There is no way to create an empty string recovery username and password and this is necessary for some customers. During the discussion we got to the conclusion that because this is JCA specific we don't want this configuration to impact Elytron and also that major configuration changes are not feasible in 7.4.x. As a result for 7.4.x, to which this issue is related, we are going to add possibility to set empty username and password by using two system variables emptyRecoveryUsername and emptyRecoveryPassword.