Elytron security realms cannot be used only for authorization

1) Configure Elytron Filesystem Realm for authentication and add users user and admin /subsystem=elytron/filesystem-realm=authnRealm:add(path=/tmp/fsRealm) /subsystem=elytron/filesystem-realm=authnRealm/identity=user:add() /subsystem=elytron/filesystem-realm=authnRealm/identity=user:set-password(clear={password=password}) /subsystem=elytron/filesystem-realm=authnRealm/identity=admin:add() /subsystem=elytron/filesystem-realm=authnRealm/identity=admin:set-password(clear={password=password}) 2) Configure Elytron Properties Realm for authorization (and add user user to user properties file) Create /tmp/users.properties with following content: #$REALM_NAME=authzRealm$ #user=whateverHere user=f3ef5b78a64bafdcae8d47ffbfecb8fc Create /tmp/roles.properties with following content: user=JBossAdmin admin=JBossAdmin Add Properties Realm: /subsystem=elytron/properties-realm=authzRealm:add(users-properties={path=/tmp/users.properties},groups-properties={path=/tmp/roles.properties}) 3) Configure Aggregate Realm /subsystem=elytron/aggregate-realm=aggregateRealm:add(authentication-realm=authnRealm,authorization-realm=authzRealm) 4) Configure rest of needed Elytron resources /subsystem=elytron/security-domain=appSecurityDomain:add( default -realm=aggregateRealm,permission-mapper= default -permission-mapper,realms=[{realm=aggregateRealm,role-decoder=groups-to-roles}]) /subsystem=elytron/http-authentication-factory=authFactory:add(http-server-mechanism-factory=global,security-domain=appSecurityDomain,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name= "aggregateRealm" }]}]) /subsystem=undertow/application-security-domain=print-roles:add(http-authentication-factory=authFactory) 5) Deploy app for printing roles (see attachments) 6) Try to authenticate to application Access http://127.0.0.1:8080/print-roles/protected/printRoles?role=JBossAdmin and try to use following users: user/password - authentication pass (because user user is included in /tmp/users.properties and role JBossAdmin is assigned to them admin/password - authentication pass but authorization fail (HTTP status 403 is returned) In correct behavior authentication should pass for both users and role JBossAdmin should be assigned to them.