Because there is the following import on AdminAuthenticateAction:

import com.sun.org.apache.xpath.internal.XPathAPI

calling the action can throws a NoClassDefFoundError when:

• the JVM is not from Sun.
• or when the tomcat distribution is not an official one.

The solution is to use javax.xml.xpath standard API.