Documentation of security-domain element of identity-provider in PicketLink Federation Subsystem XSD (wildfly-picketlink-federation_1_1.xsd) says: "This attribute is required if the IdP is not external."

When adding identity-provider with external attribute, security-domain is not required. However, external attribute can be undefined then via undefine-attribute operation in CLI. In case when security-domain is still not set, removing of external attribute leads to wrong server configuration which causes failure after server reload or restart. In this case removing of external attribute should be denied.