There is a typo and a little bit of ambiguity in the current description of the '/subsystem=undertow/application-security-domain=foo[integrated-jaspi]' attribute:

Should integrated JASPI be used or allow AsHoc identity creation.

proposed change:

Whether integrated JASPI should be used. If this is disabled, ad hoc identity will be created instead.

And here is full attribute description in related XSD file.