WildFly Elytron CLI Cheatsheet (WildFly 38+)

Common Elytron management commands for modern WildFly releases.

Credential Stores

/subsystem=elytron/credential-store=mycs:add(location=cs.store,relative-to=jboss.server.config.dir,create=true,credential-reference={clear-text=secret})

/subsystem=elytron/credential-store=mycs:add-alias(alias=db-password,secret-value=Password1!)/subsystem=elytron/credential-store=mycs:read-aliases()/subsystem=elytron/credential-store=mycs:remove-alias(alias=db-password)

Key Stores

/subsystem=elytron/key-store=httpsKS:add(path=https.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=PKCS12)

/subsystem=elytron/key-store=httpsKS:load()/subsystem=elytron/key-store=httpsKS:read-aliases()

/subsystem=elytron/key-store=httpsKS:generate-key-pair(alias=server,algorithm=RSA,key-size=2048,credential-reference={clear-text=secret},distinguished-name="CN=localhost")

Trust Stores

/subsystem=elytron/key-store=trustStore:add(path=truststore.p12,relative-to=jboss.server.config.dir,type=PKCS12,credential-reference={clear-text=secret})

SSL/TLS

/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,credential-reference={clear-text=secret})/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=[TLSv1.3,TLSv1.2])/subsystem=elytron/server-ssl-context=httpsSSC:read-resource()

Filesystem Realm

/subsystem=elytron/filesystem-realm=fsRealm:add(path=fs-realm,relative-to=jboss.server.config.dir)/subsystem=elytron/filesystem-realm=fsRealm:add-identity(identity=user1)/subsystem=elytron/filesystem-realm=fsRealm:set-password(identity=user1,clear={password=Password1!})

Properties Realm

/subsystem=elytron/properties-realm=propRealm:add(users-properties={path=application-users.properties,relative-to=jboss.server.config.dir},groups-properties={path=application-roles.properties,relative-to=jboss.server.config.dir})

Security Domains

/subsystem=elytron/security-domain=ApplicationDomain:read-resource(recursive=true)

/subsystem=elytron/security-domain=myDomain:add(default-realm=fsRealm,permission-mapper=default-permission-mapper,realms=[{realm=fsRealm,role-decoder=groups-to-roles}])

Role Mappers

/subsystem=elytron/simple-role-decoder=groups-to-roles:add(attribute=groups)/subsystem=elytron/constant-role-mapper=admin-role:add(roles=[Administrator])

Authentication Factories

/subsystem=elytron/http-authentication-factory=myHttpFactory:add(http-server-mechanism-factory=global,security-domain=myDomain,mechanism-configurations=[{mechanism-name=BASIC}])

/subsystem=elytron/sasl-authentication-factory=mySaslFactory:add(sasl-server-factory=configured,security-domain=myDomain,mechanism-configurations=[{mechanism-name=PLAIN}])

Undertow Integration

/subsystem=undertow/application-security-domain=myapp:add(http-authentication-factory=myHttpFactory)/subsystem=undertow/application-security-domain=myapp:read-resource()

Tokens and JWT

/subsystem=elytron/token-realm=jwtRealm:add(jwt={issuer=[https://issuer.example.com],audience=[myapp],public-key="PUBLIC_KEY"})

/subsystem=elytron/security-domain=jwtDomain:add(default-realm=jwtRealm,permission-mapper=default-permission-mapper,realms=[{realm=jwtRealm}])

Diagnostics

/subsystem=elytron:read-resource(recursive=true)/subsystem=elytron:key-store=httpsKS:read-resource(include-runtime=true)/subsystem=elytron/server-ssl-context=httpsSSC:read-resource(include-runtime=true)/subsystem=elytron/security-domain=myDomain:read-resource(recursive=true)

Remove Resources

/subsystem=elytron/security-domain=myDomain:remove/subsystem=elytron/filesystem-realm=fsRealm:remove/subsystem=elytron/key-store=httpsKS:remove