There is method tempPath() in org.wildfly.security.auth.realm.FileSystemSecurityRealm.Identity which uses file.mkdirs() without checking its return value. It is bad practice to ignore return value of this method (since false means that file has not been created and it can result to any unexpected and confusing failure later).