We want to externalize the username and password used for remote ejb between two AS7.2 instances. But variable interpolation does not work in the <remote-outbound-connection> element's username attribute. It always sends the variable expression verbatim according to attached debugger, and trace logging of org.jboss.security on the target server.

I dug through the code and found the problem. The offending line as of writing this:
https://github.com/wildfly/wildfly/blob/dd3724f600e00e9cc539066cf0bd359f73d62064/remoting/subsystem/src/main/java/org/jboss/as/remoting/RemoteOutboundConnectionAdd.java#L80

I checked the api here: http://grepcode.com/file/repository.jboss.org/nexus/content/repositories/releases/org.jboss/jboss-dmr/1.2.0.Final/org/jboss/dmr/ExpressionValue.java#ExpressionValue.asString%28%29

It looks like you're supposed to use resolve(), not asString(). The earliest version I verified this mistake was 7.2.0.Final, which is the version we're running. It's still there in the latest revision of master of the Wildfly repo.

This problem possibly also affects other elements and attributes, so you may want to do a full usage scan of org.jboss.dmr.ModelValue#asString().