Create a package "org.wildfly.security.mechanism"; for each authentication mechanism that spans multiple mechanism types (HTTP, SASL, GSSAPI, etc.), move that mechanism's core logic to the mechanism package, and have each mechanism type delegate to that package for its core authentication logic.