RaAdd.performRuntime has logic to do custom validation of proper combinations of security-related attributes. But it uses the wrong attributes, i.e. the ones used by the child ConnectionDefinitionResourceDefinition (CommonAttributes.CONNECTION_DEFINITIONS_NODE_ATTRIBUTE), not the "WM_xxx" ones that are part of the top level RA resource (i.e. CommonAttributes.RESOURCE_ADAPTER_ATTRIBUTE).