Elytron ldap-realm allows access with empty password

1) import user jduke with password Password1 and role JBossAdmin to Microsoft Active Directory 2) configure application server through CLI commands: /subsystem=elytron/dir-context=dir-context-ad:add(url= "$AD_URL" ,principal= "$AD_PRINCIPAL" ,credential= "$AD_CREDENTIAL" ) /subsystem=elytron/ldap-realm=ad-ldap-realm:add(dir-context=dir-context-ad,direct-verification= true ,identity-mapping={rdn-identifier=cn,search-base-dn= "$AD_BASE_DN" ,use-recursive-search= true ,attribute-mapping=[{filter-base-dn= "$AD_BASE_DN" ,filter= "(member={0})" ,from=cn,to=groups}]}) /subsystem=elytron/security-domain=ldap-security-domain:add(realms=[{realm=ad-ldap-realm,role-decoder=groups-to-roles}], default -realm=ad-ldap-realm,permission-mapper=login-permission-mapper) /subsystem=elytron/http-authentication-factory=ldap-ad-http-authentication-factory:add(http-server-mechanism-factory=global,security-domain=ldap-security-domain,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name= "Ldap Elytron" }]}]) /subsystem=undertow/application-security-domain=print-roles:add(http-authentication-factory=ldap-ad-http-authentication-factory) 3) deploy testing application (see attachments) 4) access http://localhost:8080/print-roles/protected/printRoles?role=JBossAdmin and try to with user jduke and with empty password - access to application is granted