JASPI is not available by default for deployments, and a specific Security Domain must be created to use it. For a simplified developer experience, a default JASPI Domain is already bundled, called jaspitest.

To make use of it, a Web Application only needs to specifiy the desired security domain in the jboss-web.xml deployment descriptor. This file should be located under the WEB-INF directory. An example jboss-web.xml enabling the default JASPI domain:

<?xml version="1.0"?>
<jboss-web xmlns="http://www.jboss.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-web_10_0.xsd"
    version="10.0">
    <security-domain>jaspitest</security-domain>
</jboss-web>

For EAR deployments, a jboss-app.xml like the following should be used instead, placed under the root META-INF directory:

<?xml version="1.0" encoding="UTF-8"?>
<jboss-app xmlns="http://www.jboss.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    version="7.0">
    <security-domain>jaspitest</security-domain>
</jboss-app>