The JAASSecurityManagerService does not handle the case where the class attributes are not configured.
It only process the default during the setter, which doesn't get invoked unless somebody configures the attribute anyway.