This change looks wrong to me. The intent is to have the web-cas module inherit from the web-sec module which is not an extension and lives under web/security/pom.xml.