[ https://issues.redhat.com/browse/WFLY-13141?page=com.atlassian.jira.plugi... ] Hisanobu Okuda commented on WFLY-13141: --------------------------------------- In org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService.handleJASPIMechanism(), JASPICAuthenticationMechanism and JASPICSecureResponseHandler are registered. But either is enough and the other should not be needed. Perhaps, JASPICSecureResponseHandler is not needed. {code} private void handleJASPIMechanism(final DeploymentInfo deploymentInfo) { ApplicationPolicy applicationPolicy = SecurityConfiguration.getApplicationPolicy(this.securityDomain); if (applicationPolicy != null && JASPIAuthenticationInfo.class.isInstance(applicationPolicy.getAuthenticationInfo())) { String authMethod = null; LoginConfig loginConfig = deploymentInfo.getLoginConfig(); if (loginConfig != null && loginConfig.getAuthMethods().size() > 0) { authMethod = loginConfig.getAuthMethods().get(0).getName(); } deploymentInfo.setJaspiAuthenticationMechanism(new JASPICAuthenticationMechanism(securityDomain, authMethod)); deploymentInfo.setSecurityContextFactory(new JASPICSecurityContextFactory(this.securityDomain)); deploymentInfo.addOuterHandlerChainWrapper(next -> new JASPICSecureResponseHandler(next)); <== should be removed? } } {code} -- This message was sent by Atlassian Jira (v7.13.8#713008)