The various "authentication-context" attributes added into the connector module for the elytron integration say they support expressions. They shouldn't, as model references should not support expressions as these interfere with model referential integrity checks.

Also, where possible the attribute definitions should be configured as capability references, thus automatically turning on the kernel's referential integrity checks and allowing CLI and HAL value completion.

The latter is only possible for ADs where the containing resource exposes a capability itself. The DS and XA DS resources do. I'm not sure about RAs but I suspect they don't yet.