RBAC, There are missing access-constraint for attributes which referencing elytron capabilities. ------------------------------------------------------------------------------------------------ Key: WFLY-8974 URL: https://issues.jboss.org/browse/WFLY-8974 Project: WildFly Issue Type: Bug Components: Domain Management, Security Affects Versions: 11.0.0.Alpha1 Reporter: Stefan Guilhen Assignee: Stefan Guilhen Priority: Critical According to RFE EAP7-548 there must be set access-constraint where are referenced elytron capabilities. 6 places were found where access-constraint missing. {code} /subsystem=undertow:read-resource-description(recursive=true) {code} There is http-invoker, attr http-authentication-factory with org.wildfly.security.http-authentication-factory capability. {code} /subsystem=datasources:read-resource-description(recursive=true) {code} There is xa-data-source, attr recovery-authentication-context with org.wildfly.security.authentication-context capability. {code} /subsystem=ejb3:read-resource-description(recursive=true) {code} There is identity, attr outflow-security-domains with org.wildfly.security.security-domain capability. {code} /core-service=management/management-interface=http-interface:read-resource-description(recursive=true) {code} There is sasl-authentication-factory with org.wildfly.security.sasl-authentication-factory capability. {code} /deployment=test:read-resource-description(recursive=true) {code} There is xa-data-source, attr recovery-authentication-context with org.wildfly.security.authentication-context capability and there is same problem in subdeployment resource too.