The JASPI auth-module configuration does not support a "module" attribute. This means that when using a custom JASPI module you will need to configure the application to depend on the custom module, make the JASPI module a global module or add the JASPI class to the picketbox module.

I think the JASPI auth-module should support a "module" attribute so that a user can specify which module contains a custom JASPI module.