It's not possible to create an Elytron security domain without a security realm (default-realm attribute is mandatory).

When an administrator wants to allow just ANONYMOUS access, he/she has to use a dummy security realm to configure such a security domain. It should be possible to have domain without realms too.