Since 7.3 version the elytron JASPI can be used (see documentation )

1. prepare a clean installation of WildFly Full 20.0.0.Beta1-SNAPSHOT (WildFly Core 11.0.0.Beta9) (this may occur in the older versions as well. e.g. EAP 7.2.5) 2. start wildfly $JBOSS_HOME/bin/standalone.sh 3. apply config $JBOSS_HOME/bin/jboss-cli.sh -c --file=configure.cli 4. deploy the reproducer cp reproducer.war $JBOSS_HOME/standalone/deployments/ 5. access the reproducer curl http: //localhost:8080/reproducer/ Then you will see the following message: 16:38:26,904 INFO [com.redhat.hokuda.AuthProvider] ( default task-1) Default constructor 16:38:26,905 INFO [com.redhat.hokuda.AuthProvider] ( default task-1) initialize with requestPolicy= null responsePolicy= null handler=org.jboss.security.auth.callback.JASPICallbackHandler@70eee4ee 16:38:26,906 INFO [com.redhat.hokuda.AuthProvider] ( default task-1) initialize with requestPolicy= null responsePolicy= null handler=org.jboss.security.auth.callback.JASPICallbackHandler@70eee4ee 16:38:27,395 INFO [com.redhat.hokuda.AuthProvider] ( default task-1) Default constructor 16:38:27,396 INFO [com.redhat.hokuda.AuthProvider] ( default task-1) initialize with requestPolicy= null responsePolicy= null handler=org.jboss.security.auth.callback.JASPICallbackHandler@70eee4ee 16:38:27,397 INFO [com.redhat.hokuda.AuthProvider] ( default task-1) initialize with requestPolicy= null responsePolicy= null handler=org.jboss.security.auth.callback.JASPICallbackHandler@70eee4ee Due to this and the other issue SECUIRTY-1006, initialize() is called 4 times in total.