undertow/src/main/java/org/wildfly/extension/undertow/security/jaspi/JASPICSecurityContext.java
@Override
    public boolean login(final String username, final String password) {
        // if there is an AuthConfigProvider for the HttpServlet layer and appContext, this method must throw an exception.
        String appContext = this.buildAppContext();
        AuthConfigProvider provider = AuthConfigFactory.getFactory().getConfigProvider(layer, appContext, null);
        if (provider != null) {
            ServletException se = new ServletException("login is not supported by the JASPIC mechanism");
            throw new SecurityException(se);
        }
        return super.login(username, password);
    }
@Override
    public boolean login(final String username, final String password) {
        // if there is an AuthConfigProvider for the HttpServlet layer and appContext, this method must throw an exception.
        String appContext = this.buildAppContext();
        AuthConfigProvider provider = AuthConfigFactory.getFactory().getConfigProvider(layer, appContext, null);
        if (provider != null) {
            ServletException se = new ServletException("login is not supported by the JASPIC mechanism");
            throw new SecurityException(se);
        }
        return super.login(username, password);
    }
<p>
JASPIC 1.1 specification: if there is an {@code AuthConfigProvider} for the {@code HttpServlet} layer and
application context, then @{@code login} must throw a {@code ServletException} which may convey that the
exception was caused by an incompatibility between the {@code login} method and the configured authentication
mechanism. If there is no such provider, then the container must proceed with the regular {@code login} processing.
</p>

@param username The username
@param password The password
@return <code>true</code> if the login succeeded, false otherwise
@throws SecurityException if login is called when JASPIC is enabled for application context and layer.