The security-config_4_1.xsd schema allows only (exactly) one jaas:login-module child of authentication element (line 63). This should probably be maxOccurs='unbounded'. This seems to be a regression from security-config_4.0.xsd which does specify maxOccurs='unbounded' for login-module.

It looks like this issue is also present in 4.0.4 CR2.