title: Wildfly: Assign default role to user with client certificate authentication
body: <p>I am building a registration page using Wildfly for my application that requires users to register using their smart card.  I would like to have an initial landing page that does not require any authentication, then when they access the registration page it will prompt them to select a certificate from their smart card.</p>
  
  <p>I have gotten pretty close to having this work how I expect, but have hit a wall that I feel is surely due to my lack of understanding of Wildfly/JBOSS.</p>
  
  <p>I have the following security domain defined in my standalone.xml</p>
  
  <pre><code>&lt;security-domain name="client_cert_domain" cache-type="default"&gt;
                  &lt;authentication&gt;
                      &lt;login-module code="Certificate" flag="required"&gt;
                          &lt;module-option name="verifier" value="org.jboss.security.auth.certs.AnyCertVerifier"/&gt;
                          &lt;module-option name="securityDomain" value="client_cert_domain"/&gt;
                      &lt;/login-module&gt;
                  &lt;/authentication&gt;
                  &lt;jsse keystore-password="secret" keystore-url="file:${jboss.server.config.dir}/Certificates/HQ/KeyStore" truststore-password="secret" truststore-url="file:${jboss.server.config.dir}/Certificates/HQ/cacerts.jks" client-auth="true"/&gt;
              &lt;/security-domain&gt;
  </code></pre>
  
  <p>and my web.xml is</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Registration page only&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/register/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;User&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;CLIENT-CERT&lt;/auth-method&gt;
      &lt;realm-name&gt;Some Name For User To See&lt;/realm-name&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p></p>
  
  <p>Lastly, my jboss-web.xml</p>
  
  <pre><code>&lt;jboss-web&gt;
      &lt;security-domain&gt;client_cert_domain&lt;/security-domain&gt;
  &lt;/jboss-web&gt;
  </code></pre>
  
  <p>This does almost exactly what I want.  The main page doesn't require any authentication, and /register/ requires a client certificate.  The only gotcha is that because this is not a registered user, they have no Roles assigned to them so the page is blocked since they are not in the "User" Role specified in the auth-constraint tag.  </p>
  
  <p>Is there an easy way to automatically assign a default role to any user who authenticates using client certificates without having to have them pre-defined in a roles.properties file?</p>