The legacy security subsystem provides security to the application server via the org.jboss.as.security extension:
<extension module="org.jboss.as.security"/>
This subsystem is designed around the concept of a security domain, which is a set of Java Authentication and Authorization Service (JAAS) declarative security configurations. By defining security domains, your applications can control authentication, authorization, auditing, and mapping. Within each security domain, you can define login modules, which are the building blocks of your server security.
Note
A login module in the JBoss security model is derived from the Java interface javax.security.auth.spi.LoginModule, which contains some basic methods for authenticating a subject accessing your applications.
The list of available login modules is broad enough that we cannot discuss them all in detail. Generally speaking, the login modules are split into two main categories, depending on the location...