SecurityBootstrapService should set TCCL before calling PolicyConfigurationFactory.getPolicyConfigurationFactory() ------------------------------------------------------------------------------------------------------------------ Key: WFLY-14386 URL: https://issues.redhat.com/browse/WFLY-14386 Project: WildFly Issue Type: Bug Components: Security Reporter: Brian Stansberry Priority: Major This: https://github.com/wildfly/wildfly/blob/22.0.0.Final/security/subsystem/s... should be more like this: https://github.com/wildfly/wildfly/blob/22.0.0.Final/ee/src/main/java/org... They both deal with the 'org.jboss.as.security.jacc-module' but one sets the TCCL to its module and the other does not. SecurityBootstrapService not doing that means the module, if defined, has to be a dependency of the org.jboss.as.security module. Such a module would be custom, meaning the user is editing our module.xml, and we don't want that.