There is unwritten field credential in SOAPClientAuthModule.java file, strange is that it's used in cleanSubject method. Seems like bug / unnecessary filed.

https://github.com/jbossws/jbossws-cxf/blob/master/modules/jaspi/src/main/java/org/jboss/wsf/stack/cxf/jaspi/client/module/SOAPClientAuthModule.java#L53
private Object credential = null;

https://github.com/jbossws/jbossws-cxf/blob/master/modules/jaspi/src/main/java/org/jboss/wsf/stack/cxf/jaspi/client/module/SOAPClientAuthModule.java#L113
subject.getPublicCredentials().remove(credential);