Use the attached replicator.
(1) drop the FakeLoginModule in JBoss (source file is within the jar)
(2) in standalone.xml, replace the 'other' domain with the content of security-domain.xml
(3) mvn clean install SwitchyardTest project and deploy
(4) call http://localhost/test/TestService, e. g. with SoapUI

expected result:
login module is called, SecurityException, no access is granted to service

actual result:
access is granted, login module is not called
---------------------------------------------------
Stage 2:

• Edit the switchyard.xml, align the Service 'name' with the 'promoted' name:
  <sca:service name="TestService" promote="Component/TestService">

Try again, Security will prevent the service from executing.