ELY-320 Project: WildFly Elytron Issue Type: Enhancement Components: Realms Reporter: David Lloyd Assignee: David Lloyd An offhand comment by [~dlofthouse] got me thinking about a possibly major simplification and improvement to the file system realm. Right now it uses XML to store the identity and all its credentials; this is fairly complex and also not very secure. As an alternative approach, the realm could be rewritten to store each identity in two parts: authentication information and authorization information. The authentication information could consist of a KeyStore (probably a org.wildfly.security.keystore.WrappingPasswordKeyStore which could be enhanced to support modular crypt or another general format of password), whose aliases correspond to credential names. The authorization information could simply be a properties file which is loaded in to become Attributes. Recent identities could be cached for efficiency. This would massively simplify the realm implementation, and also improve the security of the stored credentials.