As part of the following Jira issue verification was added to check that the authMethod is either BASIC or CLIENT-CERT and all other values are rejected: -

https://jira.jboss.org/jira/browse/JBWS-2565

JBoss AS has a mechanism to allow additional authMethods to be defined so JBossWS should allow this.

Instead of rejecting deployments with different authMethod values a WARN message should be logged instead.