我已经成功使用自定义登录模块.现在我尝试使用以下代码告诉WildFly使用我自己的自定义授权管理器：

的jboss-web.xml中：

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
    <security-domain>CustomSecurityDomain</security-domain>
</jboss-web>

standalone.xml：

        ...
        <subsystem xmlns="urn:jboss:domain:security:1.2">
            <security-domains>
                ...
                <security-domain name="CustomSecurityDomain" cache-type="default">
                    <authentication>
                        <login-module code="my.CustomLoginModule" flag="required">
                            <module-option name="usersProperties" value="user.properties"/>
                            <module-option name="rolesProperties" value="roles.properties"/>
                        </login-module>
                    </authentication>
                    <authorization>
                        <policy-module code="my.CustomAuthorizationManager" flag="required"/>
                    </authorization>
                </security-domain>
            </security-domains>
        </subsystem>
        ...

CustomAuthorizationManager.java：

package my;

import java.util.List;

import javax.servlet.http.HttpServletRequest;

import io.undertow.security.idm.Account;
import io.undertow.servlet.api.AuthorizationManager;
import io.undertow.servlet.api.Deployment;
import io.undertow.servlet.api.ServletInfo;
import io.undertow.servlet.api.SingleConstraintMatch;
import io.undertow.servlet.api.TransportGuaranteeType;

public class CustomAuthorizationManager implements AuthorizationManager {

    @Override
    public boolean canAccessResource(List<SingleConstraintMatch> arg0, Account arg1, ServletInfo arg2, HttpServletRequest arg3, Deployment arg4) {
        // do something
        return false;
    }

    @Override
    public boolean isUserInRole(String arg0, Account arg1, ServletInfo arg2, HttpServletRequest arg3, Deployment arg4) {
        // do something
        return false;
    }

    @Override
    public TransportGuaranteeType transportGuarantee(TransportGuaranteeType arg0, TransportGuaranteeType arg1, HttpServletRequest arg2) {
        // do something
        return null;
    }

}

通过使用调试器并将断点设置到我自己的CustomAuthorizationManager和默认的io.undertow.servlet.core.DefaultAuthorizationManager实现,我可以看到它使用默认值而不是我的自定义实现.似乎WildFly忽略了standalone.xml中的配置.
将WildFly调试级别设置为TRACE表明我的CustomAuthorizationManager已正确部署.我尝试使用WildFly 9和10,两者的行为方式相同.

有谁知道这是一个错误还是错过了配置步骤？

解决方法:

尝试安全管理元素,如下所述：https://docs.jboss.org/author/display/WFLY10/Security+subsystem+configuration