Is it possible to identify the revelevent DeploymentUnitProcessors in this process along with their phase and priority so we can check the ordering.
What may be more appropriate is for the Undertow DUP to attach something which identifies the SecurityDomain instead of the web services DUP relying on internal API / repeating the same checks already performed within Undertow.
In the future we will be removing all of the application security domain resources so coordinating using attachments will hopefully also future proof any fix.
Regards,
Darran Lofthouse.