1. add a new domain
   /subsystem=security/security-domain=test:add

1. setup auth with 2 "UsersRoles", modules.
   /subsystem=security/security-domain=test/authentication=classic:add(login-modules=[{ "code" => "UsersRoles", "flag" => "required", "module-options" => { "usersProperties" => "/home/tom/etc/UsersRoles/my-users.properties", "rolesProperties" => "/home/tom/etc/UsersRoles/my-roles.properties" }},{ "code" => "UsersRoles", "flag" => "required", "module-options" => { "usersProperties" => "/home/tom/etc/UsersRoles/my-users.properties", "rolesProperties" => "/home/tom/etc/UsersRoles/my-roles.properties" }}])

{
"outcome" => "failed",
"rolled-back" => true
}

Same thing happens with for example 2 LdapExt modules

Modifying the xml manually and it will work fine though

• edit xml
• create a fake login module, example:
  public class UsersRolesLoginModule2 extends
  org.jboss.security.auth.spi.UsersRolesLoginModule
  {
  }

set it up as a module (with a picketbox dependency) and specify this class + module name for one of the login modules.