In case when kerberos authentication is configured in security realm but principal attribute in keytab element is set incorrectly (e.g. remote/wrong_localhost@JBOSS.ORG, remote/localhost@WRONG_JBOSS.ORG or wrong_remote/localhost@JBOSS.ORG instead of remote/localhost@JBOSS.ORG) then authentication does not fallback into another authentication mechanism for user with valid kerberos ticket. In case when user does not have kerberos ticket then fallback is taken into account correctly.