Add user and group ./bin/add-user.sh -u duke -p password1 -g JBossAdmin -a ./bin/add-user.sh -u testuser -p password1 -g JBossAdmin -a Add new module with custom implementation ./bin/jboss-cli.sh embed-server module add --name=org.jboss.customprincipaldecoderimpl-exception --dependencies=org.wildfly.extension.elytron,org.wildfly.security.elytron --resources=/tmp/customprincipaldecoderimpl-exception.jar module add --name=org.jboss.customprincipaldecoderimpl-testuser --dependencies=org.wildfly.extension.elytron,org.wildfly.security.elytron --resources=/tmp/customprincipaldecoderimpl-testuser.jar stop-embedded-server Deploy test application Copy attached war file print-roles.war to JBOSS_HOME/standalone/deployments Copy configuration files from attachment to your server standalone-full.customprincipaldecoderimpl.xml, standalone-full.customprincipaldecoderimplWORK.xml Run server with given configuration - Elytron is set ./bin/standalone.sh -c=standalone-full.customprincipaldecoderimpl.xml ./bin/standalone.sh -c=standalone-full.customprincipaldecoderimplWORK.xml Invoke test app http://127.0.0.1:8080/print-roles/protected/printRoles?role=JBossAdmin log in there as duke/password1 In first case you can see only "Internal Server Error" in browser and there isn't any exception in log. In second case everything works fine. There is username "duke" decode to username "testuser" I can see problem that I don't see any exception in log, debug level of logging doesn't help.