Information
When configuring your application specific security policy, you must declare one (or more) of the following authorization modules in the security domain <policy-module> element.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Applications deploying their own security policies must specify one of the following <policy-module> within their 'code' attributes:
<application-policy name="demo">
<authorization>
<policy-module code="org.JBoss.security.authorization.modules.JACCAuthorizationModule"></policy-module>
</authorization>
</application-policy>