docs: public static ExceptionSupplier<CredentialSource, Exception> getCredentialSourceSupplier(OperationContext context, ObjectTypeAttributeDefinition credentialReferenceAttributeDefinition, ModelNode model, ServiceBuilder<?> serviceBuilder) throws OperationFailedException {
  
          ModelNode value = credentialReferenceAttributeDefinition.resolveModelAttribute(context, model);
  
          final String credentialStoreName;
          final String credentialAlias;
          final String credentialType;
          final String secret;
  
          if (value.isDefined()) {
              credentialStoreName = credentialReferencePartAsStringIfDefined(value, CredentialReference.STORE);
              credentialAlias = credentialReferencePartAsStringIfDefined(value, CredentialReference.ALIAS);
              credentialType = credentialReferencePartAsStringIfDefined(value, CredentialReference.TYPE);
              secret = credentialReferencePartAsStringIfDefined(value, CredentialReference.CLEAR_TEXT);
          } else {
              credentialStoreName = null;
              credentialAlias = null;
              credentialType = null;
              secret = null;
          }
  
          final ServiceRegistry serviceRegistry;
          final ServiceName credentialStoreServiceName;
          if (credentialAlias != null) {
              // use credential store service
              String credentialStoreCapabilityName = RuntimeCapability.buildDynamicCapabilityName(CREDENTIAL_STORE_CAPABILITY, credentialStoreName);
              credentialStoreServiceName = context.getCapabilityServiceName(credentialStoreCapabilityName, CredentialStore.class);
              if(serviceBuilder != null) {
                  serviceBuilder.requires(credentialStoreServiceName);
              }
              serviceRegistry = context.getServiceRegistry(false);
          } else {
              credentialStoreServiceName = null;
              serviceRegistry = null;
          }
  
          return new ExceptionSupplier<CredentialSource, Exception>() {
  
              private String[] parseCommand(String command, String delimiter) {
                  // comma can be back slashed
                  final String[] parsedCommand = command.split("(?<!\\\\)" + delimiter);
                  for (int k = 0; k < parsedCommand.length; k++) {
                      if (parsedCommand[k].indexOf('\\') != -1)
                          parsedCommand[k] = parsedCommand[k].replaceAll("\\\\" + delimiter, delimiter);
                  }
                  return parsedCommand;
              }
  
              private String stripType(String commandSpec) {
                  StringTokenizer tokenizer = new StringTokenizer(commandSpec, "{}");
                  tokenizer.nextToken();
                  return tokenizer.nextToken();
              }
  
              /**
               * Gets a Credential Store Supplier.
               *
               * @return a supplier
               */
              @Override
              public CredentialSource get() throws Exception {
                  if (credentialAlias != null) {
                      return new CredentialStoreCredentialSource(
                              () -> {
                                  ServiceController<?> controller = serviceRegistry.getService(credentialStoreServiceName);
                                  if (controller != null) {
                                      Service<CredentialStore> credentialStoreService = (Service<CredentialStore>) controller.getService();
                                      return credentialStoreService.getValue();
                                  } else {
                                      return null;
                                  }
                              }, credentialAlias);
                  } else if (credentialType != null && credentialType.equalsIgnoreCase("COMMAND")) {
                      CommandCredentialSource.Builder command = CommandCredentialSource.builder();
                      String commandSpec = secret.trim();
                      String[] parts;
                      if (commandSpec.startsWith("{EXT")) {
                          parts = parseCommand(stripType(commandSpec), " ");  // space delimited
                      } else if (commandSpec.startsWith("{CMD")) {
                          parts = parseCommand(stripType(commandSpec), ",");  // comma delimited
                      } else {
                          parts = parseCommand(commandSpec, " ");
                      }
                      for(String part: parts) {
                          command.addCommand(part);
                      }
                      return command.build();
                  } else if (secret != null && secret.startsWith("MASK-")) {
                      // simple MASK- string with PicketBox compatibility and fixed algorithm and initial key material
                      return new CredentialSource() {
                          @Override
                          public SupportLevel getCredentialAcquireSupport(Class<? extends Credential> credentialType, String algorithmName, AlgorithmParameterSpec parameterSpec) throws IOException {
                              return credentialType == PasswordCredential.class ? SupportLevel.SUPPORTED : SupportLevel.UNSUPPORTED;
                          }
  
                          @Override
                          public <C extends Credential> C getCredential(Class<C> credentialType, String algorithmName, AlgorithmParameterSpec parameterSpec) throws IOException {
                              String[] part = secret.substring(5).split(";");  // strip "MASK-" and split by ';'
                              if (part.length != 3) {
                                  throw ControllerLogger.ROOT_LOGGER.wrongMaskedPasswordFormat();
                              }
                              String salt = part[1];
                              final int iterationCount;
                              try {
                                  iterationCount = Integer.parseInt(part[2]);
                              } catch (NumberFormatException e) {
                                  throw ControllerLogger.ROOT_LOGGER.wrongMaskedPasswordFormat();
                              }
                              try {
                                  PasswordBasedEncryptionUtil decryptUtil = new PasswordBasedEncryptionUtil.Builder()
                                          .picketBoxCompatibility()
                                          .salt(salt)
                                          .iteration(iterationCount)
                                          .decryptMode()
                                          .build();
                                  return credentialType.cast(new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR,
                                          decryptUtil.decodeAndDecrypt(part[0]))));
                              } catch (GeneralSecurityException e) {
                                  throw new IOException(e);
                              }
                          }
                      };
                  } else {
                      if (secret != null) {
                          // clear text password
                          return new CredentialSource() {
                              @Override
                              public SupportLevel getCredentialAcquireSupport(Class<? extends Credential> credentialType, String algorithmName, AlgorithmParameterSpec parameterSpec) throws IOException {
                                  return credentialType == PasswordCredential.class ? SupportLevel.SUPPORTED : SupportLevel.UNSUPPORTED;
                              }
  
                              @Override
                              public <C extends Credential> C getCredential(Class<C> credentialType, String algorithmName, AlgorithmParameterSpec parameterSpec) throws IOException {
                                  return credentialType.cast(new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR, secret.toCharArray())));
                              }
                          };
                      } else {
                          return null;  // this indicates use of original method to get password from configuration
                      }
                  }
              }
          };
      }