The constructor of AuthConfigFactory is required to support loading the configuration dynamically: -

https://docs.oracle.com/javaee/7/api/javax/security/auth/message/config/AuthConfigFactory.html

Within the app server environment we handle the configuration slightly differently and populate the AuthConfigFactory dynamically as the management model is handled. Where these APIs are used outside the application server however we could support a custom file format for configuration.