[ https://issues.jboss.org/browse/WFCORE-2670?page=com.atlassian.jira.plugi... ] Brian Stansberry commented on WFCORE-2670: ------------------------------------------ First issue here is AbstractCollectionHandler is not propagating failure descriptions that are recorded by the read-attribute step it adds. Fixing that provides more info: {code} [standalone@embedded /] /subsystem=elytron/ldap-realm=foobar2:list-add(name=identity-mapping.new-identity-attributes,value={name=key2,value=["val1","val2"]}) { "outcome" => "failed", "failure-description" => "WFLYCTL0393: Could not resolve attribute expression: 'identity-mapping.new-identity-attributes'", "rolled-back" => true } {code} The cause of that is this in EnhancedSyntaxSupport where it is trying to read the target resource's model: {code} if (result.has(part)) { result = result.get(part); } else { throw ControllerLogger.MGMT_OP_LOGGER.couldNotResolveExpression(attributeExpression); } {code} The 'result' node when it fails is the DMR for the 'identity-mapping' attribute. It does not have any child named 'new-identity-attributes' hence the failure. So the first question is why not. It's not super surprising as the add op didn't configure this attribute, so that's probably the answer. In which case the second question is how to deal with that. Perhaps simply being lenient is fine. -- This message was sent by Atlassian JIRA (v7.2.3#72005)