The TCCL is not set, so the chances of finding com.sun.security.auth.module.Krb5LoginModule or com.ibm.security.auth.module.Krb5LoginModule are essentially completely dependent on the environment. However since the class is always the same, and we can safely assume that we should have a dependency on that module, we should set TCCL around the initialization of the LoginContext.