The SecurityFilter is supposed to be installed during the application startup by a ServletListener [1]. IMO, this is not related with Weld but with JBoss Modules. That said, I believe JBoss Modules can only install ServletListener if you have the dependencies defined in WAR.
However, a possible workaround would be to manually define the SecurityFilter in your WAR's deployment descriptor when defining EAR-level dependencies. This should install the filter but I'm not sure if everything is going to work after that. I remember users complaining about EAR-level dependencies for CDI jars. And I also remember some weird behaviors when using PL jars dependencies declared in a EAR.
[1] https://github.com/picketlink/picketlink/blob/master/modules/base/impl/src/main/java/org/picketlink/http/internal/PicketLinkServletContextListener.java
|