Thanks Sham, I did some progress... The things that I noticed that are unusual for AEM 6.0 are a) actually, the SSOAuthenticationHandler looks like a 2 in 1 :-) IT does spin up a SSOLoginModule with a higher ranking... when I see the JAAS section in Felix console, this is present at a higher prio...