custom DatabaseServerLoginModule not working in wildfly 10+

[mandrosen]

In Wildfly 9, I had a working custom login module.  It was a class that extended org.jboss.security.auth.spi.DatabaseServerLoginModule.  I declare it in the standalone.xml with:

<login-module code="com.at.security.auth.spi.CustomDatabaseServerLoginModule" flag="required" module="com.at.jboss-login-module">

...

</login-module>

In Wildfly 10 and 10.1, it does not work.  I even stripped out all custom code from it so it looks like:

public class CustomDatabaseServerLoginModule extends DatabaseServerLoginModule {

}

I don't get any errors and my debug points are never hit.  It works in (in Wildfly 10 and 10.1) as soon as I switch the standalone.xml back to:

<login-module code="Database" flag="required">

It seems like those two cases would be the same though (a custom DatabaseServerLoginModule with no overwritten methods and  the default DatabaseServerLoginModule).  I don't see anything here Security subsystem configuration - WildFly 10 - Project Documentation Editor that indicates it changed or that I am doing anything incorrectly.  I have turned on TRACE logging for org.jboss.security and org.jboss.as.security but I don't see anything.  Does anyone know what might be happening here?

[jaikiran]

I don't see anything obviously wrong. Moreover, you say this was working in WildFly 9 and no longer in 10. Can you please create a JIRA and attach the relevant sample application to reproduce this?

[mandrosen]

I was able to get it working in one of my applications.  It turns out the module.xml for the custom login-module had a dependency on org.jboss.common-core which does not exist anymore.  The module was also compiled against wildly 9 jars and was able to make use of org.jboss.security.ErrorCodes instead of org.jboss.security.PicketBoxMessages.  When I was running it, I was not getting and classpath or classloader issues.  I only saw an error when I added an explicit dependency in the jboss-deployment-structure.xml which forced wildfly to load the module at a different time.  Essentially, I am not sure any of these issues are bugs.

[jaikiran]

IMO, there should have been an error reported when a application uses a security domain, which has a login module which fails to load the login module class.

[mandrosen]

I agree, but I didn't see one.  I can try some more tests on a fresh install, but initially, it seems like the errors are suppressed or hidden.