anchor.diff:  
   === Admin Clients
   
  -At this stage assuming the same files have been used as in this example it should be possible to connect to the management interface of the server either using a web browser or the JBoss CLI with the username elytron and password passwd12#$
  -
  -For certificate based authentication the keys and certificates from the WildFly Elytron tests can be used, these are found in JKS keystores under 'src/test/resources/ca/jks', these keystores have a password of Elytron.
  -
  -==== Web Browser Configuration
  -
  -A PKCS#12 file can be created from the test keystores,this can then be imported into the web browser to use when connecting to the server.
  -
  -----
  -keytool -importkeystore -srckeystore ladybird.keystore \
  -  -destkeystore ladybird.pkcs12 \
  -  -srcstoretype jks \
  -  -deststoretype pkcs12 \
  -  -deststorepass Elytron \
  -  -srcalias ladybird \
  -  -destalias ladybird
  -----
  -
  -==== CLI Configuration
  -
  -Since the integration of WildFly Elytron it is possible with the CLI to use a configuration file wildfly-config.xml to define the security settings including the settings for the client side SSL context.
  -
  -For the purpose of this example copy the ladybird,keystore and ca.truststore from the Wildfly Elytron testsuite to the location the JBoss CLI is being started from, the following wildfly-config.xml can be created in this location as well: -
  +At this stage assuming the same files have been used as in this example it should be possible to connect to the management interface of the server either using a web browser or the JBoss CLI with username and password from your original `mgmt-users.properties` file.
  +
  +For certificate based authentication certificates signed by your CA, whose subject DN resolves to username existing in properties realm will be accepted.
  +
  +==== CLI Client Configuration
  +
  +This suppose you have used following configuration in `bin/jboss-cli.xml`:
  +
  +[source, xml]
  +----
  +<ssl>
  +  <alias>adminalias</alias>
  +  <key-store>admin.keystore</key-store>
  +  <key-store-password>keystore_password</key-store-password>
  +  <trust-store>ca.truststore</trust-store>
  +  <trust-store-password>truststore_password</trust-store-password>
  +</ssl>
  +----
  +
  +You can stay using this configuration, but since the integration of WildFly Elytron it is possible with the CLI to use a configuration file wildfly-config.xml to define the security settings including the settings for the client side SSL context.
  +
  +In such case, following wildfly-config.xml can be created in the location the JBoss CLI is being started from: -
   
   [source, xml]
   ----
  
positive.code: {
      "outcome" => "success",
      "result" => {
          "identity" => {"username" => "Ladybird"},
          "mapped-roles" => ["SuperUser"]
      }
  }
  ----
negative.code: </subsystem>
  ----
  
  There is used the same principal transformer as defined for HTTP.
  
  == SSL Context
  
  The SSL context was already defined, but we need to modify it to not fail on client certificate authentication failure, but to fallback to password authentication.
  
  ----
  ./subsystem=elytron/server-ssl-context=LocalhostSslContext:write-attribute(name=need-client-auth, value=false)
  ./subsystem=elytron/server-ssl-context=LocalhostSslContext:write-attribute(name=want-client-auth, value=true)
  ----
  
  Resulting in: -
  