Tomcat uses the hasUserDataPermission check to see if there is a need for https port redirect. A subject is expected by the JBoss Security layer. Even though the subject does not play any role in the check, it is needed for any authorization. Handle the null subject use case.