I understood this a little bit.
The main problem was this snippet from host-slave.xml:
<domain-controller>
<remote>
<discovery-options>
<static-discovery name="primary" protocol="${jboss.domain.master.protocol:remote+http}" host="${jboss.domain.master.address}" port="${jboss.domain.master.port:9990}"/>
</discovery-options>
</remote>
</domain-controller>
We must bind it with authentication-context:
<domain-controller>
<remote authentication-context="hcAuthContext">
<discovery-options>
<static-discovery name="primary" protocol="${jboss.domain.master.protocol:remote+http}" host="${jboss.domain.master.address" port="${jboss.domain.master.port:9990}"/>
</discovery-options>
</remote>
</domain-controller>
But there can be another option you can connect so too:
<remote protocol="remote" host="${jboss.domain.master.address" port="9999" authentication-context="hcAuthContext"/>
The plain remote communicate on 9999, but the discovery on 9990!