Documentation of security-domain element of identity-provider in PicketLink Federation Subsystem XSD (wildfly-picketlink-federation_1_1.xsd) says: "This attribute is required if the IdP is not external."

This definition is taken into account for adding a new identity-provider - security-domain is required, if external attribute is not set to true. However, security-domain can be undefined then via undefine-attribute operation in CLI. It leads to wrong server configuration which causes failure after server reload or restart. Removing of security-domain in this case should be denied.