We have our own CertificateLoginModule, and EAP has its CertRolesLoginModule:
https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/html/Security_Guide/chap-Login_Modules.html#BaseCertLoginModule

Investigate if we can reuse EAP's so we don't have to maintain our own.