Here is an example using a security domain. The issue is of course valid for all locations where a list of objects is expected.

(for brevity, I only list a couple of options)

/subsystem=security/security-domain=LdapRealm:add(cache-type=default)
/subsystem=security/security-domain=LdapRealm/authentication=classic:add(login-modules=[{"code" => "LdapExtended", "flag" => "required", "module-options" => {"java.naming.provider.url" => "ldap://server.redhat.com:389/", "roleRecursion" => "0" }}])

There is currently no way to change a single option in that list. You can only remove the attribute "module-options" completely and re-add it.

We need something like:

/subsystem=security/security-domain=LdapRealm/authentication=classic/login-module=LdapExtended:write-list-attribute(name=module-options,value=

)

and similarly for "read" and "undefine" methods