Did you already had a chance to look at this?

And any idea of the direction? A new attribute in jboss-web.xml? Actually adding the security domain as proposed, or something else?

Kind regards,

Arjan Tijms