undertow/src/main/java/org/wildfly/extension/undertow/security/jaspi/JASPICSecurityContext.java
@Override
    public boolean login(final String username, final String password) {
        // if there is an AuthConfigProvider for the HttpServlet layer and appContext, this method must throw an exception.
        String appContext = this.buildAppContext();
        AuthConfigProvider provider = AuthConfigFactory.getFactory().getConfigProvider(layer, appContext, null);
        if (provider != null) {
            ServletException se = new ServletException("login is not supported by the JASPIC mechanism");
            throw new SecurityException(se);
        }
        return super.login(username, password);
    }
@Override
    public boolean login(final String username, final String password) {
        // if there is an AuthConfigProvider for the HttpServlet layer and appContext, this method must throw an exception.
        String appContext = this.buildAppContext();
        AuthConfigProvider provider = AuthConfigFactory.getFactory().getConfigProvider(layer, appContext, null);
        if (provider != null) {
            ServletException se = new ServletException("login is not supported by the JASPIC mechanism");
            throw new SecurityException(se);
        }
        return super.login(username, password);
    }
@ Override public boolean login ( final String username , final String password ) { // if there is an AuthConfigProvider for the HttpServlet layer and appContext, this method must throw an exception. String appContext = this . buildAppContext ( ) ; AuthConfigProvider provider = AuthConfigFactory . getFactory ( ) . getConfigProvider ( layer , appContext , null ) ; if ( provider != null ) { ServletException se = new ServletException ( "login is not supported by the JASPIC mechanism" ) ; throw new SecurityException ( se ) ; } return super . login ( username , password ) ; }
<p>
JASPIC 1.1 specification: if there is an {@code AuthConfigProvider} for the {@code HttpServlet} layer and
application context, then @{@code login} must throw a {@code ServletException} which may convey that the
exception was caused by an incompatibility between the {@code login} method and the configured authentication
mechanism. If there is no such provider, then the container must proceed with the regular {@code login} processing.
</p>

@param username The username
@param password The password
@return <code>true</code> if the login succeeded, false otherwise
@throws SecurityException if login is called when JASPIC is enabled for application context and layer.
<p > JASPIC 1 . 1 specification : if there is an { @code AuthConfigProvider } for the { @code HttpServlet } layer and application context then @ { @code login } must throw a { @code ServletException } which may convey that the exception was caused by an incompatibility between the { @code login } method and the configured authentication mechanism . If there is no such provider then the container must proceed with the regular { @code login } processing . < / p >