This is checking that at least one of the top level attributes is defined, which AIUI is not actually required.

The issue here is the KEYSTORE and TRUSTSTORE attributes are complex attributes, with an ModelType.OBJECT structure and requirements for the keys and values in that structure. Specifically, the the key "password" be present and with a value other than ModelType.UNDEFINED.

I believe the change here can be reverted and the necessary fix is to remove:

https://github.com/wildfly/wildfly/blob/master/security/src/main/java/org/jboss/as/security/ComplexAttributes.java#L43

That line could also be changed to setAllowNull(false) but that's the default so removing the line is fine.

With that, when the KEYSTORE or TRUSTSTORE attributes are used, the validateAndSet method should verify that "password" is not undefined.