Locking appears when running Elytron.

 JSAPI in enabled by default which means this will be happening for users unless it is explicitly disabled.

 The calls that cause contention are

a

org/wildfly/security/auth/jaspi/ElytronAuth/Config/Factory.getConfigProvider

org/wildfly/elytron/web/undertow/server/servlet/ServletSecurityContextImpl.authenticate

b

jakarta/security/auth/message/config/AuthConfigFactory.getFactory

org/wildfly/elytron/web/undertow/server/servlet/ServletSecurityContextImpl.getAuthConfigFactory

org/wildfly/elytron/web/undertow/server/servlet/ServletSecurityContextImpl.authenticate

 

 Investigate whether the contention can be reduced.