I'm not sure if you saw, but I added a special hook for JASPI in Undertow Beta26 that basically allows it to take over the running of authentication mechanisms, to make this sort of scenario work ok.