Source:
<code>private void addSecretService(OperationContext context, ModelNode secret, String realmName, ServiceTarget serviceTarget, ServiceBuilder<?> realmBuilder, Injector<CallbackHandlerFactory> injector) throws OperationFailedException { ServiceName secretServiceName = SecretIdentityService.ServiceUtil.createServiceName(realmName); ModelNode resolvedValueNode = SecretServerIdentityResourceDefinition.VALUE.resolveModelAttribute(context, secret); <START> boolean base64 = true; <END> SecretIdentityService sis; if (secret.hasDefined(CredentialReference.CREDENTIAL_REFERENCE)) { sis = new SecretIdentityService(resolvedValueNode.asString(), false); } else { sis = new SecretIdentityService(resolvedValueNode.asString(), base64); } final ServiceBuilder<CallbackHandlerFactory> serviceBuilder = serviceTarget.addService(secretServiceName, sis) .setInitialMode(ON_DEMAND); if (secret.hasDefined(CredentialReference.CREDENTIAL_REFERENCE)) { sis.getCredentialSourceSupplierInjector() .inject(CredentialReference.getCredentialSourceSupplier(context, SecretServerIdentityResourceDefinition.CREDENTIAL_REFERENCE, secret, serviceBuilder)); } serviceBuilder.install(); CallbackHandlerFactory.ServiceUtil.addDependency(realmBuilder, injector, secretServiceName); }</code><technical_language>This a change breaks compatibility. AIUI issue is attribute description, some other docs, state of attribute is Base64 encoded, logic assumes a resolved expression plain text. is a reasonable expectation, encoding a password in Base64 brings real security value, putting in plain text in a vault resolving a vault standard vault usage. of attribute description docs say, this behavior in code 2013. I change require a Base64 encoded value. expression Base64 encoded resolved worked. *Perhaps* base64 Boolean, a boolean pass 'null' if expression. SecretIdentityService *tries* Base64 decode, plain text if fails. a corner case breaking change a existing plain text happened valid Base64 text</technical_language>

Target:
private void addSecretService(OperationContext context, ModelNode secret, String realmName, ServiceTarget serviceTarget, ServiceBuilder<?> realmBuilder, Injector<CallbackHandlerFactory> injector) throws OperationFailedException { ServiceName secretServiceName = SecretIdentityService.ServiceUtil.createServiceName(realmName); ModelNode resolvedValueNode = SecretServerIdentityResourceDefinition.VALUE.resolveModelAttribute(context, secret); boolean base64=true; if(secret.get(SecretServerIdentityResourceDefinition.VALUE.getName()).getType() == ModelType.EXPRESSION) { String pattern = "^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)$"; Pattern p = Pattern.compile(pattern); Matcher m = p.matcher(resolvedValueNode.asString()); base64 =(m.find())?true:false; } SecretIdentityService sis; if (secret.hasDefined(CredentialReference.CREDENTIAL_REFERENCE)) { sis = new SecretIdentityService(resolvedValueNode.asString(), false); } else { sis = new SecretIdentityService(resolvedValueNode.asString(), base64); } final ServiceBuilder<CallbackHandlerFactory> serviceBuilder = serviceTarget.addService(secretServiceName, sis) .setInitialMode(ON_DEMAND); if (secret.hasDefined(CredentialReference.CREDENTIAL_REFERENCE)) { sis.getCredentialSourceSupplierInjector() .inject(CredentialReference.getCredentialSourceSupplier(context, SecretServerIdentityResourceDefinition.CREDENTIAL_REFERENCE, secret, serviceBuilder)); } serviceBuilder.install(); CallbackHandlerFactory.ServiceUtil.addDependency(realmBuilder, injector, secretServiceName); }