WildFly Elytron doesn't need to be 'enabled' it is already enabled by default, just not in use by default. Configure it to perform HTTP BASIC authentication at the web layer The steps so the application use use Elytron based security are: - Add a new user to the application realm, as an example I add a user 'test' with a password of 'password' The test application is using the 'jmx-console' security domain, execute the following CLI command to map this to an Elytron http-authentication-factory: - ./subsystem=undertow/application-security-domain=jmx-console:add(http-authentication-factory=application-http-authentication) Deploy SimpleWar.war deploy SimpleWar.war Call the web application. curl -v http://localhost:8080/SimpleWar/Hello -u test:password the web page will print out the results of the PolicyContext.getContext() call