Legacy jboss.xml /jboss-web.xml descriptors could have a security domain defined as:

<security-domain>
something
</security-domain>

So the read of the metadata.getSecurityDomain should take into consideration newline characters in the value. A trim is necessary.