1.3. Configure Authentication in a Security Domain To configure authentication settings for a security domain, log into the management console and follow this procedure. Procedure 1.1. Setup Authentication Settings for a Security Domain Open the security domain's detailed view. Click the Configuration label at the top of the management console. Select the profile to modify from the Profile selection box at the top left of the Profile view. Note You should only select a profile if you are running Red Hat JBoss Data Virtualizaton in domain mode. Expand the Security menu, and select Security Domains . Click the View link for the security domain you want to edit. Navigate to the Authentication subsystem configuration. Select the Authentication label at the top of the view if it is not already selected. The configuration area is divided into two areas: Login Modules and Details . The login module is the basic unit of configuration. A security domain can include several login modules, each of which can include several attributes and options. Add an authentication module. Click Add to add a JAAS authentication module. Fill in the details for your module. The Code is the class name of the module. The Flag setting controls how the module relates to other authentication modules within the same security domain. Explanation of the Flags The Java Enterprise Edition 6 specification provides the following explanation of the flags for security modules. The following list is taken from https://docs.oracle.com/javase/6/docs/api/javax/security/auth/login/Configuration.html . Refer to that document for more detailed information. Flag Details required The LoginModule is required to succeed. If it succeeds or fails, authentication still continues to proceed down the LoginModule list. requisite LoginModule is required to succeed. If it succeeds, authentication continues down the LoginModule list. If it fails, control immediately returns to the application (authentication does not proceed down the LoginModule list). sufficient The LoginModule is not required to succeed. If it does succeed, control immediately returns to the application (authentication does not proceed down the LoginModule list). If it fails, authentication continues down the LoginModule list. optional The LoginModule is not required to succeed. If it succeeds or fails, authentication still continues to proceed down the LoginModule list. Edit authentication settings After you have added your module, you can modify its Code or Flags by clicking Edit in the Details section of the screen. Be sure the Attributes tab is selected. Optional: Add or remove module options. If you need to add options to your module, click its entry in the Login Modules list, and select the Module Options tab in the Details section of the page. Click the Add button, and provide the key and value for the option. Use the Remove button to remove an option. Reload the Red Hat JBoss Data Virtualization server to make the authentication module changes available to applications. Result Your authentication module is added to the security domain, and is immediately available to applications which use the security domain. The jboss.security.security_domain Module Option By default, each login module defined in a security domain has the jboss.security.security_domain module option added to it automatically. This option causes problems with login modules which check to make sure that only known options are defined. The IBM Kerberos login module, com.ibm.security.auth.module.Krb5LoginModule is one of these. You can disable the behavior of adding this module option by setting the system property to true when starting JBoss EAP 6. Add the following to your start-up parameters. You can also set this property using the web-based Management Console. On a standalone server, you can set system properties in the System Properties section of the configuration. In a managed domain, you can set system properties for each server group.

Commands:
-Djboss.security.disable.secdomain.option=true