When using multiple security schemes based on the client’s IP address, the order the security realms are specified in must be the same for all IP addresses. The default ordering is specified by the mks.security.policy.scheme.default setting. For example, if the default ordering is the following:

then the following scheme orders are valid:

but the following scheme orders are not valid:

If the default scheme does not contain the complete list of security realms, then you must use the mks.usersDomain property to specify the order. For example, the following is a valid combination of settings:

Specifying the security realm order also resolves potential issues if the same user is defined with an identical user name in more than one security realm. The user is authenticated from the security realm that appears first in the list.