The bad news is my tests showed the default.exclusions did not fix the issue. The good news is I found the static extension that was always registering the JWT providers. So I've commented that out as now your new approach of scanning the providers automatically is working just fine. I've added that to the PR 424.
I've tested now I'm seeing only one JWT set of providers when tomee.mp.scan=all and none when it's none. Would you mind checking and merging PR 424 for me for this? -- Sent from: http://tomee-openejb.979440.n4.nabble.com/TomEE-Dev-f982480.html