[ https://issues.jboss.org/browse/WFLY-9251?page=com.atlassian.jira.plugin.... ] Rémy Delerue edited comment on WFLY-9251 at 9/12/17 9:36 AM: ------------------------------------------------------------- We disabled _ClientLoginModule_ and the issue seams to be resolved. We think the following configuration is wrong: {code:xml} <security-domain name="TestSecurityDomain" cache-type="default"> <authentication> <login-module code="be.test.TestLoginModule" flag="required"/> <login-module code="org.jboss.security.ClientLoginModule" flag="optional"/> </authentication> </security-domain> {code} According to [wiki/ClientLoginModule|https://developer.jboss.org/wiki/ClientLoginModule], you can't have a _ClientLoginModule_ and the actual authentication module in the same security domain. We disabled our _ClientLoginModule_ and things seams better with good performances (that wasn't the case without the cache or with _synchronized_ blocks we tested out). We'll enable it back if we really need it. was (Author: clivia): We disabled _ClientLoginModule_ and the issue seams to be resolved. We think the following configuration is wrong: {code:xml} <security-domain name="TestSecurityDomain" cache-type="default"> <authentication> <login-module code="be.test.TestLoginModule" flag="required"/> <login-module code="org.jboss.security.ClientLoginModule" flag="optional"/> </authentication> </security-domain> {code} According to [wiki/ClientLoginModule|https://developer.jboss.org/wiki/ClientLoginModule], you can't have a _ClientLoginModule_ and the actual authentication module in the same security domain. We disabled our _ClientLoginModule_ and things seams better with good performances (that wasn't the case without the cache or with _synchronized_ blocks we tested out). We'll enable it back if we really need it. -- This message was sent by Atlassian JIRA (v7.2.3#72005)