org.wildfly.security.http.util.AggregateServerMechanismFactory

has one incorrect trace message and one which could be more helpful:

getMechanismNames has

if (log.isTraceEnabled()) {
    log.tracef("No %s provided by factories in %s: %s", HttpServerAuthenticationMechanismFactory.class.getSimpleName(), getClass().getSimpleName(), Arrays.toString(factories));
}
return names.toArray(new String[names.size()]);

should that be

if (log.isTraceEnabled()) {
log.tracef("%s factories in %s: %s", HttpServerAuthenticationMechanismFactory.class.getSimpleName(), getClass().getSimpleName(), Arrays.toString(factories));
}
return names.toArray(new String[names.size()]);

?

Same message in createAuthenticationMechanism

if (log.isTraceEnabled()) {
   log.tracef("No %s provided by factories in %s: %s", HttpServerAuthenticationMechanismFactory.class.getSimpleName(), getClass().getSimpleName(), Arrays.toString(factories));
}

It would be useful if it supplied the mechanism e.g:

if (log.isTraceEnabled()) {
log.tracef("Mechanism %s not %s provided by factories in %s: %s", mechanism, HttpServerAuthenticationMechanismFactory.class.getSimpleName(), getClass().getSimpleName(), Arrays.toString(factories));
}